Commit `3d4da5ac60`

3d4da5ac6000a4871c5caa80d1e61f2782da3069

parent: dcf0186e16

Unsigned

cmc <hello@cleberg.net> · 2023-12-03 05:27 UTC

feat: finish converting md to org

Layout: unified · split

blog/2021-01-01-seum.org +104 −81

		@@ -1,84 +1,107 @@
1		+++
2		date = 2021-01-01
3		title = "SEUM: Speedrunners from Hell"
4		description = "A video game review for SEUM: Speedrunners from Hell, an incredibly fast-paced mashup of a puzzle game and a free-running game."
5		+++
6
7		## Game Description
8
9		[SEUM: Speedrunners from Hell](https://store.steampowered.com/app/457210/SEUM_Speedrunners_from_Hell/)
10		is an incredibly fast-paced mashup of a puzzle game and a free-running game.
11		Created by [Pine Studio](https://pinestudio.co) in early 2016 and first released
12		as a
13		[demo on GameJolt](https://gamejolt.com/games/seum-speedrunners-from-hell-demo/154868),
14		this game was successfully green-lit on Steam and has amassed a cult
15		following on multiple consoles.
	1	#+title: SEUM: Speedrunners from Hell
	2	#+date: 2021-01-01
	3
	4	** Game Description
	5	:PROPERTIES:
	6	:CUSTOM_ID: game-description
	7	:ID: 809DA4E6-4E0D-4179-B8FF-6C9E767EC74D
	8	:END:
	9	[[https://store.steampowered.com/app/457210/SEUM_Speedrunners_from_Hell/][SEUM:
	10	Speedrunners from Hell]] is an incredibly fast-paced mashup of a puzzle
	11	game and a free-running game. Created by [[https://pinestudio.co][Pine
	12	Studio]] in early 2016 and first released as a
	13	[[https://gamejolt.com/games/seum-speedrunners-from-hell-demo/154868][demo
	14	on GameJolt]], this game was successfully green-lit on Steam and has
	15	amassed a cult following on multiple consoles.
16	16
17	17	Here's the game description straight from the developers:
18	18
19		> Like a bastard child of Quake 3 and Super Meat Boy, SEUM: Speedrunners from
20		> Hell is truly hardcore and focuses on speed and fast reaction.
21
22		## Story
23
24		SEUM does a great job setting the stage when you open the game for the first
25		time, playing an animated video in the form of comic book images. You see Marty,
26		the protagonist, sitting around drinking his beer as Satan busts down the door,
27		cuts his hand off, and steals all his beer and bacon. As Satan is leaving, Marty
28		whips a vinyl record across the room and cuts off one of Satan's hands. This
29		hand is what allows you to use all the powers in the game.
30
31		Check out the screenshot below for one of the first panels of the storyline:
32
33		![SEUM Story](https://img.cleberg.net/blog/20210101-seum/seum_story.png)
34
35		## Gameplay
36
37		To accomplish each level, you will need to get to the final blue portal under a
38		certain time limit. You can beat a level by getting to the portal before the
39		time meter runs out or "Dominate" a level by beating it within a shorter time
40		limit (noted by a bright red/orange color in the time meter).
41
42		The portal is usually set behind locked gates, protected by dangerous defenses,
43		or in hard-to-reach places. To reach the portal, you'll need to go through any
44		existing orange portals, light all yellow beacons, avoid things like fireballs
45		and blades, or use any satanic power orbs lying around. These special abilities
46		include:
47
48		- Gravity
49		- Teleport
50		- Rewind
51		- Spawn platform
52		- Roar (DLC)
53		- Rocket (DLC)
54		- Shadow world (DLC)
55
56		For the main storyline, there are nine floors to beat. Each floor contains nine
57		regular levels, one boss level, and one bonus level; although you don't
58		technically need to beat all levels to advance to the next floor.
59
60		![SEUM Floor Menu](https://img.cleberg.net/blog/20210101-seum/seum_floor.png)
61
62		## In-Game Screenshots
63
64		The main menu gives you plenty of options for tuning your system, playing main
65		levels, playing the DLC, or exploring the other game modes.
66
67		![SEUM Main Menu](https://img.cleberg.net/blog/20210101-seum/seum_menu.png)
68
69		Once you enter a level, you can look around and strategize before starting.
70		Clicking any button will start the menu, and you'll have to restart if you die.
71		One of the great things about SEUM is that it has great keyboard shortcuts. You
72		can quickly smash `R` to restart the level or `M` to return to the level menu.
73
74		![SEUM Level](https://img.cleberg.net/blog/20210101-seum/seum_level.png)
75
76		Once you're able to win a level, you'll see the high scores and can watch
77		replays of the best scores.
78
79		![SEUM Win](https://img.cleberg.net/blog/20210101-seum/seum_win.png)
80
81		Each regular level contains a beer in a disguised location that may take some
82		out-of-the-box thinking.
83
84		![SEUM Beer](https://img.cleberg.net/blog/20210101-seum/seum_beer.png)
	19	#+begin_quote
	20	Like a bastard child of Quake 3 and Super Meat Boy, SEUM: Speedrunners
	21	from Hell is truly hardcore and focuses on speed and fast reaction.
	22
	23	#+end_quote
	24
	25	** Story
	26	:PROPERTIES:
	27	:CUSTOM_ID: story
	28	:ID: BF401145-763D-4399-922B-7D73322B5B40
	29	:END:
	30	SEUM does a great job setting the stage when you open the game for the
	31	first time, playing an animated video in the form of comic book images.
	32	You see Marty, the protagonist, sitting around drinking his beer as
	33	Satan busts down the door, cuts his hand off, and steals all his beer
	34	and bacon. As Satan is leaving, Marty whips a vinyl record across the
	35	room and cuts off one of Satan's hands. This hand is what allows you to
	36	use all the powers in the game.
	37
	38	Check out the screenshot below for one of the first panels of the
	39	storyline:
	40
	41	#+caption: SEUM Story
	42	[[https://img.cleberg.net/blog/20210101-seum/seum_story.png]]
	43
	44	** Gameplay
	45	:PROPERTIES:
	46	:CUSTOM_ID: gameplay
	47	:ID: A55CB1AF-E818-4CA7-BF69-E8141369C269
	48	:END:
	49	To accomplish each level, you will need to get to the final blue portal
	50	under a certain time limit. You can beat a level by getting to the
	51	portal before the time meter runs out or "Dominate" a level by beating
	52	it within a shorter time limit (noted by a bright red/orange color in
	53	the time meter).
	54
	55	The portal is usually set behind locked gates, protected by dangerous
	56	defenses, or in hard-to-reach places. To reach the portal, you'll need
	57	to go through any existing orange portals, light all yellow beacons,
	58	avoid things like fireballs and blades, or use any satanic power orbs
	59	lying around. These special abilities include:
	60
	61	- Gravity
	62	- Teleport
	63	- Rewind
	64	- Spawn platform
	65	- Roar (DLC)
	66	- Rocket (DLC)
	67	- Shadow world (DLC)
	68
	69	For the main storyline, there are nine floors to beat. Each floor
	70	contains nine regular levels, one boss level, and one bonus level;
	71	although you don't technically need to beat all levels to advance to the
	72	next floor.
	73
	74	#+caption: SEUM Floor Menu
	75	[[https://img.cleberg.net/blog/20210101-seum/seum_floor.png]]
	76
	77	** In-Game Screenshots
	78	:PROPERTIES:
	79	:CUSTOM_ID: in-game-screenshots
	80	:ID: C779F008-4C8A-4BA4-AA31-60A1BF5A3EE3
	81	:END:
	82	The main menu gives you plenty of options for tuning your system,
	83	playing main levels, playing the DLC, or exploring the other game modes.
	84
	85	#+caption: SEUM Main Menu
	86	[[https://img.cleberg.net/blog/20210101-seum/seum_menu.png]]
	87
	88	Once you enter a level, you can look around and strategize before
	89	starting. Clicking any button will start the menu, and you'll have to
	90	restart if you die. One of the great things about SEUM is that it has
	91	great keyboard shortcuts. You can quickly smash =R= to restart the level
	92	or =M= to return to the level menu.
	93
	94	#+caption: SEUM Level
	95	[[https://img.cleberg.net/blog/20210101-seum/seum_level.png]]
	96
	97	Once you're able to win a level, you'll see the high scores and can
	98	watch replays of the best scores.
	99
	100	#+caption: SEUM Win
	101	[[https://img.cleberg.net/blog/20210101-seum/seum_win.png]]
	102
	103	Each regular level contains a beer in a disguised location that may take
	104	some out-of-the-box thinking.
	105
	106	#+caption: SEUM Beer
	107	[[https://img.cleberg.net/blog/20210101-seum/seum_beer.png]]

blog/2021-01-04-fediverse.org +116 −99

		@@ -1,106 +1,123 @@
1		+++
2		date = 2021-01-04
3		title = "A Simple Guide to the Fediverse"
4		description = "A simple guide to the fediverse, a federated universe of servers commonly used for sharing content, like social media."
5		draft = false
6		+++
7
8		## What is the Fediverse?
9
10		The fediverse is a federated universe of servers commonly used for sharing
11		content, like social media. So, instead of having to rely on a single
12		organization to run the server (e.g. Facebook), the fediverse is a giant
13		collection of servers across the world, owned by many people and organizations.
14
15		Take a look at this depiction of a federated network.
16		Each server in this photo is owned and run by different
17		administrators/owners.
18		Federated networks are best explained as email servers: you have an email
19		account that exists on a server (e.g. Outlook), your friend has an account on
20		a different server (e.g. GMail), and another friend has an account on a
21		third server (e.g. ProtonMail).
22		All three of you can talk and communicate back and forth without having to
23		be on the same server.
24		However, responsible email admins are there to set rules and control the
	1	#+title: A Simple Guide to the Fediverse
	2	#+date: 2021-01-04
	3
	4	** What is the Fediverse?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-the-fediverse
	7	:END:
	8	The fediverse is a federated universe of servers commonly used for
	9	sharing content, like social media. So, instead of having to rely on a
	10	single organization to run the server (e.g. Facebook), the fediverse is
	11	a giant collection of servers across the world, owned by many people and
	12	organizations.
	13
	14	Take a look at this depiction of a federated network. Each server in
	15	this photo is owned and run by different administrators/owners.
	16	Federated networks are best explained as email servers: you have an
	17	email account that exists on a server (e.g. Outlook), your friend has an
	18	account on a different server (e.g. GMail), and another friend has an
	19	account on a third server (e.g. ProtonMail). All three of you can talk
	20	and communicate back and forth without having to be on the same server.
	21	However, responsible email admins are there to set rules and control the
25	22	traffic going in/out of the server.
26	23
27		![Federated services diagram](https://img.cleberg.net/blog/20210104-a-simple-guide-to-the-fediverse/federated-example.svg)
	24	#+caption: Federated services diagram
	25	[[https://img.cleberg.net/blog/20210104-a-simple-guide-to-the-fediverse/federated-example.svg]]
28	26
29		The main objective of this architecture is to decentralize the control within
30		the internet connections. For example, if you run your own Mastodon instance,
31		you and your users can't be censored or impacted in any way by authorities of
32		another Mastodon instance. Some users have praised these features due to recent
33		criticism of popular social media websites that may be over-censoring their
34		users.
	27	The main objective of this architecture is to decentralize the control
	28	within the internet connections. For example, if you run your own
	29	Mastodon instance, you and your users can't be censored or impacted in
	30	any way by authorities of another Mastodon instance. Some users have
	31	praised these features due to recent criticism of popular social media
	32	websites that may be over-censoring their users.
35	33
36	34	This strategy is great for making sure control of the social web isn't
37		controlled by a single organization, but it also has some downsides. If I create
38		a Mastodon instance and get a ton of users to sign up, I can shut the server
39		down at any time. That means you're at risk of losing the content you've created
40		unless you back it up, or the server backs it up for you. Also, depending on the
41		software used (e.g. Mastodon, Pixelfed, etc.), censorship may still be an issue
42		if the server admins decide they want to censor their users. Now, censorship
43		isn't always a bad thing and can even benefit the community as a whole, but
44		you'll want to determine which servers align with your idea of proper
45		censorship.
46
47		However, these are risks that we take when we sign up for any online platform.
48		Whatever your reason is for trying out federated social networks, they are part
49		of the future of the internet. However, the popularity of these services is
50		still yet to be determined, especially with the increased difficulty
51		understanding and signing up for these platforms. Perhaps increased regulation
52		and litigation against current social media sites will push more users into the
53		fediverse.
54
55		## Federated Alternatives to Popular Sites
56
57		The list below is a small guide that will show you federated alternatives to
58		current popular websites.
59		There are many more out there, so go and explore: you might just find the
60		perfect home.
61
62		### Reddit
63
64		- [Lemmy](https://lemmy.ml/instances)
65
66		### Twitter/Facebook/Tumblr
67
68		- [Mastodon](https://joinmastodon.org)
69		- [Diaspora](https://diasporafoundation.org)
70		- [Friendica](https://friendi.ca)
71		- [GNU Social](https://gnusocial.network)
72		- [Pleroma](https://pleroma.social)
73
74		### Instagram
75
76		- [Pixelfed](https://pixelfed.org)
77
78		### Slack/Discord
79
80		- [Matrix](https://element.io)
81
82		### Youtube/Vimeo
83
84		- [Peertube](https://joinpeertube.org)
85
86		### Spotify/Soundcloud
87
88		- [Funkwhale](https://funkwhale.audio)
89
90		### Podcasting
91
92		- [Pubcast](https://pubcast.pub)
93
94		### Medium/Blogger
95
96		- [WriteFreely](https://writefreely.org)
97
98		## Get Started
99
100		The best way to get started is to simply sign up and learn as you go. If you're
101		comfortable signing up through a Mastodon, Pleroma, or Friendica server, here is
102		[a list of themed servers](https://fediverse.party/en/portal/servers) to choose
103		from. If you're looking for something else, try a web search for a federated
104		alternative to your favorite sites.
	35	controlled by a single organization, but it also has some downsides. If
	36	I create a Mastodon instance and get a ton of users to sign up, I can
	37	shut the server down at any time. That means you're at risk of losing
	38	the content you've created unless you back it up, or the server backs it
	39	up for you. Also, depending on the software used (e.g. Mastodon,
	40	Pixelfed, etc.), censorship may still be an issue if the server admins
	41	decide they want to censor their users. Now, censorship isn't always a
	42	bad thing and can even benefit the community as a whole, but you'll want
	43	to determine which servers align with your idea of proper censorship.
	44
	45	However, these are risks that we take when we sign up for any online
	46	platform. Whatever your reason is for trying out federated social
	47	networks, they are part of the future of the internet. However, the
	48	popularity of these services is still yet to be determined, especially
	49	with the increased difficulty understanding and signing up for these
	50	platforms. Perhaps increased regulation and litigation against current
	51	social media sites will push more users into the fediverse.
	52
	53	** Federated Alternatives to Popular Sites
	54	:PROPERTIES:
	55	:CUSTOM_ID: federated-alternatives-to-popular-sites
	56	:END:
	57	The list below is a small guide that will show you federated
	58	alternatives to current popular websites. There are many more out there,
	59	so go and explore: you might just find the perfect home.
	60
	61	*** Reddit
	62	:PROPERTIES:
	63	:CUSTOM_ID: reddit
	64	:END:
	65	- [[https://lemmy.ml/instances][Lemmy]]
	66
	67	*** Twitter/Facebook/Tumblr
	68	:PROPERTIES:
	69	:CUSTOM_ID: twitterfacebooktumblr
	70	:END:
	71	- [[https://joinmastodon.org][Mastodon]]
	72	- [[https://diasporafoundation.org][Diaspora]]
	73	- [[https://friendi.ca][Friendica]]
	74	- [[https://gnusocial.network][GNU Social]]
	75	- [[https://pleroma.social][Pleroma]]
	76
	77	*** Instagram
	78	:PROPERTIES:
	79	:CUSTOM_ID: instagram
	80	:END:
	81	- [[https://pixelfed.org][Pixelfed]]
	82
	83	*** Slack/Discord
	84	:PROPERTIES:
	85	:CUSTOM_ID: slackdiscord
	86	:END:
	87	- [[https://element.io][Matrix]]
	88
	89	*** Youtube/Vimeo
	90	:PROPERTIES:
	91	:CUSTOM_ID: youtubevimeo
	92	:END:
	93	- [[https://joinpeertube.org][Peertube]]
	94
	95	*** Spotify/Soundcloud
	96	:PROPERTIES:
	97	:CUSTOM_ID: spotifysoundcloud
	98	:END:
	99	- [[https://funkwhale.audio][Funkwhale]]
	100
	101	*** Podcasting
	102	:PROPERTIES:
	103	:CUSTOM_ID: podcasting
	104	:END:
	105	- [[https://pubcast.pub][Pubcast]]
	106
	107	*** Medium/Blogger
	108	:PROPERTIES:
	109	:CUSTOM_ID: mediumblogger
	110	:END:
	111	- [[https://writefreely.org][WriteFreely]]
	112
	113	** Get Started
	114	:PROPERTIES:
	115	:CUSTOM_ID: get-started
	116	:END:
	117	The best way to get started is to simply sign up and learn as you go. If
	118	you're comfortable signing up through a Mastodon, Pleroma, or Friendica
	119	server, here is [[https://fediverse.party/en/portal/servers][a list of
	120	themed servers]] to choose from. If you're looking for something else,
	121	try a web search for a federated alternative to your favorite sites.
105	122
106	123	Find a server that focuses on your passions and start there!

blog/2021-01-07-ufw.org +144 −127

		@@ -1,158 +1,173 @@
1		+++
2		date = 2021-01-07
3		title = "Secure Your Network with the Uncomplicated Firewall"
4		description = "Learn how to use the UFW, one of the simplest and most widely available firewalls on Linux."
5		draft = false
6		+++
7
8		## Uncomplicated Firewall
9
10		Uncomplicated Firewall, also known as ufw, is a convenient and beginner-friendly
11		way to enforce OS-level firewall rules. For those who are hosting servers or any
12		device that is accessible to the world (i.e., by public IP or domain name), it's
13		critical that a firewall is properly implemented and active.
14
15		Ufw is available by default in all Ubuntu installations after 8.04 LTS. For
16		other distributions, you can look to install ufw or check if there are
17		alternative firewalls installed already. There are usually alternatives
18		available, such as Fedora's `firewall` and the package available on most
19		distributions: `iptables`. Ufw is considered a beginner-friendly front-end to
20		iptables.
21
22		[Gufw](https://gufw.org) is available as a graphical user interface (GUI)
23		application for users who are uncomfortable setting up a firewall through a
24		terminal.
25
26		![](https://img.cleberg.net/blog/20210107-secure-your-network-with-the-uncomplicated-firewall/gufw.png)
27
28		## Getting Help
29
30		If you need help figuring out commands, remember that you can run the `--help`
31		flag to get a list of options.
32
33		```sh
	1	#+title: Secure Your Network with the Uncomplicated Firewall
	2	#+date: 2021-01-07
	3
	4	** Uncomplicated Firewall
	5	:PROPERTIES:
	6	:CUSTOM_ID: uncomplicated-firewall
	7	:END:
	8	Uncomplicated Firewall, also known as ufw, is a convenient and
	9	beginner-friendly way to enforce OS-level firewall rules. For those who
	10	are hosting servers or any device that is accessible to the world (i.e.,
	11	by public IP or domain name), it's critical that a firewall is properly
	12	implemented and active.
	13
	14	Ufw is available by default in all Ubuntu installations after 8.04 LTS.
	15	For other distributions, you can look to install ufw or check if there
	16	are alternative firewalls installed already. There are usually
	17	alternatives available, such as Fedora's =firewall= and the package
	18	available on most distributions: =iptables=. Ufw is considered a
	19	beginner-friendly front-end to iptables.
	20
	21	[[https://gufw.org][Gufw]] is available as a graphical user interface
	22	(GUI) application for users who are uncomfortable setting up a firewall
	23	through a terminal.
	24
	25	[[https://img.cleberg.net/blog/20210107-secure-your-network-with-the-uncomplicated-firewall/gufw.png]]
	26
	27	** Getting Help
	28	:PROPERTIES:
	29	:CUSTOM_ID: getting-help
	30	:END:
	31	If you need help figuring out commands, remember that you can run the
	32	=--help= flag to get a list of options.
	33
	34	#+begin_src sh
34	35	sudo ufw --help
35		```
36
37		## Set Default State
38
39		The proper way to run a firewall is to set a strict default state and slowly
40		open up ports that you want to allow. This helps prevent anything malicious from
41		slipping through the cracks. The following command prevents all incoming traffic
42		(other than the rules we specify later), but you can also set this for outgoing
43		connections, if necessary.
44
45		```sh
	36	#+end_src
	37
	38	** Set Default State
	39	:PROPERTIES:
	40	:CUSTOM_ID: set-default-state
	41	:END:
	42	The proper way to run a firewall is to set a strict default state and
	43	slowly open up ports that you want to allow. This helps prevent anything
	44	malicious from slipping through the cracks. The following command
	45	prevents all incoming traffic (other than the rules we specify later),
	46	but you can also set this for outgoing connections, if necessary.
	47
	48	#+begin_src sh
46	49	sudo ufw default deny incoming
47		```
	50	#+end_src
48	51
49		You should also allow outgoing traffic if you want to allow the device to
50		communicate back to you or other parties. For example, media servers like Plex
51		need to be able to send out data related to streaming the media.
	52	You should also allow outgoing traffic if you want to allow the device
	53	to communicate back to you or other parties. For example, media servers
	54	like Plex need to be able to send out data related to streaming the
	55	media.
52	56
53		```sh
	57	#+begin_src sh
54	58	sudo ufw default allow outgoing
55		```
56
57		## Adding Port Rules
	59	#+end_src
58	60
59		Now that we've disabled all incoming traffic by default, we need to open up some
60		ports (or else no traffic would be able to come in). If you need to be able to
61		`ssh` into the machine, you'll need to open up port 22.
	61	** Adding Port Rules
	62	:PROPERTIES:
	63	:CUSTOM_ID: adding-port-rules
	64	:END:
	65	Now that we've disabled all incoming traffic by default, we need to open
	66	up some ports (or else no traffic would be able to come in). If you need
	67	to be able to =ssh= into the machine, you'll need to open up port 22.
62	68
63		```sh
	69	#+begin_src sh
64	70	sudo ufw allow 22
65		```
	71	#+end_src
66	72
67		You can also issue more restrictive rules. The following rule will allow `ssh`
68		connections only from machines on the local subnet.
	73	You can also issue more restrictive rules. The following rule will allow
	74	=ssh= connections only from machines on the local subnet.
69	75
70		```sh
	76	#+begin_src sh
71	77	sudo ufw allow proto tcp from 192.168.0.0/24 to any port 22
72		```
	78	#+end_src
73	79
74		If you need to set a rule that isn't tcp, just append your connection type to
75		the end of the rule.
	80	If you need to set a rule that isn't tcp, just append your connection
	81	type to the end of the rule.
76	82
77		```sh
	83	#+begin_src sh
78	84	sudo ufw allow 1900/udp
79		```
80
81		## Enable ufw
	85	#+end_src
82	86
	87	** Enable ufw
	88	:PROPERTIES:
	89	:CUSTOM_ID: enable-ufw
	90	:END:
83	91	Now that the firewall is configured and ready to go, you can enable the
84	92	firewall.
85	93
86		```sh
	94	#+begin_src sh
87	95	sudo ufw enable
88		```
	96	#+end_src
89	97
90	98	A restart may be required for the firewall to begin operating.
91	99
92		```sh
	100	#+begin_src sh
93	101	sudo reboot now
94		```
	102	#+end_src
95	103
96		## Checking Status
	104	** Checking Status
	105	:PROPERTIES:
	106	:CUSTOM_ID: checking-status
	107	:END:
	108	Now that the firewall is enabled, let's check and see what the rules
	109	look like.
97	110
98		Now that the firewall is enabled, let's check and see what the rules look like.
99
100		```sh
	111	#+begin_src sh
101	112	sudo ufw status numbered
102		```
	113	#+end_src
103	114
104		```txt
	115	#+begin_src txt
105	116	Status: active
106	117
107	118	To Action From
108	119	-- ------ ----
109	120	[ 1] 22 ALLOW IN Anywhere
110	121	[ 2] 22 (v6) ALLOW IN Anywhere (v6)
111		```
112
113		## Deleting Rules
	122	#+end_src
114	123
115		If you need to delete a rule, you need to know the number associated with that
116		rule.
117		Let's delete the first rule in the table above.
118		You'll be asked to confirm the deletion as part of this process.
	124	** Deleting Rules
	125	:PROPERTIES:
	126	:CUSTOM_ID: deleting-rules
	127	:END:
	128	If you need to delete a rule, you need to know the number associated
	129	with that rule. Let's delete the first rule in the table above. You'll
	130	be asked to confirm the deletion as part of this process.
119	131
120		```sh
	132	#+begin_src sh
121	133	sudo ufw delete 1
122		```
123
124		## Managing App Rules
125
126		Luckily, there's a convenient way for installed applications to create files
127		that ufw can easily implement so that you don't have to search and find which
128		ports your application requires. To see if your device has any applications with
129		pre-installed ufw rules, execute the following command:
130
131		```sh
	134	#+end_src
	135
	136	** Managing App Rules
	137	:PROPERTIES:
	138	:CUSTOM_ID: managing-app-rules
	139	:END:
	140	Luckily, there's a convenient way for installed applications to create
	141	files that ufw can easily implement so that you don't have to search and
	142	find which ports your application requires. To see if your device has
	143	any applications with pre-installed ufw rules, execute the following
	144	command:
	145
	146	#+begin_src sh
132	147	sudo ufw app list
133		```
	148	#+end_src
134	149
135	150	The results should look something like this:
136	151
137		```txt
	152	#+begin_src txt
138	153	Available applications:
139	154	OpenSSH
140	155	Samba
141	156	plexmediaserver
142	157	plexmediaserver-all
143	158	plexmediaserver-dlna
144		```
	159	#+end_src
145	160
146		If you want to get more information on a specific app rule, use the `info`
147		command.
	161	If you want to get more information on a specific app rule, use the
	162	=info= command.
148	163
149		```sh
	164	#+begin_src sh
150	165	sudo ufw app info plexmediaserver-dlna
151		```
	166	#+end_src
152	167
153	168	You'll get a blurb of info back like this:
154	169
155		```txt
	170	#+begin_src txt
156	171	Profile: plexmediaserver-dlna
157	172	Title: Plex Media Server (DLNA)
158	173	Description: The Plex Media Server (additional DLNA capability only)
		@@ -160,29 +175,31 @@ Description: The Plex Media Server (additional DLNA capability only)
160	175	Ports:
161	176	1900/udp
162	177	32469/tcp
163		```
	178	#+end_src
164	179
165		You can add or delete app rules the same way that you'd add or delete specific
166		port rules.
	180	You can add or delete app rules the same way that you'd add or delete
	181	specific port rules.
167	182
168		```sh
	183	#+begin_src sh
169	184	sudo ufw allow plexmediaserver-dlna
170		```
	185	#+end_src
171	186
172		```sh
	187	#+begin_src sh
173	188	sudo ufw delete RULE\|NUM
174		```
175
176		## Creating App Rules
	189	#+end_src
177	190
178		If you'd like to create you own app rule, you'll need to create a file in the
179		`/etc/ufw/applications.d` directory. Within the file you create, you need to
180		make sure the content is properly formatted.
	191	** Creating App Rules
	192	:PROPERTIES:
	193	:CUSTOM_ID: creating-app-rules
	194	:END:
	195	If you'd like to create you own app rule, you'll need to create a file
	196	in the =/etc/ufw/applications.d= directory. Within the file you create,
	197	you need to make sure the content is properly formatted.
181	198
182		For example, here are the contents my `plexmediaserver` file, which creates
183		three distinct app rules for ufw:
	199	For example, here are the contents my =plexmediaserver= file, which
	200	creates three distinct app rules for ufw:
184	201
185		```config
	202	#+begin_src config
186	203	[plexmediaserver]
187	204	title=Plex Media Server (Standard)
188	205	description=The Plex Media Server
		@@ -197,24 +214,24 @@ ports=1900/udp\|32469/tcp
197	214	title=Plex Media Server (Standard + DLNA)
198	215	description=The Plex Media Server (with additional DLNA capability)
199	216	ports=32400/tcp\|3005/tcp\|5353/udp\|8324/tcp\|32410:32414/udp\|1900/udp\|32469/tcp
200		```
	217	#+end_src
201	218
202		So, if I wanted to create a custom app rule called "mycustomrule," I'd create a
203		file and add my content like this:
	219	So, if I wanted to create a custom app rule called "mycustomrule," I'd
	220	create a file and add my content like this:
204	221
205		```sh
	222	#+begin_src sh
206	223	sudo nano /etc/ufw/applications.d/mycustomrule
207		```
	224	#+end_src
208	225
209		```config
	226	#+begin_src config
210	227	[mycustomrule]
211	228	title=My Custom Rule
212	229	description=This is a temporary ufw app rule.
213	230	ports=88/tcp\|9100/udp
214		```
	231	#+end_src
215	232
216	233	Then, I would just enable this rule in ufw.
217	234
218		```sh
	235	#+begin_src sh
219	236	sudo ufw allow mycustomrule
220		```
	237	#+end_src

blog/2021-02-19-macos.org +172 −152

		@@ -1,205 +1,225 @@
1		+++
2		date = 2021-02-19
3		title = "macOS: Testing Out A New OS"
4		description = "My personal experience with macOS, from the perspective of a Linux junkie."
5		draft = false
6		+++
7
8		## Diving into macOS
9
10		After spending nearly 15 years working with Windows and 8 years on Linux, I
11		have experienced macOS for the first time.
12		By chance, my spouse happened to buy a new MacBook and gifted me their 2013
13		model.
14		Of course, I still consider my Linux desktop to be my daily driver and keep
15		Windows around for gaming needs, but over the past week I've found myself using
16		the MacBook more and more for things that don't require gaming specs or advanced
17		dev tools.
18
19		## Initial Thoughts
20
21		Before I move on to the technical aspects of my set-up, I want to take some time
22		and express my thoughts on the overall OS.
23
24		![macOS Desktop](https://img.cleberg.net/blog/20210219-macos-testing-out-a-new-os/macos-desktop.png)
25
26		As expected, the initial computer setup is a breeze with Mac's guided GUI
27		installer.
28
29		The desktop itself reminds me of GNOME more than anything else I've seen: even
30		Pantheon from [ElementaryOS](https://elementary.io/), which people commonly
31		refer to as the closest Linux distro to macOS. The desktop toolbar is great and
32		far surpasses the utility of the GNOME toolbar due to the fact that the
33		extensions and icons _actually work_. I launch macOS and immediately see my
34		shortcuts for Tresorit, Bitwarden, and Mullvad pop up as the computer loads.
35
36		Even further, the app dock is very useful and will be yet another familiarity
37		for GNOME users. I know many people like panels instead of docks, but I've
38		always found docks to have a more pleasing UI. However, I had to disable the
39		"Show recent applications in Dock" preference; I can't stand items taking up
40		precious screen space if I'm not currently using them. On that same note, it's
41		taking me some time to get use to the fact that I have to manually quit an app
42		or else it will still stay open/active in the dock, even if I've closed out all
43		windows for that app (e.g. Firefox).
44
45		Overall, I'm having a lot of fun and for users who spend a large majority of
46		their time performing basic tasks like web browsing, writing, watching media,
47		etc., macOS is a fantastic option.
	1	#+title: macOS: Testing Out A New OS
	2	#+date: 2021-02-19
	3
	4	** Diving into macOS
	5	:PROPERTIES:
	6	:CUSTOM_ID: diving-into-macos
	7	:END:
	8	After spending nearly 15 years working with Windows and 8 years on
	9	Linux, I have experienced macOS for the first time. By chance, my spouse
	10	happened to buy a new MacBook and gifted me their 2013 model. Of course,
	11	I still consider my Linux desktop to be my daily driver and keep Windows
	12	around for gaming needs, but over the past week I've found myself using
	13	the MacBook more and more for things that don't require gaming specs or
	14	advanced dev tools.
	15
	16	** Initial Thoughts
	17	:PROPERTIES:
	18	:CUSTOM_ID: initial-thoughts
	19	:END:
	20	Before I move on to the technical aspects of my set-up, I want to take
	21	some time and express my thoughts on the overall OS.
	22
	23	#+caption: macOS Desktop
	24	[[https://img.cleberg.net/blog/20210219-macos-testing-out-a-new-os/macos-desktop.png]]
	25
	26	As expected, the initial computer setup is a breeze with Mac's guided
	27	GUI installer.
	28
	29	The desktop itself reminds me of GNOME more than anything else I've
	30	seen: even Pantheon from [[https://elementary.io/][ElementaryOS]], which
	31	people commonly refer to as the closest Linux distro to macOS. The
	32	desktop toolbar is great and far surpasses the utility of the GNOME
	33	toolbar due to the fact that the extensions and icons /actually work/. I
	34	launch macOS and immediately see my shortcuts for Tresorit, Bitwarden,
	35	and Mullvad pop up as the computer loads.
	36
	37	Even further, the app dock is very useful and will be yet another
	38	familiarity for GNOME users. I know many people like panels instead of
	39	docks, but I've always found docks to have a more pleasing UI. However,
	40	I had to disable the "Show recent applications in Dock" preference; I
	41	can't stand items taking up precious screen space if I'm not currently
	42	using them. On that same note, it's taking me some time to get use to
	43	the fact that I have to manually quit an app or else it will still stay
	44	open/active in the dock, even if I've closed out all windows for that
	45	app (e.g. Firefox).
	46
	47	Overall, I'm having a lot of fun and for users who spend a large
	48	majority of their time performing basic tasks like web browsing,
	49	writing, watching media, etc., macOS is a fantastic option.
48	50
49	51	The rest of this post explains the technicalities of how I set up my CLI
50		environment to make me feel more at-home, similar to the environments I set up
51		on Fedora, Ubuntu, etc.
52
53		## Making it Feel Like Home
54
55		If you're someone who uses Linux primarily, no doubt your first thought when
56		booting macOS will be the same as mine was: "Where is the terminal and how do I
57		set up my favorite utilities?"
58
59		Luckily, macOS hasn't completely hidden away the development tools from the
60		average user. You can easily find the Terminal app in the Launchpad area, but
61		it's probably not what you're used to. I was surprised (and happy) to see that
62		the default shell is `zsh`, the shell I use on all of my Linux distros. However,
63		the commands are not the same - even the ones you may think are native to the
64		shell. Commands like `dir` do not exist, so other native commands like `ls -la`
65		or `pwd` are more useful here.
66
67		With only a few minutes of installing and tweaking a few packages, I was able to
68		recreate a terminal environment that I feel very comfortable using. See the
69		image below for a preview of the iTerm2 app with a split view between my macOS
70		desktop shell and an SSH session into my server.
71
72		![iTerm2](https://img.cleberg.net/blog/20210219-macos-testing-out-a-new-os/iterm2.png)
73
74		## Xcode
75
76		My first step was to search the web for any hints on how to get `zsh` back up to
77		the state I like, with extensions, themes, etc. My first step was to install the
78		CLI tools for [Xcode](https://developer.apple.com/xcode/), Apple's suite of
	52	environment to make me feel more at-home, similar to the environments I
	53	set up on Fedora, Ubuntu, etc.
	54
	55	** Making it Feel Like Home
	56	:PROPERTIES:
	57	:CUSTOM_ID: making-it-feel-like-home
	58	:END:
	59	If you're someone who uses Linux primarily, no doubt your first thought
	60	when booting macOS will be the same as mine was: "Where is the terminal
	61	and how do I set up my favorite utilities?"
	62
	63	Luckily, macOS hasn't completely hidden away the development tools from
	64	the average user. You can easily find the Terminal app in the Launchpad
	65	area, but it's probably not what you're used to. I was surprised (and
	66	happy) to see that the default shell is =zsh=, the shell I use on all of
	67	my Linux distros. However, the commands are not the same - even the ones
	68	you may think are native to the shell. Commands like =dir= do not exist,
	69	so other native commands like =ls -la= or =pwd= are more useful here.
	70
	71	With only a few minutes of installing and tweaking a few packages, I was
	72	able to recreate a terminal environment that I feel very comfortable
	73	using. See the image below for a preview of the iTerm2 app with a split
	74	view between my macOS desktop shell and an SSH session into my server.
	75
	76	#+caption: iTerm2
	77	[[https://img.cleberg.net/blog/20210219-macos-testing-out-a-new-os/iterm2.png]]
	78
	79	** Xcode
	80	:PROPERTIES:
	81	:CUSTOM_ID: xcode
	82	:END:
	83	My first step was to search the web for any hints on how to get =zsh=
	84	back up to the state I like, with extensions, themes, etc. My first step
	85	was to install the CLI tools for
	86	[[https://developer.apple.com/xcode/][Xcode]], Apple's suite of
79	87	development tools.
80	88
81		```sh
	89	#+begin_src sh
82	90	sudo xcode-select -r
83		```
	91	#+end_src
84	92
85		```sh
	93	#+begin_src sh
86	94	sudo xcode-select --install
87		```
88
89		## Homebrew
	95	#+end_src
90	96
91		Next up is to install [Homebrew](https://brew.sh), a nifty package manager for
92		macOS.
	97	** Homebrew
	98	:PROPERTIES:
	99	:CUSTOM_ID: homebrew
	100	:END:
	101	Next up is to install [[https://brew.sh][Homebrew]], a nifty package
	102	manager for macOS.
93	103
94		```sh
	104	#+begin_src sh
95	105	/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
96		```
	106	#+end_src
97	107
98	108	I ran into a permission error when installing Homebrew:
99	109
100		```sh
	110	#+begin_src sh
101	111	Error: Failed to link all completions, docs and manpages:
102	112	Permission denied @ rb_file_s_symlink - (../../../Homebrew/completions/zsh/_brew, /usr/local/share/zsh/site-functions/_brew)
103	113	Failed during: /usr/local/bin/brew update --force --quiet
104		```
	114	#+end_src
105	115
106		I found that the following permission modification worked like a charm. However,
107		I noted that some users online discussed the fact that this solution may not
108		work if your system has multiple users who use Homebrew.
	116	I found that the following permission modification worked like a charm.
	117	However, I noted that some users online discussed the fact that this
	118	solution may not work if your system has multiple users who use
	119	Homebrew.
109	120
110		```sh
	121	#+begin_src sh
111	122	sudo chown -R $(whoami) $(brew --prefix)/*
112		```
	123	#+end_src
113	124
114	125	Next up is to ensure Homebrew is updated and cleaned.
115	126
116		```sh
	127	#+begin_src sh
117	128	brew update
118		```
	129	#+end_src
119	130
120		```sh
	131	#+begin_src sh
121	132	brew cleanup
122		```
	133	#+end_src
123	134
124		## iTerm2
	135	** iTerm2
	136	:PROPERTIES:
	137	:CUSTOM_ID: iterm2
	138	:END:
	139	Now that I've installed the basic utilities for development, I moved
	140	onto installing iTerm2, a much better terminal than the default.
125	141
126		Now that I've installed the basic utilities for development, I moved onto
127		installing iTerm2, a much better terminal than the default.
128
129		```sh
	142	#+begin_src sh
130	143	brew install --cask iterm2
131		```
	144	#+end_src
132	145
133		I also used the `Make iTerm2 Default Term` and `Install Shell Integration`
134		options in the iTerm2 application menu to make sure I don't run into any issues
135		later on with different terminals.
	146	I also used the =Make iTerm2 Default Term= and
	147	=Install Shell Integration= options in the iTerm2 application menu to
	148	make sure I don't run into any issues later on with different terminals.
136	149
137		We will also install `zsh` so we can use it in iTerm2.
	150	We will also install =zsh= so we can use it in iTerm2.
138	151
139		```sh
	152	#+begin_src sh
140	153	brew install zsh
141		```
142
143		## Oh-My-Zsh
	154	#+end_src
144	155
145		I've shown the great aspects of [Oh My Zsh](https://ohmyz.sh) in other blog
146		posts, so I'll skip over that speech for now. Simply install it and run an
147		update.
	156	** Oh-My-Zsh
	157	:PROPERTIES:
	158	:CUSTOM_ID: oh-my-zsh
	159	:END:
	160	I've shown the great aspects of [[https://ohmyz.sh][Oh My Zsh]] in other
	161	blog posts, so I'll skip over that speech for now. Simply install it and
	162	run an update.
148	163
149		```sh
	164	#+begin_src sh
150	165	sh -c "$(curl -fsSL https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"
151		```
	166	#+end_src
152	167
153		```sh
	168	#+begin_src sh
154	169	omz update
155		```
	170	#+end_src
156	171
157		Finally, restart the iTerm2 application to ensure all changes go into effect.
	172	Finally, restart the iTerm2 application to ensure all changes go into
	173	effect.
158	174
159		## Oh-My-Zsh Themes
	175	** Oh-My-Zsh Themes
	176	:PROPERTIES:
	177	:CUSTOM_ID: oh-my-zsh-themes
	178	:END:
	179	Let's change the theme of the terminal to make it a little more
	180	friendly.
160	181
161		Let's change the theme of the terminal to make it a little more friendly.
162
163		```sh
	182	#+begin_src sh
164	183	open ~/.zshrc
165		```
	184	#+end_src
166	185
167		The third section of this file should contain a line like the code below. Change
168		that theme to
169		[any theme you want](https://github.com/ohmyzsh/ohmyzsh/wiki/Themes), save the
170		file, and exit.
	186	The third section of this file should contain a line like the code
	187	below. Change that theme to
	188	[[https://github.com/ohmyzsh/ohmyzsh/wiki/Themes][any theme you want]],
	189	save the file, and exit.
171	190
172		```sh
	191	#+begin_src sh
173	192	ZSH_THEME="af-magic"
174		```
175
176		After changing the `.zshrc` file, you'll need to close your terminal and re-open
177		it to see the changes.
178		Optionally, just open a new tab if you're using iTerm2, and you'll see the
179		new shell config.
	193	#+end_src
180	194
181		## Oh-My-Zsh Plugins
182
183		Of course, my customization of `zsh` would not be complete without
184		[zsh-autosuggestions](https://github.com/zsh-users/zsh-autosuggestions). This
185		will bring up commands you've run in the past as you type them. For example, if
186		you've run `ssh user@192.168.1.99` before, the terminal will show this command
187		as soon as you start typing it (e.g. `zsh u`), and you can hit the right arrow
188		to autocomplete the command.
	195	After changing the =.zshrc= file, you'll need to close your terminal and
	196	re-open it to see the changes. Optionally, just open a new tab if you're
	197	using iTerm2, and you'll see the new shell config.
189	198
190		```sh
	199	** Oh-My-Zsh Plugins
	200	:PROPERTIES:
	201	:CUSTOM_ID: oh-my-zsh-plugins
	202	:END:
	203	Of course, my customization of =zsh= would not be complete without
	204	[[https://github.com/zsh-users/zsh-autosuggestions][zsh-autosuggestions]].
	205	This will bring up commands you've run in the past as you type them. For
	206	example, if you've run =ssh user@192.168.1.99= before, the terminal will
	207	show this command as soon as you start typing it (e.g. =zsh u=), and you
	208	can hit the right arrow to autocomplete the command.
	209
	210	#+begin_src sh
191	211	git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
192		```
	212	#+end_src
193	213
194		```sh
	214	#+begin_src sh
195	215	open ~/.zshrc
196		```
	216	#+end_src
197	217
198		```sh
	218	#+begin_src sh
199	219	# Scroll down the script and edit this line to add zsh-autosuggestions
200	220	plugins=(git zsh-autosuggestions)
201		```
	221	#+end_src
202	222
203		Remember: After changing the `.zshrc` file, you'll need to close your terminal
204		and re-open it to see the changes. Optionally, just open a new tab if you're
205		using iTerm2, and you'll see the new shell config.
	223	Remember: After changing the =.zshrc= file, you'll need to close your
	224	terminal and re-open it to see the changes. Optionally, just open a new
	225	tab if you're using iTerm2, and you'll see the new shell config.

blog/2021-03-19-clone-github-repos.org +73 −71

		@@ -1,60 +1,59 @@
1		+++
2		date = 2021-03-19
3		title = "How to Clone All Repositories from a GitHub or Sourcehut Account"
4		description = "Learn how to properly clone all repositories from a GitHub or sourcehut account."
5		draft = false
6		+++
7
8		## Cloning from GitHub
9
10		If you're like me and use a lot of different devices (and sometimes decide to
11		just wipe your device and start with a new OS), you probably know the pain of
12		cloning all your old code repositories down to your local file system.
13
14		If you're using GitHub, you can easily clone all of your code back down in just
15		seconds.
16		First, create a bash script.
17		I do so by opening a new file in `nano`, but you can use `gedit`, `vim`, or
18		something else:
19
20		```sh
	1	#+title: How to Clone All Repositories from a GitHub or Sourcehut Account
	2	#+date: 2021-03-19
	3
	4	** Cloning from GitHub
	5	:PROPERTIES:
	6	:CUSTOM_ID: cloning-from-github
	7	:END:
	8	If you're like me and use a lot of different devices (and sometimes
	9	decide to just wipe your device and start with a new OS), you probably
	10	know the pain of cloning all your old code repositories down to your
	11	local file system.
	12
	13	If you're using GitHub, you can easily clone all of your code back down
	14	in just seconds. First, create a bash script. I do so by opening a new
	15	file in =nano=, but you can use =gedit=, =vim=, or something else:
	16
	17	#+begin_src sh
21	18	nano clone_github_repos.sh
22		```
	19	#+end_src
23	20
24		Next, paste in the following information. Note that you can replace the word
25		`users` in the first line with `orgs` and type an organization's name instead of
26		a user's name.
	21	Next, paste in the following information. Note that you can replace the
	22	word =users= in the first line with =orgs= and type an organization's
	23	name instead of a user's name.
27	24
28		```sh
	25	#+begin_src sh
29	26	CNTX=users; NAME=YOUR-USERNAME; PAGE=1
30	27	curl "https://api.github.com/$CNTX/$NAME/repos?page=$PAGE&per_page=100" \|
31	28	grep -e 'git_url*' \|
32	29	cut -d \" -f 4 \|
33	30	xargs -L1 git clone
34		```
	31	#+end_src
35	32
36	33	Finally, save the bash script and make it executable.
37	34
38		```sh
	35	#+begin_src sh
39	36	chmod a+x clone_github_repos.sh
40		```
	37	#+end_src
41	38
42	39	Now you can run the script and should see the cloning process begin.
43	40
44		```sh
	41	#+begin_src sh
45	42	./clone_github_repos.sh
46		```
	43	#+end_src
47	44
48		## Cloning from Sourcehut
49
50		I haven't fully figured out how to directly incorporate Sourcehut's GraphQL API
51		into a bash script yet, so this one will take two steps.
	45	** Cloning from Sourcehut
	46	:PROPERTIES:
	47	:CUSTOM_ID: cloning-from-sourcehut
	48	:END:
	49	I haven't fully figured out how to directly incorporate Sourcehut's
	50	GraphQL API into a bash script yet, so this one will take two steps.
52	51
53	52	First, log-in to Sourcehut and go to their
54		[GraphQL playground for Git](https://git.sr.ht/graphql). Next, paste the
55		following query into the left box:
	53	[[https://git.sr.ht/graphql][GraphQL playground for Git]]. Next, paste
	54	the following query into the left box:
56	55
57		```sh
	56	#+begin_src sh
58	57	query {
59	58	me {
60	59	canonicalName
		@@ -66,26 +65,27 @@ query {
66	65	}
67	66	}
68	67	}
69		```
	68	#+end_src
70	69
71		The output on the right side will give you an object of all your repositories.
72		Just grab that text and remove all the characters such as quotation marks and
73		curly brackets. You will need a single-line list of space-separated values for
74		the next step.
	70	The output on the right side will give you an object of all your
	71	repositories. Just grab that text and remove all the characters such as
	72	quotation marks and curly brackets. You will need a single-line list of
	73	space-separated values for the next step.
75	74
76	75	Now let's create the bash script:
77	76
78		```sh
	77	#+begin_src sh
79	78	nano clone_sourcehut_repos.sh
80		```
	79	#+end_src
81	80
82		Next, paste the following bash script in with the list of repositories you
83		obtained above and replace `your-username` with your username.
	81	Next, paste the following bash script in with the list of repositories
	82	you obtained above and replace =your-username= with your username.
84	83
85		Note that this uses the SSH-based Git cloning method (e.g. `git@git...`), so
86		you'll need to ensure you have set up Sourcehut with your SSH key.
	84	Note that this uses the SSH-based Git cloning method
	85	(e.g. =git@git...=), so you'll need to ensure you have set up Sourcehut
	86	with your SSH key.
87	87
88		```sh
	88	#+begin_src sh
89	89	repos=(repo1 repo2 repo3)
90	90
91	91	# List all sub-directories in the current directory
		@@ -94,36 +94,38 @@ do
94	94	# Clone
95	95	git clone git@git.sr.ht:~your-username/$repo
96	96	done
97		```
	97	#+end_src
98	98
99	99	Finally, save the bash script and make it executable.
100	100
101		```sh
	101	#+begin_src sh
102	102	chmod a+x clone_sourcehut_repos.sh
103		```
	103	#+end_src
104	104
105	105	Now you can run the script and should see the cloning process begin.
106	106
107		```sh
	107	#+begin_src sh
108	108	./clone_sourcehut_repos.sh
109		```
110
111		## Moving Repositories to a New Host
	109	#+end_src
112	110
113		Now that you have all of your code repositories cloned to your local computer,
114		you may want to change the remote host (e.g., moving from GitHub to GitLab).
115		To do this, let's create another bash script:
	111	** Moving Repositories to a New Host
	112	:PROPERTIES:
	113	:CUSTOM_ID: moving-repositories-to-a-new-host
	114	:END:
	115	Now that you have all of your code repositories cloned to your local
	116	computer, you may want to change the remote host (e.g., moving from
	117	GitHub to GitLab). To do this, let's create another bash script:
116	118
117		```sh
	119	#+begin_src sh
118	120	nano change_remote_urls.sh
119		```
	121	#+end_src
120	122
121		Past the following information and be sure to change the URL information to
122		whichever host you are moving to. For this example, I am looping through all of
123		my cloned GitHub directories and changing them to Sourcehut (e.g.
124		`<YOUR_NEW_REMOTE_URL>` -\> `git@git.sr.ht:~myusername`).
	123	Past the following information and be sure to change the URL information
	124	to whichever host you are moving to. For this example, I am looping
	125	through all of my cloned GitHub directories and changing them to
	126	Sourcehut (e.g. =<YOUR_NEW_REMOTE_URL>= -> =git@git.sr.ht:~myusername=).
125	127
126		```sh
	128	#+begin_src sh
127	129	# List all sub-directories in the current directory
128	130	for dir in */
129	131	do
		@@ -138,16 +140,16 @@ do
138	140	# Go back to main directory
139	141	cd ..
140	142	done
141		```
	143	#+end_src
142	144
143	145	Finally, save the bash script and make it executable.
144	146
145		```sh
	147	#+begin_src sh
146	148	chmod a+x change_remote_urls.sh
147		```
	149	#+end_src
148	150
149	151	Now you can run the script and should see the cloning process begin.
150	152
151		```sh
	153	#+begin_src sh
152	154	./change_remote_urls.sh
153		```
	155	#+end_src

blog/2021-03-28-gemini-capsule.org +129 −117

		@@ -1,30 +1,29 @@
1		+++
2		date = 2021-03-28
3		title = "Launching a Gemini Capsule"
4		description = "Learn more about Gemini, an alternative internet protocol to the World Wide Web (WWW)"
5		draft = false
6		+++
7
8		## What is Gemini?
9
10		[Gemini](https://gemini.circumlunar.space/) is an internet protocol introduced
11		in June 2019 as an alternative to HTTP(S) or Gopher. In layman's terms, it's an
12		alternative way to browse sites (called capsules) that requires a special
13		browser. Since Gemini is not standardized as an internet standard, normal web
14		browsers won't be able to load a Gemini capsule.
15		Instead, you'll need to use [a Gemini-specific browser](https://gemini.
16		circumlunar.space/clients.html).
	1	#+title: Launching a Gemini Capsule
	2	#+date: 2021-03-28
	3
	4	** What is Gemini?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-gemini
	7	:END:
	8	[[https://gemini.circumlunar.space/][Gemini]] is an internet protocol
	9	introduced in June 2019 as an alternative to HTTP(S) or Gopher. In
	10	layman's terms, it's an alternative way to browse sites (called
	11	capsules) that requires a special browser. Since Gemini is not
	12	standardized as an internet standard, normal web browsers won't be able
	13	to load a Gemini capsule. Instead, you'll need to use
	14	[[https://gemini.%20circumlunar.space/clients.html][a Gemini-specific
	15	browser]].
17	16
18	17	The content found within a Gemini page is called
19		[Gemtext](https://gemini.circumlunar.space/docs/cheatsheet.gmi) and is
20		_extremely_ basic (on purpose).
21		Gemini only processes the text, no media content like images. However,
22		you're able to style 3 levels of headings, regular text, links (which will
23		display on their own line), quotes, and an unordered list.
	18	[[https://gemini.circumlunar.space/docs/cheatsheet.gmi][Gemtext]] and is
	19	/extremely/ basic (on purpose). Gemini only processes the text, no media
	20	content like images. However, you're able to style 3 levels of headings,
	21	regular text, links (which will display on their own line), quotes, and
	22	an unordered list.
24	23
25	24	Here's a complete listing of valid Gemtext:
26	25
27		```txt
	26	#+begin_src txt
28	27	# Heading 1
29	28	## Heading 2
30	29	### Heading 3
		@@ -41,97 +40,109 @@ My List:
41	40	* Item
42	41
43	42	```Anything between three backticks will be rendered as code.```
44		```
45
46		## Free Option
47
48		There are probably numerous websites that allow you to create your personal
49		Gemini capsule, but I'm going to focus on the two sites that I have personally
50		tested. The first option below, Midnight Pub, allows you to create/edit any
51		Gemini files you want in your account. This is essentially a GUI option with a
52		built-in text box for editing. The second option below, Sourcehut, allows you to
53		use a Git repository and automatic build process to deploy your personal Gemini
54		capsule every time you push a commit.
55
56		### Midnight Pub - Beginner Friendly
57
58		[Midnight Pub](https://midnight.pub/) is a small, virtual community meant to
59		reflect the atmosphere of wandering into a small alley pub. The site is built in
60		Gemtext and has a server-side process to convert Gemtext to HTML if someone
61		loads the site in an HTTP(S) browser.
62
63		To create an account, you'll need to email the owner of the website to obtain a
64		key.
65		You can find their email on the Midnight Pub homepage.
66		Once registered, head to [your account](https://midnight.pub/account) and select
67		[manage site](https://midnight.pub/site). This is the screen where you can
68		upload or create any files to be displayed on the internet.
69
70		For example, I've created both an HTML file and a Gemini file. Remember that
71		Gemini is automatically converted to HTML on the Pub, so you don't need an HTML
72		version.
73		For example, I created an HTML version to add in some extra styling.
74
75		All you need to do is create a page like `index.gmi` and use your Gemini browser
76		to head over to your-username.midnight.pub to see the result.
77
78		That's all there is to it! Easy enough, right? Let's check out a more advanced
79		version in the next section.
80
81		## Paid Option
82
83		As of 2021, Sourcehut has decided to require users to have a paid account in
84		order to utilize their automated build system. For now, paid accounts can be as
85		low as $2/month.
86
87		### Sourcehut
88
89		[Sourcehut](https://sourcehut.org/) is a collection of software development
90		tools, but mostly surrounds their hosted Git repository service. Simply put,
91		it's a minimal and more private alternative to services like GitHub.
92
93		This walkthrough is more advanced and involves things like Git, SSH, the command
94		line. If you don't think you know enough to do this, check out my walkthrough on
95		creating a Gemini capsule for the Midnight Pub instead.
96
97		The first thing you'll need to do is create an SSH key pair, if you don't
98		already have one on your system. Once created, grab the contents of `id_rsa.pub`
99		and add it to your Sourcehut account settings - this will allow you to push and
100		pull code changes without using a username/password.
101
102		```sh
	43	#+end_src
	44
	45	** Free Option
	46	:PROPERTIES:
	47	:CUSTOM_ID: free-option
	48	:END:
	49	There are probably numerous websites that allow you to create your
	50	personal Gemini capsule, but I'm going to focus on the two sites that I
	51	have personally tested. The first option below, Midnight Pub, allows you
	52	to create/edit any Gemini files you want in your account. This is
	53	essentially a GUI option with a built-in text box for editing. The
	54	second option below, Sourcehut, allows you to use a Git repository and
	55	automatic build process to deploy your personal Gemini capsule every
	56	time you push a commit.
	57
	58	*** Midnight Pub - Beginner Friendly
	59	:PROPERTIES:
	60	:CUSTOM_ID: midnight-pub---beginner-friendly
	61	:END:
	62	[[https://midnight.pub/][Midnight Pub]] is a small, virtual community
	63	meant to reflect the atmosphere of wandering into a small alley pub. The
	64	site is built in Gemtext and has a server-side process to convert
	65	Gemtext to HTML if someone loads the site in an HTTP(S) browser.
	66
	67	To create an account, you'll need to email the owner of the website to
	68	obtain a key. You can find their email on the Midnight Pub homepage.
	69	Once registered, head to [[https://midnight.pub/account][your account]]
	70	and select [[https://midnight.pub/site][manage site]]. This is the
	71	screen where you can upload or create any files to be displayed on the
	72	internet.
	73
	74	For example, I've created both an HTML file and a Gemini file. Remember
	75	that Gemini is automatically converted to HTML on the Pub, so you don't
	76	need an HTML version. For example, I created an HTML version to add in
	77	some extra styling.
	78
	79	All you need to do is create a page like =index.gmi= and use your Gemini
	80	browser to head over to your-username.midnight.pub to see the result.
	81
	82	That's all there is to it! Easy enough, right? Let's check out a more
	83	advanced version in the next section.
	84
	85	** Paid Option
	86	:PROPERTIES:
	87	:CUSTOM_ID: paid-option
	88	:END:
	89	As of 2021, Sourcehut has decided to require users to have a paid
	90	account in order to utilize their automated build system. For now, paid
	91	accounts can be as low as $2/month.
	92
	93	*** Sourcehut
	94	:PROPERTIES:
	95	:CUSTOM_ID: sourcehut
	96	:END:
	97	[[https://sourcehut.org/][Sourcehut]] is a collection of software
	98	development tools, but mostly surrounds their hosted Git repository
	99	service. Simply put, it's a minimal and more private alternative to
	100	services like GitHub.
	101
	102	This walkthrough is more advanced and involves things like Git, SSH, the
	103	command line. If you don't think you know enough to do this, check out
	104	my walkthrough on creating a Gemini capsule for the Midnight Pub
	105	instead.
	106
	107	The first thing you'll need to do is create an SSH key pair, if you
	108	don't already have one on your system. Once created, grab the contents
	109	of =id_rsa.pub= and add it to your Sourcehut account settings - this
	110	will allow you to push and pull code changes without using a
	111	username/password.
	112
	113	#+begin_src sh
103	114	ssh keygen
104		```
	115	#+end_src
105	116
106		Next up, let's create a repository with the proper name so that the Sourcehut
107		build system will know we want them to host a website for us. Use the following
108		format exactly:
	117	Next up, let's create a repository with the proper name so that the
	118	Sourcehut build system will know we want them to host a website for us.
	119	Use the following format exactly:
109	120
110		```sh
	121	#+begin_src sh
111	122	mkdir your-username.srht.site && cd your-username.srht.site
112		```
	123	#+end_src
113	124
114		Now that we've created the repo, let's initialize Git and add the proper remote
115		URL.
	125	Now that we've created the repo, let's initialize Git and add the proper
	126	remote URL.
116	127
117		```sh
	128	#+begin_src sh
118	129	git init
119		```
	130	#+end_src
120	131
121		```sh
	132	#+begin_src sh
122	133	git remote add origin git@git.sr.ht:~your-username/your-username.srht.site
123		```
	134	#+end_src
124	135
125		Now that our repository is set up and configured, we will need to create at
126		least two files:
	136	Now that our repository is set up and configured, we will need to create
	137	at least two files:
127	138
128		- `index.gmi`
129		- `.build.yml`
	139	- =index.gmi=
	140	- =.build.yml=
130	141
131		For your `.build.yml` file, use the following content and be sure to update the
132		`site` line with your username!
	142	For your =.build.yml= file, use the following content and be sure to
	143	update the =site= line with your username!
133	144
134		```yaml
	145	#+begin_src yaml
135	146	image: alpine/latest
136	147	oauth: pages.sr.ht/PAGES:RW
137	148	environment:
		@@ -142,37 +153,38 @@ tasks:
142	153	tar -cvz . > ../site.tar.gz
143	154	- upload: \|
144	155	acurl -f https://pages.sr.ht/publish/$site -Fcontent=@site.tar.gz -Fprotocol=GEMINI
145		```
	156	#+end_src
146	157
147		For the `index.gmi` file, put whatever you want in there and save it. You could
148		even just copy and paste the Gemtext cheatsheet.
	158	For the =index.gmi= file, put whatever you want in there and save it.
	159	You could even just copy and paste the Gemtext cheatsheet.
149	160
150		If you want to serve both HTML and Gemini files from this repository, just add a
151		second command to the `upload` section:
	161	If you want to serve both HTML and Gemini files from this repository,
	162	just add a second command to the =upload= section:
152	163
153		```yaml
	164	#+begin_src yaml
154	165	- upload: \|
155	166	acurl -f https://pages.sr.ht/publish/$site -Fcontent=@site.tar.gz -Fprotocol=GEMINI
156	167	acurl -f https://pages.sr.ht/publish/$site -Fcontent=@site.tar.gz
157		```
	168	#+end_src
158	169
159	170	Lastly, commit your changes and push them to the remote repo.
160	171
161		```sh
	172	#+begin_src sh
162	173	git add .; git commit -m "initial commit"; git push --set-upstream origin HEAD
163		```
	174	#+end_src
164	175
165		If you've successfully created the files with the proper format, you'll see the
166		terminal print a message that lets you know where the automatic build is taking
167		place. For example, here's what the terminal tells me:
	176	If you've successfully created the files with the proper format, you'll
	177	see the terminal print a message that lets you know where the automatic
	178	build is taking place. For example, here's what the terminal tells me:
168	179
169		```sh
	180	#+begin_src sh
170	181	remote: Build started:
171	182	remote: https://builds.sr.ht/~user/job/689803 [.build.yml]
172		```
	183	#+end_src
173	184
174	185	Now that you've properly built your Sourcehut page, you can browse to
175		your-username.srht.site in a Gemini browser and view the final results. Take a
176		look at the image below for my Sourcehut Gemini capsule.
	186	your-username.srht.site in a Gemini browser and view the final results.
	187	Take a look at the image below for my Sourcehut Gemini capsule.
177	188
178		![Gemini page on the amfora browser](https://img.cleberg.net/blog/20210328-launching-a-gemini-capsule/amfora.png)
	189	#+caption: Gemini page on the amfora browser
	190	[[https://img.cleberg.net/blog/20210328-launching-a-gemini-capsule/amfora.png]]

blog/2021-03-28-vaporwave-vs-outrun.org +151 −120

		@@ -1,120 +1,151 @@
1		+++
2		date = 2021-03-28
3		title = "Vaporwave vs Outrun"
4		description = "This post discusses Vaporwave and Outrun, which have become almost synonymous in the minds of those online who aren't hardcore into these genres of media."
5		+++
6
7		## Overview
8
9		When it comes to an aesthetic that originated primarily online, there tends to
10		be a lot of confusion around what falls into each specific genre. This post
11		discusses Vaporwave and Outrun, which have become almost synonymous in the minds
12		of those online who aren't hardcore into these genres of media. More
13		specifically, Outrun is largely an unknown term while all aesthetics in these
14		two genres are usually attributed to Vaporwave. For example, take a look at the
15		image search results for Vaporwave: the results include a lot of
16		Outrun-themed images. You'll find a similar trend almost everywhere.
17
18		![](https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/vaporwave-search-results.png)
19
20		## Vaporwave
21
22		![](https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/macintosh-plus.png)
23
24		Okay, so what is Vaporwave? I'm going to just copy-and-paste some general info
25		from the Wikipedia article on
26		[Vaporwave](https://en.wikipedia.org/wiki/Vaporwave), so that I'm not repeating
27		everything you can already search for online:
28
29		> Vaporwave is a microgenre of electronic music, a visual art style, and an
30		> Internet meme that emerged in the early 2010s. It is defined partly by its
31		> slowed-down, chopped and screwed samples of smooth jazz, elevator, R&B, and
32		> lounge music from the 1980s and 1990s. The surrounding subculture is sometimes
33		> associated with an ambiguous or satirical take on consumer capitalism and pop
34		> culture, and tends to be characterized by a nostalgic or surrealist engagement
35		> with the popular entertainment, technology and advertising of previous
36		> decades. Visually, it incorporates early Internet imagery, late 1990s web
37		> design, glitch art, anime, 3D-rendered objects, and cyberpunk tropes in its
38		> cover artwork and music videos.
39
40		This is an excellent summary, and it helps address my point here: there are
41		specific aspects that make Vaporwave unique:
42
43		### Time Frame
44
45		The time frame for references, logos, etc. focuses mostly on the 1990s in
46		Vaporwave. You'll see old school Pepsi logos, Microsoft 95 screens, tropical
47		plants, classic marble sculptures, and many references from Japan's influence in
48		the 90s.
49
50		### Art
51
52		The color scheme is generally a soft, light palette that uses pastel colors. The
53		backdrop will often be in a light-pink or teal blue.
54
55		### Music
56
57		The musical genre of Vaporwave incorporates soft tunes, lounge music, and sound
58		effects that will make the listener reminisce of the 90s. The sounds of the
59		genre are generally slower-paced and calming. The major breakthrough artist for
60		Vaporwave was [Macintosh Plus](https://en.wikipedia.org/wiki/Vektroid), who
61		released the album
62		[Floral Shoppe](https://archive.org/details/MACINTOSHPLUS-FLORALSHOPPE_complete)
63		in 2011. Another more recent example is the artist
64		[sadbert](https://sadbert.bandcamp.com/), whose latest album incorporates the
65		upbeat tones of the 1999 Dilbert TV series.
66
67		Notice that Vaporwave doesn't include things like racing cars, futuristic
68		technology, chrome, or the deep orange/purple color scheme. Vaporwave is a focus
69		on the idyllic state of the world when technology was becoming common in
70		households, a reality that we have already experienced. Focus on the most
71		aesthetically-pleasing parts of that past is a large part of Vaporwave.
72
73		## Outrun
74
75		![Outrun](https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/outrun.png)
76
77		Now, let's get to Outrun. This one is a little trickier since the genre has
78		largely been lumped under the Vaporwave title for so long. However, it stems
79		from the [Synthwave](https://en.wikipedia.org/wiki/Synthwave) music genre and is
80		likely named after the 1986 racer game,
81		[Out Run](https://en.wikipedia.org/wiki/Out_Run).
82
83		### Time Frame
84
85		Outrun can be thought of as a retro-futuristic aesthetic born from the 1980s.
86
87		### Art
88
89		The color scheme uses a very dark color palette with the main colors being deep
90		oranges, blues, and purples. Red edges are common around objects in Outrun art.
91		The background of the Outrun aesthetic is almost always a neon grid like you'd
92		expect to see in Tron or a 1980s arcade machine.
93
94		Classic sports cars, chrome robots, computer generated graphics and fonts, and
95		the occasional use of rain or palm trees can be found in Outrun art.
96
97		### Music
98
99		This aesthetic has a more aggressive and fast-paced style of music, which tends
100		to match the subject of the art in this aesthetic.
101
102		Outrun enthusiasts love what people in the 1980s thought the future would look
103		like. Take a look at a common video game discussed in Outrun circles, Far Cry 3:
104		Blood Dragon:
105
106		![Fry Cry 3: Blood Dragon](https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/far-cry.png)
107
108		Another example that doesn't force the color scheme as hard as some online art
109		does is Kung Fury:
110
111		![Kung Fury](https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/kung-fury.png)
112
113		![Kung Fury Hacker Scene](https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/kung-fury-hacker.png)
114
115		## Conclusion
116
117		While Vaporwave and Outrun share similarities, they are two distinct aesthetics
118		with many important distinctions. Someone who enjoys one may not necessarily
119		enjoy the other, so it's important to make sure we properly describe the
120		aesthetic we're looking for.
	1	#+title: Vaporwave vs Outrun
	2	#+date: 2021-03-28
	3
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	When it comes to an aesthetic that originated primarily online, there
	9	tends to be a lot of confusion around what falls into each specific
	10	genre. This post discusses Vaporwave and Outrun, which have become
	11	almost synonymous in the minds of those online who aren't hardcore into
	12	these genres of media. More specifically, Outrun is largely an unknown
	13	term while all aesthetics in these two genres are usually attributed to
	14	Vaporwave. For example, take a look at the image search results for
	15	Vaporwave: the results include a lot of Outrun-themed images. You'll
	16	find a similar trend almost everywhere.
	17
	18	[[https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/vaporwave-search-results.png]]
	19
	20	** Vaporwave
	21	:PROPERTIES:
	22	:CUSTOM_ID: vaporwave
	23	:END:
	24	[[https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/macintosh-plus.png]]
	25
	26	Okay, so what is Vaporwave? I'm going to just copy-and-paste some
	27	general info from the Wikipedia article on
	28	[[https://en.wikipedia.org/wiki/Vaporwave][Vaporwave]], so that I'm not
	29	repeating everything you can already search for online:
	30
	31	#+begin_quote
	32	Vaporwave is a microgenre of electronic music, a visual art style, and
	33	an Internet meme that emerged in the early 2010s. It is defined partly
	34	by its slowed-down, chopped and screwed samples of smooth jazz,
	35	elevator, R&B, and lounge music from the 1980s and 1990s. The
	36	surrounding subculture is sometimes associated with an ambiguous or
	37	satirical take on consumer capitalism and pop culture, and tends to be
	38	characterized by a nostalgic or surrealist engagement with the popular
	39	entertainment, technology and advertising of previous decades. Visually,
	40	it incorporates early Internet imagery, late 1990s web design, glitch
	41	art, anime, 3D-rendered objects, and cyberpunk tropes in its cover
	42	artwork and music videos.
	43
	44	#+end_quote
	45
	46	This is an excellent summary, and it helps address my point here: there
	47	are specific aspects that make Vaporwave unique:
	48
	49	*** Time Frame
	50	:PROPERTIES:
	51	:CUSTOM_ID: time-frame
	52	:END:
	53	The time frame for references, logos, etc. focuses mostly on the 1990s
	54	in Vaporwave. You'll see old school Pepsi logos, Microsoft 95 screens,
	55	tropical plants, classic marble sculptures, and many references from
	56	Japan's influence in the 90s.
	57
	58	*** Art
	59	:PROPERTIES:
	60	:CUSTOM_ID: art
	61	:END:
	62	The color scheme is generally a soft, light palette that uses pastel
	63	colors. The backdrop will often be in a light-pink or teal blue.
	64
	65	*** Music
	66	:PROPERTIES:
	67	:CUSTOM_ID: music
	68	:END:
	69	The musical genre of Vaporwave incorporates soft tunes, lounge music,
	70	and sound effects that will make the listener reminisce of the 90s. The
	71	sounds of the genre are generally slower-paced and calming. The major
	72	breakthrough artist for Vaporwave was
	73	[[https://en.wikipedia.org/wiki/Vektroid][Macintosh Plus]], who released
	74	the album
	75	[[https://archive.org/details/MACINTOSHPLUS-FLORALSHOPPE_complete][Floral
	76	Shoppe]] in 2011. Another more recent example is the artist
	77	[[https://sadbert.bandcamp.com/][sadbert]], whose latest album
	78	incorporates the upbeat tones of the 1999 Dilbert TV series.
	79
	80	Notice that Vaporwave doesn't include things like racing cars,
	81	futuristic technology, chrome, or the deep orange/purple color scheme.
	82	Vaporwave is a focus on the idyllic state of the world when technology
	83	was becoming common in households, a reality that we have already
	84	experienced. Focus on the most aesthetically-pleasing parts of that past
	85	is a large part of Vaporwave.
	86
	87	** Outrun
	88	:PROPERTIES:
	89	:CUSTOM_ID: outrun
	90	:END:
	91	#+caption: Outrun
	92	[[https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/outrun.png]]
	93
	94	Now, let's get to Outrun. This one is a little trickier since the genre
	95	has largely been lumped under the Vaporwave title for so long. However,
	96	it stems from the [[https://en.wikipedia.org/wiki/Synthwave][Synthwave]]
	97	music genre and is likely named after the 1986 racer game,
	98	[[https://en.wikipedia.org/wiki/Out_Run][Out Run]].
	99
	100	*** Time Frame
	101	:PROPERTIES:
	102	:CUSTOM_ID: time-frame-1
	103	:END:
	104	Outrun can be thought of as a retro-futuristic aesthetic born from the
	105	1980s.
	106
	107	*** Art
	108	:PROPERTIES:
	109	:CUSTOM_ID: art-1
	110	:END:
	111	The color scheme uses a very dark color palette with the main colors
	112	being deep oranges, blues, and purples. Red edges are common around
	113	objects in Outrun art. The background of the Outrun aesthetic is almost
	114	always a neon grid like you'd expect to see in Tron or a 1980s arcade
	115	machine.
	116
	117	Classic sports cars, chrome robots, computer generated graphics and
	118	fonts, and the occasional use of rain or palm trees can be found in
	119	Outrun art.
	120
	121	*** Music
	122	:PROPERTIES:
	123	:CUSTOM_ID: music-1
	124	:END:
	125	This aesthetic has a more aggressive and fast-paced style of music,
	126	which tends to match the subject of the art in this aesthetic.
	127
	128	Outrun enthusiasts love what people in the 1980s thought the future
	129	would look like. Take a look at a common video game discussed in Outrun
	130	circles, Far Cry 3: Blood Dragon:
	131
	132	#+caption: Fry Cry 3: Blood Dragon
	133	[[https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/far-cry.png]]
	134
	135	Another example that doesn't force the color scheme as hard as some
	136	online art does is Kung Fury:
	137
	138	#+caption: Kung Fury
	139	[[https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/kung-fury.png]]
	140
	141	#+caption: Kung Fury Hacker Scene
	142	[[https://img.cleberg.net/blog/20210328-vaporwave-vs-outrun/kung-fury-hacker.png]]
	143
	144	** Conclusion
	145	:PROPERTIES:
	146	:CUSTOM_ID: conclusion
	147	:END:
	148	While Vaporwave and Outrun share similarities, they are two distinct
	149	aesthetics with many important distinctions. Someone who enjoys one may
	150	not necessarily enjoy the other, so it's important to make sure we
	151	properly describe the aesthetic we're looking for.

blog/2021-03-30-vps-web-server.org +295 −262

		@@ -1,270 +1,293 @@
1		+++
2		date = 2021-03-30
3		title = "How to Set Up a VPS Web Server"
4		description = "Choosing a place to host a website is one of the most confusing decisions for beginner web developers. Even for experienced web devs, choosing between different forms of web hosting can be a daunting choice."
5		draft = false
6		+++
7
8		## Shared Hosting vs. VPS
9
10		Choosing a place to host a website is one of the most confusing decisions for
11		beginner web developers. Even for experienced web devs, choosing between
12		different forms of web hosting can be a daunting choice.
	1	#+title: How to Set Up a VPS Web Server
	2	#+date: 2021-03-30
	3
	4	** Shared Hosting vs. VPS
	5	:PROPERTIES:
	6	:CUSTOM_ID: shared-hosting-vs.-vps
	7	:END:
	8	Choosing a place to host a website is one of the most confusing
	9	decisions for beginner web developers. Even for experienced web devs,
	10	choosing between different forms of web hosting can be a daunting
	11	choice.
13	12
14	13	First, let's take a look at
15		[shared web hosting](https://en.wikipedia.org/wiki/Shared_web_hosting_service).
16		Shared web hosting is a product where you are purchasing a small piece of a web
17		server that is being shared between many websites. As a result, the cost of
18		shared hosting is extremely low. You won't have access to the server itself,
19		which means you can't install your own software on the server, such as Docker.
20		Usually, you are simply allowed to connect your domains to the server, set up
21		domain security, and other small utilities.
	14	[[https://en.wikipedia.org/wiki/Shared_web_hosting_service][shared web
	15	hosting]]. Shared web hosting is a product where you are purchasing a
	16	small piece of a web server that is being shared between many websites.
	17	As a result, the cost of shared hosting is extremely low. You won't have
	18	access to the server itself, which means you can't install your own
	19	software on the server, such as Docker. Usually, you are simply allowed
	20	to connect your domains to the server, set up domain security, and other
	21	small utilities.
22	22
23	23	In contrast, a
24		[virtual private server](https://en.wikipedia.org/wiki/Virtual_private_server)
25		(VPS) is a virtual machine that replicates the environment of having a dedicated
26		server to yourself. You are able to control the virtual server's host names,
27		base file system, package manager, etc. Another great upside of a VPS is that
28		since it's virtual, the company providing the VPS can dynamically increase the
29		disk size, RAM size, or number of CPUs at any time. However, the virtual server
30		is still physically located on a server that is shared between multiple virtual
	24	[[https://en.wikipedia.org/wiki/Virtual_private_server][virtual private
	25	server]] (VPS) is a virtual machine that replicates the environment of
	26	having a dedicated server to yourself. You are able to control the
	27	virtual server's host names, base file system, package manager, etc.
	28	Another great upside of a VPS is that since it's virtual, the company
	29	providing the VPS can dynamically increase the disk size, RAM size, or
	30	number of CPUs at any time. However, the virtual server is still
	31	physically located on a server that is shared between multiple virtual
31	32	servers.
32	33
33		The choice between shared hosting and VPS mostly depends on your skill level
34		with system administration. If you're comforting working on a server that is
35		mostly left up to you (or you're willing to learn), then a VPS is usually a
36		better option. However, shared hosting is a fantastic option for people who
37		don't want to have to learn how to manage their server.
38
39		## My Situation
	34	The choice between shared hosting and VPS mostly depends on your skill
	35	level with system administration. If you're comforting working on a
	36	server that is mostly left up to you (or you're willing to learn), then
	37	a VPS is usually a better option. However, shared hosting is a fantastic
	38	option for people who don't want to have to learn how to manage their
	39	server.
40	40
41		I had used shared hosting for approximately 5 years before trying my first VPS.
42		I manage a homelab and have had success running a server and performing typical
43		sysadmin duties, but I was still hesitant to get a VPS. One fear was that I
44		always struggled to properly set up the networking part of a server - DNS and
45		hostname configurations were not my friend.
	41	** My Situation
	42	:PROPERTIES:
	43	:CUSTOM_ID: my-situation
	44	:END:
	45	I had used shared hosting for approximately 5 years before trying my
	46	first VPS. I manage a homelab and have had success running a server and
	47	performing typical sysadmin duties, but I was still hesitant to get a
	48	VPS. One fear was that I always struggled to properly set up the
	49	networking part of a server - DNS and hostname configurations were not
	50	my friend.
46	51
47	52	As a little bit of background, I originally used
48		[Siteground](https://www.siteground.com) for my initially shared hosting and
49		stayed on that platform for at least a year. However, the UI was clunky, and I
50		didn't like how they handled certain technical aspects, so I switched to
51		[Namecheap](https://www.namecheap.com). Namecheap was great because it is the
52		service I primarily use for purchasing domain names, which made it incredibly
53		easy to link them to my hosting service. However, it was still mediocre shared
54		hosting, and Namecheap is notorious for not letting you use
55		[Let's Encrypt](https://letsencrypt.org) to obtain free SSL/TLS certificates;
56		Namecheap wants to make you purchase certificates through their store.
57
58		Finally, I settled down with [iWebFusion](https://www.iwebfusion.net) for about
59		the last year of my shared hosting. This service was pretty great, came with
60		free SSL/TLS, and I never had any complaints.
61
62		However, I finally grew tired of not being able to install software on my own
63		web server. I wanted to be able to try out things like
64		[Postmill](https://postmill.xyz) or [Matrix](https://matrix.org). This is
65		possible with a VPS, so I decided to grab a new domain name to try it out.
66
67		## Getting Started: Buying a VPS
68
69		The first step to moving over to a VPS is (you guessed it): finding a VPS
70		provider. For my VPSs, I use [1984](https://1984hosting.com) and prefer their
71		services much more than any alternative, due to their location (Iceland), their
72		[privacy policy](https://1984hosting.com/GDPR/), their respect for GDPR, and the
73		ability to remain anonymous if you pay in Bitcoin or Monero.
74
75		[Njalla](https://njal.la) is another good, privacy-oriented option for VPS
76		services.
77
78		You'll have to decide what specifications you want on your VPS. For me, I only
79		build and deploy low-resource HTML, PHP, and Python websites. This means I can
80		survive on the smallest VPS: 1 CPU, 1GB of RAM, and 25GB SSD for $5.00 per
81		month.
82
83		As noted above, the great thing about a VPS is you can request your provider to
84		increase the resources at any time.
85
86		## Configuring DNS Settings
87
88		Okay, so now let's get into some actual work that has to be done to get content
89		moved from a shared host to a VPS. At this point, I'm assuming you have a shared
90		host with website content that you can still access, and you've purchased a new
91		VPS and can SSH into that server.
	53	[[https://www.siteground.com][Siteground]] for my initially shared
	54	hosting and stayed on that platform for at least a year. However, the UI
	55	was clunky, and I didn't like how they handled certain technical
	56	aspects, so I switched to [[https://www.namecheap.com][Namecheap]].
	57	Namecheap was great because it is the service I primarily use for
	58	purchasing domain names, which made it incredibly easy to link them to
	59	my hosting service. However, it was still mediocre shared hosting, and
	60	Namecheap is notorious for not letting you use
	61	[[https://letsencrypt.org][Let's Encrypt]] to obtain free SSL/TLS
	62	certificates; Namecheap wants to make you purchase certificates through
	63	their store.
	64
	65	Finally, I settled down with [[https://www.iwebfusion.net][iWebFusion]]
	66	for about the last year of my shared hosting. This service was pretty
	67	great, came with free SSL/TLS, and I never had any complaints.
	68
	69	However, I finally grew tired of not being able to install software on
	70	my own web server. I wanted to be able to try out things like
	71	[[https://postmill.xyz][Postmill]] or [[https://matrix.org][Matrix]].
	72	This is possible with a VPS, so I decided to grab a new domain name to
	73	try it out.
	74
	75	** Getting Started: Buying a VPS
	76	:PROPERTIES:
	77	:CUSTOM_ID: getting-started-buying-a-vps
	78	:END:
	79	The first step to moving over to a VPS is (you guessed it): finding a
	80	VPS provider. For my VPSs, I use [[https://1984hosting.com][1984]] and
	81	prefer their services much more than any alternative, due to their
	82	location (Iceland), their [[https://1984hosting.com/GDPR/][privacy
	83	policy]], their respect for GDPR, and the ability to remain anonymous if
	84	you pay in Bitcoin or Monero.
	85
	86	[[https://njal.la][Njalla]] is another good, privacy-oriented option for
	87	VPS services.
	88
	89	You'll have to decide what specifications you want on your VPS. For me,
	90	I only build and deploy low-resource HTML, PHP, and Python websites.
	91	This means I can survive on the smallest VPS: 1 CPU, 1GB of RAM, and
	92	25GB SSD for $5.00 per month.
	93
	94	As noted above, the great thing about a VPS is you can request your
	95	provider to increase the resources at any time.
	96
	97	** Configuring DNS Settings
	98	:PROPERTIES:
	99	:CUSTOM_ID: configuring-dns-settings
	100	:END:
	101	Okay, so now let's get into some actual work that has to be done to get
	102	content moved from a shared host to a VPS. At this point, I'm assuming
	103	you have a shared host with website content that you can still access,
	104	and you've purchased a new VPS and can SSH into that server.
92	105
93	106	The first change is minor, but it should be done immediately in order to
94		get things moving: DNS settings. Go to wherever your DNS settings are handled.
95		If your shared host also managed your DNS settings, you'll need to first move
96		that DNS over to your new VPS provider. For me, I route my DNS through
97		[Gandi](https://www.gandi.net).
	107	get things moving: DNS settings. Go to wherever your DNS settings are
	108	handled. If your shared host also managed your DNS settings, you'll need
	109	to first move that DNS over to your new VPS provider. For me, I route my
	110	DNS through [[https://www.gandi.net][Gandi]].
98	111
99		Once you know where your DNS settings are, go ahead and update the `A` records
100		to match the public IP address of your VPS. For example:
	112	Once you know where your DNS settings are, go ahead and update the =A=
	113	records to match the public IP address of your VPS. For example:
101	114
102		```txt
	115	#+begin_src txt
103	116	A example.com xxx.xxx.xxx.xxx
104	117	A subdomain xxx.xxx.xxx.xxx
105	118	CNAME www example.com.
106		```
107
108		If you have any other records that require updates, such as MX or TXT records
109		for a mail server, be sure to update those accordingly. Personally, I don't host
110		my own mail server.
111		I route all mail on my custom domains to [Migadu](https://www.migadu.com).
112		Hosting your own email server can become complex quickly and is not for
113		beginners.
114
115		DNS changes can take up to 48 hours to propagate, so be sure to give it some
116		time before assuming you've made an error.
117
118		## Server Updates and Packages
119
120		Now that the DNS settings have been changed, let's set up our server while we
121		wait for the DNS to propagate.
122		First up is to ssh into your server.
123		If you've signed up with a service like DigitalOcean, you can add your SSH
124		key to your account and to your VPS droplet so that you don't need a
125		password in order to SSH.
126
127		```sh
	119	#+end_src
	120
	121	If you have any other records that require updates, such as MX or TXT
	122	records for a mail server, be sure to update those accordingly.
	123	Personally, I don't host my own mail server. I route all mail on my
	124	custom domains to [[https://www.migadu.com][Migadu]]. Hosting your own
	125	email server can become complex quickly and is not for beginners.
	126
	127	DNS changes can take up to 48 hours to propagate, so be sure to give it
	128	some time before assuming you've made an error.
	129
	130	** Server Updates and Packages
	131	:PROPERTIES:
	132	:CUSTOM_ID: server-updates-and-packages
	133	:END:
	134	Now that the DNS settings have been changed, let's set up our server
	135	while we wait for the DNS to propagate. First up is to ssh into your
	136	server. If you've signed up with a service like DigitalOcean, you can
	137	add your SSH key to your account and to your VPS droplet so that you
	138	don't need a password in order to SSH.
	139
	140	#+begin_src sh
128	141	ssh root@xxx.xxx.xxx.xxx
129		```
	142	#+end_src
130	143
131		The VPS that is used in this blog post runs Ubuntu 20.04 with an Apache web
132		server.
133		If you're working on a different operating system (OS) or want a
134		different web server, such as Nginx, you'll have to use different commands
135		to set it up.
	144	The VPS that is used in this blog post runs Ubuntu 20.04 with an Apache
	145	web server. If you're working on a different operating system (OS) or
	146	want a different web server, such as Nginx, you'll have to use different
	147	commands to set it up.
136	148
137	149	First, let's update and upgrade our server.
138	150
139		NOTE: Since we have logged in to the server as `root` for now, we don't need
140		to use the `sudo` modifier before our commands.
	151	NOTE: Since we have logged in to the server as =root= for now, we
	152	don't need to use the =sudo= modifier before our commands.
141	153
142		```sh
	154	#+begin_src sh
143	155	apt update && apt upgrade -y
144		```
145
146		## Create A User Account
	156	#+end_src
147	157
148		While being able to use `root` can be beneficial at times, you shouldn't use
149		`root` unless you have to.
	158	** Create A User Account
	159	:PROPERTIES:
	160	:CUSTOM_ID: create-a-user-account
	161	:END:
	162	While being able to use =root= can be beneficial at times, you shouldn't
	163	use =root= unless you have to.
150	164
151		So let's set up a new user in our system. The `-m` option below tells the OS to
152		create a home directory for the new user.
	165	So let's set up a new user in our system. The =-m= option below tells
	166	the OS to create a home directory for the new user.
153	167
154		```sh
	168	#+begin_src sh
155	169	adduser USERNAME
156		```
	170	#+end_src
157	171
158	172	Now, create a password for that user.
159	173
160		```sh
	174	#+begin_src sh
161	175	passwd USERNAME
162		```
	176	#+end_src
163	177
164		Finally, add the user to the sudoers file, so they can perform priveleged
165		commands.
	178	Finally, add the user to the sudoers file, so they can perform
	179	priveleged commands.
166	180
167		```sh
	181	#+begin_src sh
168	182	usermod -a -G sudo USERNAME
169		```
	183	#+end_src
170	184
171		If you are using SSH keys and not passwords, you'll need to copy your SSH key
172		from your local machine to the VPS. If you haven't disabled password-based SSH
173		yet, the easiest way to do this is `ssh-copy-id` from your local computer (not
174		from the VPS):
	185	If you are using SSH keys and not passwords, you'll need to copy your
	186	SSH key from your local machine to the VPS. If you haven't disabled
	187	password-based SSH yet, the easiest way to do this is =ssh-copy-id= from
	188	your local computer (not from the VPS):
175	189
176		```sh
	190	#+begin_src sh
177	191	ssh-copy-id testuser@xxx.xxx.xxx.xxx
178		```
	192	#+end_src
179	193
180		If you've disabled password-based SSH, you'll need to manually copy your SSH key
181		into the `~/.ssh/authorized_keys` file.
	194	If you've disabled password-based SSH, you'll need to manually copy your
	195	SSH key into the =~/.ssh/authorized_keys= file.
182	196
183		## Install Software
	197	** Install Software
	198	:PROPERTIES:
	199	:CUSTOM_ID: install-software
	200	:END:
	201	Our goal here is to host a web server, so the next step is to install
	202	the Apache web server and any other packages we need.
184	203
185		Our goal here is to host a web server, so the next step is to install the Apache
186		web server and any other packages we need.
	204	From this point on, I will be logged in as a user (not =root=) and will
	205	need to use the =sudo= modifier for most commands.
187	206
188		From this point on, I will be logged in as a user (not `root`) and will need to
189		use the `sudo` modifier for most commands.
190
191		```sh
	207	#+begin_src sh
192	208	sudo apt update; sudo apt upgrade -y; sudo apt autoremove -y
193	209	sudo apt install apache2
194		```
	210	#+end_src
195	211
196		If you need other language support, such as PHP, you'll need to install that
197		too.
	212	If you need other language support, such as PHP, you'll need to install
	213	that too.
198	214
199		```sh
	215	#+begin_src sh
200	216	sudo apt install libapache2-mod-php php-dom
201	217	sudo a2enmod php
202	218	sudo systemctl restart apache2
203		```
204
205		## Website Files & Folders
	219	#+end_src
206	220
207		Next up is to create the directories for the domain(s) we want to be hosted on
208		this web server.
	221	** Website Files & Folders
	222	:PROPERTIES:
	223	:CUSTOM_ID: website-files-folders
	224	:END:
	225	Next up is to create the directories for the domain(s) we want to be
	226	hosted on this web server.
209	227
210		```sh
	228	#+begin_src sh
211	229	cd /var/www
212	230	sudo mkdir example.com
213		```
	231	#+end_src
214	232
215		We have a folder for `example.com` now, so let's add an `index.html` file and
216		put it within a specific `public_html` folder. You don't need this `public_html`
217		if you don't want it, but it helps with organizing items related to
218		`example.com` that you don't want to publish to the internet.
	233	We have a folder for =example.com= now, so let's add an =index.html=
	234	file and put it within a specific =public_html= folder. You don't need
	235	this =public_html= if you don't want it, but it helps with organizing
	236	items related to =example.com= that you don't want to publish to the
	237	internet.
219	238
220		```sh
	239	#+begin_src sh
221	240	cd example.com
222	241	sudo mkdir public_html && cd public_html
223	242	sudo nano index.html
224		```
	243	#+end_src
225	244
226		You can put anything you want in this `index.html` file. If you can't think of
227		anything, paste this in there:
	245	You can put anything you want in this =index.html= file. If you can't
	246	think of anything, paste this in there:
228	247
229		```html
	248	#+begin_src html
230	249	<!DOCTYPE html>
231	250	<html lang="en">
232		<head>
233		<meta charset="utf-8" />
234		<meta name="viewport" content="width=device-width, initial-scale=1" />
235		<title>Hello, world!</title>
236		</head>
237		<body>
238		<h1>Hello, world!</h1>
239		</body>
	251	<head>
	252	<meta charset="utf-8" />
	253	<meta name="viewport" content="width=device-width, initial-scale=1" />
	254	<title>Hello, world!</title>
	255	</head>
	256	<body>
	257	<h1>Hello, world!</h1>
	258	</body>
240	259	</html>
241		```
	260	#+end_src
242	261
243		If you want something to be served at `example.com/page01/file.txt`, you'll have
244		to create the `page01` directory under the `example.com` directory. For example:
	262	If you want something to be served at =example.com/page01/file.txt=,
	263	you'll have to create the =page01= directory under the =example.com=
	264	directory. For example:
245	265
246		```sh
	266	#+begin_src sh
247	267	cd /var/www/example.com/public_html
248	268	sudo mkdir page01
249	269	sudo nano file.txt
250		```
	270	#+end_src
251	271
252		## Apache Configuration
	272	** Apache Configuration
	273	:PROPERTIES:
	274	:CUSTOM_ID: apache-configuration
	275	:END:
	276	Now, let's set up the files that will tell the server where to find the
	277	files for =example.com=. We will copy the default configuration file and
	278	create our own.
253	279
254		Now, let's set up the files that will tell the server where to find the files
255		for `example.com`. We will copy the default configuration file and create our
256		own.
257
258		```sh
	280	#+begin_src sh
259	281	cd /etc/apache2/sites-available
260	282	sudo cp 000-default.conf example.com.conf
261	283	sudo nano example.com.conf
262		```
	284	#+end_src
263	285
264		This configuration file will have a few default lines, but you'll need to edit
265		it to look similar to this (settings may change based on your personal needs):
	286	This configuration file will have a few default lines, but you'll need
	287	to edit it to look similar to this (settings may change based on your
	288	personal needs):
266	289
267		```config
	290	#+begin_src config
268	291	<VirtualHost *:80>
269	292	ServerAdmin your-email@email-provider.com
270	293	ServerName example.com
		@@ -273,128 +296,138 @@ it to look similar to this (settings may change based on your personal needs):
273	296	ErrorLog ${APACHE_LOG_DIR}/error.log
274	297	CustomLog ${APACHE_LOG_DIR}/access.log combined
275	298	</VirtualHost>
276		```
	299	#+end_src
277	300
278	301	Now, enable the configuration for your new site, disable the default
279	302	configuration, and reload the web server.
280	303
281		```sh
	304	#+begin_src sh
282	305	sudo a2ensite example.com.conf
283	306	sudo a2dissite 000-default.conf
284	307	sudo systemctl reload apache2
285		```
	308	#+end_src
286	309
287		You can always run a test to make sure no errors or warnings are found in your
288		configuration files.
	310	You can always run a test to make sure no errors or warnings are found
	311	in your configuration files.
289	312
290		```sh
	313	#+begin_src sh
291	314	sudo apache2ctl configtest
292		```
	315	#+end_src
293	316
294		Now, restart the web server entirely. After this, you should be able to browse
295		to `http://example.com` and see the HTML content you provided earlier. Note that
296		SSL/TLS has not been enabled yet, so you won't be able to use the secure version
297		yet (`https://example.com`).
	317	Now, restart the web server entirely. After this, you should be able to
	318	browse to =http://example.com= and see the HTML content you provided
	319	earlier. Note that SSL/TLS has not been enabled yet, so you won't be
	320	able to use the secure version yet (=https://example.com=).
298	321
299		```sh
	322	#+begin_src sh
300	323	sudo systemctl restart apache2
301		```
302
303		You can repeat this for as many websites as you need. Just create the domain
304		folders in `/var/www/`, add the configuration file, enable the configuration,
305		and restart `apache2`.
	324	#+end_src
306	325
307		## SSL/TLS Certificates: Serve Websites Over HTTPS
	326	You can repeat this for as many websites as you need. Just create the
	327	domain folders in =/var/www/=, add the configuration file, enable the
	328	configuration, and restart =apache2=.
308	329
309		In order to serve secure content, you'll need to obtain SSL/TLS certificates.
310		Luckily, there's a free tool called [Certbot](https://certbot.eff.org) that
311		helps us with the process.
	330	** SSL/TLS Certificates: Serve Websites Over HTTPS
	331	:PROPERTIES:
	332	:CUSTOM_ID: ssltls-certificates-serve-websites-over-https
	333	:END:
	334	In order to serve secure content, you'll need to obtain SSL/TLS
	335	certificates. Luckily, there's a free tool called
	336	[[https://certbot.eff.org][Certbot]] that helps us with the process.
312	337
313		The first step is to install `snapd` and `core` for Ubuntu.
	338	The first step is to install =snapd= and =core= for Ubuntu.
314	339
315		```sh
	340	#+begin_src sh
316	341	sudo apt install snapd
317	342	sudo snap install core
318	343	sudo snap refresh core
319		```
	344	#+end_src
320	345
321		Next, install the `certbot` snap package.
	346	Next, install the =certbot= snap package.
322	347
323		```sh
	348	#+begin_src sh
324	349	sudo snap install --classic certbot
325		```
	350	#+end_src
326	351
327		Execute the following command to ensure that the `certbot` command can be run.
	352	Execute the following command to ensure that the =certbot= command can
	353	be run.
328	354
329		```sh
	355	#+begin_src sh
330	356	sudo ln -s /snap/bin/certbot /usr/bin/certbot
331		```
	357	#+end_src
332	358
333		Finally, you can run `certbot` one of two ways:
	359	Finally, you can run =certbot= one of two ways:
334	360
335		1. run it and let it alter your Apache configuration files automatically to
336		enable HTTPS redirects.
337		2. run it and only allow it to create certificates.
338		You'll need to manually alter the config files to enable HTTPS redirects.
	361	1. run it and let it alter your Apache configuration files automatically
	362	to enable HTTPS redirects.
	363	2. run it and only allow it to create certificates. You'll need to
	364	manually alter the config files to enable HTTPS redirects.
339	365
340	366	Run certbot and allow automatic config changes:
341	367
342		```sh
	368	#+begin_src sh
343	369	sudo certbot --apache
344		```
	370	#+end_src
345	371
346		Run certbot for certificates only and don't allow it to alter config files:
	372	Run certbot for certificates only and don't allow it to alter config
	373	files:
347	374
348		```sh
	375	#+begin_src sh
349	376	sudo certbot certonly --apache
350		```
	377	#+end_src
351	378
352		The Certbot packages on your system come with a cron job or systemd timer that
353		will renew your certificates automatically before they expire. You will not need
354		to run Certbot again unless you change your configuration. You can test
355		automatic renewal for your certificates by running this command:
	379	The Certbot packages on your system come with a cron job or systemd
	380	timer that will renew your certificates automatically before they
	381	expire. You will not need to run Certbot again unless you change your
	382	configuration. You can test automatic renewal for your certificates by
	383	running this command:
356	384
357		```sh
	385	#+begin_src sh
358	386	sudo certbot renew --dry-run
359		```
	387	#+end_src
360	388
361		Now, test your domains by going to `https://example.com`.
362
363		## Firewall Security
	389	Now, test your domains by going to =https://example.com=.
364	390
	391	** Firewall Security
	392	:PROPERTIES:
	393	:CUSTOM_ID: firewall-security
	394	:END:
365	395	To enable better security on your server, you'll need to enable a basic
366	396	firewall. For Ubuntu, we'll use
367		[the uncomplicated firewall](https://cleberg.net/blog/secure-your-network-with-the-uncomplicated-firewall.html).
	397	[[https://cleberg.net/blog/secure-your-network-with-the-uncomplicated-firewall.html][the
	398	uncomplicated firewall]].
368	399
369		Now, add the following rules to the firewall allow SSH, Apache, and HTTP(S)
370		connections. If you need to, you can enable different ports for specifics
371		applications, SFTP, etc.
	400	Now, add the following rules to the firewall allow SSH, Apache, and
	401	HTTP(S) connections. If you need to, you can enable different ports for
	402	specifics applications, SFTP, etc.
372	403
373		```sh
	404	#+begin_src sh
374	405	sudo ufw default deny incoming
375	406	sudo ufw default allow outgoing
376	407	sudo ufw allow OpenSSH
377	408	sudo ufw allow Apache
378	409	sudo ufw allow proto tcp from any to any port 80,443
379		```
	410	#+end_src
380	411
381	412	Once you've added all the rules you need, enable the firewall.
382	413
383		```sh
	414	#+begin_src sh
384	415	sudo ufw enable
385		```
386
387		## Troubleshooting
	416	#+end_src
388	417
389		If you run into any issues during your VPS set-up, be sure to walk back through
390		your actions and make sure you didn't miss any steps.
	418	** Troubleshooting
	419	:PROPERTIES:
	420	:CUSTOM_ID: troubleshooting
	421	:END:
	422	If you run into any issues during your VPS set-up, be sure to walk back
	423	through your actions and make sure you didn't miss any steps.
391	424
392	425	Many websites have fantastic guides to setting up various web servers.
393		This is one of the areas [where DigitalOcean shines](https://www.digitalocean.
394		com/community/tutorials).
395		For simpler or more Linux-oriented questions, I suggest using [Linuxize]
396		(https://linuxize.com).
397
398		If you're getting certain errors (e.g. `500 Internal Server Error`) and need to
399		debug locally, you can view the `access.log` and `error.log` files in the
400		`/var/log/apache/` directory.
	426	This is one of the areas
	427	[[https://www.digitalocean.%20com/community/tutorials][where
	428	DigitalOcean shines]]. For simpler or more Linux-oriented questions, I
	429	suggest using [Linuxize] (https://linuxize.com).
	430
	431	If you're getting certain errors (e.g. =500 Internal Server Error=) and
	432	need to debug locally, you can view the =access.log= and =error.log=
	433	files in the =/var/log/apache/= directory.

blog/2021-04-17-gemini-server.org +128 −106

		@@ -1,159 +1,181 @@
1		+++
2		date = 2021-04-17
3		title = "Hosting a Gemini Server"
4		description = "Dive deeper into Gemini by hosting your own Gemini web server."
5		draft = false
6		+++
7
8		## Similar Article Available
9
10		To read more about Gemini and ways to test out this new protocol without your
11		own server, see my previous post
12		[Launching a Gemini Capsule](/blog/launching-a-gemini-capsule/).
13
14		## Preparation
15
16		This guide assumes you have access to a server accessible to the world through a
17		public IP address and that you own a domain name used for this Gemini capsule.
18
19		## Getting Started with Agate
20
21		We are going to use [Agate](https://github.com/mbrubeck/agate) for this
22		tutorial.
23		This is a basic Gemini server written in Rust.
24		It takes very little time and maintenance to get it running.
25
26		## Install Dependencies
27
28		First, you will need to install the Rust package for your system. On Ubuntu, use
29		the following commands (remember to use `sudo` if you are not the root user).
30		The Rust installation will give you options to customize the installation; I
31		used the default installation options.
32
33		```sh
	1	#+title: Hosting a Gemini Server
	2	#+date: 2021-04-17
	3
	4	** Similar Article Available
	5	:PROPERTIES:
	6	:CUSTOM_ID: similar-article-available
	7	:END:
	8	To read more about Gemini and ways to test out this new protocol without
	9	your own server, see my previous post
	10	[[/blog/launching-a-gemini-capsule/][Launching a Gemini Capsule]].
	11
	12	** Preparation
	13	:PROPERTIES:
	14	:CUSTOM_ID: preparation
	15	:END:
	16	This guide assumes you have access to a server accessible to the world
	17	through a public IP address and that you own a domain name used for this
	18	Gemini capsule.
	19
	20	** Getting Started with Agate
	21	:PROPERTIES:
	22	:CUSTOM_ID: getting-started-with-agate
	23	:END:
	24	We are going to use [[https://github.com/mbrubeck/agate][Agate]] for
	25	this tutorial. This is a basic Gemini server written in Rust. It takes
	26	very little time and maintenance to get it running.
	27
	28	** Install Dependencies
	29	:PROPERTIES:
	30	:CUSTOM_ID: install-dependencies
	31	:END:
	32	First, you will need to install the Rust package for your system. On
	33	Ubuntu, use the following commands (remember to use =sudo= if you are
	34	not the root user). The Rust installation will give you options to
	35	customize the installation; I used the default installation options.
	36
	37	#+begin_src sh
34	38	sudo apt update && sudo apt upgrade -y
35	39	curl https://sh.rustup.rs -sSf \| sh
36		```
	40	#+end_src
37	41
38	42	Remember to configure your shell with the new configuration:
39	43
40		```sh
	44	#+begin_src sh
41	45	source $HOME/.cargo/env
42		```
	46	#+end_src
43	47
44		Before we install agate, make sure you have the `gcc` package installed:
	48	Before we install agate, make sure you have the =gcc= package installed:
45	49
46		```sh
	50	#+begin_src sh
47	51	sudo apt install gcc
48		```
	52	#+end_src
49	53
50		Next, you'll need to install the agate executable with Rust's Cargo package
51		maintainer:
	54	Next, you'll need to install the agate executable with Rust's Cargo
	55	package maintainer:
52	56
53		```sh
	57	#+begin_src sh
54	58	cargo install agate
55		```
56
57		## Create Symlinks
	59	#+end_src
58	60
59		Once Cargo has finished installing all the required packages, symlink the
60		executable to your \$PATH.
	61	** Create Symlinks
	62	:PROPERTIES:
	63	:CUSTOM_ID: create-symlinks
	64	:END:
	65	Once Cargo has finished installing all the required packages, symlink
	66	the executable to your $PATH.
61	67
62		```sh
	68	#+begin_src sh
63	69	sudo ln -s $HOME/.cargo/bin/agate /usr/local/bin/agate
64		```
	70	#+end_src
65	71
66		## Using Agate's Built-In Installation Tool
	72	** Using Agate's Built-In Installation Tool
	73	:PROPERTIES:
	74	:CUSTOM_ID: using-agates-built-in-installation-tool
	75	:END:
	76	If you're running Ubuntu or Debian, use the Debian installation script
	77	found in Agate's GitHub repository, under the =tools/debian= folder.
67	78
68		If you're running Ubuntu or Debian, use the Debian installation script found in
69		Agate's GitHub repository, under the `tools/debian` folder.
70
71		```sh
	79	#+begin_src sh
72	80	git clone https://github.com/mbrubeck/agate
73	81	cd agate/tools/debian
74	82	sudo ./install.sh
75		```
76
77		## Configure the Gemini Service
78
79		We have a little more to do, but since this script tries to immediately run the
80		service, it will likely fail with an exit code. Let's add our finishing touches.
81		Edit the following file and replace the hostname with your desired URL. You can
82		also change the directory where content will be served.
83
84		```sh
	83	#+end_src
	84
	85	** Configure the Gemini Service
	86	:PROPERTIES:
	87	:CUSTOM_ID: configure-the-gemini-service
	88	:END:
	89	We have a little more to do, but since this script tries to immediately
	90	run the service, it will likely fail with an exit code. Let's add our
	91	finishing touches. Edit the following file and replace the hostname with
	92	your desired URL. You can also change the directory where content will
	93	be served.
	94
	95	#+begin_src sh
85	96	sudo nano /etc/systemd/system/gemini.service
86		```
	97	#+end_src
87	98
88		```sh
	99	#+begin_src sh
89	100	# Edit these lines to whatever you want - see the next code block for my personal configuration.
90	101	WorkingDirectory=/srv/gemini
91	102	ExecStart=agate --hostname $(uname -n) --lang en
92		```
	103	#+end_src
93	104
94	105	This is my personal config:
95	106
96		```sh
	107	#+begin_src sh
97	108	WorkingDirectory=/var/gemini/
98	109	ExecStart=agate --hostname gemini.example.com --lang en
99		```
	110	#+end_src
100	111
101		Since we've altered the systemd configuration files, we have to reload the
102		daemon. Let's do that, restart our service, and check its status.
	112	Since we've altered the systemd configuration files, we have to reload
	113	the daemon. Let's do that, restart our service, and check its status.
103	114
104		```sh
	115	#+begin_src sh
105	116	sudo systemctl daemon-reload
106	117	sudo systemctl restart gemini.service
107	118	sudo systemctl status gemini.service
108		```
109
110		## Fixing Systemd Errors
	119	#+end_src
111	120
112		If you're still getting errors, the installation process may not have properly
113		enabled the gemini service. Fix it with the following commands.
	121	** Fixing Systemd Errors
	122	:PROPERTIES:
	123	:CUSTOM_ID: fixing-systemd-errors
	124	:END:
	125	If you're still getting errors, the installation process may not have
	126	properly enabled the gemini service. Fix it with the following commands.
114	127
115		```sh
	128	#+begin_src sh
116	129	sudo systemctl enable gemini.service
117	130	sudo systemctl restart gemini.service
118	131	sudo systemctl status gemini.service
119		```
	132	#+end_src
120	133
121		## Firewall Rules
	134	** Firewall Rules
	135	:PROPERTIES:
	136	:CUSTOM_ID: firewall-rules
	137	:END:
	138	Great! Our server is now functional and running. The first consideration
	139	now is that you need to be able to access port 1965 on the server. If
	140	you have a firewall enabled, you'll need to open that port up.
122	141
123		Great! Our server is now functional and running. The first consideration now is
124		that you need to be able to access port 1965 on the server. If you have a
125		firewall enabled, you'll need to open that port up.
126
127		```sh
	142	#+begin_src sh
128	143	sudo ufw allow 1965
129	144	sudo ufw reload
130		```
131
132		## Creating Content
133
134		Let's create the Gemini capsule. Note that wherever you set the WorkingDirectory
135		variable to earlier, Agate will expect you to put your Gemini capsule contents
136		in a sub-folder called "content." So, I place my files in "/var/gmi/content." I'm
137		going to create that folder now and put a file in there.
138
139		```sh
	145	#+end_src
	146
	147	** Creating Content
	148	:PROPERTIES:
	149	:CUSTOM_ID: creating-content
	150	:END:
	151	Let's create the Gemini capsule. Note that wherever you set the
	152	WorkingDirectory variable to earlier, Agate will expect you to put your
	153	Gemini capsule contents in a sub-folder called "content." So, I place my
	154	files in "/var/gmi/content." I'm going to create that folder now and put
	155	a file in there.
	156
	157	#+begin_src sh
140	158	sudo mkdir /var/gemini/content
141	159	sudo nano /var/gemini/content/index.gmi
142		```
143
144		You can put whatever you want in the "index.gmi" file, just make sure it's valid
145		Gemtext.
	160	#+end_src
146	161
147		## The Results
	162	You can put whatever you want in the "index.gmi" file, just make sure
	163	it's valid Gemtext.
148	164
	165	** The Results
	166	:PROPERTIES:
	167	:CUSTOM_ID: the-results
	168	:END:
149	169	Here are some screenshots of the Gemini page I just created in the
150		[Lagrange](https://gmi.skyjake.fi/lagrange/) browser and the
151		[amfora](https://github.com/makeworld-the-better-one/amfora) browser.
	170	[[https://gmi.skyjake.fi/lagrange/][Lagrange]] browser and the
	171	[[https://github.com/makeworld-the-better-one/amfora][amfora]] browser.
152	172
153		![GUI Gemini browser](https://img.cleberg.net/blog/20210417-hosting-a-gemini-server/lagrange.png)
	173	#+caption: GUI Gemini browser
	174	[[https://img.cleberg.net/blog/20210417-hosting-a-gemini-server/lagrange.png]]
154	175
155		_Lagrange_
	176	/Lagrange/
156	177
157		![CLI Gemini browser](https://img.cleberg.net/blog/20210417-hosting-a-gemini-server/amfora.png)
	178	#+caption: CLI Gemini browser
	179	[[https://img.cleberg.net/blog/20210417-hosting-a-gemini-server/amfora.png]]
158	180
159		_Amfora_
	181	/Amfora/

blog/2021-04-23-php-comment-system.org +198 −176

		@@ -1,151 +1,161 @@
1		+++
2		date = 2021-04-23
3		title = "Roll Your Own Static Commenting System in PHP"
4		description = "Learn how to skip the tedium of finding the proper commenting system by simply rolling your own in PHP."
5		draft = false
6		+++
	1	#+title: Roll Your Own Static Commenting System in PHP
	2	#+date: 2021-04-23
7	3
8		## The Terrible-ness of Commenting Systems
	4	** The Terrible-ness of Commenting Systems
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-terrible-ness-of-commenting-systems
	7	:END:
	8	The current state of affairs regarding interactive comment systems is,
	9	well, terrible. It is especially awful if you're a privacy conscious
	10	person who does not generally load third-party scripts or frames on the
	11	websites you visit.
9	12
10		The current state of affairs regarding interactive comment systems is, well,
11		terrible. It is especially awful if you're a privacy conscious person who does
12		not generally load third-party scripts or frames on the websites you visit.
13
14		Even further, many comment systems are charging exorbitant fees for something
15		that should be standard.
	13	Even further, many comment systems are charging exorbitant fees for
	14	something that should be standard.
16	15
17	16	Of course, there are some really terrible options:
18	17
19		- Facebook Comments
20		- Discourse
21
22		There are some options that are better but still use too many scripts, frames,
23		or social integrations on your web page that could impact some users:
24
25		- Disqus
26		- Isso
27		- Remark42
28
29		Lastly, I looked into a few unique ways of generating blog comments, such as
30		using Twitter threads or GitHub issues to automatically post issues. However,
31		these both rely on external third-party sites that I don't currently use.
32
33		## Stay Static with Server-Side Comments
34
35		The main issue for my personal use-case is that my blog is completely, 100%
36		static. I use PHP on the back-end but website visitors only see HTML and a
37		single CSS file. No external javascript and no embedded frames.
38
39		So, how do we keep a site static and still allow users to interact with blog
40		posts? The key actually pretty simple - I'm already using PHP, so why not rely
41		on the classic HTML `<form>` and a PHP script to save the comments somewhere? As
42		it turns out, this was a perfect solution for me.
43
44		The second issue for my personal use-case is that I am trying to keep the
45		contents of my website accessible over time, as described by @brandur, in his
46		post entitled
47		[Blog with Markdown + Git, and degrade gracefully through time](https://brandur.org/fragments/graceful-degradation-time)
48		.
49
50		This means I cannot rely on a database for comments, since I do not rely on a
51		database for any other part of my websites.
52
53		I blog in plain Markdown files, commit all articles to Git, and ensure that
54		future readers will be able to see the source data long after I'm gone, or the
55		website has gone offline. However, I still haven't committed any images served
56		on my blog to Git, as I'm not entirely sold on Git LFS yet - for now, images can
57		be found at [img.cleberg.net](https://img.cleberg.net).
58
59		Saving my comments back to the Git repository ensures that another aspect of my
60		site will degrade gracefully.
61
62		## Create a Comment Form
63
64		Okay, let's get started. The first step is to create an HTML form that users can
65		see and utilize to submit comments. This is fairly easy and can be changed
66		depending on your personal preferences.
67
68		Take a look at the code block below for the form I currently use. Note that
69		`<current-url>` is replaced automatically in PHP with the current post's URL, so
70		that my PHP script used later will know which blog post the comment is related
71		to.
	18	- Facebook Comments
	19	- Discourse
	20
	21	There are some options that are better but still use too many scripts,
	22	frames, or social integrations on your web page that could impact some
	23	users:
	24
	25	- Disqus
	26	- Isso
	27	- Remark42
	28
	29	Lastly, I looked into a few unique ways of generating blog comments,
	30	such as using Twitter threads or GitHub issues to automatically post
	31	issues. However, these both rely on external third-party sites that I
	32	don't currently use.
	33
	34	** Stay Static with Server-Side Comments
	35	:PROPERTIES:
	36	:CUSTOM_ID: stay-static-with-server-side-comments
	37	:END:
	38	The main issue for my personal use-case is that my blog is completely,
	39	100% static. I use PHP on the back-end but website visitors only see
	40	HTML and a single CSS file. No external javascript and no embedded
	41	frames.
	42
	43	So, how do we keep a site static and still allow users to interact with
	44	blog posts? The key actually pretty simple - I'm already using PHP, so
	45	why not rely on the classic HTML =<form>= and a PHP script to save the
	46	comments somewhere? As it turns out, this was a perfect solution for me.
	47
	48	The second issue for my personal use-case is that I am trying to keep
	49	the contents of my website accessible over time, as described by
	50	[cite/t:@brandur], in his post entitled
	51	[[https://brandur.org/fragments/graceful-degradation-time][Blog with
	52	Markdown + Git, and degrade gracefully through time]] .
	53
	54	This means I cannot rely on a database for comments, since I do not rely
	55	on a database for any other part of my websites.
	56
	57	I blog in plain Markdown files, commit all articles to Git, and ensure
	58	that future readers will be able to see the source data long after I'm
	59	gone, or the website has gone offline. However, I still haven't
	60	committed any images served on my blog to Git, as I'm not entirely sold
	61	on Git LFS yet - for now, images can be found at
	62	[[https://img.cleberg.net][img.cleberg.net]].
	63
	64	Saving my comments back to the Git repository ensures that another
	65	aspect of my site will degrade gracefully.
	66
	67	** Create a Comment Form
	68	:PROPERTIES:
	69	:CUSTOM_ID: create-a-comment-form
	70	:END:
	71	Okay, let's get started. The first step is to create an HTML form that
	72	users can see and utilize to submit comments. This is fairly easy and
	73	can be changed depending on your personal preferences.
	74
	75	Take a look at the code block below for the form I currently use. Note
	76	that =<current-url>= is replaced automatically in PHP with the current
	77	post's URL, so that my PHP script used later will know which blog post
	78	the comment is related to.
72	79
73	80	The form contains the following structure:
74	81
75		1. `<form>` - This is the form and will determine which PHP script to send the
76		comment to.
77		2. `<section hidden>` - This section is hidden from the user and is used to
78		ensure that we know which blog post sent the comment.
79		3. `<section>` Display Name (Optional) - Used to accept a display name, if
80		entered.
81		4. `<section>` Comment (Required) - Used to accept the user's full comment.
82		Markdown is allowed.
83		5. `<button>` - A button to submit the form.
84
85		```html
	82	1. =<form>= - This is the form and will determine which PHP script to
	83	send the comment to.
	84	2. =<section hidden>= - This section is hidden from the user and is used
	85	to ensure that we know which blog post sent the comment.
	86	3. =<section>= Display Name (Optional) - Used to accept a display name,
	87	if entered.
	88	4. =<section>= Comment (Required) - Used to accept the user's full
	89	comment. Markdown is allowed.
	90	5. =<button>= - A button to submit the form.
	91
	92	#+begin_src html
86	93	<form action="/comment.php" method="POST">
87		<h3>Leave a Comment</h3>
88		<section hidden>
89		<label class="form-label" for="postURL">Post URL</label>
90		<input
91		class="form-control"
92		id="postURL"
93		name="postURL"
94		type="text"
95		value="<current-url>"
96		/>
97		</section>
98		<section>
99		<label class="form-label" for="userName">Display Name</label>
100		<input
101		class="form-control"
102		id="userName"
103		name="userName"
104		placeholder="John Doe"
105		type="text"
106		/>
107		</section>
108		<section>
109		<label class="form-label" for="userContent">Your Comment</label>
110		<textarea
111		class="form-control"
112		id="userContent"
113		name="userContent"
114		rows="3"
115		placeholder="# Feel free to use Markdown"
116		aria-describedby="commentHelp"
117		required
118		></textarea>
119		<div id="commentHelp" class="form-text">
120		Comments are saved as Markdown and cannot be edited or deleted.
121		</div>
122		</section>
123		<button type="submit">Submit</button>
	94	<h3>Leave a Comment</h3>
	95	<section hidden>
	96	<label class="form-label" for="postURL">Post URL</label>
	97	<input
	98	class="form-control"
	99	id="postURL"
	100	name="postURL"
	101	type="text"
	102	value="<current-url>"
	103	/>
	104	</section>
	105	<section>
	106	<label class="form-label" for="userName">Display Name</label>
	107	<input
	108	class="form-control"
	109	id="userName"
	110	name="userName"
	111	placeholder="John Doe"
	112	type="text"
	113	/>
	114	</section>
	115	<section>
	116	<label class="form-label" for="userContent">Your Comment</label>
	117	<textarea
	118	class="form-control"
	119	id="userContent"
	120	name="userContent"
	121	rows="3"
	122	placeholder="# Feel free to use Markdown"
	123	aria-describedby="commentHelp"
	124	required
	125	></textarea>
	126	<div id="commentHelp" class="form-text">
	127	Comments are saved as Markdown and cannot be edited or deleted.
	128	</div>
	129	</section>
	130	<button type="submit">Submit</button>
124	131	</form>
125		```
126
127		## Handle Comments via POST
	132	#+end_src
128	133
129		Now that we have a form and can submit comments, we need to create a PHP script
130		so that the server can fetch the comment data and save it. Make sure your PHP
131		script name matches the name you entered in the `action` field in your form.
	134	** Handle Comments via POST
	135	:PROPERTIES:
	136	:CUSTOM_ID: handle-comments-via-post
	137	:END:
	138	Now that we have a form and can submit comments, we need to create a PHP
	139	script so that the server can fetch the comment data and save it. Make
	140	sure your PHP script name matches the name you entered in the =action=
	141	field in your form.
132	142
133		See the code block below for the contents of my `comment.php` script. We perform
134		the following tasks in this script:
	143	See the code block below for the contents of my =comment.php= script. We
	144	perform the following tasks in this script:
135	145
136	146	1. Grab the POST data from the HTML form.
137		2. Sanitize the comment data with `htmlentities`.
138		3. Set the display name to `Anonymous` if it was left blank.
	147	2. Sanitize the comment data with =htmlentities=.
	148	3. Set the display name to =Anonymous= if it was left blank.
139	149	4. Create a PHP object that combines all of this data.
140		5. Check if our destination file `comments.json` exists.
	150	5. Check if our destination file =comments.json= exists.
141	151	6. If so, convert the PHP object to JSON and save it to the file.
142		7. If the `comments.json` file does not exist, the script will exit with an
143		error. You can alter this to ensure it creates the script, but my source code
144		includes the file by default, so it will always exist.
145		8. Finally, send the user back to the `#comments` section of the blog post they
146		just read.
	152	7. If the =comments.json= file does not exist, the script will exit with
	153	an error. You can alter this to ensure it creates the script, but my
	154	source code includes the file by default, so it will always exist.
	155	8. Finally, send the user back to the =#comments= section of the blog
	156	post they just read.
147	157
148		```php
	158	#+begin_src php
149	159	// Get the content sent from the comment form
150	160	$comment = htmlentities($_POST['userContent']);
151	161	$post_url = $_POST['postURL'];
		@@ -180,30 +190,35 @@ if (file_exists($file_name)) {
180	190
181	191	// Send the user back
182	192	header('Location: ' . $post_url . '#comments');
183		```
	193	#+end_src
184	194
185		If you're using Apache, make sure the `www-data` user on your server has the
186		correct permissions to your website directory or else it will not be able to
187		write to `comments.json`.
	195	If you're using Apache, make sure the =www-data= user on your server has
	196	the correct permissions to your website directory or else it will not be
	197	able to write to =comments.json=.
188	198
189		```sh
	199	#+begin_src sh
190	200	chgrp -R www-data /path/to/website/
191	201	chmod -R g+w comments.json
192		```
193
194		## Display User Comments
195
196		Now that we can submit comments, and they are saved to the `comments.json` file,
197		let's make sure we can show those comments in each blog post.
198
199		The code block below shows the function I use to decode my `comments.json` file,
200		check if the comments apply to the current post, and then display them.
201
202		This piece of code should really be inside a function (or at least in an
203		organized PHP workflow). Don't just copy-and-paste and expect it to work. You
204		need to at least supply a `$query` variable depending on the page visited.
205
206		```php
	202	#+end_src
	203
	204	** Display User Comments
	205	:PROPERTIES:
	206	:CUSTOM_ID: display-user-comments
	207	:END:
	208	Now that we can submit comments, and they are saved to the
	209	=comments.json= file, let's make sure we can show those comments in each
	210	blog post.
	211
	212	The code block below shows the function I use to decode my
	213	=comments.json= file, check if the comments apply to the current post,
	214	and then display them.
	215
	216	This piece of code should really be inside a function (or at least in
	217	an organized PHP workflow). Don't just copy-and-paste and expect it to
	218	work. You need to at least supply a =$query= variable depending on the
	219	page visited.
	220
	221	#+begin_src php
207	222	$query = 'your-blog-post.html';
208	223
209	224	// Load saved comments
		@@ -235,28 +250,35 @@ foreach ($comments as $comment) {
235	250	}
236	251
237	252	echo $comment_section;
238		```
239
240		## Bonus: Create a 'Recent Comments' Page
241
242		Finally, the last part of my current system is to create a Recent Comments page
243		so that I can easily check-in on my blog and moderate any spam. As an
244		alternative, you could use PHP's `mail()` function to email you for each blog
245		comment.
246
247		The code to do this is literally the same code as the previous section, I just
248		make sure it is printed when someone visits `https://example.com/comments/`.
249
250		## Possible Enhancements
251
252		This comment system is by no means a fully-developed system. I have noted a few
253		possible enhancements here that I may implement in the future:
254
255		- Create a secure moderator page with user authentication at
256		`https://blog.example.com/mod/`. This page could have the option to edit or
257		delete any comment found in `comments.json`.
258		- Create a temporary file, such as `pending_comments.json`, that will store
259		newly-submitted comments and won't display on blog posts until approved by a
260		moderator.
261		- Create a `/modlog/` page with a chronological log, showing which moderator
262		approved which comments and why certain comments were rejected.
	253	#+end_src
	254
	255	** Bonus: Create a 'Recent Comments' Page
	256	:PROPERTIES:
	257	:CUSTOM_ID: bonus-create-a-recent-comments-page
	258	:END:
	259	Finally, the last part of my current system is to create a Recent
	260	Comments page so that I can easily check-in on my blog and moderate any
	261	spam. As an alternative, you could use PHP's =mail()= function to email
	262	you for each blog comment.
	263
	264	The code to do this is literally the same code as the previous section,
	265	I just make sure it is printed when someone visits
	266	=https://example.com/comments/=.
	267
	268	** Possible Enhancements
	269	:PROPERTIES:
	270	:CUSTOM_ID: possible-enhancements
	271	:END:
	272	This comment system is by no means a fully-developed system. I have
	273	noted a few possible enhancements here that I may implement in the
	274	future:
	275
	276	- Create a secure moderator page with user authentication at
	277	=https://blog.example.com/mod/=. This page could have the option to
	278	edit or delete any comment found in =comments.json=.
	279	- Create a temporary file, such as =pending_comments.json=, that will
	280	store newly-submitted comments and won't display on blog posts until
	281	approved by a moderator.
	282	- Create a =/modlog/= page with a chronological log, showing which
	283	moderator approved which comments and why certain comments were
	284	rejected.

blog/2021-04-28-photography.org +60 −52

		@@ -1,67 +1,75 @@
1		+++
2		date = 2021-04-28
3		title = "Jumping Back Into Photography"
4		description = "After a long respite, I have returned to my hobby of photography with a brand-new camera."
5		draft = false
6		+++
7
8		## Why Photography?
	1	#+title: Jumping Back Into Photography
	2	#+date: 2021-04-28
9	3
	4	** Why Photography?
	5	:PROPERTIES:
	6	:CUSTOM_ID: why-photography
	7	:END:
10	8	I've often wondered why photography is as enticing as it is. You can see
11		billions of people around the world taking photographs every single moment of
12		the day. New technology often boasts about their photographic capabilities,
13		especially smartphones. I would even assume that we live in a world where there
14		is never a moment in which a photograph is not being taken somewhere on Earth.
15
16		As for myself, I would simply say that I enjoy preserving a memory in physical
17		(or digital) form. I've never had the best memory when it comes to recalling
18		details of places and people gone by, so it helps to have a frame of reference
19		lying around.
20
21		Regardless of the reason, I think most people would agree that you simply cannot
22		have too many hobbies.
	9	billions of people around the world taking photographs every single
	10	moment of the day. New technology often boasts about their photographic
	11	capabilities, especially smartphones. I would even assume that we live
	12	in a world where there is never a moment in which a photograph is not
	13	being taken somewhere on Earth.
23	14
24		## Older Cameras
	15	As for myself, I would simply say that I enjoy preserving a memory in
	16	physical (or digital) form. I've never had the best memory when it comes
	17	to recalling details of places and people gone by, so it helps to have a
	18	frame of reference lying around.
25	19
26		I started playing around with the idea of photography when my family purchased a
27		Fujifilm camera for family-specific events. I don't recall the specific model,
28		but I do recall it was a point-and-shoot camera without an interchangeable lens.
29		However, it was of great value to someone, like myself, who couldn't afford any
30		other camera. I took about 10,000 shots with that camera over a 3-5 year span.
31		Most notably, all of my trips to California were documented through this camera.
	20	Regardless of the reason, I think most people would agree that you
	21	simply cannot have too many hobbies.
32	22
33		When possible, I would borrow my sister's camera, which is a Sony SLT-A58. This
34		camera was great and allowed for some of my best early shots, especially those
35		taken in Utah's and Nevada's parks.
	23	** Older Cameras
	24	:PROPERTIES:
	25	:CUSTOM_ID: older-cameras
	26	:END:
	27	I started playing around with the idea of photography when my family
	28	purchased a Fujifilm camera for family-specific events. I don't recall
	29	the specific model, but I do recall it was a point-and-shoot camera
	30	without an interchangeable lens. However, it was of great value to
	31	someone, like myself, who couldn't afford any other camera. I took about
	32	10,000 shots with that camera over a 3-5 year span. Most notably, all of
	33	my trips to California were documented through this camera.
36	34
37		## My Current Kit
	35	When possible, I would borrow my sister's camera, which is a Sony
	36	SLT-A58. This camera was great and allowed for some of my best early
	37	shots, especially those taken in Utah's and Nevada's parks.
38	38
39		I've finally come to a point in my life where I have the disposable income to
40		invest in a solid photography kit. I played around with the idea of a lot of
41		different cameras, different types, new vs used, etc. Finally, I settled on the
42		[Sony α7 III](https://en.wikipedia.org/wiki/Sony_%CE%B17_III). This camera is
43		mirror-less and uses a full-frame image sensor at 24 megapixels. I don't create
44		large prints, and I am mostly focused on preserving memories in high quality for
45		the next 5-10 years with this camera, so the specifications here are just
46		perfect for me.
	39	** My Current Kit
	40	:PROPERTIES:
	41	:CUSTOM_ID: my-current-kit
	42	:END:
	43	I've finally come to a point in my life where I have the disposable
	44	income to invest in a solid photography kit. I played around with the
	45	idea of a lot of different cameras, different types, new vs used, etc.
	46	Finally, I settled on the
	47	[[https://en.wikipedia.org/wiki/Sony_%CE%B17_III][Sony α7 III]]. This
	48	camera is mirror-less and uses a full-frame image sensor at 24
	49	megapixels. I don't create large prints, and I am mostly focused on
	50	preserving memories in high quality for the next 5-10 years with this
	51	camera, so the specifications here are just perfect for me.
47	52
48	53	For lenses, I decided to buy two lenses that could carry me through most
49	54	situations:
50	55
51		- [Vario-Tessar T\* FE 24-70 mm F4 ZA OSS](https://electronics.sony.com/imaging/lenses/full-frame-e-mount/p/sel2470z)
52		- [Tamron 70-300mm f4.5-6.3 Di III RXD](https://www.tamron-usa.com/product/lenses/a047.html)
	56	- [[https://electronics.sony.com/imaging/lenses/full-frame-e-mount/p/sel2470z][Vario-Tessar
	57	T* FE 24-70 mm F4 ZA OSS]]
	58	- [[https://www.tamron-usa.com/product/lenses/a047.html][Tamron 70-300mm
	59	f4.5-6.3 Di III RXD]]
53	60
54	61	In addition, I grabbed a couple
55		[HGX Prime 67mm](https://www.promaster.com/Product/6725) protection filters for
56		the lenses.
	62	[[https://www.promaster.com/Product/6725][HGX Prime 67mm]] protection
	63	filters for the lenses.
57	64
58		As I delve further into photography and pick up more skills, I will most likely
59		go back and grab a lens with a higher f-stop value, such as f/1.8. I toyed with
60		the idea of grabbing a 50 mm at `f/1.8`, but decided to keep things in a
61		reasonable price range instead.
	65	As I delve further into photography and pick up more skills, I will most
	66	likely go back and grab a lens with a higher f-stop value, such as
	67	f/1.8. I toyed with the idea of grabbing a 50 mm at =f/1.8=, but decided
	68	to keep things in a reasonable price range instead.
62	69
63		Finally, I made sure to buy a photography-specific backpack with a rain guard,
64		and the zipper on the back panel, to protect the equipment while wearing the
65		bag. If you've ever had to haul around a DSLR (or camera of similar heft) in a
66		bag that only has a shoulder strap, you'll know the pain it can cause. Putting
67		all my equipment in a backpack was an easy decision.
	70	Finally, I made sure to buy a photography-specific backpack with a rain
	71	guard, and the zipper on the back panel, to protect the equipment while
	72	wearing the bag. If you've ever had to haul around a DSLR (or camera of
	73	similar heft) in a bag that only has a shoulder strap, you'll know the
	74	pain it can cause. Putting all my equipment in a backpack was an easy
	75	decision.

blog/2021-05-30-changing-git-authors.org +26 −28

		@@ -1,33 +1,31 @@
1		+++
2		date = 2021-05-30
3		title = "Changing Git Authors"
4		description = "Learn how to haphazardly replace Git authors and/or emails within the Git history."
5		+++
6
7		## Changing Git Author/Email Based on Previously Committed Email
8
9		Here's the dilemma: You've been committing changes to your git repository with
10		an incorrect name or email (or multiple repositories), and now you want to fix
11		it.
12		Luckily, there's a semi-reliable way to fix that.
13		While I have never experienced issues with this method, some people have
14		warned that it can mess with historical hashes and integrity of commits, so
15		use this method only if you're okay accepting that risk.
	1	#+title: Changing Git Authors
	2	#+date: 2021-05-30
	3
	4	** Changing Git Author/Email Based on Previously Committed Email
	5	:PROPERTIES:
	6	:CUSTOM_ID: changing-git-authoremail-based-on-previously-committed-email
	7	:END:
	8	Here's the dilemma: You've been committing changes to your git
	9	repository with an incorrect name or email (or multiple repositories),
	10	and now you want to fix it. Luckily, there's a semi-reliable way to fix
	11	that. While I have never experienced issues with this method, some
	12	people have warned that it can mess with historical hashes and integrity
	13	of commits, so use this method only if you're okay accepting that risk.
16	14
17	15	Okay, let's create the bash script:
18	16
19		```sh
	17	#+begin_src sh
20	18	nano change_git_authors.sh
21		```
	19	#+end_src
22	20
23		The following information can be pasted directly into your bash script. The only
24		changes you need to make are to the following variables:
	21	The following information can be pasted directly into your bash script.
	22	The only changes you need to make are to the following variables:
25	23
26		- `OLD_EMAIL`
27		- `CORRECT_NAME`
28		- `CORRECT_EMAIL`
	24	- =OLD_EMAIL=
	25	- =CORRECT_NAME=
	26	- =CORRECT_EMAIL=
29	27
30		```sh
	28	#+begin_src sh
31	29	#!/bin/sh
32	30
33	31	# List all sub-directories in the current directory
		@@ -60,16 +58,16 @@ do
60	58
61	59	cd ..
62	60	done
63		```
	61	#+end_src
64	62
65	63	Finally, save the bash script and make it executable.
66	64
67		```sh
	65	#+begin_src sh
68	66	chmod a+x change_git_authors.sh
69		```
	67	#+end_src
70	68
71	69	Now you can run the script and should see the process begin.
72	70
73		```sh
	71	#+begin_src sh
74	72	./change_git_authors.sh
75		```
	73	#+end_src

blog/2021-07-15-delete-gitlab-repos.org +54 −49

		@@ -1,53 +1,57 @@
1		+++
2		date = 2021-07-15
3		title = "How to Delete All GitLab Repositories"
4		description = "Learn how to delete all GitLab repositories in your user account."
5		draft = false
6		+++
7
8		## Background
9
10		Have you ever used GitLab to host your source code, moved to a different host,
11		and wanted to delete everything from your GitLab account?
12		Well, this post covers any scenario where you would want to delete all
	1	#+title: How to Delete All GitLab Repositories
	2	#+date: 2021-07-15
	3
	4	** Background
	5	:PROPERTIES:
	6	:CUSTOM_ID: background
	7	:END:
	8	Have you ever used GitLab to host your source code, moved to a different
	9	host, and wanted to delete everything from your GitLab account? Well,
	10	this post covers any scenario where you would want to delete all
13	11	repositories from your GitLab account.
14	12
15		For me, I currently maintain around 30 repositories and don't like to manually
16		delete them whenever I switch host.
17		GitHub has a few different tools online to delete all repositories for you,
18		but I have not found anything similar for GitLab, so I needed an alternative
19		solution.
20
21		## Use a Python Script
22
23		### Requirements
24
25		Before we look at the script, make sure you know your GitLab username. Next,
26		[create an authorization token](https://gitlab.com/-/profile/personal_access_tokens)
27		so that the Python script can delete your repositories. Don't lose this token or
28		else you'll need to create a new one.
29
30		### Create the Script
31
32		To run a Python script, you must first create it. Open a terminal and enter the
33		following commands in whichever directory you prefer to store the script. You
34		can do the same things in a file manager if you prefer.
35
36		```sh
	13	For me, I currently maintain around 30 repositories and don't like to
	14	manually delete them whenever I switch host. GitHub has a few different
	15	tools online to delete all repositories for you, but I have not found
	16	anything similar for GitLab, so I needed an alternative solution.
	17
	18	** Use a Python Script
	19	:PROPERTIES:
	20	:CUSTOM_ID: use-a-python-script
	21	:END:
	22	*** Requirements
	23	:PROPERTIES:
	24	:CUSTOM_ID: requirements
	25	:END:
	26	Before we look at the script, make sure you know your GitLab username.
	27	Next, [[https://gitlab.com/-/profile/personal_access_tokens][create an
	28	authorization token]] so that the Python script can delete your
	29	repositories. Don't lose this token or else you'll need to create a new
	30	one.
	31
	32	*** Create the Script
	33	:PROPERTIES:
	34	:CUSTOM_ID: create-the-script
	35	:END:
	36	To run a Python script, you must first create it. Open a terminal and
	37	enter the following commands in whichever directory you prefer to store
	38	the script. You can do the same things in a file manager if you prefer.
	39
	40	#+begin_src sh
37	41	mkdir delete-gitlab
38		```
	42	#+end_src
39	43
40		```sh
	44	#+begin_src sh
41	45	cd delete-gitlab
42		```
	46	#+end_src
43	47
44		```sh
	48	#+begin_src sh
45	49	nano main.py
46		```
	50	#+end_src
47	51
48		Enter the following code into your `main.py` script.
	52	Enter the following code into your =main.py= script.
49	53
50		```python
	54	#+begin_src python
51	55	import request
52	56	import json
53	57
		@@ -101,15 +105,16 @@ def main():
101	105
102	106	if __name__ == "__main__":
103	107	main()
104		```
	108	#+end_src
105	109
106		Now that you have the proper information, replace `{user-id}` with your GitLab
107		username and `{auth-token}` with the authorization token you created earlier.
	110	Now that you have the proper information, replace ={user-id}= with your
	111	GitLab username and ={auth-token}= with the authorization token you
	112	created earlier.
108	113
109		Finally, simply run the script and watch the output. You can also use PyCharm
110		Community Edition to edit and run the Python script if you don't want to work
111		in a terminal.
	114	Finally, simply run the script and watch the output. You can also use
	115	PyCharm Community Edition to edit and run the Python script if you don't
	116	want to work in a terminal.
112	117
113		```sh
	118	#+begin_src sh
114	119	python3 main.py
115		```
	120	#+end_src

blog/2021-08-25-audit-sampling.org +154 −139

		@@ -1,52 +1,55 @@
1		+++
2		date = 2021-08-25
3		title = "Audit Sampling with Python"
4		description = "Learn how to use Python to automate the boring parts of audit sampling."
5		draft = false
6		+++
7
8		## Introduction
	1	#+title: Audit Sampling with Python
	2	#+date: 2021-08-25
9	3
	4	** Introduction
	5	:PROPERTIES:
	6	:CUSTOM_ID: introduction
	7	:END:
10	8	For anyone who is familiar with internal auditing, external auditing, or
11		consulting, you will understand how tedious audit testing can become when you
12		are required to test large swaths of data. When we cannot establish an automated
13		means of testing an entire population, we generate samples to represent the
14		population of data. This helps ensure we can have a small enough data pool to
15		test and that our results still represent the population.
16
17		However, sampling data within the world of audit still seems to confuse quite a
18		lot of people. While some audit-focused tools have introduced sampling
19		functionality (e.g. Wdesk), many audit departments and firms cannot use software
20		like this due to certain constraints, such as the team's budget or knowledge.
21		Here is where this article comes in: we're going to use
22		[Python](https://www.python.org), a free and open-source programming language,
23		to generate random samples from a dataset in order to suffice numerous audit
24		situations.
25
26		## Audit Requirements for Sampling
27
28		Before we get into the details of how to sample with Python, I want to make sure
29		I discuss the different requirements that auditors may have of samples used
30		within their projects.
31
32		### Randomness
33
34		First, let's discuss randomness. When testing out new technology to help assist
35		with audit sampling, you need to understand exactly how your samples are being
36		generated. For example, if the underlying function is just picking every 57th
37		element from a list, that's not truly random; it's a systematic form of
38		sampling. Luckily, since Python is open-source, we have access to its codebase.
39		Through this blog post, I will be using the [pandas](https://pandas.pydata.org)
40		module in order to generate the random samples. More specifically, I will be
41		using the
42		[pandas.DataFrame.sample](https://pandas.pydata.org/pandas-docs/stable/reference/api/pandas.DataFrame.sample.html)
	9	consulting, you will understand how tedious audit testing can become
	10	when you are required to test large swaths of data. When we cannot
	11	establish an automated means of testing an entire population, we
	12	generate samples to represent the population of data. This helps ensure
	13	we can have a small enough data pool to test and that our results still
	14	represent the population.
	15
	16	However, sampling data within the world of audit still seems to confuse
	17	quite a lot of people. While some audit-focused tools have introduced
	18	sampling functionality (e.g. Wdesk), many audit departments and firms
	19	cannot use software like this due to certain constraints, such as the
	20	team's budget or knowledge. Here is where this article comes in: we're
	21	going to use [[https://www.python.org][Python]], a free and open-source
	22	programming language, to generate random samples from a dataset in order
	23	to suffice numerous audit situations.
	24
	25	** Audit Requirements for Sampling
	26	:PROPERTIES:
	27	:CUSTOM_ID: audit-requirements-for-sampling
	28	:END:
	29	Before we get into the details of how to sample with Python, I want to
	30	make sure I discuss the different requirements that auditors may have of
	31	samples used within their projects.
	32
	33	*** Randomness
	34	:PROPERTIES:
	35	:CUSTOM_ID: randomness
	36	:END:
	37	First, let's discuss randomness. When testing out new technology to help
	38	assist with audit sampling, you need to understand exactly how your
	39	samples are being generated. For example, if the underlying function is
	40	just picking every 57th element from a list, that's not truly random;
	41	it's a systematic form of sampling. Luckily, since Python is
	42	open-source, we have access to its codebase. Through this blog post, I
	43	will be using the [[https://pandas.pydata.org][pandas]] module in order
	44	to generate the random samples. More specifically, I will be using the
	45	[[https://pandas.pydata.org/pandas-docs/stable/reference/api/pandas.DataFrame.sample.html][pandas.DataFrame.sample]]
43	46	function provided by Pandas.
44	47
45		Now that you know what you're using, you can always check out the code behind
46		`pandas.DataFrame.sample`. This function does a lot of work, but we really only
47		care about the following snippets of code:
	48	Now that you know what you're using, you can always check out the code
	49	behind =pandas.DataFrame.sample=. This function does a lot of work, but
	50	we really only care about the following snippets of code:
48	51
49		```python
	52	#+begin_src python
50	53	# Process random_state argument
51	54	rs = com.random_state(random_state)
52	55
		@@ -58,45 +61,45 @@ if ignore_index:
58	61	result.index = ibase.default_index(len(result))
59	62
60	63	return result
61		```
62
63		The block of code above shows you that if you assign a `random_state`
64		argument when you run the function, that will be used as a seed number in
65		the random generation and will allow you to reproduce a sample, given that
66		nothing else changes.
67		This is critical to the posterity of audit work.
68		After all, how can you say your audit process is adequately documented if
69		the next person can't run the code and get the same sample?
70		The final piece here on randomness is to look at the [choice](https://docs.
71		python.org/3/library/random.html#random.choice) function used above.
72		This is the crux of the generation and can also be examined for more
73		detailed analysis on its reliability.
74		As far as auditing goes, we will trust that these functions are
75		mathematically random.
76
77		### Sample Sizes
78
79		As mentioned in the intro, sampling is only an effective method of auditing
80		when it truly represents the entire population.
81		While some audit departments or firms may consider certain judgmental sample
82		sizes to be adequate, you may need to rely on statistically-significant
83		confidence levels of sample testing at certain points.
84		I will demonstrate both here.
85		For statistically-significant confidence levels, most people will assume a
86		90% - 99% confidence level.
87		In order to actually calculate the correct sample size, it is best to use
88		statistical tools due to the tedious math work required.
89		For example, for a population of 1000, and a 90% confidence level that no
90		more than 5% of the items are nonconforming, you would sample 45 items.
91
92		However, in my personal experience, many audit departments and firms do not use
93		statistical sampling. Most people use a predetermined, often proprietary, table
94		that will instruct auditors which sample sizes to choose. This allows for
95		uniform testing and reduces overall workload. See the table below for a common
96		implementation of sample sizes:
	64	#+end_src
	65
	66	The block of code above shows you that if you assign a =random_state=
	67	argument when you run the function, that will be used as a seed number
	68	in the random generation and will allow you to reproduce a sample, given
	69	that nothing else changes. This is critical to the posterity of audit
	70	work. After all, how can you say your audit process is adequately
	71	documented if the next person can't run the code and get the same
	72	sample? The final piece here on randomness is to look at the
	73	[[https://docs.%20python.org/3/library/random.html#random.choice][choice]]
	74	function used above. This is the crux of the generation and can also be
	75	examined for more detailed analysis on its reliability. As far as
	76	auditing goes, we will trust that these functions are mathematically
	77	random.
	78
	79	*** Sample Sizes
	80	:PROPERTIES:
	81	:CUSTOM_ID: sample-sizes
	82	:END:
	83	As mentioned in the intro, sampling is only an effective method of
	84	auditing when it truly represents the entire population. While some
	85	audit departments or firms may consider certain judgmental sample sizes
	86	to be adequate, you may need to rely on statistically-significant
	87	confidence levels of sample testing at certain points. I will
	88	demonstrate both here. For statistically-significant confidence levels,
	89	most people will assume a 90% - 99% confidence level. In order to
	90	actually calculate the correct sample size, it is best to use
	91	statistical tools due to the tedious math work required. For example,
	92	for a population of 1000, and a 90% confidence level that no more than
	93	5% of the items are nonconforming, you would sample 45 items.
	94
	95	However, in my personal experience, many audit departments and firms do
	96	not use statistical sampling. Most people use a predetermined, often
	97	proprietary, table that will instruct auditors which sample sizes to
	98	choose. This allows for uniform testing and reduces overall workload.
	99	See the table below for a common implementation of sample sizes:
97	100
98	101	\| Control Frequency \| Sample Size - High Risk \| Sample Size - Low Risk \|
99		\|-------------------\|-------------------------\|------------------------\|
	102	\|-------------------+-------------------------+------------------------\|
100	103	\| More Than Daily \| 40 \| 25 \|
101	104	\| Daily \| 40 \| 25 \|
102	105	\| Weekly \| 12 \| 5 \|
		@@ -106,23 +109,27 @@ implementation of sample sizes:
106	109	\| Annually \| 1 \| 1 \|
107	110	\| Ad-hoc \| 1 \| 1 \|
108	111
109		## Sampling with Python & Pandas
110
111		In this section, I am going to cover a few basic audit situations that require
112		sampling. While some situations may require more effort, the syntax,
113		organization, and intellect used remain largely the same. If you've never used
114		Python before, note that lines starting with a '`#`' symbol are called comments,
115		and they will be skipped by Python. I highly recommend taking a quick tutorial
116		online to understand the basics of Python if any of the code below is confusing
117		to you.
118
119		### Simple Random Sample
120
121		First, let's look at a simple, random sample. The code block below will import
122		the `pandas` module, load a data file, sample the data, and export the sample to
123		a file.
124
125		```python
	112	** Sampling with Python & Pandas
	113	:PROPERTIES:
	114	:CUSTOM_ID: sampling-with-python-pandas
	115	:END:
	116	In this section, I am going to cover a few basic audit situations that
	117	require sampling. While some situations may require more effort, the
	118	syntax, organization, and intellect used remain largely the same. If
	119	you've never used Python before, note that lines starting with a '=#='
	120	symbol are called comments, and they will be skipped by Python. I highly
	121	recommend taking a quick tutorial online to understand the basics of
	122	Python if any of the code below is confusing to you.
	123
	124	*** Simple Random Sample
	125	:PROPERTIES:
	126	:CUSTOM_ID: simple-random-sample
	127	:END:
	128	First, let's look at a simple, random sample. The code block below will
	129	import the =pandas= module, load a data file, sample the data, and
	130	export the sample to a file.
	131
	132	#+begin_src python
126	133	# Import the Pandas module
127	134	import pandas
128	135
		@@ -140,14 +147,16 @@ sample = df.sample(n=25, random_state=0)
140	147
141	148	# Save the sample to Excel
142	149	sample.to_excel(file_output)
143		```
	150	#+end_src
144	151
145		### Simple Random Sample: Using Multiple Input Files
	152	*** Simple Random Sample: Using Multiple Input Files
	153	:PROPERTIES:
	154	:CUSTOM_ID: simple-random-sample-using-multiple-input-files
	155	:END:
	156	Now that we've created a simple sample, let's create a sample from
	157	multiple files.
146	158
147		Now that we've created a simple sample, let's create a sample from multiple
148		files.
149
150		```python
	159	#+begin_src python
151	160	# Import the Pandas module
152	161	import pandas
153	162
		@@ -174,15 +183,17 @@ sample = pandas.concat([sample_01, sample_02, sample_03], ignore_index=True)
174	183
175	184	# Save the sample to Excel
176	185	sample.to_excel(file_output)
177		```
178
179		### Stratified Random Sample
	186	#+end_src
180	187
181		Well, what if you need to sample distinct parts of a single file? For example,
182		let's write some code to separate our data by "Region" and sample those regions
183		independently.
	188	*** Stratified Random Sample
	189	:PROPERTIES:
	190	:CUSTOM_ID: stratified-random-sample
	191	:END:
	192	Well, what if you need to sample distinct parts of a single file? For
	193	example, let's write some code to separate our data by "Region" and
	194	sample those regions independently.
184	195
185		```python
	196	#+begin_src python
186	197	# Import the Pandas module
187	198	import pandas
188	199
		@@ -208,16 +219,18 @@ sample = pandas.concat([sample_east, sample_west], ignore_index=True)
208	219
209	220	# Save the sample to Excel
210	221	sample.to_excel(file_output)
211		```
212
213		### Stratified Systematic Sample
214
215		This next example is quite useful if you need audit coverage over a certain time
216		period. This code will generate samples for each month in the data and combine
217		them all together at the end. Obviously, this code can be modified to stratify
218		by something other than months, if needed.
219
220		```python
	222	#+end_src
	223
	224	*** Stratified Systematic Sample
	225	:PROPERTIES:
	226	:CUSTOM_ID: stratified-systematic-sample
	227	:END:
	228	This next example is quite useful if you need audit coverage over a
	229	certain time period. This code will generate samples for each month in
	230	the data and combine them all together at the end. Obviously, this code
	231	can be modified to stratify by something other than months, if needed.
	232
	233	#+begin_src python
221	234	# Import the Pandas module
222	235	import pandas
223	236
		@@ -257,21 +270,23 @@ def monthly_stratified_sample(df: pandas.DataFrame, date_column: str, num_select
257	270	sample_size = 3
258	271	sample = monthly_stratified_sample(df, 'Date of Sale', sample_size)
259	272	sample.to_excel(file_output)
260		```
261
262		## Documenting the Results
263
264		Once you've generated a proper sample, there are a few things left to do in
265		order to properly ensure your process is reproducible.
266
267		1. Document the sample. Make sure the resulting file is readable and includes
268		the documentation listed in the next bullet.
269		2. Include documentation around the data source, extraction techniques, any
270		modifications made to the data, and be sure to include a copy of the script
271		itself.
272		3. Whenever possible, perform a completeness and accuracy test to ensure your
273		sample is coming from a complete and accurate population. To ensure
274		completeness, compare the record count from the data source to the record
275		count loaded into Python. To ensure accuracy, test a small sample against the
276		source data (e.g., test 5 sales against the database to see if the details are
277		accurate).
	273	#+end_src
	274
	275	** Documenting the Results
	276	:PROPERTIES:
	277	:CUSTOM_ID: documenting-the-results
	278	:END:
	279	Once you've generated a proper sample, there are a few things left to do
	280	in order to properly ensure your process is reproducible.
	281
	282	1. Document the sample. Make sure the resulting file is readable and
	283	includes the documentation listed in the next bullet.
	284	2. Include documentation around the data source, extraction techniques,
	285	any modifications made to the data, and be sure to include a copy of
	286	the script itself.
	287	3. Whenever possible, perform a completeness and accuracy test to ensure
	288	your sample is coming from a complete and accurate population. To
	289	ensure completeness, compare the record count from the data source to
	290	the record count loaded into Python. To ensure accuracy, test a small
	291	sample against the source data (e.g., test 5 sales against the
	292	database to see if the details are accurate).

blog/2021-10-09-apache-redirect.org +36 −34

		@@ -1,45 +1,47 @@
1		+++
2		date = 2021-10-10
3		title = "Apache Redirect HTML Files to a Directory"
4		description = "Learn how to conveniently rewrite certain Apache web file URLs to directories with the Apache web server."
5		draft = false
6		+++
7
8		## The Problem
9
10		After recently switching static site generators (SSG), my blog URLs changed with
11		no option to preserve the classic `.html` extension at the end of my blog
12		post URLs.
13
14		I really disliked using my old SSG ([Jekyll](https://jekyllrb.com)) and prefer
15		my new tool ([Zola](https://www.getzola.org)) much more, so I was determined to
16		figure out a way to get the proper redirect set up so that people who find my
17		posts online aren't constantly met by 404 errors.
18
19		## The Solution
20
	1	#+title: Apache Redirect HTML Files to a Directory
	2	#+date: 2021-10-10
	3
	4	** The Problem
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-problem
	7	:END:
	8	After recently switching static site generators (SSG), my blog URLs
	9	changed with no option to preserve the classic =.html= extension at the
	10	end of my blog post URLs.
	11
	12	I really disliked using my old SSG ([[https://jekyllrb.com][Jekyll]])
	13	and prefer my new tool ([[https://www.getzola.org][Zola]]) much more, so
	14	I was determined to figure out a way to get the proper redirect set up
	15	so that people who find my posts online aren't constantly met by 404
	16	errors.
	17
	18	** The Solution
	19	:PROPERTIES:
	20	:CUSTOM_ID: the-solution
	21	:END:
21	22	To solve this problem, I really needed to solve two pieces:
22	23
23		1. Redirect all blog post URL requests from `/blog/some-post.html` to
24		`/blog/some-post/`.
25		2. Ensure that no other `.html` files are redirected, such as `index.html`.
	24	1. Redirect all blog post URL requests from =/blog/some-post.html= to
	25	=/blog/some-post/=.
	26	2. Ensure that no other =.html= files are redirected, such as
	27	=index.html=.
26	28
27		After _a lot_ of tweaking and testing, I believe I have finally found the
28		solution. The solution is shown below.
	29	After /a lot/ of tweaking and testing, I believe I have finally found
	30	the solution. The solution is shown below.
29	31
30		```config
	32	#+begin_src config
31	33	RewriteEngine On
32	34	RewriteCond %{REQUEST_URI} !\index.html$ [NC]
33	35	RewriteRule ^(.*).html$ https://example.com/$1 [R=301,L]
34		```
	36	#+end_src
35	37
36		This piece of code in the Apache `.conf` or `.htaccess` file will do the
	38	This piece of code in the Apache =.conf= or =.htaccess= file will do the
37	39	following:
38	40
39	41	1. Turn on the RewriteEngine so that we can modify URLs.
40		2. Ignore any `index.html` files from the rule we are about to specify.
41		3. Find any `.html` files within the website directory and redirect it to
42		exclude the file extension.
43		4. The final piece is adding the trailing slash (`/`) at the end of the URL -
44		you'll notice that I don't have an Apache rule for that since Apache handles
45		that automatically.
	42	2. Ignore any =index.html= files from the rule we are about to specify.
	43	3. Find any =.html= files within the website directory and redirect it
	44	to exclude the file extension.
	45	4. The final piece is adding the trailing slash (=/=) at the end of the
	46	URL - you'll notice that I don't have an Apache rule for that since
	47	Apache handles that automatically.

blog/2021-12-04-cisa.org +209 −182

		@@ -1,197 +1,224 @@
1		+++
2		date = 2021-12-04
3		title = "I Passed the CISA!"
4		description = "After nearly a year of on-and-off studying, I passed the CISA exam by ISACA."
5		draft = false
6		+++
7
8		## What is the CISA?
	1	#+title: I Passed the CISA!
	2	#+date: 2021-12-04
9	3
	4	** What is the CISA?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-the-cisa
	7	:END:
10	8	For those of you lucky enough not to be knee-deep in the world of IT/IS
11		Auditing, [CISA](https://www.isaca.org/credentialing/cisa) stands for Certified
12		Information Systems Auditor. This certification and exam are part of ISACA's
13		suite of certifications. As I often explain it to people like my family, it
14		basically means you're employed to use your knowledge of information systems,
15		regulations, common threats, risks, etc. in order to assess an organization's
16		current control of their risk. If a risk isn't controlled (and the company
17		doesn't want to accept the risk), an IS auditor will suggest implementing a
18		control to address that risk.
19
20		Now, the CISA certification itself is, in my opinion, the main certification for
21		this career. While certifications such as the CPA or CISSP are beneficial,
22		nothing matches the power of the CISA for an IS auditor when it comes to getting
23		hired, getting a raise/bonus, or earning respect in the field.
24
25		However, to be honest, I am a skeptic of most certifications. I understand the
26		value they hold in terms of how much you need to commit to studying or learning
27		on the job, as well as the market value for certifications such as the CISA.
28		But I also have known some very ~~incompetent~~ _less than stellar_ auditors
29		who have CPAs, CISAs, CIAs, etc.
30
31		The same goes for most industries: if a person is good at studying, they can
32		earn the certification. However, that knowledge means nothing unless you're
33		actually able to use it in real life and perform as expected of a certification
34		holder. The challenge comes when people are hired or connected strictly because
35		of their certifications or resume; you need to see a person work before you can
36		assume them having a CISA means they're better than someone without the CISA.
37
38		Okay, rant over. Certifications are generally accepted as a measuring stick of
39		commitment and quality of an employee, so I am accepting it too.
40
41		## Exam Content
42
43		The CISA is broken down into five sections, each weighted with a percentage of
44		test questions that may appear.
45
46		![CISA exam sections](https://img.cleberg.net/blog/20211204-i-passed-the-cisa/cisa-exam-sections.png)
47
48		Since the exam contains 150 questions, here's how those sections break down:
49
50		\| Exam Section \| Percentage of Exam \| Questions \|
51		\|:---------------:\|:------------------:\|:---------:\|
52		\| 1 \| 21% \| 32 \|
53		\| 2 \| 17% \| 26 \|
54		\| 3 \| 12% \| 18 \|
55		\| 4 \| 23% \| 34 \|
56		\| 5 \| 27% \| 40 \|
57		\| Grand Total \| 100% \| 150 \|
58
59		## My Studying Habits
60
61		This part is a little hard for me to break down into specific detail due to the
62		craziness of the last year. While I officially purchased my studying materials
63		in December 2020 and opened them to "start studying" in January 2021, I really
64		wasn't able to study much due to the demands of my job and personal life.
	9	Auditing, [[https://www.isaca.org/credentialing/cisa][CISA]] stands for
	10	Certified Information Systems Auditor. This certification and exam are
	11	part of ISACA's suite of certifications. As I often explain it to people
	12	like my family, it basically means you're employed to use your knowledge
	13	of information systems, regulations, common threats, risks, etc. in
	14	order to assess an organization's current control of their risk. If a
	15	risk isn't controlled (and the company doesn't want to accept the risk),
	16	an IS auditor will suggest implementing a control to address that risk.
	17
	18	Now, the CISA certification itself is, in my opinion, the main
	19	certification for this career. While certifications such as the CPA or
	20	CISSP are beneficial, nothing matches the power of the CISA for an IS
	21	auditor when it comes to getting hired, getting a raise/bonus, or
	22	earning respect in the field.
	23
	24	However, to be honest, I am a skeptic of most certifications. I
	25	understand the value they hold in terms of how much you need to commit
	26	to studying or learning on the job, as well as the market value for
	27	certifications such as the CISA. But I also have known some very
	28	+incompetent+ /less than stellar/ auditors who have CPAs, CISAs, CIAs,
	29	etc.
	30
	31	The same goes for most industries: if a person is good at studying, they
	32	can earn the certification. However, that knowledge means nothing unless
	33	you're actually able to use it in real life and perform as expected of a
	34	certification holder. The challenge comes when people are hired or
	35	connected strictly because of their certifications or resume; you need
	36	to see a person work before you can assume them having a CISA means
	37	they're better than someone without the CISA.
	38
	39	Okay, rant over. Certifications are generally accepted as a measuring
	40	stick of commitment and quality of an employee, so I am accepting it
	41	too.
	42
	43	** Exam Content
	44	:PROPERTIES:
	45	:CUSTOM_ID: exam-content
	46	:END:
	47	The CISA is broken down into five sections, each weighted with a
	48	percentage of test questions that may appear.
	49
	50	#+caption: CISA exam sections
	51	[[https://img.cleberg.net/blog/20211204-i-passed-the-cisa/cisa-exam-sections.png]]
	52
	53	Since the exam contains 150 questions, here's how those sections break
	54	down:
	55
	56	\| Exam Section \| Percentage of Exam \| Questions \|
	57	\|---------------+--------------------+-----------\|
	58	\| 1 \| 21% \| 32 \|
	59	\| 2 \| 17% \| 26 \|
	60	\| 3 \| 12% \| 18 \|
	61	\| 4 \| 23% \| 34 \|
	62	\| 5 \| 27% \| 40 \|
	63	\| Grand Total \| 100% \| 150 \|
	64
	65	** My Studying Habits
	66	:PROPERTIES:
	67	:CUSTOM_ID: my-studying-habits
	68	:END:
	69	This part is a little hard for me to break down into specific detail due
	70	to the craziness of the last year. While I officially purchased my
	71	studying materials in December 2020 and opened them to "start studying"
	72	in January 2021, I really wasn't able to study much due to the demands
	73	of my job and personal life.
65	74
66	75	Let me approach this from a few different viewpoints.
67	76
68		### Study Materials
69
70		Let's start by discussing the study materials I purchased. I'll be referring to
71		#1 as the CRM and #2 as the QAE.
72
73		1. [CISA Review Manual, 27th Edition \| Print](https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCbEAK)
74		2. [CISA Review Questions, Answers & Explanations Manual, 12th Edition \| Print](https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCcEAK)
75
76		The CRM is an excellent source of information and could honestly be used as a
77		reference for most IS auditors as a learning reference during their daily audit
78		responsibilities. However, it is full of information and can be overloading
79		if you're not good at filtering out useless information while studying.
80
81		The QAE is the real star of the show here. This book contains 1000 questions,
82		separated by exam section, and a practice exam. My only complaint about the QAE
83		is that each question is immediately followed with the correct answer and
84		explanations below it, which means I had to use something to constantly cover
85		the answers while I was studying.
86
87		I didn't use the online database version of the QAE, but I've heard that it's
88		easier to use than the printed book. However, it is more expensive ($299
89		database vs $129 book) which might be important if you're paying for materials
90		yourself.
91
92		In terms of question difficulty, I felt that the QAE was a good representation
93		of the actual exam. I've seen a lot of people online say it wasn't accurate to
94		the exam or that it was much easier/harder, but I disagree with all of those.
95		The exam was fairly similar to the QAE, just focusing on whichever topics they
96		chose for my version of the exam.
97
98		If you understand the concepts, skim the CRM (and read in-depth on topics you
99		struggle with), and use the QAE to continue practicing exam-like questions, you
100		should be fine. I didn't use any online courses, videos, etc. - the ISACA
101		materials are more than enough.
102
103		### Studying Process
104
105		While I was able to briefly read through sections 1 and 2 in early 2021, I had
106		to stop and take a break from February/March to September.
107		I switched jobs in September, which allowed me a lot more free time to study.
108
109		In September, I studied sections 3-5, took notes, and did a quick review of the
110		section topics. Once I felt comfortable with my notes, I took a practice exam
111		from the QAE manual and scored 70% (105/150).
	77	*** Study Materials
	78	:PROPERTIES:
	79	:CUSTOM_ID: study-materials
	80	:END:
	81	Let's start by discussing the study materials I purchased. I'll be
	82	referring to #1 as the CRM and #2 as the QAE.
	83
	84	1. [[https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCbEAK][CISA
	85	Review Manual, 27th Edition \| Print]]
	86	2. [[https://store.isaca.org/s/store#/store/browse/detail/a2S4w000004KoCcEAK][CISA
	87	Review Questions, Answers & Explanations Manual, 12th Edition \|
	88	Print]]
	89
	90	The CRM is an excellent source of information and could honestly be used
	91	as a reference for most IS auditors as a learning reference during their
	92	daily audit responsibilities. However, it is full of information and
	93	can be overloading if you're not good at filtering out useless
	94	information while studying.
	95
	96	The QAE is the real star of the show here. This book contains 1000
	97	questions, separated by exam section, and a practice exam. My only
	98	complaint about the QAE is that each question is immediately followed
	99	with the correct answer and explanations below it, which means I had to
	100	use something to constantly cover the answers while I was studying.
	101
	102	I didn't use the online database version of the QAE, but I've heard that
	103	it's easier to use than the printed book. However, it is more expensive
	104	($299 database vs $129 book) which might be important if you're paying
	105	for materials yourself.
	106
	107	In terms of question difficulty, I felt that the QAE was a good
	108	representation of the actual exam. I've seen a lot of people online say
	109	it wasn't accurate to the exam or that it was much easier/harder, but I
	110	disagree with all of those. The exam was fairly similar to the QAE, just
	111	focusing on whichever topics they chose for my version of the exam.
	112
	113	If you understand the concepts, skim the CRM (and read in-depth on
	114	topics you struggle with), and use the QAE to continue practicing
	115	exam-like questions, you should be fine. I didn't use any online
	116	courses, videos, etc. - the ISACA materials are more than enough.
	117
	118	*** Studying Process
	119	:PROPERTIES:
	120	:CUSTOM_ID: studying-process
	121	:END:
	122	While I was able to briefly read through sections 1 and 2 in early 2021,
	123	I had to stop and take a break from February/March to September. I
	124	switched jobs in September, which allowed me a lot more free time to
	125	study.
	126
	127	In September, I studied sections 3-5, took notes, and did a quick review
	128	of the section topics. Once I felt comfortable with my notes, I took a
	129	practice exam from the QAE manual and scored 70% (105/150).
112	130
113	131	Here's a breakdown of my initial practice exam:
114	132
115		\| Exam Section \| Incorrect \| Correct \| Grand Total \| Percent \|
116		\|:---------------:\|:---------:\|:-------:\|:-----------:\|:-------:\|
117		\| 1 \| 8 \| 25 \| 33 \| 76% \|
118		\| 2 \| 5 \| 20 \| 25 \| 80% \|
119		\| 3 \| 6 \| 12 \| 18 \| 67% \|
120		\| 4 \| 10 \| 23 \| 33 \| 70% \|
121		\| 5 \| 16 \| 25 \| 41 \| 61% \|
122		\| Grand Total \| 45 \| 105 \| 150 \| 70% \|
	133	\| Exam Section \| Incorrect \| Correct \| Grand Total \| Percent \|
	134	\|---------------+-----------+---------+-------------+---------\|
	135	\| 1 \| 8 \| 25 \| 33 \| 76% \|
	136	\| 2 \| 5 \| 20 \| 25 \| 80% \|
	137	\| 3 \| 6 \| 12 \| 18 \| 67% \|
	138	\| 4 \| 10 \| 23 \| 33 \| 70% \|
	139	\| 5 \| 16 \| 25 \| 41 \| 61% \|
	140	\| Grand Total \| 45 \| 105 \| 150 \| 70% \|
123	141
124	142	As I expected, my toughest sections were related to project management,
125	143	development, implementation, and security.
126	144
127		This just leaves October and November. For these months, I tried to practice
128		every few days, doing 10 questions for each section, until the exam. This came
129		out to 13 practice sessions, ~140 questions per section, and ~700 questions
130		total.
131
132		While some practice sessions were worse and some were better, the final results
133		were similar to my practice exam results. As you can see below, my averages were
134		slightly worse than my practice exam. However, I got in over 700 questions of
135		practice and, most importantly, **I read through the explanations every time I
136		answered incorrectly and learned from my mistakes**.
137
138		\| Exam Section \| Incorrect \| Correct \| Grand Total \| Percent \|
139		\|:---------------:\|:---------:\|:-------:\|:-----------:\|:-------:\|
140		\| 1 \| 33 \| 108 \| 141 \| 77% \|
141		\| 2 \| 33 \| 109 \| 142 \| 77% \|
142		\| 3 \| 55 \| 89 \| 144 \| 62% \|
143		\| 4 \| 52 \| 88 \| 140 \| 63% \|
144		\| 5 \| 55 \| 85 \| 140 \| 61% \|
145		\| Grand Total \| 228 \| 479 \| 707 \| 68% \|
146
147		![CISA practice question results](https://img.cleberg.net/blog/20211204-i-passed-the-cisa/cisa-practice-questions-results.png)
148
149		## Results
150
151		Now, how do the practice scores reflect my actual results?
152		After all, it's hard to tell how good a practice regimen is unless you see
153		how it turns out.
154
155		\| Exam Section \| Section Name \| Score \|
156		\|:------------:\|------------------------------------------------------------------\|:-------:\|
157		\| 1 \| Information Systems Auditing Process \| 678 \|
158		\| 2 \| Governance and Management of IT \| 590 \|
159		\| 3 \| Information Systems Acquisition, Development, and Implementation \| 721 \|
160		\| 4 \| Information Systems Operations and Business Resilience \| 643 \|
161		\| 5 \| Protection of Information Assets \| 511 \|
162		\| TOTAL \| \| 616 \|
163
164		Now, in order to pass the CISA, you need at least 450 on a sliding scale of
165		200-800. Personally, I really have no clue what an average CISA score is. After
166		a _very_ brief look online, I can see that the high end is usually in the low
167		700s. In addition, only about 50-60% of people pass the exam.
168
169		Given this information, I feel great about my scores.
170		616 may not be phenomenal, and I wish I had done better on sections 2 & 5,
171		but my practicing seems to have worked very well overall.
172
173		However, the practice results do not conform to the actual results. Section 2
174		was one of my highest practice sections and was my second-lowest score in the
175		exam. Conversely, section 3 was my second-lowest practice section and turned out
176		to be my highest actual score!
177
178		After reflecting, it is obvious that if you have any background on the CISA
179		topics at all, the most important part of studying is doing practice questions.
180		You really need to understand how to read the questions critically and pick the
181		best answer.
182
183		## Looking Forward
184
185		I am extremely happy that I was finally able to pass the CISA. Looking to the
186		future, I'm not sure what's next in terms of professional learning. My current
187		company offers internal learning courses, so I will most likely focus on that if
188		I need to gain more knowledge in certain areas.
189
190		To be fair, even if you pass the CISA, it's hard to become an expert on any
191		specific topic found within.
192		My career may take me in a different direction, and I might need to focus
193		more on security or networking certifications (or possibly building a better
194		analysis/visualization portfolio if I want to go into data analysis/science).
	145	This just leaves October and November. For these months, I tried to
	146	practice every few days, doing 10 questions for each section, until the
	147	exam. This came out to 13 practice sessions, ~140 questions per section,
	148	and ~700 questions total.
	149
	150	While some practice sessions were worse and some were better, the final
	151	results were similar to my practice exam results. As you can see below,
	152	my averages were slightly worse than my practice exam. However, I got in
	153	over 700 questions of practice and, most importantly, *I read through
	154	the explanations every time I answered incorrectly and learned from my
	155	mistakes*.
	156
	157	\| Exam Section \| Incorrect \| Correct \| Grand Total \| Percent \|
	158	\|---------------+-----------+---------+-------------+---------\|
	159	\| 1 \| 33 \| 108 \| 141 \| 77% \|
	160	\| 2 \| 33 \| 109 \| 142 \| 77% \|
	161	\| 3 \| 55 \| 89 \| 144 \| 62% \|
	162	\| 4 \| 52 \| 88 \| 140 \| 63% \|
	163	\| 5 \| 55 \| 85 \| 140 \| 61% \|
	164	\| Grand Total \| 228 \| 479 \| 707 \| 68% \|
	165
	166	#+caption: CISA practice question results
	167	[[https://img.cleberg.net/blog/20211204-i-passed-the-cisa/cisa-practice-questions-results.png]]
	168
	169	** Results
	170	:PROPERTIES:
	171	:CUSTOM_ID: results
	172	:END:
	173	Now, how do the practice scores reflect my actual results? After all,
	174	it's hard to tell how good a practice regimen is unless you see how it
	175	turns out.
	176
	177	\| Exam Section \| Section Name \| Score \|
	178	\|--------------+------------------------------------------------------------------+-------\|
	179	\| 1 \| Information Systems Auditing Process \| 678 \|
	180	\| 2 \| Governance and Management of IT \| 590 \|
	181	\| 3 \| Information Systems Acquisition, Development, and Implementation \| 721 \|
	182	\| 4 \| Information Systems Operations and Business Resilience \| 643 \|
	183	\| 5 \| Protection of Information Assets \| 511 \|
	184	\| TOTAL \| \| 616 \|
	185
	186	Now, in order to pass the CISA, you need at least 450 on a sliding scale
	187	of 200-800. Personally, I really have no clue what an average CISA score
	188	is. After a /very/ brief look online, I can see that the high end is
	189	usually in the low 700s. In addition, only about 50-60% of people pass
	190	the exam.
	191
	192	Given this information, I feel great about my scores. 616 may not be
	193	phenomenal, and I wish I had done better on sections 2 & 5, but my
	194	practicing seems to have worked very well overall.
	195
	196	However, the practice results do not conform to the actual results.
	197	Section 2 was one of my highest practice sections and was my
	198	second-lowest score in the exam. Conversely, section 3 was my
	199	second-lowest practice section and turned out to be my highest actual
	200	score!
	201
	202	After reflecting, it is obvious that if you have any background on the
	203	CISA topics at all, the most important part of studying is doing
	204	practice questions. You really need to understand how to read the
	205	questions critically and pick the best answer.
	206
	207	** Looking Forward
	208	:PROPERTIES:
	209	:CUSTOM_ID: looking-forward
	210	:END:
	211	I am extremely happy that I was finally able to pass the CISA. Looking
	212	to the future, I'm not sure what's next in terms of professional
	213	learning. My current company offers internal learning courses, so I will
	214	most likely focus on that if I need to gain more knowledge in certain
	215	areas.
	216
	217	To be fair, even if you pass the CISA, it's hard to become an expert on
	218	any specific topic found within. My career may take me in a different
	219	direction, and I might need to focus more on security or networking
	220	certifications (or possibly building a better analysis/visualization
	221	portfolio if I want to go into data analysis/science).
195	222
196	223	All I know is that I am content at the moment and extremely proud of my
197	224	accomplishment.

blog/2022-02-10-leaving-the-office.org +249 −202

		@@ -1,227 +1,274 @@
1		+++
2		date = 2022-02-10
3		title = "Leaving Office-Based Work In the Past"
4		description = "As the world moves on from the before-times, I'm taking a look back on how working from different office environments affected my effectiveness and comfort."
5		draft = false
6		+++
7
8		## The Working World is Changing
9
10		There has been a trend for the past few years of companies slowly realizing that
11		the pandemic is not just a temporary state that will go away eventually and let
12		everything return to the way it was before. In terms of business and employment,
13		this means that more and more jobs are being offered as permanently remote
14		roles.
	1	#+title: Leaving Office-Based Work In the Past
	2	#+date: 2022-02-10
	3
	4	** The Working World is Changing
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-working-world-is-changing
	7	:END:
	8	There has been a trend for the past few years of companies slowly
	9	realizing that the pandemic is not just a temporary state that will go
	10	away eventually and let everything return to the way it was before. In
	11	terms of business and employment, this means that more and more jobs are
	12	being offered as permanently remote roles.
15	13
16	14	I had always dreamt of working from home but thought of it as a fantasy,
17		especially since I did not want to move over into the software development
18		field. However, I have found that almost all roles being sent to me via
19		recruiters are permanently remote (although most are limited to US citizens or
20		even region-locked for companies who only operate in select states).
21
22		I decided to take a look back at my relatively short career so far and compare
23		the positive and negative effects of the different work environments I've been
24		in.
25
26		## In-Person Offices
27
28		### Retail Internship
29
30		I started my first job as a management intern at a busy retail pharmacy, working
31		my 40-hour weeks on my feet.
32		As these retail stores don't believe in resting or sitting down, you can
33		guarantee that you will spend entire shifts standing, walking, or running
34		around the store.
35		Unfortunately, I worked at a time when our store didn't have enough managers,
36		so I spent the majority of my tenure at the store running and breaking a sweat.
37
38		Now, things aren't all bad in retail stores like this. It is definitely tiring
39		and inefficient to force employees to work constantly, or pretend to work if
40		there's nothing to do, and not allow anyone to sit down. However, if you are
41		able to operate a retail store with a limited crew and provide enough comfort
42		and support, I believe these jobs could be both comfortable and efficient.
43
44		### Semi-Private Cubicles
45
46		![Semi-Private Cubicles](https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/private_cubicles.png)
47
48		After about a year, I was able to find another internship - this time, it was in
49		my field of interest: internal auditing. This was for a life insurance company
50		that was well over 100 years old. The age of the company shows if you work
51		there, as most people in management are well into their 40s-60s with little to
52		no youthful leadership in the company.
53		Likewise, they owned a large headquarters in a nice area of town with plenty
54		of space, parking, etc.
55
56		One upside is that each person gets their own large L-shaped desk, formed into
57		cubicles that house 4 desks/employees. These "pods" of 4-person cubicles are
58		linked throughout each floor of the headquarters (except the sales
59		people, who had that open-floor concept going on). The walls of the cubicle were
60		tall and provided a lot of privacy and sound-proofing, except when I used the
61		standing desk feature (I'm over 6 feet tall, so probably not an issue for most
62		people).
	15	especially since I did not want to move over into the software
	16	development field. However, I have found that almost all roles being
	17	sent to me via recruiters are permanently remote (although most are
	18	limited to US citizens or even region-locked for companies who only
	19	operate in select states).
	20
	21	I decided to take a look back at my relatively short career so far and
	22	compare the positive and negative effects of the different work
	23	environments I've been in.
	24
	25	** In-Person Offices
	26	:PROPERTIES:
	27	:CUSTOM_ID: in-person-offices
	28	:END:
	29	*** Retail Internship
	30	:PROPERTIES:
	31	:CUSTOM_ID: retail-internship
	32	:END:
	33	I started my first job as a management intern at a busy retail pharmacy,
	34	working my 40-hour weeks on my feet. As these retail stores don't
	35	believe in resting or sitting down, you can guarantee that you will
	36	spend entire shifts standing, walking, or running around the store.
	37	Unfortunately, I worked at a time when our store didn't have enough
	38	managers, so I spent the majority of my tenure at the store running and
	39	breaking a sweat.
	40
	41	Now, things aren't all bad in retail stores like this. It is definitely
	42	tiring and inefficient to force employees to work constantly, or pretend
	43	to work if there's nothing to do, and not allow anyone to sit down.
	44	However, if you are able to operate a retail store with a limited crew
	45	and provide enough comfort and support, I believe these jobs could be
	46	both comfortable and efficient.
	47
	48	*** Semi-Private Cubicles
	49	:PROPERTIES:
	50	:CUSTOM_ID: semi-private-cubicles
	51	:END:
	52	#+caption: Semi-Private Cubicles
	53	[[https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/private_cubicles.png]]
	54
	55	After about a year, I was able to find another internship - this time,
	56	it was in my field of interest: internal auditing. This was for a life
	57	insurance company that was well over 100 years old. The age of the
	58	company shows if you work there, as most people in management are well
	59	into their 40s-60s with little to no youthful leadership in the company.
	60	Likewise, they owned a large headquarters in a nice area of town with
	61	plenty of space, parking, etc.
	62
	63	One upside is that each person gets their own large L-shaped desk,
	64	formed into cubicles that house 4 desks/employees. These "pods" of
	65	4-person cubicles are linked throughout each floor of the headquarters
	66	(except the sales people, who had that open-floor concept going on). The
	67	walls of the cubicle were tall and provided a lot of privacy and
	68	sound-proofing, except when I used the standing desk feature (I'm over 6
	69	feet tall, so probably not an issue for most people).
63	70
64	71	I loved this environment, it allowed me to focus on my work with minimal
65		distractions, but also allowed easy access, so I could spin around in my chair
66		and chat with my friends without leaving my chair. This is the closest I've been
67		to a home office environment (which is my personal favorite, as I'll get to
68		later in this post).
69
70		### Semi-Open Floor Concept
71
72		![Semi-Open Floor Concept](https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/semi_open_office.png)
73
74		When I shifted to my first full-time internal audit job out of college, I was
75		working at a company that was headquartered on a floor in a downtown high-rise
76		building. The company was only about 20 years old when I worked there and were
77		trying a lot of new things to attract young talent, one of which was a
78		semi-open floor concept for the office. My department worked just around the
79		hallway corner from the executive offices and used that "modern" layout young
80		tech companies started using in the 2000s/2010s.
81
82		Each desk was brief, and you could look most coworkers in the face without
83		moving from your chair, I hated this so much.
84		Directly to my left was the Chief Audit Executive (our department's leading
85		boss), and his desk was pointed so that his face would stare straight at my
86		desk all day.
87		I spent more time thinking about who was looking at me or checking on me
88		than actually working.
89
90		The other annoying part of the open concept they used was that the kitchen area
91		and pathways were too close to everyone's desks (since the desks were spread
92		out, to provide space or something), so noise and conversation would be constant
93		throughout the day while you try to work. For someone like me, who needs silence
94		to get work done, that was a non-starter.
95
96		### Hotel Office Concept
97
98		![Hotel Office Concept](https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/hotel_desks.png)
99
100		I currently work for a company remotely (for now) and travel to the office every
101		once in a while for events and to help coach the staff underneath me. The office
102		I visit uses the hotel desk concept, where you need to check in at a touch
103		screen when you enter the office and "rent" a desk for the day. The same goes
104		for offices and meeting rooms.
105
106		These desks are flat-top only and do not have any walls at all. In addition,
107		they're stacked with one row of 4 desks facing another row of 4 desks. These
108		pairs of desk rows are repeated through the office.
109
110		This means that when I go, I need to rent a random desk or try to remember the
111		unique ID numbers on desks I like. Once I rent it, I have to make sure no one
112		sat down in that desk without renting it. Then, I can sit down and work, but
113		will probably need to adjust the monitors so that I'm not staring in the face of
114		the person across from me all day. Finally, I need to wear headphones as this
115		environment does nothing to provide you with peace or quiet.
116
117		Luckily, you can rent offices with doors that offer quiet and privacy, which can
118		be very nice if you have a lot of meetings or webinars on a certain day.
119
120		## Home Office
121
122		![Home Office](https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/home_office.png)
123
124		Okay, now let's finally get to the home office concept. I have worked from home
125		for a little over two years at this point, across three different
126		jobs/employers. Over this time, I have experimented with a plethora of different
127		organizational ideas, desks, and room layouts to find what works best for me.
128
129		These things might not apply to you, and that's fine.
130		Everyone has a different situation, and I really don't think you'll know
131		what works until you try.
132
133		### Tip #1
134
	72	distractions, but also allowed easy access, so I could spin around in my
	73	chair and chat with my friends without leaving my chair. This is the
	74	closest I've been to a home office environment (which is my personal
	75	favorite, as I'll get to later in this post).
	76
	77	*** Semi-Open Floor Concept
	78	:PROPERTIES:
	79	:CUSTOM_ID: semi-open-floor-concept
	80	:END:
	81	#+caption: Semi-Open Floor Concept
	82	[[https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/semi_open_office.png]]
	83
	84	When I shifted to my first full-time internal audit job out of college,
	85	I was working at a company that was headquartered on a floor in a
	86	downtown high-rise building. The company was only about 20 years old
	87	when I worked there and were trying a lot of new things to attract young
	88	talent, one of which was a semi-open floor concept for the office. My
	89	department worked just around the hallway corner from the executive
	90	offices and used that "modern" layout young tech companies started using
	91	in the 2000s/2010s.
	92
	93	Each desk was brief, and you could look most coworkers in the face
	94	without moving from your chair, I hated this so much. Directly to my
	95	left was the Chief Audit Executive (our department's leading boss), and
	96	his desk was pointed so that his face would stare straight at my desk
	97	all day. I spent more time thinking about who was looking at me or
	98	checking on me than actually working.
	99
	100	The other annoying part of the open concept they used was that the
	101	kitchen area and pathways were too close to everyone's desks (since the
	102	desks were spread out, to provide space or something), so noise and
	103	conversation would be constant throughout the day while you try to work.
	104	For someone like me, who needs silence to get work done, that was a
	105	non-starter.
	106
	107	*** Hotel Office Concept
	108	:PROPERTIES:
	109	:CUSTOM_ID: hotel-office-concept
	110	:END:
	111	#+caption: Hotel Office Concept
	112	[[https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/hotel_desks.png]]
	113
	114	I currently work for a company remotely (for now) and travel to the
	115	office every once in a while for events and to help coach the staff
	116	underneath me. The office I visit uses the hotel desk concept, where you
	117	need to check in at a touch screen when you enter the office and "rent"
	118	a desk for the day. The same goes for offices and meeting rooms.
	119
	120	These desks are flat-top only and do not have any walls at all. In
	121	addition, they're stacked with one row of 4 desks facing another row of
	122	4 desks. These pairs of desk rows are repeated through the office.
	123
	124	This means that when I go, I need to rent a random desk or try to
	125	remember the unique ID numbers on desks I like. Once I rent it, I have
	126	to make sure no one sat down in that desk without renting it. Then, I
	127	can sit down and work, but will probably need to adjust the monitors so
	128	that I'm not staring in the face of the person across from me all day.
	129	Finally, I need to wear headphones as this environment does nothing to
	130	provide you with peace or quiet.
	131
	132	Luckily, you can rent offices with doors that offer quiet and privacy,
	133	which can be very nice if you have a lot of meetings or webinars on a
	134	certain day.
	135
	136	** Home Office
	137	:PROPERTIES:
	138	:CUSTOM_ID: home-office
	139	:END:
	140	#+caption: Home Office
	141	[[https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/home_office.png]]
	142
	143	Okay, now let's finally get to the home office concept. I have worked
	144	from home for a little over two years at this point, across three
	145	different jobs/employers. Over this time, I have experimented with a
	146	plethora of different organizational ideas, desks, and room layouts to
	147	find what works best for me.
	148
	149	These things might not apply to you, and that's fine. Everyone has a
	150	different situation, and I really don't think you'll know what works
	151	until you try.
	152
	153	*** Tip #1
	154	:PROPERTIES:
	155	:CUSTOM_ID: tip-1
	156	:END:
135	157	Let's start with my top rule for a home office:
136	158
137		> If you live with others, working in a shared space is not effective.
	159	#+begin_quote
	160	If you live with others, working in a shared space is not effective.
138	161
139		It just does not work.
140		If you have another person sleeping in your bedroom, it is difficult to
141		manage your work schedule with their sleeping/work/school schedule.
142		If they wake up after you need to start work, you might wake them up
143		or have to suffer the agony of staring at bright screens in a dark room.
	162	#+end_quote
144	163
145		In a similar vein, working from a location such as the living room likely won't
146		work either.
147		Distractions will come far more frequently: televisions, cooking, cleaning,
148		deliveries, etc. If you're like me, you'll end up playing a game instead of
149		actually doing any work.
	164	It just does not work. If you have another person sleeping in your
	165	bedroom, it is difficult to manage your work schedule with their
	166	sleeping/work/school schedule. If they wake up after you need to start
	167	work, you might wake them up or have to suffer the agony of staring at
	168	bright screens in a dark room.
150	169
151		### Tip #2
	170	In a similar vein, working from a location such as the living room
	171	likely won't work either. Distractions will come far more frequently:
	172	televisions, cooking, cleaning, deliveries, etc. If you're like me,
	173	you'll end up playing a game instead of actually doing any work.
152	174
	175	*** Tip #2
	176	:PROPERTIES:
	177	:CUSTOM_ID: tip-2
	178	:END:
153	179	Okay, the second thing I've discovered that works for me:
154	180
155		> Use the pomodoro method (or something similar) to balance work tasks with
156		> personal tasks.
157
158		I use a very casual version of the pomodoro method where I will work for 1-2
159		hours (usually set in strict intervals like 1, 1.5, 2 hours) and then will allow
160		myself 30-60 minutes for personal tasks. This schedule works for me, since my
161		work schedule really only comes to 3-6 hours of work per day.
162
163		In this case, I'll work through my list of tasks for an hour or two and then
164		give myself personal time to get drinks and food, wash dishes, put clothes in
165		the washer, get the mail, etc. If you're in a convenient location, this usually
166		gives time for things like getting groceries (as long as you're not a slow
167		shopper).
168
169		### Tip #3
170
171		While I listed this one as number three, I don't think I'd accomplish anything
172		without it:
173
174		> Document everything: even things you didn't before - such as task lists and
175		> notes from casual calls or meetings.
176
177		I've noticed that staying in an office gave me more constant reminders of
178		outstanding tasks or facts I had learned in a conversation. Translating
179		everything to a digital world has made me lose a bit of that focus (perhaps
180		since I don't have visual reminders?).
181
182		Keeping a running task list of all things I have to do - even potential tasks! -
183		has helped me keep up without missing anything small. Likewise, keeping notes
184		for ALL meetings and calls, no matter how casual/quick, has improved my
185		retention immensely. Beyond helping my mental recollection, it has saved me
186		numerous times when I need to do a keyword search for some topic that was discussed
187		6+ months ago.
188
189		### Tip #4
190
	181	#+begin_quote
	182	Use the pomodoro method (or something similar) to balance work tasks
	183	with personal tasks.
	184
	185	#+end_quote
	186
	187	I use a very casual version of the pomodoro method where I will work for
	188	1-2 hours (usually set in strict intervals like 1, 1.5, 2 hours) and
	189	then will allow myself 30-60 minutes for personal tasks. This schedule
	190	works for me, since my work schedule really only comes to 3-6 hours of
	191	work per day.
	192
	193	In this case, I'll work through my list of tasks for an hour or two and
	194	then give myself personal time to get drinks and food, wash dishes, put
	195	clothes in the washer, get the mail, etc. If you're in a convenient
	196	location, this usually gives time for things like getting groceries (as
	197	long as you're not a slow shopper).
	198
	199	*** Tip #3
	200	:PROPERTIES:
	201	:CUSTOM_ID: tip-3
	202	:END:
	203	While I listed this one as number three, I don't think I'd accomplish
	204	anything without it:
	205
	206	#+begin_quote
	207	Document everything: even things you didn't before - such as task lists
	208	and notes from casual calls or meetings.
	209
	210	#+end_quote
	211
	212	I've noticed that staying in an office gave me more constant reminders
	213	of outstanding tasks or facts I had learned in a conversation.
	214	Translating everything to a digital world has made me lose a bit of that
	215	focus (perhaps since I don't have visual reminders?).
	216
	217	Keeping a running task list of all things I have to do - even potential
	218	tasks! - has helped me keep up without missing anything small. Likewise,
	219	keeping notes for ALL meetings and calls, no matter how casual/quick,
	220	has improved my retention immensely. Beyond helping my mental
	221	recollection, it has saved me numerous times when I need to do a keyword
	222	search for some topic that was discussed 6+ months ago.
	223
	224	*** Tip #4
	225	:PROPERTIES:
	226	:CUSTOM_ID: tip-4
	227	:END:
191	228	Okay, last one for now.
192	229
193		> Keep your work area clean.
	230	#+begin_quote
	231	Keep your work area clean.
194	232
195		This one is straightforward, but I know some people struggle with cleanliness or
196		may not believe it makes a difference. Trust me, keeping your desk area clean
197		and organized makes a huge difference, both mentally and emotionally.
	233	#+end_quote
198	234
199		Just think about it, you walk into your home office and see a clean desk with a
200		laptop, dock, monitors, keyboard, mouse, and a notepad with a pen on top.
	235	This one is straightforward, but I know some people struggle with
	236	cleanliness or may not believe it makes a difference. Trust me, keeping
	237	your desk area clean and organized makes a huge difference, both
	238	mentally and emotionally.
201	239
202		Now imagine the opposite, there's an office with the same equipment, but there
203		are clothes hanging on the chair, empty drink bottles, candy wrappers and dirty
204		plates. This can take both a mental and emotional toll by bringing constant
205		disarray and stress into your working environment.
	240	Just think about it, you walk into your home office and see a clean desk
	241	with a laptop, dock, monitors, keyboard, mouse, and a notepad with a pen
	242	on top.
206	243
207		Just keep things clean each day, and you won't need to do any big cleaning days
208		to recover.
	244	Now imagine the opposite, there's an office with the same equipment, but
	245	there are clothes hanging on the chair, empty drink bottles, candy
	246	wrappers and dirty plates. This can take both a mental and emotional
	247	toll by bringing constant disarray and stress into your working
	248	environment.
209	249
210		## My Preferences
	250	Just keep things clean each day, and you won't need to do any big
	251	cleaning days to recover.
211	252
212		I've talked about the different environments I've worked in and expressed some
213		honest thoughts on pros or cons to each, but what do I prefer? Well, if you're
214		reading along, you should be able to tell that I much prefer a home office above
215		all else.
	253	** My Preferences
	254	:PROPERTIES:
	255	:CUSTOM_ID: my-preferences
	256	:END:
	257	I've talked about the different environments I've worked in and
	258	expressed some honest thoughts on pros or cons to each, but what do I
	259	prefer? Well, if you're reading along, you should be able to tell that I
	260	much prefer a home office above all else.
216	261
217		Being able to control my own day and allot my time as needed has brought a
218		calmness to my life and has allowed me to maximize each day. I feel far more
219		effective and efficient in a home office than any other office, especially
220		open-office layouts.
	262	Being able to control my own day and allot my time as needed has brought
	263	a calmness to my life and has allowed me to maximize each day. I feel
	264	far more effective and efficient in a home office than any other office,
	265	especially open-office layouts.
221	266
222		If I do need to return to an office part-time in the future, I really hope the
223		office will have privacy and quietness in order for me to get my work done.
	267	If I do need to return to an office part-time in the future, I really
	268	hope the office will have privacy and quietness in order for me to get
	269	my work done.
224	270
225	271	Cubicles are good! I agree with Alice (from the comic Dilbert):
226	272
227		![Dilbert comic strip](https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/dilbert_120109.png)
	273	#+caption: Dilbert comic strip
	274	[[https://img.cleberg.net/blog/20220210-leaving-office-based-work-in-the-past/dilbert_120109.png]]

blog/2022-02-16-debian-and-nginx.org +120 −113

		@@ -1,76 +1,78 @@
1		+++
2		date = 2022-02-16
3		title = "Migrating to a New Web Server Setup with Debian, Nginx, and Agate"
4		description = "I've finally taken the leap of faith on two different technologies for the first time: trying out Debian as my main server OS and Nginx as my web server software."
5		draft = false
6		+++
7
8		## Server OS: Debian
9
10		![Debian + neofetch](https://img.cleberg.net/blog/20220216-migrating-to-debian-and-nginx/neofetch.png)
11
12		I've used various Linux distributions throughout the years, but I've never used
13		anything except Ubuntu for my servers.
14		Why?
15		I really have no idea, mostly just comfort around the commands and software
16		availability.
17
18		However, I have always wanted to try Debian as a server OS after testing it out
19		in a VM a few years ago (side-note: I'd love to try Alpine too, but I always
20		struggle with compatibility). So, I decided to launch a new VPS and use
21		[Debian](https://www.debian.org) 11 as the OS. Spoiler alert: it feels identical
22		to Ubuntu for my purposes.
23
24		I did the normal things when first launching the VPS, such as adding a new user,
25		locking down SSH, etc. If you want to see that level of detail, read my other
26		post about
27		[How to Set Up a VPS Web Server](https://cleberg.net/blog/how-to-set-up-a-vps-web-server/).
28
29		All of this has been similar, apart from small things such as the location of
30		users' home folders. No complaints at all from me - Debian seems great.
31
32		## Web Server: Nginx
33
34		![Nginx status](https://img.cleberg.net/blog/20220216-migrating-to-debian-and-nginx/nginx.png)
35
36		Once I had the baseline server configuration set-up for Debian, I moved on to
37		trying out [Nginx](https://nginx.org) as my web server software. This required
38		me to install the `nginx` and `ufw` packages, as well as setting up the initial
39		UFW config:
40
41		```sh
	1	#+title: Migrating to a New Web Server Setup with Debian, Nginx, and Agate
	2	#+date: 2022-02-16
	3
	4	** Server OS: Debian
	5	:PROPERTIES:
	6	:CUSTOM_ID: server-os-debian
	7	:END:
	8	#+caption: Debian + neofetch
	9	[[https://img.cleberg.net/blog/20220216-migrating-to-debian-and-nginx/neofetch.png]]
	10
	11	I've used various Linux distributions throughout the years, but I've
	12	never used anything except Ubuntu for my servers. Why? I really have no
	13	idea, mostly just comfort around the commands and software availability.
	14
	15	However, I have always wanted to try Debian as a server OS after testing
	16	it out in a VM a few years ago (side-note: I'd love to try Alpine too,
	17	but I always struggle with compatibility). So, I decided to launch a new
	18	VPS and use [[https://www.debian.org][Debian]] 11 as the OS. Spoiler
	19	alert: it feels identical to Ubuntu for my purposes.
	20
	21	I did the normal things when first launching the VPS, such as adding a
	22	new user, locking down SSH, etc. If you want to see that level of
	23	detail, read my other post about
	24	[[https://cleberg.net/blog/how-to-set-up-a-vps-web-server/][How to Set
	25	Up a VPS Web Server]].
	26
	27	All of this has been similar, apart from small things such as the
	28	location of users' home folders. No complaints at all from me - Debian
	29	seems great.
	30
	31	** Web Server: Nginx
	32	:PROPERTIES:
	33	:CUSTOM_ID: web-server-nginx
	34	:END:
	35	#+caption: Nginx status
	36	[[https://img.cleberg.net/blog/20220216-migrating-to-debian-and-nginx/nginx.png]]
	37
	38	Once I had the baseline server configuration set-up for Debian, I moved
	39	on to trying out [[https://nginx.org][Nginx]] as my web server software.
	40	This required me to install the =nginx= and =ufw= packages, as well as
	41	setting up the initial UFW config:
	42
	43	#+begin_src sh
42	44	sudo apt install nginx ufw
43	45	sudo ufw allow 'Nginx Full'
44	46	sudo ufw allow SSH
45	47	sudo ufw enable
46	48	sudo ufw status
47	49	sudo systemctl status nginx
48		```
	50	#+end_src
49	51
50		Once I had the firewall set, I moved on to creating the directories and files
51		for my website. This is very easy and is basically the same as setting up an
52		Apache server, so no struggles here.
	52	Once I had the firewall set, I moved on to creating the directories and
	53	files for my website. This is very easy and is basically the same as
	54	setting up an Apache server, so no struggles here.
53	55
54		```sh
	56	#+begin_src sh
55	57	sudo mkdir -p /var/www/your_domain/html
56	58	sudo chown -R $USER:$USER /var/www/your_domain/html
57	59	sudo chmod -R 755 /var/www/your_domain
58	60	nano /var/www/your_domain/html/index.html
59		```
	61	#+end_src
60	62
61		The next part, creating the Nginx configuration files, is quite a bit different
62		from Apache. First, you need to create the files in the `sites-available` folder
63		and symlink it the `sites-enabled` folder.
	63	The next part, creating the Nginx configuration files, is quite a bit
	64	different from Apache. First, you need to create the files in the
	65	=sites-available= folder and symlink it the =sites-enabled= folder.
64	66
65	67	Creating the config file for your domain:
66	68
67		```sh
	69	#+begin_src sh
68	70	sudo nano /etc/nginx/sites-available/your_domain
69		```
	71	#+end_src
70	72
71	73	Default content for an Nginx config file:
72	74
73		```sh
	75	#+begin_src sh
74	76	server {
75	77	listen 80;
76	78	listen [::]:80;
		@@ -84,42 +86,43 @@ server {
84	86	try_files $uri $uri/ =404;
85	87	}
86	88	}
87		```
	89	#+end_src
88	90
89	91	Finally, symlink it together:
90	92
91		```sh
	93	#+begin_src sh
92	94	sudo ln -s /etc/nginx/sites-available/your_domain /etc/nginx/sites-enabled/
93		```
	95	#+end_src
94	96
95	97	This will make your site available to the public (as long as you have
96		`your_domain` DNS records pointed at the server's IP address)!
	98	=your_domain= DNS records pointed at the server's IP address)!
97	99
98		Next, I used [certbot](https://certbot.eff.org/) to issue an HTTPS certificate
99		for my domains using the following commands:
	100	Next, I used [[https://certbot.eff.org/][certbot]] to issue an HTTPS
	101	certificate for my domains using the following commands:
100	102
101		```sh
	103	#+begin_src sh
102	104	sudo apt install snapd; sudo snap install core; sudo snap refresh core
103	105	sudo snap install --classic certbot
104	106	sudo ln -s /snap/bin/certbot /usr/bin/certbot
105	107	sudo certbot --nginx
106		```
	108	#+end_src
107	109
108		Now that certbot ran successfully and updated my Nginx config files to include a
109		`443` server block of code, I went back in and edited the config file to include
110		security HTTP headers. This part is optional, but is recommended for security
111		purposes; you can even test a website's HTTP header security at
112		[Security Headers](https://securityheaders.com/).
	110	Now that certbot ran successfully and updated my Nginx config files to
	111	include a =443= server block of code, I went back in and edited the
	112	config file to include security HTTP headers. This part is optional, but
	113	is recommended for security purposes; you can even test a website's HTTP
	114	header security at [[https://securityheaders.com/][Security Headers]].
113	115
114		The configuration below shows a set-up where you only want your website to serve
115		content from its own domain, except for images and scripts, which may come from
116		`nullitics.com`. All other content would be blocked from loading in a browser.
	116	The configuration below shows a set-up where you only want your website
	117	to serve content from its own domain, except for images and scripts,
	118	which may come from =nullitics.com=. All other content would be blocked
	119	from loading in a browser.
117	120
118		```sh
	121	#+begin_src sh
119	122	sudo nano /etc/nginx/sites-available/your_domain
120		```
	123	#+end_src
121	124
122		```sh
	125	#+begin_src sh
123	126	server {
124	127	...
125	128	add_header Content-Security-Policy "default-src 'none'; img-src 'self' https://nullitics.com; script-src 'self' https://nullitics.com; style-src 'self'; font-src 'self'";
		@@ -130,46 +133,50 @@ server {
130	133	add_header Referrer-Policy "no-referrer";
131	134	...
132	135	}
133		```
	136	#+end_src
134	137
135		```sh
	138	#+begin_src sh
136	139	sudo systemctl restart nginx
137		```
138
139		### Nginx vs. Apache
140
141		As I stated at the beginning, my historical hesitation with trying Nginx was
142		that the differences in configuration formats scared me away from leaving
143		Apache.
144		However, I prefer Nginx to Apache for a few reasons:
145
146		1. Nginx uses only one config file (`your_domain`) vs. Apache's two-file
147		approach for HTTP vs. HTTPS (`your_domain.conf` and
148		`your_domain-le-ssl.conf`).
149		2. Symlinking new configurations files and reloading Nginx are way easier than
150		Apache's process of having to enable headers with `a2enmod mod_headers`,
151		enable PHP with `a2enmod php` (plus any other mods you need), and then
152		enabling sites with `a2ensite`, and THEN reloading Apache.
153		3. The contents of the Nginx config files seem more organized and logical with
154		the curly-bracket approach.
155		This is a minor reason, but everything just felt cleaner while I was
156		installing my sites and that had a big quality of life impact on the
157		installation for me.
158
159		They're both great software packages, but Nginx just seems more organized and
160		easier to use these days.
161		I will certainly be exploring the Nginx docs to see what other fun things I
162		can do with all of this.
163
164		## Gemini Server: Agate
165
166		![Agate status](https://img.cleberg.net/blog/20220216-migrating-to-debian-and-nginx/agate.png)
167
168		Finally, I set up the Agate software on this server again to host my Gemini
169		server content, using Rust as I have before.
170		You can read my other post for more information on installing Agate:
171		[Hosting a Gemini Server](https://cleberg.net/blog/hosting-a-gemini-server/).
172
173		All in all, Debian + Nginx is very slick and I prefer it over my old combination
174		of Ubuntu + Apache (although it's really just Nginx > Apache for me, since
175		Debian seems mostly the same as Ubuntu is so far).
	140	#+end_src
	141
	142	*** Nginx vs. Apache
	143	:PROPERTIES:
	144	:CUSTOM_ID: nginx-vs.-apache
	145	:END:
	146	As I stated at the beginning, my historical hesitation with trying Nginx
	147	was that the differences in configuration formats scared me away from
	148	leaving Apache. However, I prefer Nginx to Apache for a few reasons:
	149
	150	1. Nginx uses only one config file (=your_domain=) vs. Apache's two-file
	151	approach for HTTP vs. HTTPS (=your_domain.conf= and
	152	=your_domain-le-ssl.conf=).
	153	2. Symlinking new configurations files and reloading Nginx are way
	154	easier than Apache's process of having to enable headers with
	155	=a2enmod mod_headers=, enable PHP with =a2enmod php= (plus any other
	156	mods you need), and then enabling sites with =a2ensite=, and THEN
	157	reloading Apache.
	158	3. The contents of the Nginx config files seem more organized and
	159	logical with the curly-bracket approach. This is a minor reason, but
	160	everything just felt cleaner while I was installing my sites and that
	161	had a big quality of life impact on the installation for me.
	162
	163	They're both great software packages, but Nginx just seems more
	164	organized and easier to use these days. I will certainly be exploring
	165	the Nginx docs to see what other fun things I can do with all of this.
	166
	167	** Gemini Server: Agate
	168	:PROPERTIES:
	169	:CUSTOM_ID: gemini-server-agate
	170	:END:
	171	#+caption: Agate status
	172	[[https://img.cleberg.net/blog/20220216-migrating-to-debian-and-nginx/agate.png]]
	173
	174	Finally, I set up the Agate software on this server again to host my
	175	Gemini server content, using Rust as I have before. You can read my
	176	other post for more information on installing Agate:
	177	[[https://cleberg.net/blog/hosting-a-gemini-server/][Hosting a Gemini
	178	Server]].
	179
	180	All in all, Debian + Nginx is very slick and I prefer it over my old
	181	combination of Ubuntu + Apache (although it's really just Nginx > Apache
	182	for me, since Debian seems mostly the same as Ubuntu is so far).

blog/2022-02-17-exiftool.org +57 −53

		@@ -1,63 +1,67 @@
1		+++
2		date = 2022-02-17
3		title = "Stripping Image Metadata with exiftool"
4		description = "Become a h@ck3r (i.e., just protect your privacy) by using the exiftool command line package to strip metadata from images."
5		draft = false
6		+++
7
8		## Why Strip Metadata?
9
10		Okay, so you want to strip metadata from your photos. Perhaps you take pictures
11		of very rare birds, and the location metadata is a gold mine for poachers, or
12		perhaps you're just privacy-oriented like me and prefer to strip metadata from
13		publicly-available images.
14
15		There are various components of image metadata that you may want to delete
16		before releasing a photo to the public. Here's an incomplete list of things I
17		could easily see just by inspecting a photo on my laptop:
18
19		- Location (Latitude & Longitude)
20		- Dimensions
21		- Device Make & Model
22		- Color Space
23		- Color Profile
24		- Focal Length
25		- Alpha Channel
26		- Red Eye
27		- Metering Mode
28		- F Number
29
30		Regardless of your reasoning, I'm going to explain how I used the `exiftool`
31		package in Linux to automatically strip metadata from all images in a directory
32		(+ subdirectories).
33
34		## Installing `exiftool`
35
36		First things first: we need to install the tool. I'm running Debian 11 on my
37		server (Ubuntu will work the same), so the command is as simple as:
38
39		```sh
	1	#+title: Stripping Image Metadata with exiftool
	2	#+date: 2022-02-17
	3
	4	** Why Strip Metadata?
	5	:PROPERTIES:
	6	:CUSTOM_ID: why-strip-metadata
	7	:END:
	8	Okay, so you want to strip metadata from your photos. Perhaps you take
	9	pictures of very rare birds, and the location metadata is a gold mine
	10	for poachers, or perhaps you're just privacy-oriented like me and prefer
	11	to strip metadata from publicly-available images.
	12
	13	There are various components of image metadata that you may want to
	14	delete before releasing a photo to the public. Here's an incomplete list
	15	of things I could easily see just by inspecting a photo on my laptop:
	16
	17	- Location (Latitude & Longitude)
	18	- Dimensions
	19	- Device Make & Model
	20	- Color Space
	21	- Color Profile
	22	- Focal Length
	23	- Alpha Channel
	24	- Red Eye
	25	- Metering Mode
	26	- F Number
	27
	28	Regardless of your reasoning, I'm going to explain how I used the
	29	=exiftool= package in Linux to automatically strip metadata from all
	30	images in a directory (+ subdirectories).
	31
	32	** Installing =exiftool=
	33	:PROPERTIES:
	34	:CUSTOM_ID: installing-exiftool
	35	:END:
	36	First things first: we need to install the tool. I'm running Debian 11
	37	on my server (Ubuntu will work the same), so the command is as simple
	38	as:
	39
	40	#+begin_src sh
40	41	sudo apt install exiftool
41		```
	42	#+end_src
42	43
43	44	There are different tools that can accomplish the same thing across
44	45	distributions, but I really only care to test out this one package.
45	46
46		## Recursively Strip Data
47
48		I actually use this tool extensively to strip any photos uploaded to the website
49		that serves all the images for my blog (`img.cleberg.net`).
	47	** Recursively Strip Data
	48	:PROPERTIES:
	49	:CUSTOM_ID: recursively-strip-data
	50	:END:
	51	I actually use this tool extensively to strip any photos uploaded to the
	52	website that serves all the images for my blog (=img.cleberg.net=).
50	53
51		The following command is incredibly useful and can be modified to include any
52		image extensions that `exiftool` supports:
	54	The following command is incredibly useful and can be modified to
	55	include any image extensions that =exiftool= supports:
53	56
54		```sh
	57	#+begin_src sh
55	58	exiftool -r -all= -ext jpg -ext png /path/to/directory/
56		```
	59	#+end_src
57	60
58		See below for the results of my most recent usage of `exiftool` after I uploaded
59		the image for this blog post. You can see that the command will let you know how
60		many directories were scanned, how many images were updated, and how many images
61		were unchanged.
	61	See below for the results of my most recent usage of =exiftool= after I
	62	uploaded the image for this blog post. You can see that the command will
	63	let you know how many directories were scanned, how many images were
	64	updated, and how many images were unchanged.
62	65
63		![exiftool results](https://img.cleberg.net/blog/20220217-stripping-metadata-with-exiftool/exiftool.png)
	66	#+caption: exiftool results
	67	[[https://img.cleberg.net/blog/20220217-stripping-metadata-with-exiftool/exiftool.png]]

blog/2022-02-20-nginx-caching.org +65 −57

		@@ -1,23 +1,22 @@
1		+++
2		date = 2022-02-20
3		title = "Caching Static Content with Nginx"
4		description = "Learn how to cache static content client-side with Nginx configurations."
5		draft = false
6		+++
7
8		## Update Your Nginx Config to Cache Static Files
9
10		If you run a website on Nginx that serves static content (i.e., content that is
11		not dynamic and changing with interactions from the user), you would likely
12		benefit from caching that content on the client-side. If you're used to Apache
13		and looking for the Nginx equivalent, this post should help.
14
15		Luckily, setting up the cache is as easy as identifying the file types you want
16		to cache and determining the expiration length. To include more file types,
17		simply use the bar separator (`\|`) and type the new file extension you want to
18		include.
19
20		```config
	1	#+title: Caching Static Content with Nginx
	2	#+date: 2022-02-20
	3
	4	** Update Your Nginx Config to Cache Static Files
	5	:PROPERTIES:
	6	:CUSTOM_ID: update-your-nginx-config-to-cache-static-files
	7	:END:
	8	If you run a website on Nginx that serves static content (i.e., content
	9	that is not dynamic and changing with interactions from the user), you
	10	would likely benefit from caching that content on the client-side. If
	11	you're used to Apache and looking for the Nginx equivalent, this post
	12	should help.
	13
	14	Luckily, setting up the cache is as easy as identifying the file types
	15	you want to cache and determining the expiration length. To include more
	16	file types, simply use the bar separator (=\|=) and type the new file
	17	extension you want to include.
	18
	19	#+begin_src config
21	20	server {
22	21	...
23	22
		@@ -27,41 +26,50 @@ server {
27	26
28	27	...
29	28	}
30		```
31
32		I have seen some people who prefer to set `expires` as `365d` or even `max`, but
33		that is only for stable, infrequently changing websites.
34		As my site often changes (i.e., I'm never content with my website), I need
35		to know that my readers are seeing the new content without waiting too long.
36
37		So, I went ahead and set the expiration date at `30d`, which is short enough to
38		refresh for readers but long enough that clients/browsers won't be re-requesting
39		the static files too often, hopefully resulting in faster loading times, as
40		images should be the only thing slowing down my site.
41
42		## Testing Results
43
	29	#+end_src
	30
	31	I have seen some people who prefer to set =expires= as =365d= or even
	32	=max=, but that is only for stable, infrequently changing websites. As
	33	my site often changes (i.e., I'm never content with my website), I need
	34	to know that my readers are seeing the new content without waiting too
	35	long.
	36
	37	So, I went ahead and set the expiration date at =30d=, which is short
	38	enough to refresh for readers but long enough that clients/browsers
	39	won't be re-requesting the static files too often, hopefully resulting
	40	in faster loading times, as images should be the only thing slowing down
	41	my site.
	42
	43	** Testing Results
	44	:PROPERTIES:
	45	:CUSTOM_ID: testing-results
	46	:END:
44	47	To test my changes to the Nginx configuration, I used the
45		[HTTP Header Live](https://addons.mozilla.org/en-US/firefox/addon/http-header-live/)
46		extension on my Gecko browser and used the sidebar to inspect the headers of a
47		recent image from my blog.
48
49		In the image below, you can see that the `Cache-Control` header is now present
50		and set to 2592000, which is 30 days represented in seconds (30 days _ 24
51		hours/day _ 60 minutes/hour \* 60 seconds/minute = 2,592,000 seconds).
52
53		The `Expires` field is now showing 22 March 2022, which is 30 days from the day
54		of this post, 20 February 2022.
55
56		![Image Headers](https://img.cleberg.net/blog/20220220-caching-static-content-with-nginx/image_headers.png)
57
58		## Caveats
59
60		Remember that this caching system is client-side, which means that content
61		is only cached for as long as a client allows it. For example, my browser purges
62		all caches, data, etc. upon exit, so this caching policy will only work as long
63		as my browser remains open and running.
64
65		If you need to test updates to your site, you'll need to clear the cache to see
66		updates for any file extension you configured. This can often be done with the
67		`Shift + F5` or `Ctrl + F5` key combinations in most browsers.
	48	[[https://addons.mozilla.org/en-US/firefox/addon/http-header-live/][HTTP
	49	Header Live]] extension on my Gecko browser and used the sidebar to
	50	inspect the headers of a recent image from my blog.
	51
	52	In the image below, you can see that the =Cache-Control= header is now
	53	present and set to 2592000, which is 30 days represented in seconds (30
	54	days _ 24 hours/day _ 60 minutes/hour * 60 seconds/minute = 2,592,000
	55	seconds).
	56
	57	The =Expires= field is now showing 22 March 2022, which is 30 days from
	58	the day of this post, 20 February 2022.
	59
	60	#+caption: Image Headers
	61	[[https://img.cleberg.net/blog/20220220-caching-static-content-with-nginx/image_headers.png]]
	62
	63	** Caveats
	64	:PROPERTIES:
	65	:CUSTOM_ID: caveats
	66	:END:
	67	Remember that this caching system is client-side, which means that
	68	content is only cached for as long as a client allows it. For example,
	69	my browser purges all caches, data, etc. upon exit, so this caching
	70	policy will only work as long as my browser remains open and running.
	71
	72	If you need to test updates to your site, you'll need to clear the cache
	73	to see updates for any file extension you configured. This can often be
	74	done with the =Shift + F5= or =Ctrl + F5= key combinations in most
	75	browsers.

blog/2022-02-22-tuesday.org +30 −27

		@@ -1,35 +1,38 @@
1		+++
2		date = 2022-02-22
3		title = "Tuesday"
4		description = "Today is Tuesday, February 22nd, 2022 - also a ubiquitous six-digit palindrome date known as Twosday."
5		draft = false
6		+++
	1	#+title: Tuesday
	2	#+date: 2022-02-22
7	3
8		## Tuesday, Twosday
	4	** Tuesday, Twosday
	5	:PROPERTIES:
	6	:CUSTOM_ID: tuesday-twosday
	7	:END:
	8	I'm taking a break from my usual technology-related posts and writing
	9	about something a little more enjoyable today.
9	10
10		I'm taking a break from my usual technology-related posts and writing about
11		something a little more enjoyable today.
12
13		Today is Tuesday, February 22nd, 2022. Today is 02-22-2022. Today is Twosday.
	11	Today is Tuesday, February 22nd, 2022. Today is 02-22-2022. Today is
	12	Twosday.
14	13
15	14	Let's look at everything that fell in place today:
16	15
17		1. Written in the `m-dd-yy` or `dd-m-yy` formats, today is 2-22-22 or 22-2-22,
18		which is a neat little palindrome in either format. (The last ubiquitous
19		six-digit palindrome was 1-11-11.)
20		2. Today is Tuesday, which is why everyone is using the nickname Twosday to call
21		out these similarities.
	16	1. Written in the =m-dd-yy= or =dd-m-yy= formats, today is 2-22-22 or
	17	22-2-22, which is a neat little palindrome in either format. (The
	18	last ubiquitous six-digit palindrome was 1-11-11.)
	19	2. Today is Tuesday, which is why everyone is using the nickname Twosday
	20	to call out these similarities.
22	21	3. Falling on Tuesday means today is the 2nd day of the week (for most
23	22	cultures. For the US, it's the 3rd day of the week since we start on
24	23	Sunday).
25		4. The only culture I could find with a connection to a `2` is that some Slavic
26		languages derived their version of Tuesday from the Old Church Slavonic word
27		`въторъ`, meaning "the second."
28		5. Written in the classic monospaced, digital font (think of digital clocks from
29		the 80s/90s), there is nice symmetry to the numbers
30		([view the image here](https://img.cleberg.net/blog/20220222-tuesday/digital_font.png)!).
31		6. This one isn't naturally-occurring, but it seems people around the world are
32		celebrating the day. For example, a group is putting together
33		[a wedding of 222 couples at the California State Capitol in Sacramento](https://www.eventbrite.com/e/2-22-22-a-collective-wedding-ceremony-at-the-state-capitol-tickets-211434605597),
34		concluding at exactly 2:22 PM. These couples will record their marriage dates
35		as 2-22-22 2:22 PM. Tickets were on sale for $222.22.
	24	4. The only culture I could find with a connection to a =2= is that some
	25	Slavic languages derived their version of Tuesday from the Old Church
	26	Slavonic word =въторъ=, meaning "the second."
	27	5. Written in the classic monospaced, digital font (think of digital
	28	clocks from the 80s/90s), there is nice symmetry to the numbers
	29	([[https://img.cleberg.net/blog/20220222-tuesday/digital_font.png][view
	30	the image here]]!).
	31	6. This one isn't naturally-occurring, but it seems people around the
	32	world are celebrating the day. For example, a group is putting
	33	together
	34	[[https://www.eventbrite.com/e/2-22-22-a-collective-wedding-ceremony-at-the-state-capitol-tickets-211434605597][a
	35	wedding of 222 couples at the California State Capitol in
	36	Sacramento]], concluding at exactly 2:22 PM. These couples will
	37	record their marriage dates as 2-22-22 2:22 PM. Tickets were on sale
	38	for $222.22.

blog/2022-03-02-note-taking.org +132 −100

		@@ -1,125 +1,157 @@
1		+++
2		date = 2022-03-02
3		title = "Easy, Reliable Note-Taking"
4		description = "After years of testing, I have finally settled on maintaining my collection of personal notes and writings."
5		draft = false
6		+++
	1	#+title: Easy, Reliable Note-Taking
	2	#+date: 2022-03-02
7	3
8		## Choosing Durable File Formats
	4	** Choosing Durable File Formats
	5	:PROPERTIES:
	6	:CUSTOM_ID: choosing-durable-file-formats
	7	:END:
9	8
10		> TL;DR: Write in a format that can be easily rendered and read in plain-text
11		> mode (e.g., `.txt`, `.md`, etc.).
	9	#+begin_quote
	10	TL;DR: Write in a format that can be easily rendered and read in
	11	plain-text mode (e.g., =.txt=, =.md=, etc.).
	12
	13	#+end_quote
12	14
13	15	As I've written more and more over the years, I've found that my love of
14		note-taking is always growing. Everything I learn or need to remember can be
15		written down in a note and saved digitally, with no cost to myself. Unlike paper
16		copies that need physical storage space, digital files simply need space on your
17		local disk or cloud storage, which is fairly abundant these days.
	16	note-taking is always growing. Everything I learn or need to remember
	17	can be written down in a note and saved digitally, with no cost to
	18	myself. Unlike paper copies that need physical storage space, digital
	19	files simply need space on your local disk or cloud storage, which is
	20	fairly abundant these days.
18	21
19		However, I had a historical struggle with migration of notes between different
20		apps that require different formats and applied proprietary styling. This meant
21		that I had to go through each note during migration and edit the file to look
22		presentable again.
	22	However, I had a historical struggle with migration of notes between
	23	different apps that require different formats and applied proprietary
	24	styling. This meant that I had to go through each note during migration
	25	and edit the file to look presentable again.
23	26
24	27	For the last year or two, I have written everything exclusively in
25		[Markdown](https://en.wikipedia.org/wiki/Markdown) format. Small notes,
26		long-form writings, and even these blog posts are all written in Markdown.
27
28		Why Markdown? While I do appreciate the simplicity of plain-text files without
29		any formatting, I often need visual cues such as heading and code blocks to keep
30		my thoughts straight. Markdown provides a minimal set of styling indicators for
31		me to style my notes without adding any proprietary, embedded data into the
32		files. If I want a top-level heading, I simply add a hash (`#`) before the line.
33		An added bonus is that even if a system doesn't understand Markdown, it will
34		render it as plain-text and I can read it just as easily.
35
36		For example, here's how TextEdit on macOS will open and display a Markdown file
37		in plain-text, since it does contain any features to preview Markdown as HTML:
38
39		![Plain Text Markdown](https://img.cleberg.net/blog/20220302-easy-reliable-note-taking/plain_markdown.png)
40
41		## Saving & Syncing Files
42
43		In order to read and edit my notes across platforms, I use my personal cloud
44		storage through Tresorit due to its native integration with macOS and iOS file
45		managers. In addition, Tresorit works well on Debian-based Linux distros, which
46		I used before macOS (and will likely switch back to in a few years).
47
48		You can use whatever sync software you want - syncing plain-text or markdown
49		files is incredibly easy and fast, since the files are generally tiny.
50
51		Since the cloud storage syncs files automatically, there is no need for me to
52		sync anything manually or kick-off a sync job to update my files. This means
53		that I can edit on mobile, and it takes about 5-10 seconds to see the changes on
	28	[[https://en.wikipedia.org/wiki/Markdown][Markdown]] format. Small
	29	notes, long-form writings, and even these blog posts are all written in
	30	Markdown.
	31
	32	Why Markdown? While I do appreciate the simplicity of plain-text files
	33	without any formatting, I often need visual cues such as heading and
	34	code blocks to keep my thoughts straight. Markdown provides a minimal
	35	set of styling indicators for me to style my notes without adding any
	36	proprietary, embedded data into the files. If I want a top-level
	37	heading, I simply add a hash (=#=) before the line. An added bonus is
	38	that even if a system doesn't understand Markdown, it will render it as
	39	plain-text and I can read it just as easily.
	40
	41	For example, here's how TextEdit on macOS will open and display a
	42	Markdown file in plain-text, since it does contain any features to
	43	preview Markdown as HTML:
	44
	45	#+caption: Plain Text Markdown
	46	[[https://img.cleberg.net/blog/20220302-easy-reliable-note-taking/plain_markdown.png]]
	47
	48	** Saving & Syncing Files
	49	:PROPERTIES:
	50	:CUSTOM_ID: saving-syncing-files
	51	:END:
	52	In order to read and edit my notes across platforms, I use my personal
	53	cloud storage through Tresorit due to its native integration with macOS
	54	and iOS file managers. In addition, Tresorit works well on Debian-based
	55	Linux distros, which I used before macOS (and will likely switch back to
	56	in a few years).
	57
	58	You can use whatever sync software you want - syncing plain-text or
	59	markdown files is incredibly easy and fast, since the files are
	60	generally tiny.
	61
	62	Since the cloud storage syncs files automatically, there is no need for
	63	me to sync anything manually or kick-off a sync job to update my files.
	64	This means that I can edit on mobile, and it takes about 5-10 seconds to
	65	see the changes on desktop.
	66
	67	*** Version Control with Git
	68	:PROPERTIES:
	69	:CUSTOM_ID: version-control-with-git
	70	:END:
	71	A different approach I've contemplated is storing my notes and
	72	attachments is using a hosted Git repository to track changes to the
	73	files. However, I don't want to rely on an external service that could
	74	potentially see into my data, even if the repository is private.
	75
	76	I might just do =git init= locally and then commit my changes each time
	77	I write or update a note, but that seems to be a lot of work just for
	78	tracking changes - which I don't necessarily care to know.
	79
	80	*** Backups!
	81	:PROPERTIES:
	82	:CUSTOM_ID: backups
	83	:END:
	84	One small addition to the storage/sync conversation is the idea of
	85	backups. Personally, I manually create periodic backups of my entire
	86	cloud storage, compress it into an archive, and store it on my home
	87	server.
	88
	89	To improve my workflow, I am going to be exploring options to
	90	automatically compress the mounted cloud directory and send it over to
	91	my server on a set schedule.
	92
	93	** Writing on Desktop
	94	:PROPERTIES:
	95	:CUSTOM_ID: writing-on-desktop
	96	:END:
	97
	98	#+begin_quote
	99	Update (06.14.22): Since writing this post, I have reverted to simply
	100	keeping my =notes= folder open and opening notes individually in
	101	TextEdit for a more minimal and relaxing writing experience on the
54	102	desktop.
55	103
56		### Version Control with Git
57
58		A different approach I've contemplated is storing my notes and attachments is
59		using a hosted Git repository to track changes to the files. However, I don't
60		want to rely on an external service that could potentially see into my data,
61		even if the repository is private.
	104	#+end_quote
62	105
63		I might just do `git init` locally and then commit my changes each time I write
64		or update a note, but that seems to be a lot of work just for tracking changes -
65		which I don't necessarily care to know.
	106	The bulk of my writing occurs in a desktop environment, with a full
	107	keyboard layout and wide screen. I don't illustrate with a smart pen, I
	108	rarely use embedded images, and I love being able to see all of my
	109	notes/directories in a sidebar.
66	110
67		### Backups!
68
69		One small addition to the storage/sync conversation is the idea of backups.
70		Personally, I manually create periodic backups of my entire cloud storage,
71		compress it into an archive, and store it on my home server.
72
73		To improve my workflow, I am going to be exploring options to automatically
74		compress the mounted cloud directory and send it over to my server on a set
75		schedule.
76
77		## Writing on Desktop
78
79		> Update (06.14.22): Since writing this post, I have reverted to simply
80		> keeping my `notes` folder open and opening notes individually in TextEdit
81		> for a more minimal and relaxing writing experience on the desktop.
82
83		The bulk of my writing occurs in a desktop environment, with a full keyboard
84		layout and wide screen. I don't illustrate with a smart pen, I rarely use
85		embedded images, and I love being able to see all of my notes/directories in a
86		sidebar.
87
88		With this simple set of requirements, I chose [Obsidian](https://obsidian.md) as
89		my desktop text editor.
90		Obsidian has some in-depth tools like a graph view, command palette,
91		mentions, etc., but I've found that using it as a simple Markdown editor is
	111	With this simple set of requirements, I chose
	112	[[https://obsidian.md][Obsidian]] as my desktop text editor. Obsidian
	113	has some in-depth tools like a graph view, command palette, mentions,
	114	etc., but I've found that using it as a simple Markdown editor is
92	115	incredibly easy and straightforward.
93	116
94		Here's an example of how my Markdown notes look when opened in plain-text mode:
95
96		![Obsidian Markdown Source Mode](https://img.cleberg.net/blog/20220302-easy-reliable-note-taking/obsidian_source_mode.png)
97
98		Here's the "live preview" version, where the Markdown is rendered into its HTML
99		format:
	117	Here's an example of how my Markdown notes look when opened in
	118	plain-text mode:
100	119
101		![Obsidian Markdown Live Preview](https://img.cleberg.net/blog/20220302-easy-reliable-note-taking/obsidian_live_preview.png)
	120	#+caption: Obsidian Markdown Source Mode
	121	[[https://img.cleberg.net/blog/20220302-easy-reliable-note-taking/obsidian_source_mode.png]]
102	122
103		### Programming on Desktop
	123	Here's the "live preview" version, where the Markdown is rendered into
	124	its HTML format:
104	125
105		While I was writing this, I realized I should specify that I don't use the same
106		editor for writing notes and for writing code. For programming purposes, I use
107		[VSCodium](https://vscodium.com) as my development IDE.
	126	#+caption: Obsidian Markdown Live Preview
	127	[[https://img.cleberg.net/blog/20220302-easy-reliable-note-taking/obsidian_live_preview.png]]
108	128
109		## Writing on Mobile
	129	*** Programming on Desktop
	130	:PROPERTIES:
	131	:CUSTOM_ID: programming-on-desktop
	132	:END:
	133	While I was writing this, I realized I should specify that I don't use
	134	the same editor for writing notes and for writing code. For programming
	135	purposes, I use [[https://vscodium.com][VSCodium]] as my development
	136	IDE.
110	137
	138	** Writing on Mobile
	139	:PROPERTIES:
	140	:CUSTOM_ID: writing-on-mobile
	141	:END:
111	142	Personally, I write very little on mobile, except when needing to take
112		important notes on-the-go. Any long-form writing, journals, etc. are done at
113		home, where I always have my laptop available.
	143	important notes on-the-go. Any long-form writing, journals, etc. are
	144	done at home, where I always have my laptop available.
114	145
115	146	I wanted a simple and foolproof editor for iOS, preferably open-source.
116		After a long journey of testing the few (& terrible) open-source iOS
	147	After a long journey of testing the few (& terrible) open-source iOS
117	148	note-taking apps, I finally found a phenomenal one:
118		[Runestone](https://github.com/simonbs/runestone). This app is fantastic
119		for note-taking, has plenty of optional features, and integrates natively
120		with the iOS file manager.
	149	[[https://github.com/simonbs/runestone][Runestone]]. This app is
	150	fantastic for note-taking, has plenty of optional features, and
	151	integrates natively with the iOS file manager.
121	152
122		This app opens the iOS file manager and allows you to click any file you want,
123		opens it up in an editor, and lets me save and close out of that note.
	153	This app opens the iOS file manager and allows you to click any file you
	154	want, opens it up in an editor, and lets me save and close out of that
	155	note.
124	156
125	157	Quite simple but effective.

blog/2022-03-03-financial-database.org +173 −154

		@@ -1,153 +1,166 @@
1		+++
2		date = 2022-03-03
3		title = "Maintaining a Personal Financial Database"
4		description = "Detailing my process for creating, maintaining, and utilizing a personal financial database."
5		draft = false
6		+++
7
8		## Personal Financial Tracking
9
10		For the last 6-ish years, I've tracked my finances in a spreadsheet. This is
11		common practice in the business world, but any good dev will cringe at the
12		thought of storing long-term data in a spreadsheet. A spreadsheet is not for
13		long-term storage or as a source of data to pull data/reports.
14
15		As I wanted to expand the functionality of my financial data (e.g., adding more
16		reports), I decided to migrate the data into a database. To run reports, I would
17		query the database and use a language like Python or Javascript to process the
18		data, perform calculations, and visualize the data.
19
20		## SQLite
21
22		When choosing the type of database I wanted to use for this project, I was split
23		between three options:
24
25		1. MySQL: The database I have the most experience with and have used for years.
	1	#+title: Maintaining a Personal Financial Database
	2	#+date: 2022-03-03
	3
	4	** Personal Financial Tracking
	5	:PROPERTIES:
	6	:CUSTOM_ID: personal-financial-tracking
	7	:END:
	8	For the last 6-ish years, I've tracked my finances in a spreadsheet.
	9	This is common practice in the business world, but any good dev will
	10	cringe at the thought of storing long-term data in a spreadsheet. A
	11	spreadsheet is not for long-term storage or as a source of data to pull
	12	data/reports.
	13
	14	As I wanted to expand the functionality of my financial data (e.g.,
	15	adding more reports), I decided to migrate the data into a database. To
	16	run reports, I would query the database and use a language like Python
	17	or Javascript to process the data, perform calculations, and visualize
	18	the data.
	19
	20	** SQLite
	21	:PROPERTIES:
	22	:CUSTOM_ID: sqlite
	23	:END:
	24	When choosing the type of database I wanted to use for this project, I
	25	was split between three options:
	26
	27	1. MySQL: The database I have the most experience with and have used for
	28	years.
26	29	2. PostgreSQL: A database I'm new to, but want to learn.
27		3. SQLite: A database that I've used for a couple projects and have moderate
28		experience.
29
30		I ended up choosing SQLite since it can be maintained within a single `.sqlite`
31		file, which allows me more flexibility for storage and backup. I keep this file
32		in my cloud storage and pull it up whenever needed.
33
34		### GUI Editing
35
36		Since I didn't want to try and import 1000–1500 records into my new database
37		via the command line, I opted to use
38		[DB Browser for SQLite (DB4S)](https://sqlitebrowser.org/) as a GUI tool. This
39		application is excellent, and I don't see myself going back to the CLI
40		when working in this database.
	30	3. SQLite: A database that I've used for a couple projects and have
	31	moderate experience.
	32
	33	I ended up choosing SQLite since it can be maintained within a single
	34	=.sqlite= file, which allows me more flexibility for storage and backup.
	35	I keep this file in my cloud storage and pull it up whenever needed.
	36
	37	*** GUI Editing
	38	:PROPERTIES:
	39	:CUSTOM_ID: gui-editing
	40	:END:
	41	Since I didn't want to try and import 1000--1500 records into my new
	42	database via the command line, I opted to use
	43	[[https://sqlitebrowser.org/][DB Browser for SQLite (DB4S)]] as a GUI
	44	tool. This application is excellent, and I don't see myself going back
	45	to the CLI when working in this database.
41	46
42	47	DB4S allows you to copy a range of cells from a spreadsheet and paste it
43		straight into the SQL table. I used this process for all 36 accounts, 1290
44		account statements, and 126 pay statements. Overall, I'm guessing this took
45		anywhere between 4–8 hours. In comparison, it probably took me 2-3 days to
46		initially create the spreadsheet.
	48	straight into the SQL table. I used this process for all 36 accounts,
	49	1290 account statements, and 126 pay statements. Overall, I'm guessing
	50	this took anywhere between 4--8 hours. In comparison, it probably took
	51	me 2-3 days to initially create the spreadsheet.
47	52
48		![DB4S](https://img.cleberg.net/blog/20220303-maintaining-a-personal-financial-database/db4s.png)
	53	#+caption: DB4S
	54	[[https://img.cleberg.net/blog/20220303-maintaining-a-personal-financial-database/db4s.png]]
49	55
50		### Schema
51
52		The schema for this database is actually extremely simple and involves only
53		three tables (for now):
	56	*** Schema
	57	:PROPERTIES:
	58	:CUSTOM_ID: schema
	59	:END:
	60	The schema for this database is actually extremely simple and involves
	61	only three tables (for now):
54	62
55	63	1. Accounts
56	64	2. Statements
57	65	3. Payroll
58	66
59		Accounts
	67	Accounts
60	68
61		The Accounts table contains summary information about an account, such as a car
62		loan or a credit card. By viewing this table, you can find high-level data, such
63		as interest rate, credit line, or owner.
	69	The Accounts table contains summary information about an account, such
	70	as a car loan or a credit card. By viewing this table, you can find
	71	high-level data, such as interest rate, credit line, or owner.
64	72
65		```sql
	73	#+begin_src sql
66	74	CREATE TABLE "Accounts" (
67		"AccountID" INTEGER NOT NULL UNIQUE,
68		"AccountType" TEXT,
69		"AccountName" TEXT,
70		"InterestRate" NUMERIC,
71		"CreditLine" NUMERIC,
72		"State" TEXT,
73		"Owner" TEXT,
74		"Co-Owner" TEXT,
75		PRIMARY KEY("AccountID" AUTOINCREMENT)
	75	"AccountID" INTEGER NOT NULL UNIQUE,
	76	"AccountType" TEXT,
	77	"AccountName" TEXT,
	78	"InterestRate" NUMERIC,
	79	"CreditLine" NUMERIC,
	80	"State" TEXT,
	81	"Owner" TEXT,
	82	"Co-Owner" TEXT,
	83	PRIMARY KEY("AccountID" AUTOINCREMENT)
76	84	)
77		```
	85	#+end_src
78	86
79		Statements
	87	Statements
80	88
81		The Statements table uses the same unique identifier as the Accounts table,
82		meaning you can join the tables to find a monthly statement for any of the
83		accounts listed in the Accounts table. Each statement has an account ID,
84		statement date, and total balance.
	89	The Statements table uses the same unique identifier as the Accounts
	90	table, meaning you can join the tables to find a monthly statement for
	91	any of the accounts listed in the Accounts table. Each statement has an
	92	account ID, statement date, and total balance.
85	93
86		```sql
	94	#+begin_src sql
87	95	CREATE TABLE "Statements" (
88		"StatementID" INTEGER NOT NULL UNIQUE,
89		"AccountID" INTEGER,
90		"StatementDate" INTEGER,
91		"Balance" NUMERIC,
92		PRIMARY KEY("StatementID" AUTOINCREMENT),
93		FOREIGN KEY("AccountID") REFERENCES "Accounts"("AccountID")
	96	"StatementID" INTEGER NOT NULL UNIQUE,
	97	"AccountID" INTEGER,
	98	"StatementDate" INTEGER,
	99	"Balance" NUMERIC,
	100	PRIMARY KEY("StatementID" AUTOINCREMENT),
	101	FOREIGN KEY("AccountID") REFERENCES "Accounts"("AccountID")
94	102	)
95		```
	103	#+end_src
96	104
97		Payroll
	105	Payroll
98	106
99		The Payroll table is a separate entity, unrelated to the Accounts or Statements
100		tables. This table contains all information you would find on a pay statement
101		from an employer. As you change employers or obtain new perks/benefits, just add
102		new columns to adapt to the new data.
	107	The Payroll table is a separate entity, unrelated to the Accounts or
	108	Statements tables. This table contains all information you would find on
	109	a pay statement from an employer. As you change employers or obtain new
	110	perks/benefits, just add new columns to adapt to the new data.
103	111
104		```sql
	112	#+begin_src sql
105	113	CREATE TABLE "Payroll" (
106		"PaycheckID" INTEGER NOT NULL UNIQUE,
107		"PayDate" TEXT,
108		"Payee" TEXT,
109		"Employer" TEXT,
110		"JobTitle" TEXT,
111		"IncomeRegular" NUMERIC,
112		"IncomePTO" NUMERIC,
113		"IncomeHoliday" NUMERIC,
114		"IncomeBonus" NUMERIC,
115		"IncomePTOPayout" NUMERIC,
116		"IncomeReimbursements" NUMERIC,
117		"FringeHSA" NUMERIC,
118		"FringeStudentLoan" NUMERIC,
119		"Fringe401k" NUMERIC,
120		"PreTaxMedical" NUMERIC,
121		"PreTaxDental" NUMERIC,
122		"PreTaxVision" NUMERIC,
123		"PreTaxLifeInsurance" NUMERIC,
124		"PreTax401k" NUMERIC,
125		"PreTaxParking" NUMERIC,
126		"PreTaxStudentLoan" NUMERIC,
127		"PreTaxOther" NUMERIC,
128		"TaxFederal" NUMERIC,
129		"TaxSocial" NUMERIC,
130		"TaxMedicare" NUMERIC,
131		"TaxState" NUMERIC,
132		PRIMARY KEY("PaycheckID" AUTOINCREMENT)
	114	"PaycheckID" INTEGER NOT NULL UNIQUE,
	115	"PayDate" TEXT,
	116	"Payee" TEXT,
	117	"Employer" TEXT,
	118	"JobTitle" TEXT,
	119	"IncomeRegular" NUMERIC,
	120	"IncomePTO" NUMERIC,
	121	"IncomeHoliday" NUMERIC,
	122	"IncomeBonus" NUMERIC,
	123	"IncomePTOPayout" NUMERIC,
	124	"IncomeReimbursements" NUMERIC,
	125	"FringeHSA" NUMERIC,
	126	"FringeStudentLoan" NUMERIC,
	127	"Fringe401k" NUMERIC,
	128	"PreTaxMedical" NUMERIC,
	129	"PreTaxDental" NUMERIC,
	130	"PreTaxVision" NUMERIC,
	131	"PreTaxLifeInsurance" NUMERIC,
	132	"PreTax401k" NUMERIC,
	133	"PreTaxParking" NUMERIC,
	134	"PreTaxStudentLoan" NUMERIC,
	135	"PreTaxOther" NUMERIC,
	136	"TaxFederal" NUMERIC,
	137	"TaxSocial" NUMERIC,
	138	"TaxMedicare" NUMERIC,
	139	"TaxState" NUMERIC,
	140	PRIMARY KEY("PaycheckID" AUTOINCREMENT)
133	141	)
134		```
135
136		### Python Reporting
137
138		Once I created the database tables and imported all my data, the only step left
139		was to create a process to report and visualize on various aspects of the data.
140
141		In order to explore and create the reports I'm interested in, I utilized a
142		two-part process involving Jupyter Notebooks and Python scripts.
143
144		#### Step 1: Jupyter Notebooks
145
	142	#+end_src
	143
	144	*** Python Reporting
	145	:PROPERTIES:
	146	:CUSTOM_ID: python-reporting
	147	:END:
	148	Once I created the database tables and imported all my data, the only
	149	step left was to create a process to report and visualize on various
	150	aspects of the data.
	151
	152	In order to explore and create the reports I'm interested in, I utilized
	153	a two-part process involving Jupyter Notebooks and Python scripts.
	154
	155	**** Step 1: Jupyter Notebooks
	156	:PROPERTIES:
	157	:CUSTOM_ID: step-1-jupyter-notebooks
	158	:END:
146	159	When I need to explore data, try different things, and re-run my code
147		cell-by-cell, I use Jupyter Notebooks. For example, I explored the `Accounts`
148		table until I found the following useful information:
	160	cell-by-cell, I use Jupyter Notebooks. For example, I explored the
	161	=Accounts= table until I found the following useful information:
149	162
150		```python
	163	#+begin_src python
151	164	import sqlite3
152	165	import pandas as pd
153	166	import matplotlib
		@@ -167,14 +180,17 @@ matplotlib.rcParams['legend.labelcolor'] = 'black'
167	180
168	181	# Display graph
169	182	df.groupby(['AccountType']).sum().plot.pie(title='Credit Line by Account Type', y='CreditLine', figsize=(5,5), autopct='%1.1f%%')
170		```
171
172		#### Step 2: Python Scripts
	183	#+end_src
173	184
174		Once I explored enough through the notebooks and had a list of reports I wanted,
175		I moved on to create a Python project with the following structure:
	185	**** Step 2: Python Scripts
	186	:PROPERTIES:
	187	:CUSTOM_ID: step-2-python-scripts
	188	:END:
	189	Once I explored enough through the notebooks and had a list of reports I
	190	wanted, I moved on to create a Python project with the following
	191	structure:
176	192
177		```
	193	#+begin_example
178	194	finance/
179	195	├── notebooks/
180	196	│ │ ├── account_summary.ipynb
		@@ -191,23 +207,24 @@ finance/
191	207	├── process.py
192	208	├── requirements.txt
193	209	└── README.md
194		```
	210	#+end_example
195	211
196	212	This structure allows me to:
197	213
198		1. Compile all required python packages into `requirements.txt` for easy
	214	1. Compile all required python packages into =requirements.txt= for easy
199	215	installation if I move to a new machine.
200		2. Activate a virtual environment in `venv/` so I don't need to maintain a
201		system-wide Python environment just for this project.
202		3. Keep my `notebooks/` folder to continuously explore the data as I see fit.
203		4. Maintain a local copy of the database in `src/` for easy access.
204		5. Export reports, images, HTML files, etc. to `public/`.
205
206		Now, onto the differences between the code in a Jupyter Notebook and the actual
207		Python files. To create the report in the Notebook snippet above, I created the
208		following function inside `process.py`:
209
210		```python
	216	2. Activate a virtual environment in =venv/= so I don't need to maintain
	217	a system-wide Python environment just for this project.
	218	3. Keep my =notebooks/= folder to continuously explore the data as I see
	219	fit.
	220	4. Maintain a local copy of the database in =src/= for easy access.
	221	5. Export reports, images, HTML files, etc. to =public/=.
	222
	223	Now, onto the differences between the code in a Jupyter Notebook and the
	224	actual Python files. To create the report in the Notebook snippet above,
	225	I created the following function inside =process.py=:
	226
	227	#+begin_src python
211	228	# Create summary pie chart
212	229	def summary_data(accounts: pandas.DataFrame) -> None:
213	230	accounts_01 = accounts[accounts["Owner"] == "Person01"]
		@@ -233,21 +250,23 @@ def summary_data(accounts: pandas.DataFrame) -> None:
233	250	)
234	251	)
235	252	summary_chart.figure.savefig(f"public/summary_chart_{x}.png", dpi=1200)
236		```
	253	#+end_src
237	254
238	255	The result? A high-quality pie chart that is read directly by the
239		`public/index.html` template I use.
	256	=public/index.html= template I use.
240	257
241		![Summary Pie Chart](https://img.cleberg.net/blog/20220303-maintaining-a-personal-financial-database/summary_chart.png)
	258	#+caption: Summary Pie Chart
	259	[[https://img.cleberg.net/blog/20220303-maintaining-a-personal-financial-database/summary_chart.png]]
242	260
243	261	Other charts generated by this project include:
244	262
245		- Charts of account balances over time.
246		- Line chart of effective tax rate (taxes divided by taxable income).
247		- Salary projections and error limits using past income and inflation rates.
248		- Multi-line chart of gross income, taxable income, and net income.
	263	- Charts of account balances over time.
	264	- Line chart of effective tax rate (taxes divided by taxable income).
	265	- Salary projections and error limits using past income and inflation
	266	rates.
	267	- Multi-line chart of gross income, taxable income, and net income.
249	268
250		The best thing about this project? I can improve it at any given time, shaping
251		it into whatever helps me the most for that time. I imagine that I will be
252		introducing an asset tracking table soon to track the depreciating value of
253		cars, houses, etc. Who knows what's next?
	269	The best thing about this project? I can improve it at any given time,
	270	shaping it into whatever helps me the most for that time. I imagine that
	271	I will be introducing an asset tracking table soon to track the
	272	depreciating value of cars, houses, etc. Who knows what's next?

blog/2022-03-08-plex-migration.org +199 −162

		@@ -1,233 +1,270 @@
1		+++
2		date = 2022-03-08
3		title = "Migrating Plex to New Server (+ Nvidia Transcoding)"
4		description = "A quick instructional guide on how to migrate Plex Media Server to a new server, including servers with Nvidia GPUs."
5		draft = false
6		+++
7
8		## Migration Phases
9
10		I recently decided to migrate my server from an old OptiPlex desktop machine to
11		a custom-built tower with better hardware in every category. In order to do
12		this, I would need to properly migrate a full Plex installation.
13
14		The second part of this migration is that the new server uses an Nvidia GPU and
15		does not have any integrated graphics, which requires extra work for
16		installation, but provides much better hardware transcoding options for Plex.
	1	#+title: Migrating Plex to New Server (+ Nvidia Transcoding)
	2	#+date: 2022-03-08
	3
	4	** Migration Phases
	5	:PROPERTIES:
	6	:CUSTOM_ID: migration-phases
	7	:END:
	8	I recently decided to migrate my server from an old OptiPlex desktop
	9	machine to a custom-built tower with better hardware in every category.
	10	In order to do this, I would need to properly migrate a full Plex
	11	installation.
	12
	13	The second part of this migration is that the new server uses an Nvidia
	14	GPU and does not have any integrated graphics, which requires extra work
	15	for installation, but provides much better hardware transcoding options
	16	for Plex.
17	17
18	18	Therefore, I have broken this migration down into three phases:
19	19
20		1. [Configure the New Server](#phase-1-configure-the-new-server)
21		2. [Migrate Plex Data & Devices](#phase-2-migrate-plex-data-devices)
22		3. [Configure GPU Transcoding](#phase-3-configure-gpu-transcoding)
23
24		---
	20	1. [[#phase-1-configure-the-new-server][Configure the New Server]]
	21	2. [[#phase-2-migrate-plex-data-devices][Migrate Plex Data & Devices]]
	22	3. [[#phase-3-configure-gpu-transcoding][Configure GPU Transcoding]]
25	23
26		## Phase 1: Configure the New Server
27
28		### Choosing an OS
	24	--------------
29	25
	26	** Phase 1: Configure the New Server
	27	:PROPERTIES:
	28	:CUSTOM_ID: phase-1-configure-the-new-server
	29	:END:
	30	*** Choosing an OS
	31	:PROPERTIES:
	32	:CUSTOM_ID: choosing-an-os
	33	:END:
30	34	In order to migrate Plex to my new server, I first needed to choose an
31		appropriate operating system (OS) and install it on the machine. Given that I
32		have encountered numerous issues installing other Linux distributions
33		properly with Nvidia graphics, I chose
34		[Ubuntu Server](https://ubuntu.com/download/server).
35
36		The first step is to create a bootable USB with Ubuntu Server. This is easy with
37		[Etcher](https://www.balena.io/etcher/), an app that runs on many different
38		platforms. Just download the Ubuntu Server `.iso` image, launch Etcher, and
39		install the `.iso` on the USB.
40
41		Once the USB is created, insert it into my server, reboot, and click `Esc` (or
42		any of the `F1-12` keys) until the BIOS menu appears. Finally, launch the USB
43		boot drive.
44
45		### Booting with Nvidia
46
	35	appropriate operating system (OS) and install it on the machine. Given
	36	that I have encountered numerous issues installing other Linux
	37	distributions properly with Nvidia graphics, I chose
	38	[[https://ubuntu.com/download/server][Ubuntu Server]].
	39
	40	The first step is to create a bootable USB with Ubuntu Server. This is
	41	easy with [[https://www.balena.io/etcher/][Etcher]], an app that runs on
	42	many different platforms. Just download the Ubuntu Server =.iso= image,
	43	launch Etcher, and install the =.iso= on the USB.
	44
	45	Once the USB is created, insert it into my server, reboot, and click
	46	=Esc= (or any of the =F1-12= keys) until the BIOS menu appears. Finally,
	47	launch the USB boot drive.
	48
	49	*** Booting with Nvidia
	50	:PROPERTIES:
	51	:CUSTOM_ID: booting-with-nvidia
	52	:END:
47	53	In order to install Ubuntu Server with an Nvidia Graphics card (and no
48		integrated graphics on this device for some reason), you'll have to configure
49		the boot menu to allow different graphics drivers to be loaded.
	54	integrated graphics on this device for some reason), you'll have to
	55	configure the boot menu to allow different graphics drivers to be
	56	loaded.
50	57
51		When booting from the USB, the machine will launch the initial installation
52		menu. From this menu, type `e` to view the default command options that come
53		with the device - it's a good idea to take a photo of this screen, so you can
54		enter these commands on the next screen (along with adding support for Nvidia).
	58	When booting from the USB, the machine will launch the initial
	59	installation menu. From this menu, type =e= to view the default command
	60	options that come with the device - it's a good idea to take a photo of
	61	this screen, so you can enter these commands on the next screen (along
	62	with adding support for Nvidia).
55	63
56		Finally, type `Ctrl + C` to enter the command line. From this command line,
57		enter the commands found on the `e` screen. **Remember to add `nomodeset` to the
58		`linux ...` line so that your Nvidia device will display the installation
59		screens properly!**
	64	Finally, type =Ctrl + C= to enter the command line. From this command
	65	line, enter the commands found on the =e= screen. *Remember to add
	66	=nomodeset= to the =linux ...= line so that your Nvidia device will
	67	display the installation screens properly!*
60	68
61		Here's an example of the commands I pulled from the `e` screen and entered on
62		the command line.
	69	Here's an example of the commands I pulled from the =e= screen and
	70	entered on the command line.
63	71
64		```sh
	72	#+begin_src sh
65	73	setparams 'Install Ubuntu Server'
66	74	setgfxpayload=keep
67	75	linux /casper/vmlinuz quiet nomodeset ---
68	76	initrd /casper/initrd
69	77	boot
70		```
	78	#+end_src
71	79
72		![Ubuntu Server Installation 01](https://img.cleberg.net/blog/20220308-plex-media-server-migration/ubuntu_server_installation_01.png)
	80	#+caption: Ubuntu Server Installation 01
	81	[[https://img.cleberg.net/blog/20220308-plex-media-server-migration/ubuntu_server_installation_01.png]]
73	82
74		![Ubuntu Server Installation 02](https://img.cleberg.net/blog/20220308-plex-media-server-migration/ubuntu_server_installation_02.png)
	83	#+caption: Ubuntu Server Installation 02
	84	[[https://img.cleberg.net/blog/20220308-plex-media-server-migration/ubuntu_server_installation_02.png]]
75	85
76		Once the machine is rebooted, enter the `e` screen again and add `nomodeset` to
77		the `linux ...` line again and press `Ctrl + X` to save the boot options.
	86	Once the machine is rebooted, enter the =e= screen again and add
	87	=nomodeset= to the =linux ...= line again and press =Ctrl + X= to save
	88	the boot options.
78	89
79		The machine is now fully installed and can properly display on an external
80		display using the Nvidia GPU.
	90	The machine is now fully installed and can properly display on an
	91	external display using the Nvidia GPU.
81	92
82	93	Always remember to update and upgrade on a new installation:
83	94
84		```sh
	95	#+begin_src sh
85	96	sudo apt update; sudo apt upgrade -y; sudo apt autoremove -y
86		```
	97	#+end_src
87	98
88		---
89
90		## Phase 2: Migrate Plex Data & Devices
	99	--------------
91	100
	101	** Phase 2: Migrate Plex Data & Devices
	102	:PROPERTIES:
	103	:CUSTOM_ID: phase-2-migrate-plex-data-devices
	104	:END:
92	105	This phase uses the great Plex article on migrations
93		([Move an Installation to Another System](https://support.plex.tv/articles/201370363-move-an-install-to-another-system/))
94		and adds a bit more information to help with commands and context.
95
96		### Terminology
97
98		Source: The original server that is being replaced.
99		Destination: The new server.
100		Client: Any application that can be used to modify settings for both
	106	([[https://support.plex.tv/articles/201370363-move-an-install-to-another-system/][Move
	107	an Installation to Another System]]) and adds a bit more information to
	108	help with commands and context.
	109
	110	*** Terminology
	111	:PROPERTIES:
	112	:CUSTOM_ID: terminology
	113	:END:
	114	Source: The original server that is being replaced.\\
	115	Destination: The new server.\\
	116	Client: Any application that can be used to modify settings for both
101	117	source/destination.
102	118
103		### Step 01: [Client] Update Settings
104
105		Open up a Plex app and _disable_ the `Account` > `Library` >
106		`Empty trash automatically after every scan` preference for the source server.
107
108		### Step 02: [Destination] Install Plex
109
110		Open up the
111		[Plex Media Server download page](https://www.plex.tv/media-server-downloads/)
112		and copy the link for the appropriate platform.
113
114		Execute the following commands on the destination server to install Plex:
115
116		```sh
	119	*** Step 01: [Client] Update Settings
	120	:PROPERTIES:
	121	:CUSTOM_ID: step-01-client-update-settings
	122	:END:
	123	Open up a Plex app and /disable/ the =Account= > =Library= >
	124	=Empty trash automatically after every scan= preference for the source
	125	server.
	126
	127	*** Step 02: [Destination] Install Plex
	128	:PROPERTIES:
	129	:CUSTOM_ID: step-02-destination-install-plex
	130	:END:
	131	Open up the [[https://www.plex.tv/media-server-downloads/][Plex Media
	132	Server download page]] and copy the link for the appropriate platform.
	133
	134	Execute the following commands on the destination server to install
	135	Plex:
	136
	137	#+begin_src sh
117	138	wget <url>
118	139	sudo dpkg -i <filename>
119	140	sudo systemctl stop plexmediaserver.service
120		```
121
122		### Step 03: [Source] Stop Plex & Migrate Data
	141	#+end_src
123	142
124		First, stop the Plex service so that no data is created or modified during the
125		migration.
	143	*** Step 03: [Source] Stop Plex & Migrate Data
	144	:PROPERTIES:
	145	:CUSTOM_ID: step-03-source-stop-plex-migrate-data
	146	:END:
	147	First, stop the Plex service so that no data is created or modified
	148	during the migration.
126	149
127		```sh
	150	#+begin_src sh
128	151	sudo systemctl stop plexmediaserver.service
129		```
	152	#+end_src
130	153
131		Next, copy the data to the new server. To find where the Plex data directory is
132		located, Plex has another excellent article available:
133		[Where is the Plex Media Server data directory located?](https://support.plex.tv/articles/202915258-where-is-the-plex-media-server-data-directory-located/).
	154	Next, copy the data to the new server. To find where the Plex data
	155	directory is located, Plex has another excellent article available:
	156	[[https://support.plex.tv/articles/202915258-where-is-the-plex-media-server-data-directory-located/][Where
	157	is the Plex Media Server data directory located?]].
134	158
135		There are many ways to copy the data to the new server and will largely depend
136		on the size of the folder being copied. Personally, my data folder was ~23GB and
137		I opted to simply use the `scp` command to copy the files over SSH.
	159	There are many ways to copy the data to the new server and will largely
	160	depend on the size of the folder being copied. Personally, my data
	161	folder was ~23GB and I opted to simply use the =scp= command to copy the
	162	files over SSH.
138	163
139		This process was throttled by the old server's slow HDD and ports and took
140		approximately 90 minutes to complete. In comparison, moving the data from the
141		new server's `home/user/` directory to the `/var/.../Plex Media Server`
142		directory took 2-3 minutes.
	164	This process was throttled by the old server's slow HDD and ports and
	165	took approximately 90 minutes to complete. In comparison, moving the
	166	data from the new server's =home/user/= directory to the
	167	=/var/.../Plex Media Server= directory took 2-3 minutes.
143	168
144		```sh
	169	#+begin_src sh
145	170	scp -r "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server" your_user@xxx.xxx.xxx.xxx:"'/path/to/destination/'"
146		```
	171	#+end_src
147	172
148		### Step 04: [Destination] Update File Permissions
	173	*** Step 04: [Destination] Update File Permissions
	174	:PROPERTIES:
	175	:CUSTOM_ID: step-04-destination-update-file-permissions
	176	:END:
	177	In case you move the data directory to a common area on the new server,
	178	it will have to be moved to the proper location before Plex can function
	179	properly:
149	180
150		In case you move the data directory to a common area on the new server, it will
151		have to be moved to the proper location before Plex can function properly:
152
153		```sh
	181	#+begin_src sh
154	182	mv "Plex Media Server" /var/lib/plexmediaserver/Library/Application Support/
155		```
	183	#+end_src
156	184
157		To ensure permissions were retained properly, the server will need to show that
158		all files and folders in the data directory are owned by `plex:plex` (or
159		whichever user is running the Plex application).
	185	To ensure permissions were retained properly, the server will need to
	186	show that all files and folders in the data directory are owned by
	187	=plex:plex= (or whichever user is running the Plex application).
160	188
161		```sh
	189	#+begin_src sh
162	190	sudo chown -R plex:plex "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server"
163		```
	191	#+end_src
164	192
165	193	Finally, start the service and check the status.
166	194
167		```sh
	195	#+begin_src sh
168	196	sudo systemctl start plexmediaserver.service
169	197	sudo systemctl status plexmediaserver.service
170		```
171
172		### Step 05: [Client] Update Libraries & Metadata
173
174		The first step - now that the new server is up and running - is to sign out of
175		the client and sign back in. Once this is done, update any library locations, if
176		necessary. This was unnecessary in my case since I simply moved my storage
177		drives from the source server to the destination server.
	198	#+end_src
	199
	200	*** Step 05: [Client] Update Libraries & Metadata
	201	:PROPERTIES:
	202	:CUSTOM_ID: step-05-client-update-libraries-metadata
	203	:END:
	204	The first step - now that the new server is up and running - is to sign
	205	out of the client and sign back in. Once this is done, update any
	206	library locations, if necessary. This was unnecessary in my case since I
	207	simply moved my storage drives from the source server to the destination
	208	server.
178	209
179	210	Next, perform the following actions in the client:
180	211
181		1. On the left sidebar, click `More` > Three-Dot Menu > `Scan Library Files`
182		2. _Enable_ the `Account` > `Library` >
183		`Empty trash automatically after every scan` preference for the source
184		server.
185		3. On the left sidebar, click `More` > Three-Dot Menu > `Manage Server` >
186		`Empty Trash`
187		4. On the left sidebar, click `More` > Three-Dot Menu > `Manage Server` >
188		`Clean Bundles`
189		5. On the left sidebar, click `More` > Three-Dot Menu > `Manage Server` >
190		`Optimize Database`
191
192		Finally, double-check the Remote Access settings to make sure no changes have
193		caused issues with accessing the server from outside the network.
194
195		In my case, I use a single port forwarding rule in my router and needed to
196		update the Local LAN IP Address to the new server IP address.
197
198		![Router port forwarding](https://img.cleberg.net/blog/20220308-plex-media-server-migration/port_forwarding.png)
199
200		---
201
202		## Phase 3: Configure GPU Transcoding
203
204		The final piece to the migration is enabling hardware transcoding so that Plex
205		can fully utilize the new Nvidia GPU available in the server. The first step is
206		to install Nvidia graphics drivers. This process may take a few minutes, but the
207		commands are pretty simple:
208
209		```sh
	212	1. On the left sidebar, click =More= > Three-Dot Menu >
	213	=Scan Library Files=
	214	2. /Enable/ the =Account= > =Library= >
	215	=Empty trash automatically after every scan= preference for the
	216	source server.
	217	3. On the left sidebar, click =More= > Three-Dot Menu > =Manage Server=
	218	> =Empty Trash=
	219	4. On the left sidebar, click =More= > Three-Dot Menu > =Manage Server=
	220	> =Clean Bundles=
	221	5. On the left sidebar, click =More= > Three-Dot Menu > =Manage Server=
	222	> =Optimize Database=
	223
	224	Finally, double-check the Remote Access settings to make sure no changes
	225	have caused issues with accessing the server from outside the network.
	226
	227	In my case, I use a single port forwarding rule in my router and needed
	228	to update the Local LAN IP Address to the new server IP address.
	229
	230	#+caption: Router port forwarding
	231	[[https://img.cleberg.net/blog/20220308-plex-media-server-migration/port_forwarding.png]]
	232
	233	--------------
	234
	235	** Phase 3: Configure GPU Transcoding
	236	:PROPERTIES:
	237	:CUSTOM_ID: phase-3-configure-gpu-transcoding
	238	:END:
	239	The final piece to the migration is enabling hardware transcoding so
	240	that Plex can fully utilize the new Nvidia GPU available in the server.
	241	The first step is to install Nvidia graphics drivers. This process may
	242	take a few minutes, but the commands are pretty simple:
	243
	244	#+begin_src sh
210	245	sudo add-apt-repository ppa:graphics-drivers/ppa
211	246	sudo apt update
212	247	sudo apt-get install ubuntu-drivers-common
213	248	sudo ubuntu-drivers autoinstall
214		```
	249	#+end_src
215	250
216	251	Finally, reboot so that the changes are loaded:
217	252
218		```sh
	253	#+begin_src sh
219	254	sudo reboot now
220		```
	255	#+end_src
221	256
222	257	To ensure that the Nvidia graphics drivers are working properly, run the
223	258	following command to view the available GPUs, statistics, and processes:
224	259
225		```sh
	260	#+begin_src sh
226	261	sudo nvidia-smi
227		```
	262	#+end_src
228	263
229		![nvidia-smi](https://img.cleberg.net/blog/20220308-plex-media-server-migration/nvidia_smi.png)
	264	#+caption: nvidia-smi
	265	[[https://img.cleberg.net/blog/20220308-plex-media-server-migration/nvidia_smi.png]]
230	266
231	267	Finally, enable hardware transcoding settings in the Plex application:
232	268
233		![Plex transcoding settings](https://img.cleberg.net/blog/20220308-plex-media-server-migration/plex_transcoding.png)
	269	#+caption: Plex transcoding settings
	270	[[https://img.cleberg.net/blog/20220308-plex-media-server-migration/plex_transcoding.png]]

blog/2022-03-23-cloudflare-dns-api.org +50 −49

		@@ -1,39 +1,40 @@
1		+++
2		date = 2022-03-23
3		title = "Dynamic DNS with Cloudflare API"
4		description = "Learn how to update Cloudflare DNS records automatically with a simple bash script."
5		draft = false
6		+++
7
8		## DDNS: Dynamic DNS
9
10		If you're hosting a service from a location with dynamic DNS (where your IP may
11		change at any time), you must have a solution to update the DNS so that you can
12		access your service even when the IP of the server changes.
13
14		The process below uses the [Cloudflare API](https://api.cloudflare.com/) to
15		update DNS `A` and `AAAA` records with the server's current IP. If you use
16		another DNS provider, you will have to find a way to update your DNS (or find a
17		way to get a static IP).
18
19		First, install `jq` since we will use it in the next script:
20
21		```sh
	1	#+title: Dynamic DNS with Cloudflare API
	2	#+date: 2022-03-23
	3
	4	** DDNS: Dynamic DNS
	5	:PROPERTIES:
	6	:CUSTOM_ID: ddns-dynamic-dns
	7	:END:
	8	If you're hosting a service from a location with dynamic DNS (where your
	9	IP may change at any time), you must have a solution to update the DNS
	10	so that you can access your service even when the IP of the server
	11	changes.
	12
	13	The process below uses the [[https://api.cloudflare.com/][Cloudflare
	14	API]] to update DNS =A= and =AAAA= records with the server's current IP.
	15	If you use another DNS provider, you will have to find a way to update
	16	your DNS (or find a way to get a static IP).
	17
	18	First, install =jq= since we will use it in the next script:
	19
	20	#+begin_src sh
22	21	sudo apt install jq
23		```
	22	#+end_src
24	23
25		Next, create a location for your DDNS update scripts and open the first script:
	24	Next, create a location for your DDNS update scripts and open the first
	25	script:
26	26
27		```sh
	27	#+begin_src sh
28	28	mkdir ~/ddns
29	29	nano ~/ddns/update.sh
30		```
	30	#+end_src
31	31
32		The following `update.sh` script will take all of your domains and subdomains
33		and check Cloudflare to see if the current `A` and `AAAA` records match your
34		server's IP address. If not, it will update the records.
	32	The following =update.sh= script will take all of your domains and
	33	subdomains and check Cloudflare to see if the current =A= and =AAAA=
	34	records match your server's IP address. If not, it will update the
	35	records.
35	36
36		```sh
	37	#+begin_src sh
37	38	# file: update.sh
38	39	#!/bin/bash
39	40
		@@ -55,20 +56,20 @@ do
55	56	echo -e "\nUpdating $subdomain..."
56	57	zone_name=$domain dns_record=$subdomain /home/<your-username>/ddns/ddns.sh
57	58	done
58		```
	59	#+end_src
59	60
60		Next, open up the `ddns.sh` script. Paste the following into the script and
61		update the `api_token` and `email` variables.
	61	Next, open up the =ddns.sh= script. Paste the following into the script
	62	and update the =api_token= and =email= variables.
62	63
63		```sh
	64	#+begin_src sh
64	65	nano ~/ddns/ddns.sh
65		```
	66	#+end_src
66	67
67		:warning: Note: If you want your DNS records to be proxied through
68		Cloudflare, find and update the following snippet: `\"proxied\":false}"` to say
69		`true` instead of `false`.
	68	:warning: Note: If you want your DNS records to be proxied through
	69	Cloudflare, find and update the following snippet: =\"proxied\":false}"=
	70	to say =true= instead of =false=.
70	71
71		```sh
	72	#+begin_src sh
72	73	# file: ddns.sh
73	74	#!/bin/bash
74	75	# based on https://gist.github.com/Tras2/cba88201b17d765ec065ccbedfb16d9a
		@@ -161,30 +162,30 @@ then
161	162	else
162	163	echo "There is a problem with either the email or the password"
163	164	fi
164		```
	165	#+end_src
165	166
166	167	Once the script is saved and closed, make the scripts executable:
167	168
168		```sh
	169	#+begin_src sh
169	170	chmod +x ~/ddns/ddns.sh
170	171	chmod +x ~/ddns/update.sh
171		```
	172	#+end_src
172	173
173	174	You can test the script by running it manually:
174	175
175		```sh
	176	#+begin_src sh
176	177	./update.sh
177		```
	178	#+end_src
178	179
179		To make sure the scripts run automatically, add it to the `cron` file so that it
180		will run on a schedule. To do this, open the cron file:
	180	To make sure the scripts run automatically, add it to the =cron= file so
	181	that it will run on a schedule. To do this, open the cron file:
181	182
182		```sh
	183	#+begin_src sh
183	184	crontab -e
184		```
	185	#+end_src
185	186
186	187	In the cron file, paste the following at the bottom of the editor:
187	188
188		```sh
	189	#+begin_src sh
189	190	/5 * * * bash /home/<your_username>/ddns/update.sh
190		```
	191	#+end_src

blog/2022-03-23-nextcloud-on-ubuntu.org +95 −75

		@@ -1,80 +1,90 @@
1		+++
2		date = 2022-03-23
3		title = "Installing Nextcloud on Ubuntu"
4		description = "Learn how to install the self-hosted cloud storage solution, Nextcloud, on Ubuntu."
5		draft = false
6		+++
	1	#+title: Installing Nextcloud on Ubuntu
	2	#+date: 2022-03-23
7	3
8		## What is Nextcloud?
9
10		[Nextcloud](https://nextcloud.com/) is a self-hosted solution for storage,
11		communications, editing, calendar, contacts, and more.
	4	** What is Nextcloud?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-nextcloud
	7	:END:
	8	[[https://nextcloud.com/][Nextcloud]] is a self-hosted solution for
	9	storage, communications, editing, calendar, contacts, and more.
12	10
13	11	This tutorial assumes that you have an Ubuntu server and a domain name
14	12	configured to point toward the server.
15	13
16		## Install Dependencies
17
	14	** Install Dependencies
	15	:PROPERTIES:
	16	:CUSTOM_ID: install-dependencies
	17	:END:
18	18	To start, you will need to install the packages that Nextcloud requires:
19	19
20		```sh
	20	#+begin_src sh
21	21	sudo apt install apache2 mariadb-server libapache2-mod-php7.4
22	22	sudo apt install php7.4-gd php7.4-mysql php7.4-curl php7.4-mbstring php7.4-intl
23	23	sudo apt install php7.4-gmp php7.4-bcmath php-imagick php7.4-xml php7.4-zip
24		```
	24	#+end_src
25	25
26		## Set Up MySQL
	26	** Set Up MySQL
	27	:PROPERTIES:
	28	:CUSTOM_ID: set-up-mysql
	29	:END:
	30	Next, you will need to log in to MySQL as the =root= user of the
	31	machine.
27	32
28		Next, you will need to log in to MySQL as the `root` user of the machine.
29
30		```sh
	33	#+begin_src sh
31	34	sudo mysql -uroot -p
32		```
	35	#+end_src
33	36
34		Once you've logged in, you must create a new user so that Nextcloud can manage
35		the database. You will also create a `nextcloud` database and assign privileges:
	37	Once you've logged in, you must create a new user so that Nextcloud can
	38	manage the database. You will also create a =nextcloud= database and
	39	assign privileges:
36	40
37		```sql
	41	#+begin_src sql
38	42	CREATE USER 'username'@'localhost' IDENTIFIED BY 'password';
39	43	CREATE DATABASE IF NOT EXISTS nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
40	44	GRANT ALL PRIVILEGES ON nextcloud.* TO 'username'@'localhost';
41	45	FLUSH PRIVILEGES;
42	46	quit;
43		```
44
45		## Download & Install Nextcloud
	47	#+end_src
46	48
	49	** Download & Install Nextcloud
	50	:PROPERTIES:
	51	:CUSTOM_ID: download-install-nextcloud
	52	:END:
47	53	To download Nextcloud, go the
48		[Nextcloud downloads page](https://nextcloud.com/install/#instructions-server),
49		click on `Archive File` and right-click the big blue button to copy the link.
	54	[[https://nextcloud.com/install/#instructions-server][Nextcloud
	55	downloads page]], click on =Archive File= and right-click the big blue
	56	button to copy the link.
50	57
51		Then, go to your server and enter the following commands to download, unzip, and
52		move the files to your destination directory. This example uses `example.com` as
53		the destination, but you can put it wherever you want to server your files from.
	58	Then, go to your server and enter the following commands to download,
	59	unzip, and move the files to your destination directory. This example
	60	uses =example.com= as the destination, but you can put it wherever you
	61	want to server your files from.
54	62
55		```sh
	63	#+begin_src sh
56	64	wget https://download.nextcloud.com/server/releases/nextcloud-23.0.3.zip
57	65	sudo apt install unzip
58	66	unzip nextcloud-23.0.3.zip
59	67	sudo cp -r nextcloud /var/www/example.com
60		```
	68	#+end_src
61	69
62		## Configure the Apache Web Server
63
64		Now that the database is set up and Nextcloud is installed, you need to set up
65		the Apache configuration files to tell the server how to handle requests for
66		`example.com/nextcloud`.
	70	** Configure the Apache Web Server
	71	:PROPERTIES:
	72	:CUSTOM_ID: configure-the-apache-web-server
	73	:END:
	74	Now that the database is set up and Nextcloud is installed, you need to
	75	set up the Apache configuration files to tell the server how to handle
	76	requests for =example.com/nextcloud=.
67	77
68	78	First, open the following file in the editor:
69	79
70		```sh
	80	#+begin_src sh
71	81	sudo nano /etc/apache2/sites-available/nextcloud.conf
72		```
	82	#+end_src
73	83
74		Once the editor is open, paste the following information in. Then, save and
75		close the file.
	84	Once the editor is open, paste the following information in. Then, save
	85	and close the file.
76	86
77		```config
	87	#+begin_src config
78	88	<VirtualHost *:80>
79	89	DocumentRoot /var/www/example.com
80	90	ServerName example.com
		@@ -93,69 +103,79 @@ close the file.
93	103	</IfModule>
94	104	</Directory>
95	105	</VirtualHost>
96		```
	106	#+end_src
97	107
98	108	Once the file is saved, enable it with Apache:
99	109
100		```sh
	110	#+begin_src sh
101	111	sudo a2ensite nextcloud.conf
102		```
	112	#+end_src
103	113
104	114	Next, enable the Apache mods required by Nextcloud:
105	115
106		```sh
	116	#+begin_src sh
107	117	sudo a2enmod rewrite headers env dir mime
108		```
	118	#+end_src
109	119
110		Finally, restart Apache. If any errors arise, you must solve those before
111		continuing.
	120	Finally, restart Apache. If any errors arise, you must solve those
	121	before continuing.
112	122
113		```sh
	123	#+begin_src sh
114	124	sudo systemctl restart apache2
115		```
	125	#+end_src
116	126
117	127	For the app to work, you must have the correct file permissions on your
118		`nextcloud` directory. Set the owner to be `www-data`:
	128	=nextcloud= directory. Set the owner to be =www-data=:
119	129
120		```sh
	130	#+begin_src sh
121	131	sudo chown -R www-data:www-data /var/www/example.com/nextcloud/
122		```
123
124		## DNS
	132	#+end_src
125	133
	134	** DNS
	135	:PROPERTIES:
	136	:CUSTOM_ID: dns
	137	:END:
126	138	If you do not have a static IP address, you will need to update your DNS
127		settings (at your DNS provider) whenever your dynamic IP address changes.
	139	settings (at your DNS provider) whenever your dynamic IP address
	140	changes.
128	141
129	142	For an example on how I do that with Cloudflare, see my other post:
130		[Updating Dynamic DNS with Cloudflare API](/blog/updating-dynamic-dns-with-cloudflare-api/)
	143	[[/blog/updating-dynamic-dns-with-cloudflare-api/][Updating Dynamic DNS
	144	with Cloudflare API]]
131	145
132		## Certbot
	146	** Certbot
	147	:PROPERTIES:
	148	:CUSTOM_ID: certbot
	149	:END:
	150	If you want to serve Nextcloud from HTTPS rather than plain HTTP, use
	151	the following commands to issue Let's Encrypt SSL certificates:
133	152
134		If you want to serve Nextcloud from HTTPS rather than plain HTTP, use the
135		following commands to issue Let's Encrypt SSL certificates:
136
137		```sh
	153	#+begin_src sh
138	154	sudo apt install snapd
139	155	sudo snap install core
140	156	sudo snap refresh core
141	157	sudo snap install --classic certbot
142	158	sudo ln -s /snap/bin/certbot /usr/bin/certbot
143	159	sudo certbot --apache
144		```
145
146		## Results
	160	#+end_src
147	161
148		Voilà!
149		You're all done and should be able to access Nextcloud from your domain or
150		IP address.
	162	** Results
	163	:PROPERTIES:
	164	:CUSTOM_ID: results
	165	:END:
	166	Voilà! You're all done and should be able to access Nextcloud from your
	167	domain or IP address.
151	168
152		See the screenshots below for the dashboard and a settings page on my instance
153		of Nextcloud, using the `Breeze Dark` theme I installed from the Apps page.
	169	See the screenshots below for the dashboard and a settings page on my
	170	instance of Nextcloud, using the =Breeze Dark= theme I installed from
	171	the Apps page.
154	172
155		![Nextcloud Dashboard](https://img.cleberg.net/blog/20220323-installing-nextcloud-on-ubuntu/nextcloud_dashboard.png)
	173	#+caption: Nextcloud Dashboard
	174	[[https://img.cleberg.net/blog/20220323-installing-nextcloud-on-ubuntu/nextcloud_dashboard.png]]
156	175
157		_Figure 01: Nextcloud Dashboard_
	176	/Figure 01: Nextcloud Dashboard/
158	177
159		![Nextcloud Settings](https://img.cleberg.net/blog/20220323-installing-nextcloud-on-ubuntu/nextcloud_settings.png)
	178	#+caption: Nextcloud Settings
	179	[[https://img.cleberg.net/blog/20220323-installing-nextcloud-on-ubuntu/nextcloud_settings.png]]
160	180
161		_Figure 02: Nextcloud Security Settings_
	181	/Figure 02: Nextcloud Security Settings/

blog/2022-03-24-server-hardening.org +339 −299

		@@ -1,23 +1,28 @@
1		+++
2		date = 2022-03-24
3		title = "Hardening a Public-Facing Home Server"
4		description = "My personal reflection on the steps it took to get a home server ready to be publicly-accessible."
5		draft = false
6		+++
7
8		## Post Updates
9
10		> After reviewing this post today (2022-10-04), I noticed quite a few gaps in my
11		> write-up and wanted to add a few things, even though this blog is really
12		> just a retrospective and knowledge dump for myself.
13		> I left things intact and simply crossed them out (~~like this~~) for
14		> posterity.
15
16		## Planning Data Flows & Security
17
18		### My Personal Data Flow
19
20		```txt
	1	#+title: Hardening a Public-Facing Home Server
	2	#+date: 2022-03-24
	3
	4	** Post Updates
	5	:PROPERTIES:
	6	:CUSTOM_ID: post-updates
	7	:END:
	8
	9	#+begin_quote
	10	After reviewing this post today (2022-10-04), I noticed quite a few gaps
	11	in my write-up and wanted to add a few things, even though this blog is
	12	really just a retrospective and knowledge dump for myself. I left things
	13	intact and simply crossed them out (+like this+) for posterity.
	14
	15	#+end_quote
	16
	17	** Planning Data Flows & Security
	18	:PROPERTIES:
	19	:CUSTOM_ID: planning-data-flows-security
	20	:END:
	21	*** My Personal Data Flow
	22	:PROPERTIES:
	23	:CUSTOM_ID: my-personal-data-flow
	24	:END:
	25	#+begin_src txt
21	26	┌───────┐ ┌─────────────────┐
22	27	┌──► VLAN1 ├───► Private Devices │
23	28	│ └───────┘ └─────────────────┘
		@@ -27,320 +32,355 @@ draft = false
27	32	│ ┌───────┐ ┌───────────────┐
28	33	└──► VLAN2 ├───► Public Server │
29	34	└───────┘ └───────────────┘
30		```
31
32		### Thought Process
	35	#+end_src
33	36
34		To serve content from your home server and harden your security posture, you
35		have to think about the transport of data from `server` to `client`.
	37	*** Thought Process
	38	:PROPERTIES:
	39	:CUSTOM_ID: thought-process
	40	:END:
	41	To serve content from your home server and harden your security posture,
	42	you have to think about the transport of data from =server= to =client=.
36	43
37	44	Let's start with the actual server itself. Think about the following:
38	45
39		- Do I have a firewall enabled? Do I need to update this to allow new ports or
40		IPs?
41		- Do I have an IPS/IDS that may prevent outside traffic?
42		- Do I have any other security software installed?
43		- Are the services hosted inside Docker containers, behind a reverse proxy, or
44		virtualized? If so, are they configured to allow outside traffic?
45
46		Once the data leaves the server, where does it go? In my case, it goes to a
47		managed switch. In this case, I asked the following:
48
49		- What configurations is the switch using?
50		- Am I using VLANs?
51		- Yes, I am using 802.1Q VLANs.
52		- Are the VLANs configured properly?
53		- Yes, as shown in the [Switch](#switch) section below, I have a separate
54		VLAN to allow outside traffic to and from the server alone. No other
55		devices, except for a service port, and in that VLAN.
56
57		At this point, the data has been processed through the switch. Where does it go
58		next? In my case, it's pretty simple: it goes to the router/modem device.
59
60		- Does my ISP block any ports that I need?
61		- This is an important step that a lot of people run into when
62		self-hosting at home.
63		Use an online port-checker tool for your IP or call your ISP if you
64		think ports are blocked.
65		- Is there a router firewall?
66		- Yes, I checked that it's configured to allow the ports I need to run my
67		services publicly. Common web servers and reverse proxies require ports
68		80 and 443, but other services like media servers or games can require
69		unique ports, so be sure to check the documentation for your service(s).
70		- Are there any other settings affecting inbound/outbound traffic?
71		- Schedules or access blocks
72		- Static Routing
73		- QoS
74		- Port Forwarding
75		- DMZ Hosting
76		- Remote Management (this can sometimes mess with services that also
77		require the use of ports 80 and 443)
78
79		Once the data leaves my router, it goes to the upstream ISP and can be accessed
80		publicly.
81
82		## Server
83
84		~~The services I run on my server are installed straight into the OS, without
85		any use of Docker or VMs, so I don't need any extra application configuration to
86		make them accessible to the outside world.~~
87
88		As of 2022-10-04, the paragraph above is no longer true as I now run a reverse
89		proxy with Nginx and host many services inside Docker. However, it doesn't
90		change anything regarding this post as I still just need to open ports 80 & 443
91		and create the necessary website configuration files.
92
93		When creating new services - either installed directly on bare metal or within
94		something like Docker - I ensure that I read through the documentation
95		thoroughly to understand a few key things:
96		- What network activities should this app perform (if any)? Using which ports
97		and protocols?
98		- Does this app require any commands/services to be run as `root`?
99		- Does this app log errors, authentication failures/successes, or anything
100		else that would be useful for an investigation?
101
102		For extra security, I use limit all incoming connections to SSH connections
103		through my server firewall (`ufw`) and disable common SSH settings. After all of
104		that, I use `fail2ban` as a preventative measure against brute-force login
105		attempts.
106
107		As another piece of security, you can randomize your SSH port to ensure that
108		random scanners or attackers can't easily try to force their way into your
109		network. For example, you can edit the port rules in your server to block all
110		connection requests to port `22` but forward all remote connections from port
111		`12345` to your server's port `22`. Then you just need to SSH to your network
112		via your randomized port.
113
114		### `ufw`
115
116		To see how to configure `ufw`, see my other post:
117		[Secure Your Network with the Uncomplicated Firewall](/blog/secure-your-network-with-the-uncomplicated-firewall/).
118
119		The general notion with an on-device firewall is that you want to deny all
120		incoming connections by default and then selectively open certain ports for
121		services or users that you know need access.
122
123		If you know that you will only be logging into this server from a certain set or
124		list of IPs, you can always set the firewall to only allow connections to port
125		22 from those IPs.
	46	- Do I have a firewall enabled? Do I need to update this to allow new
	47	ports or IPs?
	48	- Do I have an IPS/IDS that may prevent outside traffic?
	49	- Do I have any other security software installed?
	50	- Are the services hosted inside Docker containers, behind a reverse
	51	proxy, or virtualized? If so, are they configured to allow outside
	52	traffic?
	53
	54	Once the data leaves the server, where does it go? In my case, it goes
	55	to a managed switch. In this case, I asked the following:
	56
	57	- What configurations is the switch using?
	58	- Am I using VLANs?
	59	- Yes, I am using 802.1Q VLANs.
	60	- Are the VLANs configured properly?
	61	- Yes, as shown in the [[#switch][Switch]] section below, I have a
	62	separate VLAN to allow outside traffic to and from the server alone.
	63	No other devices, except for a service port, and in that VLAN.
	64
	65	At this point, the data has been processed through the switch. Where
	66	does it go next? In my case, it's pretty simple: it goes to the
	67	router/modem device.
	68
	69	- Does my ISP block any ports that I need?
	70	- This is an important step that a lot of people run into when
	71	self-hosting at home. Use an online port-checker tool for your IP or
	72	call your ISP if you think ports are blocked.
	73	- Is there a router firewall?
	74	- Yes, I checked that it's configured to allow the ports I need to run
	75	my services publicly. Common web servers and reverse proxies require
	76	ports 80 and 443, but other services like media servers or games can
	77	require unique ports, so be sure to check the documentation for your
	78	service(s).
	79	- Are there any other settings affecting inbound/outbound traffic?
	80	- Schedules or access blocks
	81	- Static Routing
	82	- QoS
	83	- Port Forwarding
	84	- DMZ Hosting
	85	- Remote Management (this can sometimes mess with services that also
	86	require the use of ports 80 and 443)
	87
	88	Once the data leaves my router, it goes to the upstream ISP and can be
	89	accessed publicly.
	90
	91	** Server
	92	:PROPERTIES:
	93	:CUSTOM_ID: server
	94	:END:
	95	+The services I run on my server are installed straight into the OS,
	96	without any use of Docker or VMs, so I don't need any extra application
	97	configuration to make them accessible to the outside world.+
	98
	99	As of 2022-10-04, the paragraph above is no longer true as I now run a
	100	reverse proxy with Nginx and host many services inside Docker. However,
	101	it doesn't change anything regarding this post as I still just need to
	102	open ports 80 & 443 and create the necessary website configuration
	103	files.
	104
	105	When creating new services - either installed directly on bare metal or
	106	within something like Docker - I ensure that I read through the
	107	documentation thoroughly to understand a few key things: - What network
	108	activities should this app perform (if any)? Using which ports and
	109	protocols? - Does this app require any commands/services to be run as
	110	=root=? - Does this app log errors, authentication failures/successes,
	111	or anything else that would be useful for an investigation?
	112
	113	For extra security, I use limit all incoming connections to SSH
	114	connections through my server firewall (=ufw=) and disable common SSH
	115	settings. After all of that, I use =fail2ban= as a preventative measure
	116	against brute-force login attempts.
	117
	118	As another piece of security, you can randomize your SSH port to ensure
	119	that random scanners or attackers can't easily try to force their way
	120	into your network. For example, you can edit the port rules in your
	121	server to block all connection requests to port =22= but forward all
	122	remote connections from port =12345= to your server's port =22=. Then
	123	you just need to SSH to your network via your randomized port.
	124
	125	*** =ufw=
	126	:PROPERTIES:
	127	:CUSTOM_ID: ufw
	128	:END:
	129	To see how to configure =ufw=, see my other post:
	130	[[/blog/secure-your-network-with-the-uncomplicated-firewall/][Secure
	131	Your Network with the Uncomplicated Firewall]].
	132
	133	The general notion with an on-device firewall is that you want to deny
	134	all incoming connections by default and then selectively open certain
	135	ports for services or users that you know need access.
	136
	137	If you know that you will only be logging into this server from a
	138	certain set or list of IPs, you can always set the firewall to only
	139	allow connections to port 22 from those IPs.
126	140
127	141	For a quick start to only allow SSH connections to the server, use this:
128	142
129		```sh
	143	#+begin_src sh
130	144	sudo ufw default deny incoming
131	145	sudo ufw default allow outgoing
132	146	sudo ufw allow 22
133	147	sudo ufw enable
134		```
135
136		![ufw](https://img.cleberg.net/blog/20220324-hardening-a-public-facing-home-server/ufw.png)
137
138		### `ssh`
139
140		#### Using SSH Keys
141
142		First, make sure you have an SSH keypair generated on the device(s) that you'll
143		be using to log in to the server. If you don't have an SSH key, run this
144		command:
145
146		```sh
	148	#+end_src
	149
	150	#+caption: ufw
	151	[[https://img.cleberg.net/blog/20220324-hardening-a-public-facing-home-server/ufw.png]]
	152
	153	*** =ssh=
	154	:PROPERTIES:
	155	:CUSTOM_ID: ssh
	156	:END:
	157	**** Using SSH Keys
	158	:PROPERTIES:
	159	:CUSTOM_ID: using-ssh-keys
	160	:END:
	161	First, make sure you have an SSH keypair generated on the device(s) that
	162	you'll be using to log in to the server. If you don't have an SSH key,
	163	run this command:
	164
	165	#+begin_src sh
147	166	ssh-keygen
148		```
	167	#+end_src
149	168
150		Now that we have an SSH key, copy it to the server with the following command,
151		which will ask for the user's password before accepting the key:
	169	Now that we have an SSH key, copy it to the server with the following
	170	command, which will ask for the user's password before accepting the
	171	key:
152	172
153		```sh
	173	#+begin_src sh
154	174	ssh-copy-id my_user@my_server
155		```
	175	#+end_src
156	176
157		If you have multiple keys, you'll need to specify which to use. After it's
158		complete, `ssh` back into the server as that user and make sure it doesn't ask
159		for a password.
	177	If you have multiple keys, you'll need to specify which to use. After
	178	it's complete, =ssh= back into the server as that user and make sure it
	179	doesn't ask for a password.
160	180
161		#### Disable Password & Root Authentication
	181	**** Disable Password & Root Authentication
	182	:PROPERTIES:
	183	:CUSTOM_ID: disable-password-root-authentication
	184	:END:
	185	Now that we can access the server without a password, we will disable
	186	password authentication and disable anyone from using =ssh= to login as
	187	=root=.
162	188
163		Now that we can access the server without a password, we will disable password
164		authentication and disable anyone from using `ssh` to login as `root`.
	189	To do this, open the =sshd_config= file:
165	190
166		To do this, open the `sshd_config` file:
167
168		```sh
	191	#+begin_src sh
169	192	sudo nano /etc/ssh/sshd_config
170		```
	193	#+end_src
171	194
172		You'll need to update the parameters to the values below. If one of these rules
173		is commented-out or doesn't exist, create the rule at the bottom of the file.
	195	You'll need to update the parameters to the values below. If one of
	196	these rules is commented-out or doesn't exist, create the rule at the
	197	bottom of the file.
174	198
175		```config
	199	#+begin_src config
176	200	PermitRootLogin no
177	201	PasswordAuthentication no
178	202	PubkeyAuthentication yes
179		```
	203	#+end_src
180	204
181		Finally, restart the `ssh` service:
	205	Finally, restart the =ssh= service:
182	206
183		```sh
	207	#+begin_src sh
184	208	sudo systemctl restart sshd.service
185		```
186
187		To test that everything’s working so far, open ANOTHER terminal and try logging
188		in as `root` over SSH. It is very important that you keep your current SSH
189		session open and test with an additional session, or you will lock yourself out
190		at some point and will need to use a recovery method (e.g., hooking monitor up
191		to home server) to get yourself back in.
192
193		#### Enable MFA for `ssh`
194
195		This part is optional, but I highly recommend it.
196		So far, we've ensured that no one can log into our user on the server
197		without using our secret key, and we've ensured that no one can log in
198		remotely as `root`.
199		Next, you can enable MFA authentication for `ssh` connections.
200
201		This process involves editing a couple files and installing an MFA package, so I
202		will not include all the details in this post. To see how to configure MFA for
203		`ssh`, see my other post:
204		[Enabling MFA for SSH](/blog/enable-totp-mfa-for-ssh/).
205
206		![SSH MFA](https://img.cleberg.net/blog/20220324-hardening-a-public-facing-home-server/ssh_mfa.png)
207
208		### `fail2ban`
209
210		I haven't written a post on how I use `fail2ban`, but it's quite simple. I use
211		the default `sshd` jail, but you can always create new jails for respective
212		applications or ports. For example, if you use Nginx as your web server, you can
213		use the `nginx-http-auth` jail.
	209	#+end_src
	210
	211	To test that everything's working so far, open ANOTHER terminal and try
	212	logging in as =root= over SSH. It is very important that you keep your
	213	current SSH session open and test with an additional session, or you
	214	will lock yourself out at some point and will need to use a recovery
	215	method (e.g., hooking monitor up to home server) to get yourself back
	216	in.
	217
	218	**** Enable MFA for =ssh=
	219	:PROPERTIES:
	220	:CUSTOM_ID: enable-mfa-for-ssh
	221	:END:
	222	This part is optional, but I highly recommend it. So far, we've ensured
	223	that no one can log into our user on the server without using our secret
	224	key, and we've ensured that no one can log in remotely as =root=. Next,
	225	you can enable MFA authentication for =ssh= connections.
	226
	227	This process involves editing a couple files and installing an MFA
	228	package, so I will not include all the details in this post. To see how
	229	to configure MFA for =ssh=, see my other post:
	230	[[/blog/enable-totp-mfa-for-ssh/][Enabling MFA for SSH]].
	231
	232	#+caption: SSH MFA
	233	[[https://img.cleberg.net/blog/20220324-hardening-a-public-facing-home-server/ssh_mfa.png]]
	234
	235	*** =fail2ban=
	236	:PROPERTIES:
	237	:CUSTOM_ID: fail2ban
	238	:END:
	239	I haven't written a post on how I use =fail2ban=, but it's quite simple.
	240	I use the default =sshd= jail, but you can always create new jails for
	241	respective applications or ports. For example, if you use Nginx as your
	242	web server, you can use the =nginx-http-auth= jail.
214	243
215	244	In order to get it up and running, use the following commands:
216	245
217		```sh
	246	#+begin_src sh
218	247	sudo apt install fail2ban
219	248	sudo fail2ban-client start sshd
220	249	sudo fail2ban-client status sshd
221		```
222
223		This should be used as a last-resort defense and shouldn't be a replacement for
224		the security measures mentioned above.
225
226		![fail2ban](https://img.cleberg.net/blog/20220324-hardening-a-public-facing-home-server/fail2ban.png)
227
228		## Switch
229
230		Between the router and any local devices is my managed switch, which is used to
231		create VLANs. The example below shows how I would isolate the VLANs if I were
232		starting to host a single service at home.
233
234		### 802.1Q VLAN Configuration
235
236		In this configuration, port 8 is the public server that needs to be accessed
237		from the outside. Port 23 is my 'dedicated service port' for this server. In
238		order to SSH to this server, I need to plug my laptop into port 23 or else I
239		cannot SSH. Otherwise, I'd need to hook up a monitor and keyboard directly to
240		the server to manage it.
	250	#+end_src
	251
	252	This should be used as a last-resort defense and shouldn't be a
	253	replacement for the security measures mentioned above.
	254
	255	#+caption: fail2ban
	256	[[https://img.cleberg.net/blog/20220324-hardening-a-public-facing-home-server/fail2ban.png]]
	257
	258	** Switch
	259	:PROPERTIES:
	260	:CUSTOM_ID: switch
	261	:END:
	262	Between the router and any local devices is my managed switch, which is
	263	used to create VLANs. The example below shows how I would isolate the
	264	VLANs if I were starting to host a single service at home.
	265
	266	*** 802.1Q VLAN Configuration
	267	:PROPERTIES:
	268	:CUSTOM_ID: q-vlan-configuration
	269	:END:
	270	In this configuration, port 8 is the public server that needs to be
	271	accessed from the outside. Port 23 is my 'dedicated service port' for
	272	this server. In order to SSH to this server, I need to plug my laptop
	273	into port 23 or else I cannot SSH. Otherwise, I'd need to hook up a
	274	monitor and keyboard directly to the server to manage it.
241	275
242	276	\| VLAN ID \| VLAN Name \| Member Ports \| Tagged Ports \| Untagged Ports \|
243		\|:-------:\|:---------:\|:------------:\|:------------:\|:--------------:\|
244		\| 1 \| Default \| 1-24 \| \| 1-24 \|
245		\| 2 \| Server \| 1,8,23 \| \| 1,8,23 \|
246
247		### 802.1Q VLAN PVID Setting
248
249		Once the VLAN is created, I simply add the `VLAN ID` of `2` as the `PVID` for
250		any related ports (in this case, see that ports `8` and `23` have a PVID of
251		`2`).
	277	\|---------+-----------+--------------+--------------+----------------\|
	278	\| 1 \| Default \| 1-24 \| \| 1-24 \|
	279	\| 2 \| Server \| 1,8,23 \| \| 1,8,23 \|
	280
	281	*** 802.1Q VLAN PVID Setting
	282	:PROPERTIES:
	283	:CUSTOM_ID: q-vlan-pvid-setting
	284	:END:
	285	Once the VLAN is created, I simply add the =VLAN ID= of =2= as the
	286	=PVID= for any related ports (in this case, see that ports =8= and =23=
	287	have a PVID of =2=).
252	288
253	289	\| Port \| PVID \|
254		\|:----:\|:----:\|
255		\| 1 \| 1 \|
256		\| 2 \| 1 \|
257		\| 3 \| 1 \|
258		\| 4 \| 1 \|
259		\| 5 \| 1 \|
260		\| 6 \| 1 \|
261		\| 7 \| 1 \|
262		\| 8 \| 2 \|
263		\| 9 \| 1 \|
264		\| 10 \| 1 \|
265		\| 11 \| 1 \|
266		\| 12 \| 1 \|
267		\| 13 \| 1 \|
268		\| 14 \| 1 \|
269		\| 15 \| 1 \|
270		\| 16 \| 1 \|
271		\| 17 \| 1 \|
272		\| 18 \| 1 \|
273		\| 19 \| 1 \|
274		\| 20 \| 1 \|
275		\| 21 \| 1 \|
276		\| 22 \| 1 \|
277		\| 23 \| 2 \|
278		\| 24 \| 1 \|
279
280		## Router
281
282		On my router, the configuration was as easy as opening the firewall settings and
283		unblocking the ports I needed for my services (e.g., HTTP/S, Plex, SSH, MySQL,
284		etc.).
285
286		~~Since I'm relying on an ISP-provided modem/router combo for now (not by
287		choice), I do not use any other advanced settings on my router that would
288		inhibit any valid traffic to these services.~~
289
290		The paragraph above regarding the ISP-owned router is no longer accurate as I
291		now use the Ubiquiti Unifi Dream Machine Pro as my router.
292		Within this router, I enabled port forwarding/firewall rules, segregate the
293		network based on the device, and enable traffic restrictions (e.g., silently
294		drop traffic from certain countries and threat categories).
295
296		If you have the option with your ISP, I recommend using a personal router with
297		software that you are familiar with so that you can explore all the options
298		available to you.
299
300		## Physical Security
301
302		One large piece of self-hosting that people generally don't discuss online is
303		physical security. However, physical security is very important for everyone who
304		hosts a server like this. Exactly how important it is depends on the server
305		use/purpose.
306
307		If you self-host customer applications that hold protected data (HIPAA, GDPR,
308		COPPA, etc.), then physical security is extremely important and cannot be
309		ignored. If you simply host a blog and some hobby sites, then it's a relatively
310		minor consideration, but one you still need to think about.
311
312		### Location
313
314		The first consideration is quite simple: location.
315		- Is the server within a property you own or housed on someone else's property?
316		- Is it nearby (in your house, in your work office, in your neighbor's garage,
317		in a storage unit, etc.)?
318		- Do you have 24/7 access to the server?
319		- Are there climate considerations, such as humidity, fires, tornadoes,
320		monsoons?
321		- Do you have emergency equipment nearby in case of emergency?
322
323		### Hardware Ownership
324
325		Secondly, consider the hardware itself:
326		- Do you own the server in its entirety?
327		- Are any other users able to access the server, even if your data/space is
328		segregated?
329		- If you're utilizing a third party, do they have any documentation to show
330		responsibility? This could be a SOC 1/2/3 report, ISO compliance report,
331		internal security/safety documentation.
332
333		### Physical Controls
334
335		Regardless of who owns the hardware, ensure that there are adequate safeguards
336		in place, if necessary. These usually don't apply to small home servers and are
337		usually covered already if you're utilizing a third party.
338
339		These can include:
340		- Server bezel locks
341		- Server room locks - physical, digital, or biometric authentication
342		- Security cameras
343		- Raised floors/lowered ceilings with proper guards/gates in-place within the
344		floors or ceilings
345		- Security personnel
346		- Log sheets and/or guest badges
	290	\|------+------\|
	291	\| 1 \| 1 \|
	292	\| 2 \| 1 \|
	293	\| 3 \| 1 \|
	294	\| 4 \| 1 \|
	295	\| 5 \| 1 \|
	296	\| 6 \| 1 \|
	297	\| 7 \| 1 \|
	298	\| 8 \| 2 \|
	299	\| 9 \| 1 \|
	300	\| 10 \| 1 \|
	301	\| 11 \| 1 \|
	302	\| 12 \| 1 \|
	303	\| 13 \| 1 \|
	304	\| 14 \| 1 \|
	305	\| 15 \| 1 \|
	306	\| 16 \| 1 \|
	307	\| 17 \| 1 \|
	308	\| 18 \| 1 \|
	309	\| 19 \| 1 \|
	310	\| 20 \| 1 \|
	311	\| 21 \| 1 \|
	312	\| 22 \| 1 \|
	313	\| 23 \| 2 \|
	314	\| 24 \| 1 \|
	315
	316	** Router
	317	:PROPERTIES:
	318	:CUSTOM_ID: router
	319	:END:
	320	On my router, the configuration was as easy as opening the firewall
	321	settings and unblocking the ports I needed for my services (e.g.,
	322	HTTP/S, Plex, SSH, MySQL, etc.).
	323
	324	+Since I'm relying on an ISP-provided modem/router combo for now (not by
	325	choice), I do not use any other advanced settings on my router that
	326	would inhibit any valid traffic to these services.+
	327
	328	The paragraph above regarding the ISP-owned router is no longer accurate
	329	as I now use the Ubiquiti Unifi Dream Machine Pro as my router. Within
	330	this router, I enabled port forwarding/firewall rules, segregate the
	331	network based on the device, and enable traffic restrictions (e.g.,
	332	silently drop traffic from certain countries and threat categories).
	333
	334	If you have the option with your ISP, I recommend using a personal
	335	router with software that you are familiar with so that you can explore
	336	all the options available to you.
	337
	338	** Physical Security
	339	:PROPERTIES:
	340	:CUSTOM_ID: physical-security
	341	:END:
	342	One large piece of self-hosting that people generally don't discuss
	343	online is physical security. However, physical security is very
	344	important for everyone who hosts a server like this. Exactly /how/
	345	important it is depends on the server use/purpose.
	346
	347	If you self-host customer applications that hold protected data (HIPAA,
	348	GDPR, COPPA, etc.), then physical security is extremely important and
	349	cannot be ignored. If you simply host a blog and some hobby sites, then
	350	it's a relatively minor consideration, but one you still need to think
	351	about.
	352
	353	*** Location
	354	:PROPERTIES:
	355	:CUSTOM_ID: location
	356	:END:
	357	The first consideration is quite simple: location. - Is the server
	358	within a property you own or housed on someone else's property? - Is it
	359	nearby (in your house, in your work office, in your neighbor's garage,
	360	in a storage unit, etc.)? - Do you have 24/7 access to the server? - Are
	361	there climate considerations, such as humidity, fires, tornadoes,
	362	monsoons? - Do you have emergency equipment nearby in case of emergency?
	363
	364	*** Hardware Ownership
	365	:PROPERTIES:
	366	:CUSTOM_ID: hardware-ownership
	367	:END:
	368	Secondly, consider the hardware itself: - Do you own the server in its
	369	entirety? - Are any other users able to access the server, even if your
	370	data/space is segregated? - If you're utilizing a third party, do they
	371	have any documentation to show responsibility? This could be a SOC 1/2/3
	372	report, ISO compliance report, internal security/safety documentation.
	373
	374	*** Physical Controls
	375	:PROPERTIES:
	376	:CUSTOM_ID: physical-controls
	377	:END:
	378	Regardless of who owns the hardware, ensure that there are adequate
	379	safeguards in place, if necessary. These usually don't apply to small
	380	home servers and are usually covered already if you're utilizing a third
	381	party.
	382
	383	These can include: - Server bezel locks - Server room locks - physical,
	384	digital, or biometric authentication - Security cameras - Raised
	385	floors/lowered ceilings with proper guards/gates in-place within the
	386	floors or ceilings - Security personnel - Log sheets and/or guest badges

blog/2022-03-26-ssh-mfa.org +115 −103

		@@ -1,82 +1,88 @@
1		+++
2		date = 2022-03-26
3		title = "Enable TOTP MFA for SSH"
4		description = "Harden your SSH target with user-enabled MFA options, such as TOTP."
5		draft = false
6		+++
7
8		## Why Do I Need MFA for SSH?
9
10		If you are a sysadmin of a server anywhere (that includes at home!), you may
11		want an added layer of protection against intruders. This is not a replacement
12		for other security measures, such as:
13
14		- Disable root SSH
15		- Disable SSH password authentication
16		- Allow only certain users to login via SSH
17		- Allow SSH only from certain IPs
18
19		However, MFA can be added as an additional security measure to ensure that your
20		server is protected. This is especially important if you need to allow password
21		authentication for SSH.
	1	#+title: Enable TOTP MFA for SSH
	2	#+date: 2022-03-26
	3
	4	** Why Do I Need MFA for SSH?
	5	:PROPERTIES:
	6	:CUSTOM_ID: why-do-i-need-mfa-for-ssh
	7	:END:
	8	If you are a sysadmin of a server anywhere (that includes at home!), you
	9	may want an added layer of protection against intruders. This is not a
	10	replacement for other security measures, such as:
	11
	12	- Disable root SSH
	13	- Disable SSH password authentication
	14	- Allow only certain users to login via SSH
	15	- Allow SSH only from certain IPs
	16
	17	However, MFA can be added as an additional security measure to ensure
	18	that your server is protected. This is especially important if you need
	19	to allow password authentication for SSH.
22	20
23	21	For more guidance on server security measures, see my other post:
24		[Hardening a Public-Facing Home Server](/blog/hardening-a-public-facing-home-server/).
25
26		## Install MFA PAM Module
27
28		PAM, which stands for Pluggable Authentication Module, is an authentication
29		infrastructure used on Linux systems to authenticate a user. In order to use
30		this technology, let's install the `libpam-google-authenticator` package:
31
32		```sh
	22	[[/blog/hardening-a-public-facing-home-server/][Hardening a
	23	Public-Facing Home Server]].
	24
	25	** Install MFA PAM Module
	26	:PROPERTIES:
	27	:CUSTOM_ID: install-mfa-pam-module
	28	:END:
	29	PAM, which stands for Pluggable Authentication Module, is an
	30	authentication infrastructure used on Linux systems to authenticate a
	31	user. In order to use this technology, let's install the
	32	=libpam-google-authenticator= package:
	33
	34	#+begin_src sh
33	35	sudo apt-get update
34		```
	36	#+end_src
35	37
36		```sh
	38	#+begin_src sh
37	39	sudo apt-get install libpam-google-authenticator
38		```
39
40		## Initialize the PAM Module
41
42		### Interactive Method
43
44		Once the package is installed, initialize it and following the interactive
45		prompts to generate your OTP or TOTP:
46
47		```sh
	40	#+end_src
	41
	42	** Initialize the PAM Module
	43	:PROPERTIES:
	44	:CUSTOM_ID: initialize-the-pam-module
	45	:END:
	46	*** Interactive Method
	47	:PROPERTIES:
	48	:CUSTOM_ID: interactive-method
	49	:END:
	50	Once the package is installed, initialize it and following the
	51	interactive prompts to generate your OTP or TOTP:
	52
	53	#+begin_src sh
48	54	google-authenticator
49		```
	55	#+end_src
50	56
51		If you are not sure how to answer, read the prompts carefully and think about
52		having to how each situation would affect your normal login attempts. If you are
53		still not sure, use my default responses below.
	57	If you are not sure how to answer, read the prompts carefully and think
	58	about having to how each situation would affect your normal login
	59	attempts. If you are still not sure, use my default responses below.
54	60
55		```txt
	61	#+begin_src txt
56	62	OUTPUT
57	63
58	64	Do you want authentication tokens to be time-based (y/n) y
59		```
	65	#+end_src
60	66
61		At this point, use an authenticator app somewhere one of your devices to scan
62		the QR code. Any future login attempts after our upcoming configuration changes
63		will require that TOTP.
	67	At this point, use an authenticator app somewhere one of your devices to
	68	scan the QR code. Any future login attempts after our upcoming
	69	configuration changes will require that TOTP.
64	70
65		```txt
	71	#+begin_src txt
66	72	OUTPUT
67	73
68	74	Do you want me to update your "/home/user/.google_authenticator" file? (y/n) y
69		```
	75	#+end_src
70	76
71		```txt
	77	#+begin_src txt
72	78	OUTPUT
73	79
74	80	Do you want to disallow multiple uses of the same authentication
75	81	token? This restricts you to one login about every 30s, but it increases
76	82	your chances to notice or even prevent man-in-the-middle attacks (y/n) y
77		```
	83	#+end_src
78	84
79		```txt
	85	#+begin_src txt
80	86	OUTPUT
81	87
82	88	By default, a new token is generated every 30 seconds by the mobile app.
		@@ -89,30 +95,32 @@ code, the next code) to 17 permitted codes (the 8 previous codes, the current
89	95	code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
90	96	between client and server.
91	97	Do you want to do so? (y/n) n
92		```
	98	#+end_src
93	99
94		```txt
	100	#+begin_src txt
95	101	OUTPUT
96	102
97	103	If the computer that you are logging into isn't hardened against brute-force
98	104	login attempts, you can enable rate-limiting for the authentication module.
99	105	By default, this limits attackers to no more than 3 login attempts every 30s.
100	106	Do you want to enable rate-limiting? (y/n) y
101		```
	107	#+end_src
102	108
103		### Non-Interactive Method
	109	*** Non-Interactive Method
	110	:PROPERTIES:
	111	:CUSTOM_ID: non-interactive-method
	112	:END:
	113	If you need to do this quickly, know your responses to the prompts, or
	114	are setting this up for numerous users, the non-interactive method can
	115	be much faster:
104	116
105		If you need to do this quickly, know your responses to the prompts, or are
106		setting this up for numerous users, the non-interactive method can be much
107		faster:
108
109		```sh
	117	#+begin_src sh
110	118	google-authenticator -t -d -f -r 3 -R 30 -w 3
111		```
	119	#+end_src
112	120
113	121	The options referenced above are as follows:
114	122
115		```txt
	123	#+begin_src txt
116	124	google-authenticator [<options>]
117	125	-h, --help Print this message
118	126	-c, --counter-based Set up counter-based (HOTP) verification
		@@ -132,65 +140,69 @@ google-authenticator [<options>]
132	140	-w, --window-size=W Set window of concurrently valid codes
133	141	-W, --minimal-window Disable window of concurrently valid codes
134	142	-e, --emergency-codes=N Number of emergency codes to generate
135		```
136
137		This fully configures the authenticator, saves it to a file, and then outputs
138		the secret key, QR code, and recovery codes. (If you add the flag `-q`, then
139		there won’t be any output). If you use this command in an automated fashion,
140		make sure your script captures the secret key and/or recovery codes and makes
141		them available to the user.
142
143		## PAM Configuration Settings
144
145		Once you've enabled the T/OTP and have it saved to an MFA app on your phone or
146		other device, open the PAM `sshd` file:
147
148		```sh
	143	#+end_src
	144
	145	This fully configures the authenticator, saves it to a file, and then
	146	outputs the secret key, QR code, and recovery codes. (If you add the
	147	flag =-q=, then there won't be any output). If you use this command in
	148	an automated fashion, make sure your script captures the secret key
	149	and/or recovery codes and makes them available to the user.
	150
	151	** PAM Configuration Settings
	152	:PROPERTIES:
	153	:CUSTOM_ID: pam-configuration-settings
	154	:END:
	155	Once you've enabled the T/OTP and have it saved to an MFA app on your
	156	phone or other device, open the PAM =sshd= file:
	157
	158	#+begin_src sh
149	159	sudo nano /etc/pam.d/sshd
150		```
	160	#+end_src
151	161
152		You need to do two things in this file. First, add the following lines to the
153		bottom of the file:
	162	You need to do two things in this file. First, add the following lines
	163	to the bottom of the file:
154	164
155		```config
	165	#+begin_src config
156	166	auth required pam_google_authenticator.so nullok
157	167	auth required pam_permit.so
158		```
	168	#+end_src
159	169
160	170	Second, comment-out the following line near the top of the file.
161	171
162		If you leave this line uncommented, every SSH login attempt will ask for the
163		following three authentication factors:
	172	If you leave this line uncommented, every SSH login attempt will ask for
	173	the following three authentication factors:
164	174
165	175	1. Publickey
166	176	2. Password
167	177	3. T/OTP code
168	178
169		```config
	179	#+begin_src config
170	180	#@include common-auth
171		```
172
173		## SSH Configuration Settings
	181	#+end_src
174	182
175		Finally, edit the `sshd_config` file again:
	183	** SSH Configuration Settings
	184	:PROPERTIES:
	185	:CUSTOM_ID: ssh-configuration-settings
	186	:END:
	187	Finally, edit the =sshd_config= file again:
176	188
177		```sh
	189	#+begin_src sh
178	190	sudo nano /etc/ssh/sshd_config
179		```
	191	#+end_src
180	192
181		You'll need to change `ChallengeResponseAuthentication` to yes and add the
182		`AuthenticationMethods` line to the bottom of the file.
	193	You'll need to change =ChallengeResponseAuthentication= to yes and add
	194	the =AuthenticationMethods= line to the bottom of the file.
183	195
184		```config
	196	#+begin_src config
185	197	ChallengeResponseAuthentication yes
186	198	AuthenticationMethods publickey,password publickey,keyboard-interactive
187		```
	199	#+end_src
188	200
189		Finally, restart the `ssh` service:
	201	Finally, restart the =ssh= service:
190	202
191		```sh
	203	#+begin_src sh
192	204	sudo systemctl restart sshd.service
193		```
	205	#+end_src
194	206
195		The next time you log in, you should be greeted with a verification code
	207	The next time you log in, you should be greeted with a verification code
196	208	request!

blog/2022-04-02-nginx-reverse-proxy.org +163 −142

		@@ -1,42 +1,43 @@
1		+++
2		date = 2022-04-02
3		title = "Set-Up a Reverse Proxy with Nginx"
4		description = "Learn how to set-up a reverse proxy server with Nginx on Ubuntu."
5		draft = false
6		+++
7
8		## What is a Reverse Proxy?
9
10		A reverse proxy is a server that is placed between local servers or services and
11		clients/users (e.g., the internet). The reverse proxy intercepts all requests
12		from clients at the network edge and uses its configuration files to determine
13		where each request should be sent.
14
15		### A Brief Example
16
	1	#+title: Set-Up a Reverse Proxy with Nginx
	2	#+date: 2022-04-02
	3
	4	** What is a Reverse Proxy?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-a-reverse-proxy
	7	:END:
	8	A reverse proxy is a server that is placed between local servers or
	9	services and clients/users (e.g., the internet). The reverse proxy
	10	intercepts all requests from clients at the network edge and uses its
	11	configuration files to determine where each request should be sent.
	12
	13	*** A Brief Example
	14	:PROPERTIES:
	15	:CUSTOM_ID: a-brief-example
	16	:END:
17	17	For example, let's say that I run three servers in my home:
18	18
19		- Server_01 (`example.com`)
20		- Server_02 (`service01.example.com`)
21		- Server_03 (`service02.example.com`)
	19	- Server_01 (=example.com=)
	20	- Server_02 (=service01.example.com=)
	21	- Server_03 (=service02.example.com=)
22	22
23		I also run a reverse proxy in my home that intercepts all public traffic:
	23	I also run a reverse proxy in my home that intercepts all public
	24	traffic:
24	25
25		- Reverse Proxy
	26	- Reverse Proxy
26	27
27		Assume that I have a domain name (`example.com`) that allows clients to request
28		websites or services from my home servers.
	28	Assume that I have a domain name (=example.com=) that allows clients to
	29	request websites or services from my home servers.
29	30
30		In this case, the reverse proxy will intercept all traffic from `example.com`
31		that enters my network and determine if the client is requesting valid data,
32		based on my configuration.
	31	In this case, the reverse proxy will intercept all traffic from
	32	=example.com= that enters my network and determine if the client is
	33	requesting valid data, based on my configuration.
33	34
34		If the user is requesting `example.com` and my configuration files say that
35		Server_01 holds that data, Nginx will send the user to Server_01. If I were to
36		change the configuration so that `example.com` is routed to Server_02, that same
37		user would be sent to Server_02 instead.
	35	If the user is requesting =example.com= and my configuration files say
	36	that Server_01 holds that data, Nginx will send the user to Server_01.
	37	If I were to change the configuration so that =example.com= is routed to
	38	Server_02, that same user would be sent to Server_02 instead.
38	39
39		```txt
	40	#+begin_src txt
40	41	┌──────┐ ┌───────────┐
41	42	│ User │─┐ ┌──► Server_01 │
42	43	└──────┘ │ │ └───────────┘
		@@ -46,133 +47,151 @@ user would be sent to Server_02 instead.
46	47	┌──────┐ │ │ ┌───────────┐
47	48	│ User │─┘ └──► Server_03 │
48	49	└──────┘ └───────────┘
49		```
50
51		## Reverse Proxy Options
52
53		There are a lot of options when it comes to reverse proxy servers, so I'm just
54		going to list a few of the options I've heard recommended over the last few
55		years:
56
57		- [Nginx](https://nginx.com)
58		- [Caddy](https://caddyserver.com)
59		- [Traefik](https://traefik.io/)
60		- [HAProxy](https://www.haproxy.org/)
61		- [Squid](https://ubuntu.com/server/docs/proxy-servers-squid)
62
63		In this post, we will be using Nginx as our reverse proxy, running on Ubuntu
64		Server 20.04.4 LTS.
65
66		## Nginx Reverse Proxy Example
67
68		### Local Applications
69
70		You may be like me and have a lot of applications running on your local network
71		that you'd like to expose publicly with a domain.
72
73		In my case, I have services running in multiple Docker containers within a
74		single server and want a way to visit those services from anywhere with a URL.
75		For example, on my local network, [Dashy](https://dashy.to) runs through port
76		4000 (`localhost:4000`) and
77		[Uptime Kuma](https://github.com/louislam/uptime-kuma) runs through port 3001
78		(`localhost:3001`).
	50	#+end_src
	51
	52	** Reverse Proxy Options
	53	:PROPERTIES:
	54	:CUSTOM_ID: reverse-proxy-options
	55	:END:
	56	There are a lot of options when it comes to reverse proxy servers, so
	57	I'm just going to list a few of the options I've heard recommended over
	58	the last few years:
	59
	60	- [[https://nginx.com][Nginx]]
	61	- [[https://caddyserver.com][Caddy]]
	62	- [[https://traefik.io/][Traefik]]
	63	- [[https://www.haproxy.org/][HAProxy]]
	64	- [[https://ubuntu.com/server/docs/proxy-servers-squid][Squid]]
	65
	66	In this post, we will be using Nginx as our reverse proxy, running on
	67	Ubuntu Server 20.04.4 LTS.
	68
	69	** Nginx Reverse Proxy Example
	70	:PROPERTIES:
	71	:CUSTOM_ID: nginx-reverse-proxy-example
	72	:END:
	73	*** Local Applications
	74	:PROPERTIES:
	75	:CUSTOM_ID: local-applications
	76	:END:
	77	You may be like me and have a lot of applications running on your local
	78	network that you'd like to expose publicly with a domain.
	79
	80	In my case, I have services running in multiple Docker containers within
	81	a single server and want a way to visit those services from anywhere
	82	with a URL. For example, on my local network,
	83	[[https://dashy.to][Dashy]] runs through port 4000 (=localhost:4000=)
	84	and [[https://github.com/louislam/uptime-kuma][Uptime Kuma]] runs
	85	through port 3001 (=localhost:3001=).
79	86
80	87	In order to expose these services to the public, I will need to do the
81	88	following:
82	89
83		1. Set up DNS records for a domain or subdomain (one per service) to point
84		toward the IP address of the server.
85		2. Open up the server network's HTTP and HTTPS ports (80 & 443) so that the
86		reverse proxy can accept traffic and determine where to send it.
	90	1. Set up DNS records for a domain or subdomain (one per service) to
	91	point toward the IP address of the server.
	92	2. Open up the server network's HTTP and HTTPS ports (80 & 443) so that
	93	the reverse proxy can accept traffic and determine where to send it.
87	94	3. Install the reverse proxy software.
88		4. Configure the reverse proxy to recognize which service should get traffic
89		from any of the domains or subdomains.
	95	4. Configure the reverse proxy to recognize which service should get
	96	traffic from any of the domains or subdomains.
90	97
91		### Step 1: DNS Configuration
	98	*** Step 1: DNS Configuration
	99	:PROPERTIES:
	100	:CUSTOM_ID: step-1-dns-configuration
	101	:END:
	102	To start, update your DNS configuration so that you have an =A= record
	103	for each domain or subdomain.
92	104
93		To start, update your DNS configuration so that you have an `A` record for each
94		domain or subdomain.
	105	The =A= records should point toward the public IP address of the server.
	106	If you don't know the public IP address, log in to the server and run
	107	the following command:
95	108
96		The `A` records should point toward the public IP address of the server. If you
97		don't know the public IP address, log in to the server and run the following
98		command:
99
100		```sh
	109	#+begin_src sh
101	110	curl ifconfig.co
102		```
	111	#+end_src
103	112
104		In the DNS example below, `xxx.xxx.xxx.xxx` is the public IP address of the
105		server.
	113	In the DNS example below, =xxx.xxx.xxx.xxx= is the public IP address of
	114	the server.
106	115
107		```config
	116	#+begin_src config
108	117	example.com A xxx.xxx.xxx.xxx
109	118	uptime.example.com A xxx.xxx.xxx.xxx
110	119	dashy.example.com A xxx.xxx.xxx.xxx
111	120	www CNAME example.com
112		```
	121	#+end_src
113	122
114	123	Finally, ensure the DNS has propagated correctly with
115		[DNS Checker](https://dnschecker.org) by entering your domains or subdomains in
116		the search box and ensuring the results are showing the correct IP address.
117
118		### Step 2: Open Network Ports
119
120		This step will be different depending on which router you have in your home. If
121		you're not sure, try to visit [192.168.1.1](http://192.168.1.1) in your browser.
122		Login credentials are usually written on a sticker somewhere on your
123		modem/router.
124
125		Once you're able to log in to your router, find the Port Forwarding settings.
126		You will need to forward ports `80` and `443` to whichever machine is
127		running the reverse proxy.
128
129		In my case, the table below shows the port-forwarding rules I've created.
130		In this table, `xxx.xxx.xxx.xxx` is the local device IP of the reverse proxy
131		server, it will probably be an IP between `192.168.1.1` and `192.168.1.255`.
132
133		\| NAME \| FROM \| PORT \| DEST PORT/IP \| ENABLED \|
134		\|:-----:\|:----:\|:----:\|:---------------:\|:-------:\|
135		\| HTTP \| \* \| 80 \| xxx.xxx.xxx.xxx \| TRUE \|
136		\| HTTPS \| \* \| 443 \| xxx.xxx.xxx.xxx \| TRUE \|
137
138		Once configured, these rules will direct all web traffic to your reverse proxy.
139
140		### Step 3: Nginx Installation
141
	124	[[https://dnschecker.org][DNS Checker]] by entering your domains or
	125	subdomains in the search box and ensuring the results are showing the
	126	correct IP address.
	127
	128	*** Step 2: Open Network Ports
	129	:PROPERTIES:
	130	:CUSTOM_ID: step-2-open-network-ports
	131	:END:
	132	This step will be different depending on which router you have in your
	133	home. If you're not sure, try to visit
	134	[[http://192.168.1.1][192.168.1.1]] in your browser. Login credentials
	135	are usually written on a sticker somewhere on your modem/router.
	136
	137	Once you're able to log in to your router, find the Port Forwarding
	138	settings. You will need to forward ports =80= and =443= to whichever
	139	machine is running the reverse proxy.
	140
	141	In my case, the table below shows the port-forwarding rules I've
	142	created. In this table, =xxx.xxx.xxx.xxx= is the local device IP of the
	143	reverse proxy server, it will probably be an IP between =192.168.1.1=
	144	and =192.168.1.255=.
	145
	146	\| NAME \| FROM \| PORT \| DEST PORT/IP \| ENABLED \|
	147	\|-------+------+------+-----------------+---------\|
	148	\| HTTP \| * \| 80 \| xxx.xxx.xxx.xxx \| TRUE \|
	149	\| HTTPS \| * \| 443 \| xxx.xxx.xxx.xxx \| TRUE \|
	150
	151	Once configured, these rules will direct all web traffic to your reverse
	152	proxy.
	153
	154	*** Step 3: Nginx Installation
	155	:PROPERTIES:
	156	:CUSTOM_ID: step-3-nginx-installation
	157	:END:
142	158	To install Nginx, simply run the following command:
143	159
144		```sh
	160	#+begin_src sh
145	161	sudo apt install nginx
146		```
	162	#+end_src
147	163
148		If you have a firewall enabled, open up ports `80` and `443` on your server so
149		that Nginx can accept web traffic from the router.
	164	If you have a firewall enabled, open up ports =80= and =443= on your
	165	server so that Nginx can accept web traffic from the router.
150	166
151		For example, if you want to use `ufw` for web traffic and SSH, run the following
152		commands:
	167	For example, if you want to use =ufw= for web traffic and SSH, run the
	168	following commands:
153	169
154		```sh
	170	#+begin_src sh
155	171	sudo ufw allow 'Nginx Full'
156	172	sudo ufw allow SSH
157	173	sudo ufw enable
158		```
	174	#+end_src
159	175
160		### Step 4: Nginx Configuration
161
162		Now that we have domains pointing toward the server, the only step left is to
163		configure the reverse proxy to direct traffic from domains to local services.
	176	*** Step 4: Nginx Configuration
	177	:PROPERTIES:
	178	:CUSTOM_ID: step-4-nginx-configuration
	179	:END:
	180	Now that we have domains pointing toward the server, the only step left
	181	is to configure the reverse proxy to direct traffic from domains to
	182	local services.
164	183
165	184	To start, you'll need to create a configuration file for each domain in
166		`/etc/nginx/sites-available/`. They will look identical except for the
167		`server_name` variable and the `proxy_pass` port.
	185	=/etc/nginx/sites-available/=. They will look identical except for the
	186	=server_name= variable and the =proxy_pass= port.
168	187
169	188	Dashy:
170	189
171		```sh
	190	#+begin_src sh
172	191	nano /etc/nginx/sites-available/dashy.example.com
173		```
	192	#+end_src
174	193
175		```config
	194	#+begin_src config
176	195	server {
177	196	listen 80;
178	197	server_name dashy.example.com;
		@@ -181,15 +200,15 @@ server {
181	200	proxy_pass http://localhost:4000;
182	201	}
183	202	}
184		```
	203	#+end_src
185	204
186	205	Uptime:
187	206
188		```sh
	207	#+begin_src sh
189	208	nano /etc/nginx/sites-available/uptime.example.com
190		```
	209	#+end_src
191	210
192		```config
	211	#+begin_src config
193	212	server {
194	213	listen 80;
195	214	server_name uptime.example.com;
		@@ -198,29 +217,31 @@ server {
198	217	proxy_pass http://localhost:3001;
199	218	}
200	219	}
201		```
	220	#+end_src
202	221
203		Once the configuration files are created, you will need to enable them with the
204		`symlink` command:
	222	Once the configuration files are created, you will need to enable them
	223	with the =symlink= command:
205	224
206		```sh
	225	#+begin_src sh
207	226	sudo ln -s /etc/nginx/sites-available/dashy.example.com /etc/nginx/sites-enabled/
208		```
	227	#+end_src
209	228
210	229	Voilà! Your local services should now be available through their URLs.
211	230
212		## HTTPS with Certbot
213
214		If you've followed along, you'll notice that your services are only available
215		via HTTP (not HTTPS).
	231	** HTTPS with Certbot
	232	:PROPERTIES:
	233	:CUSTOM_ID: https-with-certbot
	234	:END:
	235	If you've followed along, you'll notice that your services are only
	236	available via HTTP (not HTTPS).
216	237
217		If you want to enable HTTPS for your new domains, you will need to generate
218		SSL/TLS certificates for them. The easiest way to generate certificates on Nginx
219		is [Certbot](https://certbot.eff.org):
	238	If you want to enable HTTPS for your new domains, you will need to
	239	generate SSL/TLS certificates for them. The easiest way to generate
	240	certificates on Nginx is [[https://certbot.eff.org][Certbot]]:
220	241
221		```sh
	242	#+begin_src sh
222	243	sudo apt install snapd; sudo snap install core; sudo snap refresh core
223	244	sudo snap install --classic certbot
224	245	sudo ln -s /snap/bin/certbot /usr/bin/certbot
225	246	sudo certbot --nginx
226		```
	247	#+end_src

blog/2022-04-09-pinetime.org +160 −130

		@@ -1,148 +1,178 @@
1		+++
2		date = 2022-04-09
3		title = "PineTime: An Open-Source SmartWatch"
4		description = "Exploring the PineTime, an open-source smartwatch created by PINE64."
5		draft = false
6		+++
7
8		## PineTime Product Information
9
10		### Overview
11
12		The [PineTime](https://www.pine64.org/pinetime/) is an open-source smartwatch,
13		created by [PINE64](https://www.pine64.org). Originally announced in September
14		2019, this ARM-based watch is a fantastic option for users who want the benefits
15		of a modern smartwatch with the backing of open-source components and software.
16
17		### Product Specifications
18
	1	#+title: PineTime: An Open-Source SmartWatch
	2	#+date: 2022-04-09
	3
	4	** PineTime Product Information
	5	:PROPERTIES:
	6	:CUSTOM_ID: pinetime-product-information
	7	:END:
	8	*** Overview
	9	:PROPERTIES:
	10	:CUSTOM_ID: overview
	11	:END:
	12	The [[https://www.pine64.org/pinetime/][PineTime]] is an open-source
	13	smartwatch, created by [[https://www.pine64.org][PINE64]]. Originally
	14	announced in September 2019, this ARM-based watch is a fantastic option
	15	for users who want the benefits of a modern smartwatch with the backing
	16	of open-source components and software.
	17
	18	*** Product Specifications
	19	:PROPERTIES:
	20	:CUSTOM_ID: product-specifications
	21	:END:
19	22	I won't dive into too many details that you can find on
20		[the product page](https://www.pine64.org/pinetime/), but I wanted to point out
21		the prices for each watch and the primary functions:
22
23		#### Price:
24
25		- $26.99 (Sealed)
26		- $24.99 (Dev Kit)
27		- $51.98 (One Sealed + One Dev Kit)
28
29		#### Primary Functionality:
30
31		- Clock (+ Smartphone Sync)
32		- Pedometer
33		- Heart Rate Monitor
34		- Sleep Monitor
35		- Calories burned
36		- Messaging
37		- Smartphone Notifications
38		- Media Controls
39
40		## Unboxing
41
42		Now, my PineTime was ordered on 2022-02-17, shipped on 2022-02-22, and was
43		delivered on 2022-03-23.
44		With the current delays on shipping times around the world (and the
45		semiconductor shortage), a month for delivery from China seems reasonable to me.
46
47		The packaging is simple, and the watch comes with instructions, technical
48		information, the watch, and a charger (it does not include a USB wall adapter).
49
50		The watch itself was able to turn on immediately when I pulled it out of the
51		box, but the battery was depleted and required charging right away.
52
53		![PineTime Box Contents](https://img.cleberg.net/blog/20220409-pinetime-smart-watch/pinetime_box_contents.png)
54
55		## Software
56
57		### Watch OS: InfiniTime
58
59		While turning on the watch for the first time, some of the main design choices
60		you can see in the watch OS,
61		[InfiniTime](https://wiki.pine64.org/wiki/InfiniTime), are:
62
63		- A square bezel, not too thin against the sides of the watch.
64		- A simple, rubber band.
65		- Basic font and screen pixel design.
66		- Swipe gestures to access other screens.
67
68		![PineTime Screens](https://img.cleberg.net/blog/20220409-pinetime-smart-watch/pinetime.png)
69
70		The OS itself is fantastic in terms of functionality for me. It does exactly
71		what a smartwatch should do - track time, steps, heart rates, and connect to
72		another smart device, without being overly burdensome to the user.
73
74		My only gripe so far is that it's _really_ difficult to swipe to different
75		screens, such as pulling down the notification tray. I'm not sure if this is an
76		OS or hardware issue, but it makes it quite hard to quickly move around the
77		screens.
78
79		However, my absolute favorite design choice is that the button the side turns
80		the screen on and off and tilting/waving my wrist doesn't accidentally turn on
81		the screen. With other watches, I absolutely hated not being able to turn off
82		the raise-to-wake or wave features (i.e., blinding myself while wearing a watch
83		at night because I moved my arm).
84
85		### iOS App: InfiniLink
86
	23	[[https://www.pine64.org/pinetime/][the product page]], but I wanted to
	24	point out the prices for each watch and the primary functions:
	25
	26	**** Price:
	27	:PROPERTIES:
	28	:CUSTOM_ID: price
	29	:END:
	30	- $26.99 (Sealed)
	31	- $24.99 (Dev Kit)
	32	- $51.98 (One Sealed + One Dev Kit)
	33
	34	**** Primary Functionality:
	35	:PROPERTIES:
	36	:CUSTOM_ID: primary-functionality
	37	:END:
	38	- Clock (+ Smartphone Sync)
	39	- Pedometer
	40	- Heart Rate Monitor
	41	- Sleep Monitor
	42	- Calories burned
	43	- Messaging
	44	- Smartphone Notifications
	45	- Media Controls
	46
	47	** Unboxing
	48	:PROPERTIES:
	49	:CUSTOM_ID: unboxing
	50	:END:
	51	Now, my PineTime was ordered on 2022-02-17, shipped on 2022-02-22, and
	52	was delivered on 2022-03-23. With the current delays on shipping times
	53	around the world (and the semiconductor shortage), a month for delivery
	54	from China seems reasonable to me.
	55
	56	The packaging is simple, and the watch comes with instructions,
	57	technical information, the watch, and a charger (it does not include a
	58	USB wall adapter).
	59
	60	The watch itself was able to turn on immediately when I pulled it out of
	61	the box, but the battery was depleted and required charging right away.
	62
	63	#+caption: PineTime Box Contents
	64	[[https://img.cleberg.net/blog/20220409-pinetime-smart-watch/pinetime_box_contents.png]]
	65
	66	** Software
	67	:PROPERTIES:
	68	:CUSTOM_ID: software
	69	:END:
	70	*** Watch OS: InfiniTime
	71	:PROPERTIES:
	72	:CUSTOM_ID: watch-os-infinitime
	73	:END:
	74	While turning on the watch for the first time, some of the main design
	75	choices you can see in the watch OS,
	76	[[https://wiki.pine64.org/wiki/InfiniTime][InfiniTime]], are:
	77
	78	- A square bezel, not too thin against the sides of the watch.
	79	- A simple, rubber band.
	80	- Basic font and screen pixel design.
	81	- Swipe gestures to access other screens.
	82
	83	#+caption: PineTime Screens
	84	[[https://img.cleberg.net/blog/20220409-pinetime-smart-watch/pinetime.png]]
	85
	86	The OS itself is fantastic in terms of functionality for me. It does
	87	exactly what a smartwatch should do - track time, steps, heart rates,
	88	and connect to another smart device, without being overly burdensome to
	89	the user.
	90
	91	My only gripe so far is that it's /really/ difficult to swipe to
	92	different screens, such as pulling down the notification tray. I'm not
	93	sure if this is an OS or hardware issue, but it makes it quite hard to
	94	quickly move around the screens.
	95
	96	However, my absolute favorite design choice is that the button the side
	97	turns the screen on and off and tilting/waving my wrist doesn't
	98	accidentally turn on the screen. With other watches, I absolutely hated
	99	not being able to turn off the raise-to-wake or wave features (i.e.,
	100	blinding myself while wearing a watch at night because I moved my arm).
	101
	102	*** iOS App: InfiniLink
	103	:PROPERTIES:
	104	:CUSTOM_ID: ios-app-infinilink
	105	:END:
87	106	Since I am using iOS as my primary mobile device OS, I am using the
88		[InfiniLink](https://github.com/xan-m/InfiniLink) app to connect my watch.
	107	[[https://github.com/xan-m/InfiniLink][InfiniLink]] app to connect my
	108	watch.
89	109
90	110	This app provides the following for PineTime owners:
91	111
92		- Firmware updates
93		- Steps
94		- Charts
95		- Notifications
	112	- Firmware updates
	113	- Steps
	114	- Charts
	115	- Notifications
96	116
97		I mashed up a few screenshots to show off the home page, menu, firmware update,
98		and notification test screens:
	117	I mashed up a few screenshots to show off the home page, menu, firmware
	118	update, and notification test screens:
99	119
100		![InfiniLink Home](https://img.cleberg.net/blog/20220409-pinetime-smart-watch/infinilink_home.png)
	120	#+caption: InfiniLink Home
	121	[[https://img.cleberg.net/blog/20220409-pinetime-smart-watch/infinilink_home.png]]
101	122
102		Another big feature of InfiniLink is the ability to track pedometer steps in a
103		collection of beautiful graphs, with the option to change your step goal and
104		add in manual steps.
	123	Another big feature of InfiniLink is the ability to track pedometer
	124	steps in a collection of beautiful graphs, with the option to change
	125	your step goal and add in manual steps.
105	126
106		![InfiniLink Steps](https://img.cleberg.net/blog/20220409-pinetime-smart-watch/infinilink_steps.png)
	127	#+caption: InfiniLink Steps
	128	[[https://img.cleberg.net/blog/20220409-pinetime-smart-watch/infinilink_steps.png]]
107	129
108		Finally, there are charts to display the battery percentage and heart rates over
109		time. This area also comes with an option to clear data.
	130	Finally, there are charts to display the battery percentage and heart
	131	rates over time. This area also comes with an option to clear data.
110	132
111		![InfiniLink Charts](https://img.cleberg.net/blog/20220409-pinetime-smart-watch/infinilink_charts.png)
	133	#+caption: InfiniLink Charts
	134	[[https://img.cleberg.net/blog/20220409-pinetime-smart-watch/infinilink_charts.png]]
112	135
113		## Final Thoughts
114
115		### Pros
116
117		After wearing my watch for a few weeks, I have mostly positive thoughts about
118		the watch so far.
119		In the past, I have owned smartwatches by FitBit, Fossil, Apple, etc. -
120		but I prefer the PineTime over all of those watches.
	136	** Final Thoughts
	137	:PROPERTIES:
	138	:CUSTOM_ID: final-thoughts
	139	:END:
	140	*** Pros
	141	:PROPERTIES:
	142	:CUSTOM_ID: pros
	143	:END:
	144	After wearing my watch for a few weeks, I have mostly positive thoughts
	145	about the watch so far. In the past, I have owned smartwatches by
	146	FitBit, Fossil, Apple, etc. - *but I prefer the PineTime over all of
	147	those watches*.
121	148
122	149	The PineTime strips out all the unnecessary features and performs the
123	150	functions that it provides effectively and efficiently.
124	151
125		The battery life is amazing on this device. By default, the watch seems to last
126		anywhere from a few days to a week before dying.
	152	The battery life is amazing on this device. By default, the watch seems
	153	to last anywhere from a few days to a week before dying.
127	154
128	155	And of course, it's open source and backed by some of the most dedicated
129		enthusiasts and developers I've seen. Watching the Matrix channel, forums, and
130		website have been exciting to see.
131
132		### Cons
133
134		If I had to complain about anything, it would simply be the small bugs in some
135		features that can be contributed to the companion apps more than the watch
136		itself.
137
138		A regular user would want native notification support out-of-the-box, which is
139		the biggest item not working for me at the moment.
140
141		My only other complaint is that the battery indicator on the watch doesn't seem
142		accurate when it's nearing depletion - it seems that there's a bit of battery
143		life left and then my watch is dead very suddenly after. This could just be me
144		misinterpreting the battery level icons, but it has fooled me a few times into
145		thinking I had more battery left than I actually did.
146
147		Other than those small items, I really do love this watch and am glad I replaced
148		my Apple Watch with the PineTime.
	156	enthusiasts and developers I've seen. Watching the Matrix channel,
	157	forums, and website have been exciting to see.
	158
	159	*** Cons
	160	:PROPERTIES:
	161	:CUSTOM_ID: cons
	162	:END:
	163	If I had to complain about anything, it would simply be the small bugs
	164	in some features that can be contributed to the companion apps more than
	165	the watch itself.
	166
	167	A regular user would want native notification support out-of-the-box,
	168	which is the biggest item not working for me at the moment.
	169
	170	My only other complaint is that the battery indicator on the watch
	171	doesn't seem accurate when it's nearing depletion - it seems that
	172	there's a bit of battery life left and then my watch is dead very
	173	suddenly after. This could just be me misinterpreting the battery level
	174	icons, but it has fooled me a few times into thinking I had more battery
	175	left than I actually did.
	176
	177	Other than those small items, I really do love this watch and am glad I
	178	replaced my Apple Watch with the PineTime.

blog/2022-06-01-ditching-cloudflare.org +103 −87

		@@ -1,89 +1,105 @@
1		+++
2		date = 2022-06-01
3		title = "Ditching Cloudflare for Njalla"
4		description = "After spending a few years jumping around to different DNS hosts, I'm finally ditching Cloudflare for good."
5		draft = false
6		+++
7
8		## Registrar
9
10		After spending a year or so using Cloudflare for DNS only - no proxying or
11		applications - I spent the last few months using Cloudflare Tunnels and
12		Cloudflare Access to protect my self-hosted websites and applications via their
13		proxy traffic model.
14
15		However, I have never liked using Cloudflare due to their increasingly large
16		share of control over web traffic, as well as their business model of being a
17		MITM for all of your traffic.
18
19		So, as of today, I have switched over to [Njalla](https://njal.la) as my
20		registrar and DNS manager. I was able to easily transfer my domains over
21		rapidly, with only one domain taking more than 15-30 minutes to propagate.
22
23		~~I do still have two domains sitting at Cloudflare for the moment while I
24		decide if they're worth the higher rates (one domain is 30€ and the other is
25		45€).~~
26
27		> Update (2022.06.03): I ended up transferring my final two domains over to
28		> Njalla, clearing my Cloudflare account of personal data, and deleting the
29		> Cloudflare account entirely. _I actually feel relieved to have moved on to a
30		> provider I trust._
31
32		## DNS
33
34		As noted above, I'm using Njalla exclusively for DNS configurations on my
35		domains.
36
37		However, the transfer process was not ideal. As soon as the domains transferred
38		over, I switched the nameservers from Cloudflare to Njalla and lost most of the
39		associated DNS records. So, the majority of the time spent during the migration
40		was simply re-typing all the DNS records back in one-by-one.
41
42		This would be much simpler if I were able to edit the plain-text format of the
43		DNS configuration. I was able to do that at a past registrar (perhaps it was
44		[Gandi.net](https://gandi.net/)?) and it made life a lot easier.
45
46		### Dynamic DNS Updates
47
48		I have built an easy Python script to run (or set-up in `cron` to run
49		automatically) that will check my server's IPv4 and IPv6, compare it to Njalla,
50		and update the DNS records if they don't match. You can see the full script and
51		process in my other post:
52		[Updating Dynamic DNS with Njalla API](/blog/njalla-dns-api/).
53
54		I haven't used this other method, but I do know that you can create `Dynamic`
55		DNS records with Njalla that
56		[work for updating dynamic subdomains](https://njal.la/docs/ddns/).
57
58		### Njalla's DNS Tool
59
	1	#+title: Ditching Cloudflare for Njalla
	2	#+date: 2022-06-01
	3
	4	** Registrar
	5	:PROPERTIES:
	6	:CUSTOM_ID: registrar
	7	:END:
	8	After spending a year or so using Cloudflare for DNS only - no proxying
	9	or applications - I spent the last few months using Cloudflare Tunnels
	10	and Cloudflare Access to protect my self-hosted websites and
	11	applications via their proxy traffic model.
	12
	13	However, I have never liked using Cloudflare due to their increasingly
	14	large share of control over web traffic, as well as their business model
	15	of being a MITM for all of your traffic.
	16
	17	So, as of today, I have switched over to [[https://njal.la][Njalla]] as
	18	my registrar and DNS manager. I was able to easily transfer my domains
	19	over rapidly, with only one domain taking more than 15-30 minutes to
	20	propagate.
	21
	22	+I do still have two domains sitting at Cloudflare for the moment while
	23	I decide if they're worth the higher rates (one domain is 30€ and the
	24	other is 45€).+
	25
	26	#+begin_quote
	27	Update (2022.06.03): I ended up transferring my final two domains over
	28	to Njalla, clearing my Cloudflare account of personal data, and deleting
	29	the Cloudflare account entirely. /I actually feel relieved to have moved
	30	on to a provider I trust./
	31
	32	#+end_quote
	33
	34	** DNS
	35	:PROPERTIES:
	36	:CUSTOM_ID: dns
	37	:END:
	38	As noted above, I'm using Njalla exclusively for DNS configurations on
	39	my domains.
	40
	41	However, the transfer process was not ideal. As soon as the domains
	42	transferred over, I switched the nameservers from Cloudflare to Njalla
	43	and lost most of the associated DNS records. So, the majority of the
	44	time spent during the migration was simply re-typing all the DNS records
	45	back in one-by-one.
	46
	47	This would be much simpler if I were able to edit the plain-text format
	48	of the DNS configuration. I was able to do that at a past registrar
	49	(perhaps it was [[https://gandi.net/][Gandi.net]]?) and it made life a
	50	lot easier.
	51
	52	*** Dynamic DNS Updates
	53	:PROPERTIES:
	54	:CUSTOM_ID: dynamic-dns-updates
	55	:END:
	56	I have built an easy Python script to run (or set-up in =cron= to run
	57	automatically) that will check my server's IPv4 and IPv6, compare it to
	58	Njalla, and update the DNS records if they don't match. You can see the
	59	full script and process in my other post:
	60	[[/blog/njalla-dns-api/][Updating Dynamic DNS with Njalla API]].
	61
	62	I haven't used this other method, but I do know that you can create
	63	=Dynamic= DNS records with Njalla that
	64	[[https://njal.la/docs/ddns/][work for updating dynamic subdomains]].
	65
	66	*** Njalla's DNS Tool
	67	:PROPERTIES:
	68	:CUSTOM_ID: njallas-dns-tool
	69	:END:
60	70	One neat upside to Njalla is that they have a
61		[DNS lookup tool](https://check.njal.la/dns/) that provides a lot of great
62		information for those of you (AKA: me) who hate using the `dig` command.
63
64		This was very useful for monitoring a couple of my transferred domains to see
65		when the changes in nameservers, records, and DNSSEC went into effect.
66
67		## Tunnel
68
	71	[[https://check.njal.la/dns/][DNS lookup tool]] that provides a lot of
	72	great information for those of you (AKA: me) who hate using the =dig=
	73	command.
	74
	75	This was very useful for monitoring a couple of my transferred domains
	76	to see when the changes in nameservers, records, and DNSSEC went into
	77	effect.
	78
	79	** Tunnel
	80	:PROPERTIES:
	81	:CUSTOM_ID: tunnel
	82	:END:
69	83	Cloudflare Tunnel is a service that acts as a reverse-proxy (hosted on
70		Cloudflare's servers) and allowed me to mask the private IP address of the
71		server hosting my various websites and apps.
72
73		However, as I was moving away from Cloudflare, I was not able to find a suitable
74		replacement that was both inexpensive and simple. So, I simply went back to
75		hosting [my own reverse proxy with Nginx](/blog/set-up-nginx-reverse-proxy/).
76		With the recent additions of Unifi hardware in my server/network rack, I am much
77		more protected against spam and malicious attacks at the network edge than I was
78		before I switched to Cloudflare.
79
80		## Access
81
82		Cloudflare Access, another app I used in combination with Cloudflare Tunnel,
83		provided an authentication screen that required you to enter valid credentials
84		before Cloudflare would forward you to the actual website or app (if the
85		website/app has their own authentication, you'd then have to authenticate a
86		second time).
87
88		I did not replace this service with anything since I only host a handful of
89		non-sensitive apps that don't require duplicate authentication.
	84	Cloudflare's servers) and allowed me to mask the private IP address of
	85	the server hosting my various websites and apps.
	86
	87	However, as I was moving away from Cloudflare, I was not able to find a
	88	suitable replacement that was both inexpensive and simple. So, I simply
	89	went back to hosting [[/blog/set-up-nginx-reverse-proxy/][my own reverse
	90	proxy with Nginx]]. With the recent additions of Unifi hardware in my
	91	server/network rack, I am much more protected against spam and malicious
	92	attacks at the network edge than I was before I switched to Cloudflare.
	93
	94	** Access
	95	:PROPERTIES:
	96	:CUSTOM_ID: access
	97	:END:
	98	Cloudflare Access, another app I used in combination with Cloudflare
	99	Tunnel, provided an authentication screen that required you to enter
	100	valid credentials before Cloudflare would forward you to the actual
	101	website or app (if the website/app has their own authentication, you'd
	102	then have to authenticate a second time).
	103
	104	I did not replace this service with anything since I only host a handful
	105	of non-sensitive apps that don't require duplicate authentication.

blog/2022-06-04-njalla-dns-api.org +112 −99

		@@ -1,104 +1,113 @@
1		+++
2		date = 2022-06-04
3		title = "Dynamic DNS with Njalla API"
4		description = "Learn how to update Njalla DNS records automatically with a simple Python script."
5		draft = false
6		+++
7
8		## Njalla's API
9
10		As noted in my recent post about
11		[switching to Njalla from Cloudflare](/blog/ditching-cloudflare/), I was
12		searching for a way to replace my very easy-to-use bash script to
13		[update Cloudflare's DNS via their API](/blog/cloudflare-dns-api/).
14
15		To reiterate what I said in those posts, this is a common necessity for those of
16		us who have non-static IP addresses that can change at any moment due to ISP
17		policy.
18
19		In order to keep a home server running smoothly, the server admin needs to have
20		a process to constantly monitor their public IP address and update their
21		domain's DNS records if it changes.
22
23		This post explains how to use Python to update Njalla's DNS records whenever a
24		machine's public IP address changes.
25
26		### Creating a Token
27
28		To use Njalla's API, you will first need to create a token that will be used to
29		authenticate you every time you call the API. Luckily, this is very easy to do
30		if you have an account with Njalla.
31
32		Simply go the [API Settings](https://njal.la/settings/api/) page and click the
33		`Add Token` button. Next, enter a name for the token and click `Add`.
34
35		Finally, click the `Manage` button next to your newly created token and copy the
36		`API Token` field.
37
38		### Finding the Correct API Request
39
40		Once you have a token, you're ready to call the Njalla API for any number of
41		requests. For a full listing of available requests, see the
42		[Njalla API Documentation](https://njal.la/api/).
43
44		For this demo, we are using the `list-records` and `edit-record` requests.
45
46		The `list-records` request requires the following payload to be sent when
47		calling the API:
48
49		```txt
	1	#+title: Dynamic DNS with Njalla API
	2	#+date: 2022-06-04
	3
	4	** Njalla's API
	5	:PROPERTIES:
	6	:CUSTOM_ID: njallas-api
	7	:END:
	8	As noted in my recent post about [[/blog/ditching-cloudflare/][switching
	9	to Njalla from Cloudflare]], I was searching for a way to replace my
	10	very easy-to-use bash script to [[/blog/cloudflare-dns-api/][update
	11	Cloudflare's DNS via their API]].
	12
	13	To reiterate what I said in those posts, this is a common necessity for
	14	those of us who have non-static IP addresses that can change at any
	15	moment due to ISP policy.
	16
	17	In order to keep a home server running smoothly, the server admin needs
	18	to have a process to constantly monitor their public IP address and
	19	update their domain's DNS records if it changes.
	20
	21	This post explains how to use Python to update Njalla's DNS records
	22	whenever a machine's public IP address changes.
	23
	24	*** Creating a Token
	25	:PROPERTIES:
	26	:CUSTOM_ID: creating-a-token
	27	:END:
	28	To use Njalla's API, you will first need to create a token that will be
	29	used to authenticate you every time you call the API. Luckily, this is
	30	very easy to do if you have an account with Njalla.
	31
	32	Simply go the [[https://njal.la/settings/api/][API Settings]] page and
	33	click the =Add Token= button. Next, enter a name for the token and click
	34	=Add=.
	35
	36	Finally, click the =Manage= button next to your newly created token and
	37	copy the =API Token= field.
	38
	39	*** Finding the Correct API Request
	40	:PROPERTIES:
	41	:CUSTOM_ID: finding-the-correct-api-request
	42	:END:
	43	Once you have a token, you're ready to call the Njalla API for any
	44	number of requests. For a full listing of available requests, see the
	45	[[https://njal.la/api/][Njalla API Documentation]].
	46
	47	For this demo, we are using the =list-records= and =edit-record=
	48	requests.
	49
	50	The =list-records= request requires the following payload to be sent
	51	when calling the API:
	52
	53	#+begin_src txt
50	54	params: {
51	55	domain: string
52	56	}
53		```
	57	#+end_src
54	58
55		The `edit-record` request requires the following payload to be sent when calling
56		the API:
	59	The =edit-record= request requires the following payload to be sent when
	60	calling the API:
57	61
58		```txt
	62	#+begin_src txt
59	63	params: {
60	64	domain: string
61	65	id: int
62	66	content: string
63	67	}
64		```
65
66		## Server Set-Up
67
68		To create this script, we will be using Python. By default, I use Python 3 on my
69		servers, so please note that I did not test this in Python 2, and I do not know
70		if Python 2 will work for this.
71
72		### Creating the Script
73
74		First, find a suitable place to create your script. Personally, I just create a
75		directory called `ddns` in my home directory:
76
77		```sh
	68	#+end_src
	69
	70	** Server Set-Up
	71	:PROPERTIES:
	72	:CUSTOM_ID: server-set-up
	73	:END:
	74	To create this script, we will be using Python. By default, I use Python
	75	3 on my servers, so please note that I did not test this in Python 2,
	76	and I do not know if Python 2 will work for this.
	77
	78	*** Creating the Script
	79	:PROPERTIES:
	80	:CUSTOM_ID: creating-the-script
	81	:END:
	82	First, find a suitable place to create your script. Personally, I just
	83	create a directory called =ddns= in my home directory:
	84
	85	#+begin_src sh
78	86	mkdir ~/ddns
79		```
	87	#+end_src
80	88
81	89	Next, create a Python script file:
82	90
83		```sh
	91	#+begin_src sh
84	92	nano ~/ddns/ddns.py
85		```
	93	#+end_src
86	94
87		The following code snippet is quite long, so I won't go into depth on each part.
88		However, I suggest you read through the entire script before running it; it is
89		quite simple and contains comments to help explain each code block.
	95	The following code snippet is quite long, so I won't go into depth on
	96	each part. However, I suggest you read through the entire script before
	97	running it; it is quite simple and contains comments to help explain
	98	each code block.
90	99
91		:warning: Note: You will need to update the following variables for this to
92		work:
	100	:warning: Note: You will need to update the following variables for
	101	this to work:
93	102
94		- `token`: This is the Njalla API token you created earlier.
95		- `user_domain`: This is the top-level domain you want to modify.
96		- `include_subdomains`: Set this to `True` if you also want to modify
97		subdomains found under the TLD.
98		- `subdomains`: If `include_subdomains` = `True`, you can include your list of
99		subdomains to be modified here.
	103	- =token=: This is the Njalla API token you created earlier.
	104	- =user_domain=: This is the top-level domain you want to modify.
	105	- =include_subdomains=: Set this to =True= if you also want to modify
	106	subdomains found under the TLD.
	107	- =subdomains=: If =include_subdomains= = =True=, you can include your
	108	list of subdomains to be modified here.
100	109
101		```python
	110	#+begin_src python
102	111	#!/usr/bin/python
103	112	# -- coding: utf-8 --
104	113	# Import Python modules
		@@ -177,29 +186,33 @@ for record in data['records']:
177	186	'does not match Njalla\'s value of',
178	187	record['content'], '. Updating...')
179	188	update_record(user_domain, record['id'], ipv6)
180		```
	189	#+end_src
181	190
182		### Running the Script
	191	*** Running the Script
	192	:PROPERTIES:
	193	:CUSTOM_ID: running-the-script
	194	:END:
	195	Once you've created the script and are ready to test it, run the
	196	following command:
183	197
184		Once you've created the script and are ready to test it, run the following
185		command:
186
187		```sh
	198	#+begin_src sh
188	199	python3 ~/ddns/ddns.py
189		```
190
191		### Setting the Script to Run Automatically
	200	#+end_src
192	201
193		To make sure the scripts run automatically, add it to the `cron` file so that it
194		will run on a schedule. To do this, open the `cron` file:
	202	*** Setting the Script to Run Automatically
	203	:PROPERTIES:
	204	:CUSTOM_ID: setting-the-script-to-run-automatically
	205	:END:
	206	To make sure the scripts run automatically, add it to the =cron= file so
	207	that it will run on a schedule. To do this, open the =cron= file:
195	208
196		```sh
	209	#+begin_src sh
197	210	crontab -e
198		```
	211	#+end_src
199	212
200		In the cron file, paste the following at the bottom of the editor in order to
201		check the IP every five minutes:
	213	In the cron file, paste the following at the bottom of the editor in
	214	order to check the IP every five minutes:
202	215
203		```sh
	216	#+begin_src sh
204	217	/5 * * * python3 /home/<your_username>/ddns/ddns.py
205		```
	218	#+end_src

blog/2022-06-07-freshrss.org +175 −152

		@@ -1,67 +1,75 @@
1		+++
2		date = 2022-06-07
3		title = "Self-Hosting FreshRSS"
4		description = "A detailed description of my process to self-host FreshRSS on Ubuntu."
5		draft = false
6		+++
7
8		## Why RSS?
9
10		After noticing that I have collected 50+ blogs as bookmarks, I decided to
11		migrate back to using RSS feeds to stay up-to-date with my favorite websites.
12		Using RSS allows me to read all of these posts in a single app (on both mobile &
13		desktop) and allows me to be notified when new posts are available.
14
15		However, I ran into one issue: syncing subscriptions and read/unread posts
16		across devices. Since I want to be able to easily read on both mobile and
17		desktop, I decided to look for a self-hosted RSS solution.
18
19		Thus, I found [FreshRSS](https://www.freshrss.org/) and was able to successfully
20		install it on my server in about 30 minutes.
21
22		## Documentation
23
	1	#+title: Self-Hosting FreshRSS
	2	#+date: 2022-06-07
	3
	4	** Why RSS?
	5	:PROPERTIES:
	6	:CUSTOM_ID: why-rss
	7	:END:
	8	After noticing that I have collected 50+ blogs as bookmarks, I decided
	9	to migrate back to using RSS feeds to stay up-to-date with my favorite
	10	websites. Using RSS allows me to read all of these posts in a single app
	11	(on both mobile & desktop) and allows me to be notified when new posts
	12	are available.
	13
	14	However, I ran into one issue: syncing subscriptions and read/unread
	15	posts across devices. Since I want to be able to easily read on both
	16	mobile and desktop, I decided to look for a self-hosted RSS solution.
	17
	18	Thus, I found [[https://www.freshrss.org/][FreshRSS]] and was able to
	19	successfully install it on my server in about 30 minutes.
	20
	21	** Documentation
	22	:PROPERTIES:
	23	:CUSTOM_ID: documentation
	24	:END:
24	25	While it's certainly not robust, the
25		[FreshRSS documentation](https://freshrss.github.io/FreshRSS/) is helpful for
26		figuring out basic information about the service.
27
28		However, I wanted to install this service as a Docker container and stumbled
29		across the
30		[Docker README](https://github.com/FreshRSS/FreshRSS/tree/edge/Docker) within
31		the GitHub repository.
32
33		This README was the documentation I actually needed. However, as you'll see
34		below, I still had to manually edit one file (`config.php`) to access the API
35		externally via my RSS apps.
36
37		## Installation
38
39		### DNS
40
41		The first step, as required by any external web service, was assigning a domain
42		name to use. I chose to use a subdomain, like `rss.example.com`.
43
44		To assign this, I created an `A` record in my DNS settings with the IPv4 address
45		of the server and an `AAAA` record with the IPv6 address of the server. Note:
46		assigning an IPv6 (`AAAA`) record is optional, but I like to enable IPV6 for my
47		services.
48
49		```config
	26	[[https://freshrss.github.io/FreshRSS/][FreshRSS documentation]] is
	27	helpful for figuring out basic information about the service.
	28
	29	However, I wanted to install this service as a Docker container and
	30	stumbled across the
	31	[[https://github.com/FreshRSS/FreshRSS/tree/edge/Docker][Docker README]]
	32	within the GitHub repository.
	33
	34	This README was the documentation I actually needed. However, as you'll
	35	see below, I still had to manually edit one file (=config.php=) to
	36	access the API externally via my RSS apps.
	37
	38	** Installation
	39	:PROPERTIES:
	40	:CUSTOM_ID: installation
	41	:END:
	42	*** DNS
	43	:PROPERTIES:
	44	:CUSTOM_ID: dns
	45	:END:
	46	The first step, as required by any external web service, was assigning a
	47	domain name to use. I chose to use a subdomain, like =rss.example.com=.
	48
	49	To assign this, I created an =A= record in my DNS settings with the IPv4
	50	address of the server and an =AAAA= record with the IPv6 address of the
	51	server. Note: assigning an IPv6 (=AAAA=) record is optional, but I like
	52	to enable IPV6 for my services.
	53
	54	#+begin_src config
50	55	rss.example.com A xxx.xxx.xxx.xxx
51	56	rss.example.com AAAA xxxx:xxxx: ... :xxxx
52		```
53
54		### Docker
55
56		I initially tried to set up a `docker-compose.yml` file with a `.env` file
57		because I prefer to have a file I can look back at later to see how I initially
58		started the container, but it simply wouldn't work for me. I'm not sure why, but
59		I assume I wasn't telling `docker-compose` where the `.env` file was.
60
61		Regardless, I chose to simply run the service with `docker run`. See the
62		following command for my `docker run` configuration:
63
64		```sh
	57	#+end_src
	58
	59	*** Docker
	60	:PROPERTIES:
	61	:CUSTOM_ID: docker
	62	:END:
	63	I initially tried to set up a =docker-compose.yml= file with a =.env=
	64	file because I prefer to have a file I can look back at later to see how
	65	I initially started the container, but it simply wouldn't work for me.
	66	I'm not sure why, but I assume I wasn't telling =docker-compose= where
	67	the =.env= file was.
	68
	69	Regardless, I chose to simply run the service with =docker run=. See the
	70	following command for my =docker run= configuration:
	71
	72	#+begin_src sh
65	73	sudo docker run -d --restart unless-stopped --log-opt max-size=10m \
66	74	-p 8080:80 \
67	75	-e TZ=America/Chicago \
		@@ -70,42 +78,46 @@ sudo docker run -d --restart unless-stopped --log-opt max-size=10m \
70	78	-v freshrss_extensions:/var/www/FreshRSS/extensions \
71	79	--name freshrss \
72	80	freshrss/freshrss
73		```
74
75		This started the container successfully and allowed me to visit the FreshRSS
76		instance at `localhost:8080`.
77
78		### Fresh RSS Set-Up
79
80		I HIGHLY suggest that you set up your user account prior to
81		exposing this service to the public. It's unlikely that someone is trying to
82		access the exact domain or IP/port you're assigning here, but as soon as you
83		expose this service, the first person to open the URL will be able to create the
84		admin user.
85
86		In order to set up your FreshRSS service, open the `localhost:8080` URL in your
87		browser (you may need to use a local IP instead of `localhost` if you're
88		accessing the page from a different machine on the network - e.g.,
89		`192.168.1.20:8080`).
	81	#+end_src
	82
	83	This started the container successfully and allowed me to visit the
	84	FreshRSS instance at =localhost:8080=.
	85
	86	*** Fresh RSS Set-Up
	87	:PROPERTIES:
	88	:CUSTOM_ID: fresh-rss-set-up
	89	:END:
	90	I HIGHLY suggest that you set up your user account prior to exposing
	91	this service to the public. It's unlikely that someone is trying to
	92	access the exact domain or IP/port you're assigning here, but as soon as
	93	you expose this service, the first person to open the URL will be able
	94	to create the admin user.
	95
	96	In order to set up your FreshRSS service, open the =localhost:8080= URL
	97	in your browser (you may need to use a local IP instead of =localhost=
	98	if you're accessing the page from a different machine on the network -
	99	e.g., =192.168.1.20:8080=).
90	100
91	101	Once the page loads, set up your default user with a strong username and
92		password. You may also choose to configure other settings prior to exposing this
93		service.
94
95		### Nginx Reverse-Proxy
	102	password. You may also choose to configure other settings prior to
	103	exposing this service.
96	104
	105	*** Nginx Reverse-Proxy
	106	:PROPERTIES:
	107	:CUSTOM_ID: nginx-reverse-proxy
	108	:END:
97	109	In order to access this service outside my home, I needed to set up a
98		reverse-proxy to connect `localhost:8080` to `rss.example.com`.
	110	reverse-proxy to connect =localhost:8080= to =rss.example.com=.
99	111
100	112	First, I created a new Nginx configuration file:
101	113
102		```sh
	114	#+begin_src sh
103	115	sudo nano /etc/nginx/sites-available/rss.example.com
104		```
	116	#+end_src
105	117
106	118	Within the config file, I pasted the following code:
107	119
108		```config
	120	#+begin_src config
109	121	upstream freshrss {
110	122	server 127.0.0.1:8080;
111	123	keepalive 64;
		@@ -134,80 +146,91 @@ server {
134	146	proxy_pass_header Authorization;
135	147	}
136	148	}
137		```
	149	#+end_src
138	150
139		Finally, restart Nginx and you will be able to access your service via HTTP:
	151	Finally, restart Nginx and you will be able to access your service via
	152	HTTP:
140	153
141		```sh
	154	#+begin_src sh
142	155	sudo systemctl restart nginx.service
143		```
144
145		### HTTPS
146
147		However, I don't want to access my RSS feeds via HTTP. I want it available only
148		via HTTPS. In order to do this, I ran the [certbot](https://certbot.eff.org/)
149		program to generate SSL certificates for me:
150
151		```sh
	156	#+end_src
	157
	158	*** HTTPS
	159	:PROPERTIES:
	160	:CUSTOM_ID: https
	161	:END:
	162	However, I don't want to access my RSS feeds via HTTP. I want it
	163	available only via HTTPS. In order to do this, I ran the
	164	[[https://certbot.eff.org/][certbot]] program to generate SSL
	165	certificates for me:
	166
	167	#+begin_src sh
152	168	sudo certbot --nginx
153		```
154
155		This process will automatically generate an SSL certificate for you and modify
156		the Nginx configuration file to include a redirect from HTTP to HTTPS.
157
158		## Post-Installation Fixes
159
160		At this point, we have a functional FreshRSS website, available from anywhere
161		and secured with HTTPS. However, attempting to connect this service to an RSS
162		app resulted in many errors regarding unavailable URLs and incorrect
163		credentials.
164
165		### API Set-Up
166
167		First, you need to open your user profile in FreshRSS (`Settings` > `Profile`)
168		and set an API password in the field at the bottom. This is the password you
169		will need to provide to your RSS apps.
170
171		Once that is set and saved, click the link below the API password field to open
172		the API check tool. It should look something like `https://localhost:8080/api/`
173		or `https://rss.example.com/api/`.
174
175		Within this page, you _should_ see your correct external URL and "PASS" at the
176		bottom of each API type.
177		This would mean everything is set up correctly, and you can now move on and
178		login to any RSS apps that support self-hosted options.
	169	#+end_src
	170
	171	This process will automatically generate an SSL certificate for you and
	172	modify the Nginx configuration file to include a redirect from HTTP to
	173	HTTPS.
	174
	175	** Post-Installation Fixes
	176	:PROPERTIES:
	177	:CUSTOM_ID: post-installation-fixes
	178	:END:
	179	At this point, we have a functional FreshRSS website, available from
	180	anywhere and secured with HTTPS. However, attempting to connect this
	181	service to an RSS app resulted in many errors regarding unavailable URLs
	182	and incorrect credentials.
	183
	184	*** API Set-Up
	185	:PROPERTIES:
	186	:CUSTOM_ID: api-set-up
	187	:END:
	188	First, you need to open your user profile in FreshRSS (=Settings= >
	189	=Profile=) and set an API password in the field at the bottom. This is
	190	the password you will need to provide to your RSS apps.
	191
	192	Once that is set and saved, click the link below the API password field
	193	to open the API check tool. It should look something like
	194	=https://localhost:8080/api/= or =https://rss.example.com/api/=.
	195
	196	Within this page, you /should/ see your correct external URL and "PASS"
	197	at the bottom of each API type. This would mean everything is set up
	198	correctly, and you can now move on and login to any RSS apps that
	199	support self-hosted options.
179	200
180	201	In my case, the URL showed an internal URL and I had a warning that the
181		`base_url` variable may be misconfigured. If this is the case, see the next
182		section for a fix.
183
184		### Base URL Fix
	202	=base_url= variable may be misconfigured. If this is the case, see the
	203	next section for a fix.
185	204
186		In order to fix the `base_url` for the API, I opened up my docker container with
187		the following command:
	205	*** Base URL Fix
	206	:PROPERTIES:
	207	:CUSTOM_ID: base-url-fix
	208	:END:
	209	In order to fix the =base_url= for the API, I opened up my docker
	210	container with the following command:
188	211
189		```sh
	212	#+begin_src sh
190	213	sudo docker exec -it freshrss bash
191		```
	214	#+end_src
192	215
193	216	Within this container, update the packages and install an editor:
194	217
195		```sh
	218	#+begin_src sh
196	219	apt-get update
197	220	apt-get install nano
198		```
	221	#+end_src
199	222
200		Finally, open up `config.php` in the `data` directory:
	223	Finally, open up =config.php= in the =data= directory:
201	224
202		```sh
	225	#+begin_src sh
203	226	nano data/config.php
204		```
	227	#+end_src
205	228
206		Within `config.php`, you will need to update the `base_url` variable and update
207		it to match your external URL. In my case, I simply commented-out the incorrect
208		URL with `//` and added the correct one on a new line:
	229	Within =config.php=, you will need to update the =base_url= variable and
	230	update it to match your external URL. In my case, I simply commented-out
	231	the incorrect URL with =//= and added the correct one on a new line:
209	232
210		```php
	233	#+begin_src php
211	234	<?php
212	235	return array (
213	236	...
		@@ -216,25 +239,25 @@ URL with `//` and added the correct one on a new line:
216	239	...
217	240	)
218	241	>
219		```
	242	#+end_src
220	243
221		You can now exit the file with `Ctrl + x`, press `y` to save the file, and then
222		click `Enter` to keep the same file name.
	244	You can now exit the file with =Ctrl + x=, press =y= to save the file,
	245	and then click =Enter= to keep the same file name.
223	246
224	247	Finally, just exit out of the docker container:
225	248
226		```sh
	249	#+begin_src sh
227	250	exit
228		```
	251	#+end_src
229	252
230	253	Next, just restart the container:
231	254
232		```sh
	255	#+begin_src sh
233	256	sudo docker restart freshrss
234		```
	257	#+end_src
235	258
236		Voilà! Your API check should now "PASS" and you should be able to use one of the
237		API URLs in your RSS apps.
	259	Voilà! Your API check should now "PASS" and you should be able to use
	260	one of the API URLs in your RSS apps.
238	261
239		In my case, I use [NetNewsWire](https://netnewswire.com) on my desktop and
240		phone.
	262	In my case, I use [[https://netnewswire.com][NetNewsWire]] on my desktop
	263	and phone.

blog/2022-06-16-terminal-lifestyle.org +188 −160

		@@ -1,43 +1,48 @@
1		+++
2		date = 2022-06-16
3		title = "A Terminal Lifestyle"
4		description = "A detailed description on how I'm living my digital life in the terminal."
5		+++
6
7		## Text-Based Simplicity
8
9		I've detailed my views on web-based minimalism and related topics in other
10		posts throughout the years; e.g., JavaScript/CSS bloat slowing down websites
11		that are essentially a text document. However, I have never really expanded
12		beyond talking about the web and describing how I focus on minimizing
13		distractions in other digital environments.
14
15		This post is going to set the baseline for how I try to live my digital life.
16		It does not necessarily get into my physical life, which is often harder to
17		control and contain all the noise in our modern world.
18
19		While there are new things to do every day in our digital world, I find that
20		keeping a core set of values and interests can ground you and keep you mindful
21		of why you are participating in the digital world. For example, if - at your
22		core - you have no interest in what strangers think about random topics, it
23		would be unwise to start participating in social media. However, I am someone
24		who has been dragged in by effective advertising to participate in communities
25		that I realize I do not care for.
26
27		I won't dive much further into explaining the philosophy of all this, but I will
28		link a few helpful articles that may pique your interest if you're in search of
29		more meaningful experiences:
30
31		- [Mindfulness](https://en.wikipedia.org/wiki/Mindfulness)
32		- [Minimalism](https://en.wikipedia.org/wiki/Minimalism)
33		- [Stoicism](https://en.wikipedia.org/wiki/Stoicism)
34
35		## Living Life in the Terminal
36
37		My personal approach to reducing digital distractions and increasing my focus on
38		the task at hand is to use a terminal for as much as I possibly can.
39
40		Most days, this means that I have a few tabs open constantly in my terminal:
	1	#+title: A Terminal Lifestyle
	2	#+date: 2022-06-16
	3
	4	** Text-Based Simplicity
	5	:PROPERTIES:
	6	:CUSTOM_ID: text-based-simplicity
	7	:END:
	8	I've detailed my views on web-based minimalism and related topics in
	9	other posts throughout the years; e.g., JavaScript/CSS bloat slowing
	10	down websites that are essentially a text document. However, I have
	11	never really expanded beyond talking about the web and describing how I
	12	focus on minimizing distractions in other digital environments.
	13
	14	This post is going to set the baseline for how I /try/ to live my
	15	digital life. It does not necessarily get into my physical life, which
	16	is often harder to control and contain all the noise in our modern
	17	world.
	18
	19	While there are new things to do every day in our digital world, I find
	20	that keeping a core set of values and interests can ground you and keep
	21	you mindful of /why/ you are participating in the digital world. For
	22	example, if - at your core - you have no interest in what strangers
	23	think about random topics, it would be unwise to start participating in
	24	social media. However, I am someone who has been dragged in by effective
	25	advertising to participate in communities that I realize I do not care
	26	for.
	27
	28	I won't dive much further into explaining the philosophy of all this,
	29	but I will link a few helpful articles that may pique your interest if
	30	you're in search of more meaningful experiences:
	31
	32	- [[https://en.wikipedia.org/wiki/Mindfulness][Mindfulness]]
	33	- [[https://en.wikipedia.org/wiki/Minimalism][Minimalism]]
	34	- [[https://en.wikipedia.org/wiki/Stoicism][Stoicism]]
	35
	36	** Living Life in the Terminal
	37	:PROPERTIES:
	38	:CUSTOM_ID: living-life-in-the-terminal
	39	:END:
	40	My personal approach to reducing digital distractions and increasing my
	41	focus on the task at hand is to use a terminal for as much as I possibly
	42	can.
	43
	44	Most days, this means that I have a few tabs open constantly in my
	45	terminal:
41	46
42	47	1. A web browser
43	48	2. A chat client
		@@ -46,157 +51,180 @@ Most days, this means that I have a few tabs open constantly in my terminal:
46	51	5. A local shell for navigating my computer's files
47	52	6. A remote shell for managing servers and other machines
48	53
49		Beyond this, I rarely open other tabs or GUI applications, unless absolutely
50		necessary. If you look, you may be surprised what can be accomplished in the
51		terminal.
	54	Beyond this, I rarely open other tabs or GUI applications, unless
	55	absolutely necessary. If you look, you may be surprised what can be
	56	accomplished in the terminal.
52	57
53		For example, I have moved my music and entertainment downloads to the
54		terminal, along with my device VPN connections. I am exploring options for
55		moving my RSS subscriptions to something like [Newsboat](https://newsboat.org/),
56		so that I can read my daily articles without all the fuss.
	58	For example, I have moved my music and entertainment downloads to the
	59	terminal, along with my device VPN connections. I am exploring options
	60	for moving my RSS subscriptions to something like
	61	[[https://newsboat.org/][Newsboat]], so that I can read my daily
	62	articles without all the fuss.
57	63
58		Now that we have some examples out of the way, let's dive into the
	64	Now that we have some examples out of the way, let's dive into the
59	65	specifics.
60	66
61		### Browsing the Web
62
63		I'm going to start off with a hard topic for those who prefer to live in the
64		terminal: web browsing. This task is made hard mostly by websites and web apps
65		that require JavaScript to run. The other difficult part is that if you're using
66		a text-based browser, that means images won't load (hopefully that's obvious).
67
68		I am using [Lynx](https://lynx.invisible-island.net), a text-based browser that
69		runs quickly and easily in the terminal. Lynx allows me to browser most websites
70		by simply typing `g` and then typing in the URL I want.
71
72		![Lynx](https://img.cleberg.net/blog/20220616-terminal-lifestyle/lynx.png)
73
74		If you need a search engine while in Lynx, I recommend [DuckDuckGo
75		(Lite)](https://lite.duckduckgo.com/lite/), which allows you to search the web
76		using their text-only interface.
77
78		![DuckDuckGo
79		!Lite](https://img.cleberg.net/blog/20220616-terminal-lifestyle/ddg.png)
80
81		Eventually, you will run into websites that don't work (or are just too ugly
82		and messy) in a text-only mode, and you'll be forced to switch over to a GUI
83		browser to look at that site. Personally, I don't mind this as it doesn't happen
84		as often as I thought it would.
85
86		The only time I need to do this is when I want to browse an image/video-focused
87		webpage or if I need to log in to a site, and it doesn't support a text-only
88		login page.
89		For example, I am able to easily log in to [Sourcehut](https://sr.ht) in lynx.
90
91		### Chatting with Friends
92
93		After web browsing activities, my main form of terminal communication is Matrix.
94		I use the [gomuks](https://docs.mau.fi/gomuks/) client currently.
95
96		This was incredibly easy to install on macOS (but I will need to see if it'll
97		be just as easy on Linux when my new laptop arrives):
98
99		```sh
	67	*** Browsing the Web
	68	:PROPERTIES:
	69	:CUSTOM_ID: browsing-the-web
	70	:END:
	71	I'm going to start off with a hard topic for those who prefer to live in
	72	the terminal: web browsing. This task is made hard mostly by websites
	73	and web apps that require JavaScript to run. The other difficult part is
	74	that if you're using a text-based browser, that means images won't load
	75	(hopefully that's obvious).
	76
	77	I am using [[https://lynx.invisible-island.net][Lynx]], a text-based
	78	browser that runs quickly and easily in the terminal. Lynx allows me to
	79	browser most websites by simply typing =g= and then typing in the URL I
	80	want.
	81
	82	#+caption: Lynx
	83	[[https://img.cleberg.net/blog/20220616-terminal-lifestyle/lynx.png]]
	84
	85	If you need a search engine while in Lynx, I recommend
	86	[[https://lite.duckduckgo.com/lite/][DuckDuckGo (Lite)]], which allows
	87	you to search the web using their text-only interface.
	88
	89	#+caption: DuckDuckGo !Lite
	90	[[https://img.cleberg.net/blog/20220616-terminal-lifestyle/ddg.png]]
	91
	92	Eventually, you will run into websites that don't work (or are just too
	93	ugly and messy) in a text-only mode, and you'll be forced to switch over
	94	to a GUI browser to look at that site. Personally, I don't mind this as
	95	it doesn't happen as often as I thought it would.
	96
	97	The only time I need to do this is when I want to browse an
	98	image/video-focused webpage or if I need to log in to a site, and it
	99	doesn't support a text-only login page. For example, I am able to easily
	100	log in to [[https://sr.ht][Sourcehut]] in lynx.
	101
	102	*** Chatting with Friends
	103	:PROPERTIES:
	104	:CUSTOM_ID: chatting-with-friends
	105	:END:
	106	After web browsing activities, my main form of terminal communication is
	107	Matrix. I use the [[https://docs.mau.fi/gomuks/][gomuks]] client
	108	currently.
	109
	110	This was incredibly easy to install on macOS (but I will need to see if
	111	it'll be just as easy on Linux when my new laptop arrives):
	112
	113	#+begin_src sh
100	114	brew install gomuks
101		```
	115	#+end_src
102	116
103		Once you launch gomuks, it will sync and require your username and password to
104		login. After doing so, the only problem I ran into was verifying my gomuks
105		client so that I could participate in rooms with E2EE.
	117	Once you launch gomuks, it will sync and require your username and
	118	password to login. After doing so, the only problem I ran into was
	119	verifying my gomuks client so that I could participate in rooms with
	120	E2EE.
106	121
107		Finally, I was able to verify the session by opening the Element desktop app (I
108		assume you can do this in the browser and mobile app too, but I'm not sure) and
109		manually verifying myself with this process:
	122	Finally, I was able to verify the session by opening the Element desktop
	123	app (I assume you can do this in the browser and mobile app too, but I'm
	124	not sure) and manually verifying myself with this process:
110	125
111	126	1. Open the Element desktop app
112	127	2. Open a room I was a member of
113		3. Open the `Room Info` pane
114		4. Open the `People` menu and search for myself
	128	3. Open the =Room Info= pane
	129	4. Open the =People= menu and search for myself
115	130	5. Click on my profile name
116		6. Click on the session link under the `Security` section and follow the
117		prompts to manually verify the session
118
119		Overall, I like gomuks and am able to enjoy all the features I was using in
120		Element. The only hiccup I have occurred is manually downloading images to view
121		them, which can be annoying.
122
123		![gomuks](https://img.cleberg.net/blog/20220616-terminal-lifestyle/gomuks.png)
124
125		### Email
126
127		Moving email to the terminal has been the hardest of the tasks for me. Unlike
128		web browsing, where I can simply decide to not look at a website that does not
129		work in the terminal, I cannot simply ignore emails sent to me.
130
131		Personally, I am experimenting with [neomutt](https://neomutt.org/) as a
132		potential email client.
133
134		However, this requires a TON of configuration and tweaking to get right.
135		Even when I was able to set up neomutt, configure my email account, and
136		customize a few personal preferences, a lot of emails still do not display
137		correctly (mostly due to HTML and images).
138
139		I won't get into the details of configuring `neomutt`; I mostly followed this
140		blog post: [Email in the Terminal: Configuring
141		Neomutt](https://gideonwolfe.com/posts/workflow/neomutt/intro/).
142
143		Finally, I have yet to figure out how to connect my GPG keys to `neomutt`, but
144		that's a problem for another day.
145
146		### RSS Feed Reader
147
148		I have just started using [Newsboat](https://newsboat.org/) to read articles in
149		my terminal and have found quick success with it.
	131	6. Click on the session link under the =Security= section and follow the
	132	prompts to manually verify the session
	133
	134	Overall, I like gomuks and am able to enjoy all the features I was using
	135	in Element. The only hiccup I have occurred is manually downloading
	136	images to view them, which can be annoying.
	137
	138	#+caption: gomuks
	139	[[https://img.cleberg.net/blog/20220616-terminal-lifestyle/gomuks.png]]
	140
	141	*** Email
	142	:PROPERTIES:
	143	:CUSTOM_ID: email
	144	:END:
	145	Moving email to the terminal has been the hardest of the tasks for me.
	146	Unlike web browsing, where I can simply decide to not look at a website
	147	that does not work in the terminal, I cannot simply ignore emails sent
	148	to me.
	149
	150	Personally, I am experimenting with [[https://neomutt.org/][neomutt]] as
	151	a potential email client.
	152
	153	However, this requires a TON of configuration and tweaking to get
	154	right. Even when I was able to set up neomutt, configure my email
	155	account, and customize a few personal preferences, a lot of emails still
	156	do not display correctly (mostly due to HTML and images).
	157
	158	I won't get into the details of configuring =neomutt=; I mostly followed
	159	this blog post:
	160	[[https://gideonwolfe.com/posts/workflow/neomutt/intro/][Email in the
	161	Terminal: Configuring Neomutt]].
	162
	163	Finally, I have yet to figure out how to connect my GPG keys to
	164	=neomutt=, but that's a problem for another day.
	165
	166	*** RSS Feed Reader
	167	:PROPERTIES:
	168	:CUSTOM_ID: rss-feed-reader
	169	:END:
	170	I have just started using [[https://newsboat.org/][Newsboat]] to read
	171	articles in my terminal and have found quick success with it.
150	172
151	173	I'll show you a quick screenshot first:
152	174
153		![Newsboat](https://img.cleberg.net/blog/20220616-terminal-lifestyle/newsboat.png)
	175	#+caption: Newsboat
	176	[[https://img.cleberg.net/blog/20220616-terminal-lifestyle/newsboat.png]]
154	177
155		The configuration was super easy for this app; I simply installed the app,
156		created a file for URLs, and imported my OPML subscriptions that I had exported
157		out of my old feed reader:
	178	The configuration was super easy for this app; I simply installed the
	179	app, created a file for URLs, and imported my OPML subscriptions that I
	180	had exported out of my old feed reader:
158	181
159		```sh
	182	#+begin_src sh
160	183	brew install newsboat
161		```
	184	#+end_src
162	185
163		```sh
	186	#+begin_src sh
164	187	touch ~/.newsboat/urls
165		```
	188	#+end_src
166	189
167		```sh
	190	#+begin_src sh
168	191	newsboat -i=my_subscriptions.opml
169		```
170
171		### Writing & Programming
	192	#+end_src
172	193
173		Unfortunately, the weak link in my terminal-based environment right now is my
174		grasp of the possibilities of editing files within a shell.
	194	*** Writing & Programming
	195	:PROPERTIES:
	196	:CUSTOM_ID: writing-programming
	197	:END:
	198	Unfortunately, the weak link in my terminal-based environment right now
	199	is my grasp of the possibilities of editing files within a shell.
175	200
176		I am used to the easy extensions found in VSCodium and Kate, so I am slowly
177		learning how to mold the default editing tools to my needs. Currently, this
178		means I am using `nano` with the following configuration:
	201	I am used to the easy extensions found in VSCodium and Kate, so I am
	202	slowly learning how to mold the default editing tools to my needs.
	203	Currently, this means I am using =nano= with the following
	204	configuration:
179	205
180		```config
	206	#+begin_src config
181	207	set breaklonglines
182	208	set autoindent
183	209	set linenumbers
184	210	set tabstospaces
185	211	set tabsize 2
186	212	set fill 80
187		```
	213	#+end_src
188	214
189		This configuration allows nano to automatically hard-wrap lines at 80
190		characters, autoindent the wrapped lines (if the previous line was indented),
191		use 2 spaces per tab, and display line numbers within each file I open.
	215	This configuration allows nano to automatically hard-wrap lines at 80
	216	characters, autoindent the wrapped lines (if the previous line was
	217	indented), use 2 spaces per tab, and display line numbers within each
	218	file I open.
192	219
193		I am currently looking to see if `vim` or `emacs` would be more useful for my
194		current needs, but I'm not in any rush, so I don't expect to find an answer
195		anytime soon.
	220	I am currently looking to see if =vim= or =emacs= would be more useful
	221	for my current needs, but I'm not in any rush, so I don't expect to find
	222	an answer anytime soon.
196	223
197		With my current life demands, I am not programming at the moment and have not
198		explored the best terminal set-up for programming. However, I have seen many
199		peers find success configuring `vim` and `emacs`, so that's where I will start
200		when I pick my projects back up.
	224	With my current life demands, I am not programming at the moment and
	225	have not explored the best terminal set-up for programming. However, I
	226	have seen many peers find success configuring =vim= and =emacs=, so
	227	that's where I will start when I pick my projects back up.
201	228
202		![nano](https://img.cleberg.net/blog/20220616-terminal-lifestyle/nano.png)
	229	#+caption: nano
	230	[[https://img.cleberg.net/blog/20220616-terminal-lifestyle/nano.png]]

blog/2022-06-22-daily-poetry.org +140 −114

		@@ -1,71 +1,80 @@
1		+++
2		date = 2022-06-22
3		title = "Daily Plaintext Poetry via Email"
4		description = "A quick tutorial showing how to use Python and the PoetryDB API to email daily poetry."
5		draft = false
6		+++
7
8		## Source Code
9
10		I don't want to bury the lede here, so if you'd like to see the full source
11		code I use to email myself plaintext poems daily, visit the repository:
12		[daily-poem](https://git.sr.ht/~cmc/daily-poem/).
13
14		## My Daily Dose of Poetry
15
16		Most of my programming projects are small, random projects that are made
	1	#+title: Daily Plaintext Poetry via Email
	2	#+date: 2022-06-22
	3
	4	** Source Code
	5	:PROPERTIES:
	6	:CUSTOM_ID: source-code
	7	:END:
	8	I don't want to bury the lede here, so if you'd like to see the full
	9	source code I use to email myself plaintext poems daily, visit the
	10	repository: [[https://git.sr.ht/~cmc/daily-poem/][daily-poem]].
	11
	12	** My Daily Dose of Poetry
	13	:PROPERTIES:
	14	:CUSTOM_ID: my-daily-dose-of-poetry
	15	:END:
	16	Most of my programming projects are small, random projects that are made
17	17	strictly to fix some small problem I have or enhance my quality of life.
18	18
19		In this case, I was looking for a simply and easy way to get a daily dose of
20		literature or poetry to read in the mornings.
21
22		However, I don't want to sign up for a random mailing list on just any website.
23		I also don't want to have to work to find the reading content each morning, as I
24		know I would simply give up and stop reading daily.
	19	In this case, I was looking for a simply and easy way to get a daily
	20	dose of literature or poetry to read in the mornings.
25	21
26		Thus, I found a way to deliver poetry to myself in plain-text format, on a daily
27		basis, and scheduled to deliver automatically.
	22	However, I don't want to sign up for a random mailing list on just any
	23	website. I also don't want to have to work to find the reading content
	24	each morning, as I know I would simply give up and stop reading daily.
28	25
29		## Prerequisites
	26	Thus, I found a way to deliver poetry to myself in plain-text format, on
	27	a daily basis, and scheduled to deliver automatically.
30	28
31		This solution uses Python and email, so the following process requires the
32		following to be installed:
	29	** Prerequisites
	30	:PROPERTIES:
	31	:CUSTOM_ID: prerequisites
	32	:END:
	33	This solution uses Python and email, so the following process requires
	34	the following to be installed:
33	35
34		1. An SMTP server, which can be as easy as installing `mailutils` if you're on
35		a Debian-based distro.
	36	1. An SMTP server, which can be as easy as installing =mailutils= if
	37	you're on a Debian-based distro.
36	38	2. Python (& pip!)
37		3. The following Python packages: `email`, `smtplib`, `json`, and `requests`
38
39		## Breaking Down the Logic
40
41		I want to break down the logic for this program, as it's quite simple and
42		informational.
43
44		### Required Packages
45
46		This program starts with a simple import of the required packages, so I wanted
47		to explain why each package is used:
48
49		```py
	39	3. The following Python packages: =email=, =smtplib=, =json=, and
	40	=requests=
	41
	42	** Breaking Down the Logic
	43	:PROPERTIES:
	44	:CUSTOM_ID: breaking-down-the-logic
	45	:END:
	46	I want to break down the logic for this program, as it's quite simple
	47	and informational.
	48
	49	*** Required Packages
	50	:PROPERTIES:
	51	:CUSTOM_ID: required-packages
	52	:END:
	53	This program starts with a simple import of the required packages, so I
	54	wanted to explain why each package is used:
	55
	56	#+begin_src py
50	57	from email.mime.text import MIMEText # Required for translating MIMEText
51	58	import smtplib # Required to process the SMTP mail delivery
52	59	import json # Required to parse the poetry API results
53	60	import requests # Required to send out a request to the API
54		```
55
56		### Sending the API Request
	61	#+end_src
57	62
58		Next, we need to actually send the API request. In my case, I'm calling a random
59		poem from the entire API. If you want, you can call specific poems or authors
60		from this API.
	63	*** Sending the API Request
	64	:PROPERTIES:
	65	:CUSTOM_ID: sending-the-api-request
	66	:END:
	67	Next, we need to actually send the API request. In my case, I'm calling
	68	a random poem from the entire API. If you want, you can call specific
	69	poems or authors from this API.
61	70
62		```py
	71	#+begin_src py
63	72	json_data = requests.get('https://poetrydb.org/random').json()
64		```
	73	#+end_src
65	74
66	75	This gives us the following result in JSON:
67	76
68		```json
	77	#+begin_src json
69	78	[
70	79	{
71	80	"title": "Sonnet XXII: With Fools and Children",
		@@ -91,80 +100,95 @@ This gives us the following result in JSON:
91	100	"linecount": "15"
92	101	}
93	102	]
94		```
95
96		### Parsing the API Results
97
98		In order to parse this into a readable format, we need to use the `json` package
99		and extract the fields we want. In the example below, I am grabbing every field
100		presented by the API.
101
102		For the actual poem content, we need to loop over each line in the `lines`
103		variable since each line is a separate string by default.
104
105		> You could also extract the title or author and make another call out to the
106		> API to avoid having to build the plaintext poem with a loop, but it just
107		> doesn't make sense to me to send multiple requests when we can create a simple
108		> loop on our local machine to work with the data we already have.
109		>
110		> For
111		> [example](https://poetrydb.org/title/Sonnet%20XXII:%20With%20Fools%20and%20Children/lines.text),
112		> look at the raw data response of this link to see the poem's lines returned
113		> in plaintext.
114
115		```py
	103	#+end_src
	104
	105	*** Parsing the API Results
	106	:PROPERTIES:
	107	:CUSTOM_ID: parsing-the-api-results
	108	:END:
	109	In order to parse this into a readable format, we need to use the =json=
	110	package and extract the fields we want. In the example below, I am
	111	grabbing every field presented by the API.
	112
	113	For the actual poem content, we need to loop over each line in the
	114	=lines= variable since each line is a separate string by default.
	115
	116	#+begin_quote
	117	You /could/ also extract the title or author and make another call out
	118	to the API to avoid having to build the plaintext poem with a loop, but
	119	it just doesn't make sense to me to send multiple requests when we can
	120	create a simple loop on our local machine to work with the data we
	121	already have.
	122
	123	For
	124	[[https://poetrydb.org/title/Sonnet%20XXII:%20With%20Fools%20and%20Children/lines.text][example]],
	125	look at the raw data response of this link to see the poem's lines
	126	returned in plaintext.
	127
	128	#+end_quote
	129
	130	#+begin_src py
116	131	title = json_data[0]['title']
117	132	author = json_data[0]['author']
118	133	line_count = json_data[0]['linecount']
119	134	lines = ''
120	135	for line in json_data[0]['lines']:
121	136	lines = lines + line + "\n"
122		```
123
124		### Composing the Email
	137	#+end_src
125	138
126		Now that I have all the data I need, I just need to compose it into a message
127		and prepare the message metadata.
	139	*** Composing the Email
	140	:PROPERTIES:
	141	:CUSTOM_ID: composing-the-email
	142	:END:
	143	Now that I have all the data I need, I just need to compose it into a
	144	message and prepare the message metadata.
128	145
129		For my daily email, I want to see the title of the poem first, followed by the
130		author, then a blank line, and finally the full poem. This code snippet combines
131		that data and packages it into a MIMEText container, ready to be emailed.
	146	For my daily email, I want to see the title of the poem first, followed
	147	by the author, then a blank line, and finally the full poem. This code
	148	snippet combines that data and packages it into a MIMEText container,
	149	ready to be emailed.
132	150
133		```py
	151	#+begin_src py
134	152	msg_body = title + "\n" + author + "\n\n" + lines
135	153	msg = MIMEText(msg_body)
136		```
	154	#+end_src
137	155
138		Before we send the email, we need to prepare the metadata (subject, from, to,
139		etc.):
	156	Before we send the email, we need to prepare the metadata (subject,
	157	from, to, etc.):
140	158
141		```py
	159	#+begin_src py
142	160	sender_email = 'example@server.local'
143	161	recipient_emails = ['user@example.com']
144	162	msg['Subject'] = 'Your Daily Poem (' + line_count + ' lines)'
145	163	msg['From'] = sender_email
146	164	msg['To'] = recipient_email
147		```
148
149		### Sending the Email
150
151		Now that I have everything ready to be emailed, the last step is to simply
152		connect to an SMTP server and send the email out to the recipients. In my case,
153		I installed `mailutils` on Ubuntu and let my SMTP server be `localhost`.
154
155		```py
	165	#+end_src
	166
	167	*** Sending the Email
	168	:PROPERTIES:
	169	:CUSTOM_ID: sending-the-email
	170	:END:
	171	Now that I have everything ready to be emailed, the last step is to
	172	simply connect to an SMTP server and send the email out to the
	173	recipients. In my case, I installed =mailutils= on Ubuntu and let my
	174	SMTP server be =localhost=.
	175
	176	#+begin_src py
156	177	smtp_server = 'localhost'
157	178	s = smtplib.SMTP(smtp_server)
158	179	s.sendmail(sender_email, recipient_emails, msg.as_string())
159	180	s.quit()
160		```
	181	#+end_src
161	182
162		## The Result!
	183	** The Result!
	184	:PROPERTIES:
	185	:CUSTOM_ID: the-result
	186	:END:
	187	Instead of including a screenshot, I've copied the contents of the email
	188	that was delivered to my inbox below since I set this process up in
	189	plaintext format.
163	190
164		Instead of including a screenshot, I've copied the contents of the email that
165		was delivered to my inbox below since I set this process up in plaintext format.
166
167		```txt
	191	#+begin_src txt
168	192	Date: Wed, 22 Jun 2022 14:37:19 +0000 (UTC)
169	193	From: REDACTED
170	194	To: REDACTED
		@@ -190,24 +214,26 @@ You that behold us, laugh us not to scorn;
190	214	Give Nature thanks you are not such as we.
191	215	Yet fools and children sometimes tell in play
192	216	Some, wise in show, more fools indeed than they.
193		```
194
195		## Scheduling the Daily Email
	217	#+end_src
196	218
197		Last, but not least, is scheduling this Python script with `crontab`. To
198		schedule a script to run daily, you can add it to the `crontab` file. To do
199		this, open `crontab` in editing mode:
	219	** Scheduling the Daily Email
	220	:PROPERTIES:
	221	:CUSTOM_ID: scheduling-the-daily-email
	222	:END:
	223	Last, but not least, is scheduling this Python script with =crontab=. To
	224	schedule a script to run daily, you can add it to the =crontab= file. To
	225	do this, open =crontab= in editing mode:
200	226
201		```sh
	227	#+begin_src sh
202	228	crontab -e
203		```
	229	#+end_src
204	230
205		In the file, simply paste the following snippet at the bottom of the file and
206		ensure that the file path is correctly pointing to wherever you saved your
207		Python script:
	231	In the file, simply paste the following snippet at the bottom of the
	232	file and ensure that the file path is correctly pointing to wherever you
	233	saved your Python script:
208	234
209		```config
	235	#+begin_src config
210	236	0 8 * * * python3 /home/<your_user>/dailypoem/main.py
211		```
	237	#+end_src
212	238
213	239	We have now set up the script and scheduled it to run daily at 08:00!

blog/2022-06-24-fedora-i3.org +118 −101

		@@ -1,78 +1,86 @@
1		+++
2		date = 2022-06-24
3		title = "Rebooting My Love Affair with Linux"
4		description = "A quick recap on my migration from macOS to Fedora i3."
5		draft = false
6		+++
7
8		## Leaving macOS
9
10		As I noted [in a recent post](/blog/foss-macos-apps), I have been planning on
11		migrating from macOS back to a Linux-based OS. I am happy to say that I have
12		finally completed my migration and am now stuck in the wonderful world of Linux
13		again.
14
15		My decision to leave macOS really came down to just a few important things:
16
17		- Apple Security (Gatekeeper) restricting me from running any software I want.
18		Even if you disable Gatekeeper and allow software to bypass the rest of the
19		device installation security, you still have to repeat that process every time
20		the allowed software is updated.
21		- macOS sends out nearly constant connections, pings, telemetry, etc. to a
22		myriad of mysterious Apple services. I'm not even going to dive into how many
23		macOS apps have constant telemetry on, as well.
24		- Lastly, I just really missed the customization and freedom that comes with
25		Linux. Being able to switch to entirely new kernel, OS, or desktop within
26		minutes is a freedom I took for granted when I switched to macOS.
27
28		Now that I've covered macOS, I'm going to move on to more exciting topics: my
29		personal choice of OS, DE, and various customizations I'm using.
30
31		## Fedora
32
33		After trying a ton of distros (I think I booted and tested around 20-25
34		distros), I finally landed on [Fedora Linux](https://getfedora.org/). I have
35		quite a bit of experience with Fedora and enjoy the `dnf` package manager.
36		Fedora allows me to keep up-to-date with recent software (I'm looking at you,
37		Debian), but still provides a level of stability you don't find in every distro.
38
39		In a very close second place was Arch Linux, as well as its spin-off: Garuda
40		Linux (Garuda w/ sway is beautiful). Arch is great for compatibility and the
41		massive community it has, but I have just never had the time to properly sit
42		down and learn the methodology behind their packaging systems.
43
44		Basically, everything else I tested was unacceptable in at least one way or
45		another.
46		Void (`glibc`) was great, but doesn't support all the software I need.
47		Slackware worked well as a tui, but I wasn't skilled enough to get a tiling
48		window manager (WM) working on it.
49
50		### i3
51
52		One of the reasons I settled on Fedora is that it comes with an official i3
53		spin. Being able to use a tiling WM, such as i3 or sway, is one of the biggest
54		things I wanted to do as soon as I adopted Linux again.
55
56		I will probably set up a dotfile repository soon, so that I don't lose any
57		of my configurations, but nothing big has been configured thus far.
58
59		The two main things I have updated in i3wm are natural scrolling and binding my
60		brightness keys to the `brightnessctl` program.
61
62		#### Natural Scrolling
63
	1	#+title: Rebooting My Love Affair with Linux
	2	#+date: 2022-06-24
	3
	4	** Leaving macOS
	5	:PROPERTIES:
	6	:CUSTOM_ID: leaving-macos
	7	:END:
	8	As I noted [[/blog/foss-macos-apps][in a recent post]], I have been
	9	planning on migrating from macOS back to a Linux-based OS. I am happy to
	10	say that I have finally completed my migration and am now stuck in the
	11	wonderful world of Linux again.
	12
	13	My decision to leave macOS really came down to just a few important
	14	things:
	15
	16	- Apple Security (Gatekeeper) restricting me from running any software I
	17	want. Even if you disable Gatekeeper and allow software to bypass the
	18	rest of the device installation security, you still have to repeat
	19	that process every time the allowed software is updated.
	20	- macOS sends out nearly constant connections, pings, telemetry, etc. to
	21	a myriad of mysterious Apple services. I'm not even going to dive into
	22	how many macOS apps have constant telemetry on, as well.
	23	- Lastly, I just /really/ missed the customization and freedom that
	24	comes with Linux. Being able to switch to entirely new kernel, OS, or
	25	desktop within minutes is a freedom I took for granted when I switched
	26	to macOS.
	27
	28	Now that I've covered macOS, I'm going to move on to more exciting
	29	topics: my personal choice of OS, DE, and various customizations I'm
	30	using.
	31
	32	** Fedora
	33	:PROPERTIES:
	34	:CUSTOM_ID: fedora
	35	:END:
	36	After trying a ton of distros (I think I booted and tested around 20-25
	37	distros), I finally landed on [[https://getfedora.org/][Fedora Linux]].
	38	I have quite a bit of experience with Fedora and enjoy the =dnf= package
	39	manager. Fedora allows me to keep up-to-date with recent software (I'm
	40	looking at you, Debian), but still provides a level of stability you
	41	don't find in every distro.
	42
	43	In a very close second place was Arch Linux, as well as its spin-off:
	44	Garuda Linux (Garuda w/ sway is /beautiful/). Arch is great for
	45	compatibility and the massive community it has, but I have just never
	46	had the time to properly sit down and learn the methodology behind their
	47	packaging systems.
	48
	49	Basically, everything else I tested was unacceptable in at least one way
	50	or another. Void (=glibc=) was great, but doesn't support all the
	51	software I need. Slackware worked well as a tui, but I wasn't skilled
	52	enough to get a tiling window manager (WM) working on it.
	53
	54	*** i3
	55	:PROPERTIES:
	56	:CUSTOM_ID: i3
	57	:END:
	58	One of the reasons I settled on Fedora is that it comes with an official
	59	i3 spin. Being able to use a tiling WM, such as i3 or sway, is one of
	60	the biggest things I wanted to do as soon as I adopted Linux again.
	61
	62	I will probably set up a dotfile repository soon, so that I don't lose
	63	any of my configurations, but nothing big has been configured thus far.
	64
	65	The two main things I have updated in i3wm are natural scrolling and
	66	binding my brightness keys to the =brightnessctl= program.
	67
	68	**** Natural Scrolling
	69	:PROPERTIES:
	70	:CUSTOM_ID: natural-scrolling
	71	:END:
64	72	You can enable natural scrolling by opening the following file:
65	73
66		```sh
	74	#+begin_src sh
67	75	sudo nano /usr/share/X11/xorg.conf.d/40-libinput.conf
68		```
	76	#+end_src
69	77
70		Within the `40-libinput.conf` file, find the following input sections and enable
71		the natural scrolling option.
	78	Within the =40-libinput.conf= file, find the following input sections
	79	and enable the natural scrolling option.
72	80
73		This is the `pointer` section:
	81	This is the =pointer= section:
74	82
75		```conf
	83	#+begin_src conf
76	84	Section "InputClass"
77	85	Identifier "libinput pointer catchall"
78	86	MatchIsPointer "on"
		@@ -80,11 +88,11 @@ Section "InputClass"
80	88	Driver "libinput"
81	89	Option "NaturalScrolling" "True"
82	90	EndSection
83		```
	91	#+end_src
84	92
85		This is the `touchpad` section:
	93	This is the =touchpad= section:
86	94
87		```conf
	95	#+begin_src conf
88	96	Section "InputClass"
89	97	Identifier "libinput touchpad catchall"
90	98	MatchIsTouchpad "on"
		@@ -92,44 +100,53 @@ Section "InputClass"
92	100	Driver "libinput"
93	101	Option "NaturalScrolling" "True"
94	102	EndSection
95		```
	103	#+end_src
96	104
97		#### Enabling Brightness Keys
98
99		Likewise, enabling brightness key functionality is as simple as binding the keys
100		to the `brightnessctl` program.
	105	**** Enabling Brightness Keys
	106	:PROPERTIES:
	107	:CUSTOM_ID: enabling-brightness-keys
	108	:END:
	109	Likewise, enabling brightness key functionality is as simple as binding
	110	the keys to the =brightnessctl= program.
101	111
102	112	To do this, open up your i3 config file. Mine is located here:
103	113
104		```sh
	114	#+begin_src sh
105	115	nano /home/<my-user>/.config/i3/config
106		```
	116	#+end_src
107	117
108		```conf
	118	#+begin_src conf
109	119	# Use brightnessctl to adjust brightness.
110	120	bindsym XF86MonBrightnessDown exec --no-startup-id brightnessctl --min-val=2 -q set 3%-
111	121	bindsym XF86MonBrightnessUp exec --no-startup-id brightnessctl -q set 3%+
112		```
113
114		#### `polybar`
115
116		Instead of using the default `i3status` bar, I have opted to use `polybar`
117		instead (as you can also see in the screenshot above).
118
119		My config for this menu bar is basically just the default settings with modified
120		colors and an added battery block to quickly show me the machine's battery info.
121
122		#### `alacritty`
123
124		Not much to say on this part yet, as I haven't configured it much, but I
125		installed `alacritty` as my default terminal, and I am using `zsh` and the
126		shell.
127
128		## Software Choices
129
130		Again, I'm not going to say much that I haven't said yet in other blog
131		posts, so I'll just do a quick rundown of the apps I installed immediately after
132		I set up the environment.
	122	#+end_src
	123
	124	**** =polybar=
	125	:PROPERTIES:
	126	:CUSTOM_ID: polybar
	127	:END:
	128	Instead of using the default =i3status= bar, I have opted to use
	129	=polybar= instead (as you can also see in the screenshot above).
	130
	131	My config for this menu bar is basically just the default settings with
	132	modified colors and an added battery block to quickly show me the
	133	machine's battery info.
	134
	135	**** =alacritty=
	136	:PROPERTIES:
	137	:CUSTOM_ID: alacritty
	138	:END:
	139	Not much to say on this part yet, as I haven't configured it much, but I
	140	installed =alacritty= as my default terminal, and I am using =zsh= and
	141	the shell.
	142
	143	** Software Choices
	144	:PROPERTIES:
	145	:CUSTOM_ID: software-choices
	146	:END:
	147	Again, I'm not going to say much that I haven't said yet in other blog
	148	posts, so I'll just do a quick rundown of the apps I installed
	149	immediately after I set up the environment.
133	150
134	151	Flatpak Apps:
135	152

blog/2022-07-01-git-server.org +357 −305

		@@ -1,244 +1,271 @@
1		+++
2		date = 2022-07-01
3		title = "Self-Hosting a Personal Git Server"
4		description = "My retrospective on successfully setting up a personal git server at home."
5		+++
	1	#+title: Self-Hosting a Personal Git Server
	2	#+date: 2022-07-01
6	3
7		## My Approach to Self-Hosting Git
	4	** My Approach to Self-Hosting Git
	5	:PROPERTIES:
	6	:CUSTOM_ID: my-approach-to-self-hosting-git
	7	:END:
	8	I have often tried to self-host my Git repositories, but have always
	9	fallen short when I tried to find a suitable web interface to show on
	10	the front-end.
8	11
9		I have often tried to self-host my Git repositories, but have always fallen
10		short when I tried to find a suitable web interface to show on the front-end.
	12	After a few years, I have finally found a combination of methods that
	13	allow me to easily self-host my projects, view them on the web, and
	14	access them from anywhere.
11	15
12		After a few years, I have finally found a combination of methods that allow me
13		to easily self-host my projects, view them on the web, and access them from
14		anywhere.
	16	Before I dive into the details, I want to state a high-level summary of
	17	my self-hosted Git approach:
15	18
16		Before I dive into the details, I want to state a high-level summary of my
17		self-hosted Git approach:
18
19		- This method uses the `ssh://` (read & write) and `git://` (read-only)
	19	- This method uses the =ssh://= (read & write) and =git://= (read-only)
20	20	protocols for push and pull access.
21		- For the `git://` protocol, I create a `git-daemon-export-ok` file in any
22		repository that I want to be cloneable by anyone.
23		- The web interface I am using (`cgit`) allows simple HTTP cloning by
24		default.
25		I do not disable this setting as I want beginners to be able to
26		clone one of my repositories even if they don't know the proper method.
27		- I am not enabling Smart HTTPS for any repositories. Updates to repositories
28		must be pushed via SSH.
29		- Beyond the actual repository management, I am using `cgit` for the front-end
30		web interface.
31		- If you use the `scan-path=<path>` configuration in the `cgitrc`
32		configuration file to automatically find repositories, you can't exclude a
33		repository from `cgit` if it's stored within the path that `cgit` reads. To
34		host private repositories, you'd need to set up another directory that `cgit`
35		can't read.
36
37		## Assumptions
38
	21	- For the =git://= protocol, I create a =git-daemon-export-ok= file in
	22	any repository that I want to be cloneable by anyone.
	23	- The web interface I am using (=cgit=) allows simple HTTP cloning by
	24	default. I do not disable this setting as I want beginners to be
	25	able to clone one of my repositories even if they don't know the
	26	proper method.
	27	- I am not enabling Smart HTTPS for any repositories. Updates to
	28	repositories must be pushed via SSH.
	29	- Beyond the actual repository management, I am using =cgit= for the
	30	front-end web interface.
	31	- If you use the =scan-path=<path>= configuration in the =cgitrc=
	32	configuration file to automatically find repositories, you can't
	33	exclude a repository from =cgit= if it's stored within the path that
	34	=cgit= reads. To host private repositories, you'd need to set up
	35	another directory that =cgit= can't read.
	36
	37	** Assumptions
	38	:PROPERTIES:
	39	:CUSTOM_ID: assumptions
	40	:END:
39	41	For the purposes of this walkthrough, I am assuming you have a URL
40		(`git.example.com`) or IP address (`207.84.26.991`) addressed to the server that
41		you will be using to host your git repositories.
42
43		## Adding a Git User
44
45		In order to use the SSH method associated with git, we will need to add a
46		user named `git`. If you have used the SSH method for other git hosting sites,
47		you are probably used to the following syntax:
48
49		```sh
	42	(=git.example.com=) or IP address (=207.84.26.991=) addressed to the
	43	server that you will be using to host your git repositories.
	44
	45	** Adding a Git User
	46	:PROPERTIES:
	47	:CUSTOM_ID: adding-a-git-user
	48	:END:
	49	In order to use the SSH method associated with git, we will need to add
	50	a user named =git=. If you have used the SSH method for other git
	51	hosting sites, you are probably used to the following syntax:
	52
	53	#+begin_src sh
50	54	git clone [user@]server:project.git
51		```
	55	#+end_src
52	56
53		The syntax above is an `scp`-like syntax for using SSH on the `git` user on the
54		server to access your repository.
	57	The syntax above is an =scp=-like syntax for using SSH on the =git= user
	58	on the server to access your repository.
55	59
56		Let's delete any remnants of an old `git` user, if any, and create the new user
57		account:
	60	Let's delete any remnants of an old =git= user, if any, and create the
	61	new user account:
58	62
59		```sh
	63	#+begin_src sh
60	64	sudo deluser --remove-home git
61	65	sudo adduser git
62		```
	66	#+end_src
63	67
64		### Import Your SSH Keys to the Git User
65
66		Once the `git` user is created, you will need to copy your public SSH key on
67		your local development machine to the `git` user on the server.
	68	*** Import Your SSH Keys to the Git User
	69	:PROPERTIES:
	70	:CUSTOM_ID: import-your-ssh-keys-to-the-git-user
	71	:END:
	72	Once the =git= user is created, you will need to copy your public SSH
	73	key on your local development machine to the =git= user on the server.
68	74
69	75	If you don't have an SSH key yet, create one with this command:
70	76
71		```sh
	77	#+begin_src sh
72	78	ssh-keygen
73		```
	79	#+end_src
74	80
75		Once you create the key pair, the public should be saved to `~/.ssh/id_rsa.pub`.
	81	Once you create the key pair, the public should be saved to
	82	=~/.ssh/id_rsa.pub=.
76	83
77		If your server still has password-based authentication available, you can copy
78		it over to your user's home directory like this:
	84	If your server still has password-based authentication available, you
	85	can copy it over to your user's home directory like this:
79	86
80		```sh
	87	#+begin_src sh
81	88	ssh-copy-id git@server
82		```
	89	#+end_src
83	90
84	91	Otherwise, copy it over to any user that you can access.
85	92
86		```sh
	93	#+begin_src sh
87	94	scp ~/.ssh/id_rsa.pub your_user@your_server:
88		```
	95	#+end_src
89	96
90		Once on the server, you will need to copy the contents into the `git` user's
91		`authorized_keys` file:
	97	Once on the server, you will need to copy the contents into the =git=
	98	user's =authorized_keys= file:
92	99
93		```sh
	100	#+begin_src sh
94	101	cat id_rsa.pub > /home/git/.ssh/authorized_keys
95		```
96
97		### (Optional) Disable Password-Based SSH
	102	#+end_src
98	103
99		If you want to lock down your server and ensure that no one can authenticate in
100		via SSH with a password, you will need to edit your SSH configuration.
	104	*** (Optional) Disable Password-Based SSH
	105	:PROPERTIES:
	106	:CUSTOM_ID: optional-disable-password-based-ssh
	107	:END:
	108	If you want to lock down your server and ensure that no one can
	109	authenticate in via SSH with a password, you will need to edit your SSH
	110	configuration.
101	111
102		```sh
	112	#+begin_src sh
103	113	sudo nano /etc/ssh/sshd_config
104		```
	114	#+end_src
105	115
106		Within this file, find the following settings and set them to the values I am
107		showing below:
	116	Within this file, find the following settings and set them to the values
	117	I am showing below:
108	118
109		```conf
	119	#+begin_src conf
110	120	PermitRootLogin no
111	121	PasswordAuthentication no
112	122	AuthenticationMethods publickey
113		```
	123	#+end_src
114	124
115		You may have other Authentication Methods required in your personal set-up, so
116		the key here is just to ensure that `AuthenticationMethods` does not allow
117		passwords.
	125	You may have other Authentication Methods required in your personal
	126	set-up, so the key here is just to ensure that =AuthenticationMethods=
	127	does not allow passwords.
118	128
119		## Setting up the Base Directory
	129	** Setting up the Base Directory
	130	:PROPERTIES:
	131	:CUSTOM_ID: setting-up-the-base-directory
	132	:END:
	133	Now that we have set up a =git= user to handle all transport methods, we
	134	need to set up the directory that we will be using as our base of all
	135	repositories.
120	136
121		Now that we have set up a `git` user to handle all transport methods, we need
122		to set up the directory that we will be using as our base of all repositories.
	137	In my case, I am using =/git= as my source folder. To create this folder
	138	and assign it to the user we created, execute the following commands:
123	139
124		In my case, I am using `/git` as my source folder. To create this folder and
125		assign it to the user we created, execute the following commands:
126
127		```sh
	140	#+begin_src sh
128	141	sudo mkdir /git
129	142	sudo chown -R git:git /git
130		```
131
132		## Creating a Test Repository
	143	#+end_src
133	144
134		On your server, switch over to the `git` user in order to start managing git
135		files.
	145	** Creating a Test Repository
	146	:PROPERTIES:
	147	:CUSTOM_ID: creating-a-test-repository
	148	:END:
	149	On your server, switch over to the =git= user in order to start managing
	150	git files.
136	151
137		```sh
	152	#+begin_src sh
138	153	su git
139		```
	154	#+end_src
140	155
141		Once logged-in as the `git` user, go to your base directory and create a test
142		repository.
	156	Once logged-in as the =git= user, go to your base directory and create a
	157	test repository.
143	158
144		```sh
	159	#+begin_src sh
145	160	cd /git
146	161	mkdir test.git && cd test.git
147	162	git init --bare
148		```
	163	#+end_src
149	164
150		If you want to make this repo viewable/cloneable to the public via the `git://`
151		protocol, you need to create a `git-daemon-export-ok` file inside the
152		repository.
	165	If you want to make this repo viewable/cloneable to the public via the
	166	=git://= protocol, you need to create a =git-daemon-export-ok= file
	167	inside the repository.
153	168
154		```sh
	169	#+begin_src sh
155	170	touch git-daemon-export-ok
156		```
	171	#+end_src
157	172
158		## Change the Login Shell for `git`
	173	** Change the Login Shell for =git=
	174	:PROPERTIES:
	175	:CUSTOM_ID: change-the-login-shell-for-git
	176	:END:
	177	To make sure that the =git= user is only used for git operations and
	178	nothing else, you need to change the user's login shell. To do this,
	179	simply use the =chsh= command:
159	180
160		To make sure that the `git` user is only used for git operations and nothing
161		else, you need to change the user's login shell. To do this, simply use the
162		`chsh` command:
163
164		```sh
	181	#+begin_src sh
165	182	sudo chsh git
166		```
	183	#+end_src
167	184
168		The interactive prompt will ask which shell you want the `git` user to use. You
169		must use the following value:
	185	The interactive prompt will ask which shell you want the =git= user to
	186	use. You must use the following value:
170	187
171		```sh
	188	#+begin_src sh
172	189	/usr/bin/git-shell
173		```
174
175		Once done, no one will be able to SSH to the `git` user or execute commands
176		other than the standard git commands.
	190	#+end_src
177	191
178		## Opening the Firewall
	192	Once done, no one will be able to SSH to the =git= user or execute
	193	commands other than the standard git commands.
179	194
180		Don't forget to open up ports on the device firewall and network firewall if
181		you want to access these repositories publicly. If you're using default ports,
182		forward ports `22` (ssh) and `9418` (git) from your router to your server's IP
183		address.
	195	** Opening the Firewall
	196	:PROPERTIES:
	197	:CUSTOM_ID: opening-the-firewall
	198	:END:
	199	Don't forget to open up ports on the device firewall and network
	200	firewall if you want to access these repositories publicly. If you're
	201	using default ports, forward ports =22= (ssh) and =9418= (git) from your
	202	router to your server's IP address.
184	203
185		If your server also has a firewall, ensure that the firewall allows the same
186		ports that are forwarded from the router. For example, if you use `ufw`:
	204	If your server also has a firewall, ensure that the firewall allows the
	205	same ports that are forwarded from the router. For example, if you use
	206	=ufw=:
187	207
188		```sh
	208	#+begin_src sh
189	209	sudo ufw allow 22
190	210	sudo ufw allow 9418
191		```
192
193		### Non-Standard SSH Ports
	211	#+end_src
194	212
195		If you use a non-standard port for SSH, such as `9876`, you will need to create
196		an SSH configuration file on your local development machine in order to connect
197		to your server's git repositories.
	213	*** Non-Standard SSH Ports
	214	:PROPERTIES:
	215	:CUSTOM_ID: non-standard-ssh-ports
	216	:END:
	217	If you use a non-standard port for SSH, such as =9876=, you will need to
	218	create an SSH configuration file on your local development machine in
	219	order to connect to your server's git repositories.
198	220
199		To do this, you'll need to define your custom port on your client machine in
200		your `~/.ssh/config` file:
	221	To do this, you'll need to define your custom port on your client
	222	machine in your =~/.ssh/config= file:
201	223
202		```sh
	224	#+begin_src sh
203	225	nano ~/.ssh/config
204		```
	226	#+end_src
205	227
206		```conf
	228	#+begin_src conf
207	229	Host git.example.com
208	230	# HostName can be a URL or an IP address
209	231	HostName git.example.com
210	232	Port 9876
211	233	User git
212		```
213
214		### Testing SSH
	234	#+end_src
215	235
	236	*** Testing SSH
	237	:PROPERTIES:
	238	:CUSTOM_ID: testing-ssh
	239	:END:
216	240	There are two main syntaxes you can use to manage git over SSH:
217	241
218		- `git clone [user@]server:project.git`
219		- `git clone ssh://[user@]server/project.git`
	242	- =git clone [user@]server:project.git=
	243	- =git clone ssh://[user@]server/project.git=
220	244
221		I prefer the first, which is an `scp`-like syntax. To test it, try to clone the
222		test repository you set up on the server:
	245	I prefer the first, which is an =scp=-like syntax. To test it, try to
	246	clone the test repository you set up on the server:
223	247
224		```sh
	248	#+begin_src sh
225	249	git clone git@git.example.com:/git/test.git
226		```
227
228		## Enabling Read-Only Access
	250	#+end_src
229	251
230		If you want people to be able to clone any repository where you've placed a
231		`git-daemon-export-ok` file, you will need to start the git daemon.
	252	** Enabling Read-Only Access
	253	:PROPERTIES:
	254	:CUSTOM_ID: enabling-read-only-access
	255	:END:
	256	If you want people to be able to clone any repository where you've
	257	placed a =git-daemon-export-ok= file, you will need to start the git
	258	daemon.
232	259
233		To do this on a system with `systemd`, create a service file:
	260	To do this on a system with =systemd=, create a service file:
234	261
235		```sh
	262	#+begin_src sh
236	263	sudo nano /etc/systemd/system/git-daemon.service
237		```
	264	#+end_src
238	265
239		Inside the `git-daemon.service` file, paste the following:
	266	Inside the =git-daemon.service= file, paste the following:
240	267
241		```conf
	268	#+begin_src conf
242	269	[Unit]
243	270	Description=Start Git Daemon
244	271
		@@ -257,72 +284,79 @@ Group=git
257	284
258	285	[Install]
259	286	WantedBy=multi-user.target
260		```
	287	#+end_src
261	288
262	289	Once created, enable and start the service:
263	290
264		```sh
	291	#+begin_src sh
265	292	sudo systemctl enable git-daemon.service
266	293	sudo systemctl start git-daemon.service
267		```
	294	#+end_src
268	295
269		To clone read-only via the `git://` protocol, you can use the following syntax:
	296	To clone read-only via the =git://= protocol, you can use the following
	297	syntax:
270	298
271		```sh
	299	#+begin_src sh
272	300	git clone git://git.example.com/test.git
273		```
274
275		## Migrating Repositories
	301	#+end_src
276	302
	303	** Migrating Repositories
	304	:PROPERTIES:
	305	:CUSTOM_ID: migrating-repositories
	306	:END:
277	307	At this point, we have a working git server that works with both SSH and
278	308	read-only access.
279	309
280		For each of the repositories I had hosted a different provider, I executed the
281		following commands in order to place a copy on my server as my new source of
282		truth:
	310	For each of the repositories I had hosted a different provider, I
	311	executed the following commands in order to place a copy on my server as
	312	my new source of truth:
283	313
284	314	Server:
285	315
286		```sh
	316	#+begin_src sh
287	317	su git
288	318	mkdir /git/<REPOSITORY_NAME>.git && cd /git/<REPOSITORY_NAME>.git
289	319	git init --bare
290	320
291	321	# If you want to make this repo viewable/cloneable to the public
292	322	touch git-daemon-export-ok
293		```
	323	#+end_src
294	324
295	325	Client:
296	326
297		```sh
	327	#+begin_src sh
298	328	git clone git@<PREVIOUS_HOST>:<REPOSITORY_NAME>
299	329	git remote set-url origin git@git.EXAMPLE.COM:/git/<REPOSITORY_NAME>.git
300	330	git push
301		```
302
303		## Optional Web View: `cgit`
304
305		If you want a web viewer for your repositories, you can use various tools, such
306		as `gitweb`, `cgit`, or `klaus`. I chose `cgit` due to its simple interface and
307		fairly easy set-up (compared to others). Not to mention that the
308		[Linux kernel uses `cgit`](https://git.kernel.org/).
309
310		### Docker Compose
311
312		Instead of using my previous method of using a `docker run` command, I've
313		updated this section to use `docker-compose` instead for an easier installation
314		and simpler management and configuration.
315
316		In order to use Docker Compose, you will set up a `docker-compose.yml` file to
317		automatically connect resources like the repositories, `cgitrc`, and various
318		files or folders to the `cgit` container you're creating:
319
320		```sh
	331	#+end_src
	332
	333	** Optional Web View: =cgit=
	334	:PROPERTIES:
	335	:CUSTOM_ID: optional-web-view-cgit
	336	:END:
	337	If you want a web viewer for your repositories, you can use various
	338	tools, such as =gitweb=, =cgit=, or =klaus=. I chose =cgit= due to its
	339	simple interface and fairly easy set-up (compared to others). Not to
	340	mention that the [[https://git.kernel.org/][Linux kernel uses =cgit=]].
	341
	342	*** Docker Compose
	343	:PROPERTIES:
	344	:CUSTOM_ID: docker-compose
	345	:END:
	346	Instead of using my previous method of using a =docker run= command,
	347	I've updated this section to use =docker-compose= instead for an easier
	348	installation and simpler management and configuration.
	349
	350	In order to use Docker Compose, you will set up a =docker-compose.yml=
	351	file to automatically connect resources like the repositories, =cgitrc=,
	352	and various files or folders to the =cgit= container you're creating:
	353
	354	#+begin_src sh
321	355	mkdir ~/cgit && cd ~/cgit
322	356	nano docker-compose.yml
323		```
	357	#+end_src
324	358
325		```conf
	359	#+begin_src conf
326	360	# docker-compose.yml
327	361	version: '3'
328	362
		@@ -338,39 +372,41 @@ services:
338	372	ports:
339	373	- "8763:80"
340	374	restart: always
341		```
	375	#+end_src
342	376
343	377	Then, just start the container:
344	378
345		```sh
	379	#+begin_src sh
346	380	sudo docker-compose up -d
347		```
348
349		Once it's finished installing, you can access the site at `<SERVER_IP>:8763` or
350		use a reverse-proxy service to forward `cgit` to a URL, such as
351		`git.example.com`. See the next section for more details on reverse proxying a
352		URL to a local port.
353
354		### Nginx Reverse Proxy
355
356		I am using Nginx as my reverse proxy so that the `cgit` Docker container can use
357		`git.example.com` as its URL. To do so, I simply created the following
358		configuration file:
359
360		```sh
	381	#+end_src
	382
	383	Once it's finished installing, you can access the site at
	384	=<SERVER_IP>:8763= or use a reverse-proxy service to forward =cgit= to a
	385	URL, such as =git.example.com=. See the next section for more details on
	386	reverse proxying a URL to a local port.
	387
	388	*** Nginx Reverse Proxy
	389	:PROPERTIES:
	390	:CUSTOM_ID: nginx-reverse-proxy
	391	:END:
	392	I am using Nginx as my reverse proxy so that the =cgit= Docker container
	393	can use =git.example.com= as its URL. To do so, I simply created the
	394	following configuration file:
	395
	396	#+begin_src sh
361	397	sudo nano /etc/nginx/sites-available/git.example.com
362		```
	398	#+end_src
363	399
364		```conf
	400	#+begin_src conf
365	401	server {
366	402	listen 80;
367		server_name git.example.com;
	403	server_name git.example.com;
368	404
369		if ($host = git.example.com) {
370		return 301 https://$host$request_uri;
371		}
	405	if ($host = git.example.com) {
	406	return 301 https://$host$request_uri;
	407	}
372	408
373		return 404;
	409	return 404;
374	410	}
375	411
376	412	server {
		@@ -379,7 +415,7 @@ server {
379	415
380	416	location / {
381	417	# The final `/` is important.
382		proxy_pass http://localhost:8763/;
	418	proxy_pass http://localhost:8763/;
383	419	add_header X-Frame-Options SAMEORIGIN;
384	420	add_header X-XSS-Protection "1; mode=block";
385	421	proxy_redirect off;
		@@ -395,64 +431,71 @@ server {
395	431	include /etc/letsencrypt/options-ssl-nginx.conf;
396	432	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
397	433	}
398
399		```
	434	#+end_src
400	435
401	436	Once created, symlink it and restart the web server.
402	437
403		```sh
	438	#+begin_src sh
404	439	sudo ln -s /etc/nginx/sites-available/git.example.com /etc/nginx/sites-enabled/
405	440	sudo systemctl restart nginx.service
406		```
407
408		As we can see below, my site at `git.example.com` is available and running:
	441	#+end_src
409	442
410		### Settings Up Git Details
	443	As we can see below, my site at =git.example.com= is available and
	444	running:
411	445
412		Once you have `cgit` running, you can add some small details, such as repository
413		owners and descriptions by editing the following files within each repository.
	446	*** Settings Up Git Details
	447	:PROPERTIES:
	448	:CUSTOM_ID: settings-up-git-details
	449	:END:
	450	Once you have =cgit= running, you can add some small details, such as
	451	repository owners and descriptions by editing the following files within
	452	each repository.
414	453
415		Alternatively, you can use the `cgitrc` file to edit these details if you only
416		care to edit them for the purpose of seeing them on your website.
	454	Alternatively, you can use the =cgitrc= file to edit these details if
	455	you only care to edit them for the purpose of seeing them on your
	456	website.
417	457
418		The `description` file within the repository on your server will display the
419		description online.
	458	The =description= file within the repository on your server will display
	459	the description online.
420	460
421		```sh
	461	#+begin_src sh
422	462	cd /git/example.git
423	463	nano description
424		```
	464	#+end_src
425	465
426		You can add a `[gitweb]` block to the `config` file in order to display the
427		owner of the repository.
	466	You can add a =[gitweb]= block to the =config= file in order to display
	467	the owner of the repository.
428	468
429		```sh
	469	#+begin_src sh
430	470	cd /git/example.git
431	471	nano config
432		```
	472	#+end_src
433	473
434		```conf
	474	#+begin_src conf
435	475	[gitweb]
436		owner = "YourName"
437		```
	476	owner = "YourName"
	477	#+end_src
438	478
439		Note that you can ignore the configuration within each repository and simply set
440		up this information in the `cgitrc` file, if you want to do it that way.
	479	Note that you can ignore the configuration within each repository and
	480	simply set up this information in the =cgitrc= file, if you want to do
	481	it that way.
441	482
442		### Editing `cgit`
	483	*** Editing =cgit=
	484	:PROPERTIES:
	485	:CUSTOM_ID: editing-cgit
	486	:END:
	487	In order to edit certain items within =cgit=, you need to edit the
	488	=cgitrc= file.
443	489
444		In order to edit certain items within `cgit`, you need to edit the `cgitrc`
445		file.
446
447		```sh
	490	#+begin_src sh
448	491	nano ~/cgit/cgitrc
449		```
	492	#+end_src
450	493
451		Below is an example configuration for `cgitrc`.
452		You can find all the configuration options within the [configuration manual]
	494	Below is an example configuration for =cgitrc=. You can find all the
	495	configuration options within the [configuration manual]
453	496	(https://git.zx2c4.com/cgit/plain/cgitrc.5.txt).
454	497
455		```conf
	498	#+begin_src conf
456	499	css=/cgit.css
457	500	logo=/logo.png
458	501	favicon=/favicon.png
		@@ -524,103 +567,112 @@ repo.path=/git/test.git
524	567	repo.readme=:README.md
525	568	repo.owner=John Doe
526	569	repo.desc=An example repository!
527		```
528
529		### Final Fixes: Syntax Highlighting & README Rendering
	570	#+end_src
530	571
531		After completing my initial install and playing around with it for a few days, I
532		noticed two issues:
	572	*** Final Fixes: Syntax Highlighting & README Rendering
	573	:PROPERTIES:
	574	:CUSTOM_ID: final-fixes-syntax-highlighting-readme-rendering
	575	:END:
	576	After completing my initial install and playing around with it for a few
	577	days, I noticed two issues:
533	578
534		1. Syntax highlighting did not work when viewing the source code within a file.
535		2. The `about` tab within a repository was not rendered to HTML.
	579	1. Syntax highlighting did not work when viewing the source code within
	580	a file.
	581	2. The =about= tab within a repository was not rendered to HTML.
536	582
537		The following process fixes these issues.
538		To start, let's go to the `cgit` directory where we were editing our
539		configuration file earlier.
	583	The following process fixes these issues. To start, let's go to the
	584	=cgit= directory where we were editing our configuration file earlier.
540	585
541		```sh
	586	#+begin_src sh
542	587	cd ~/cgit
543		```
	588	#+end_src
544	589
545	590	In here, create two folders that will hold our syntax files:
546	591
547		```sh
	592	#+begin_src sh
548	593	mkdir filters && mkdir filters/html-converters && cd filters
549		```
	594	#+end_src
550	595
551	596	Next, download the default filters:
552	597
553		```sh
	598	#+begin_src sh
554	599	curl https://git.zx2c4.com/cgit/plain/filters/about-formatting.sh > about-formatting.sh
555	600	chmod 755 about-formatting.sh
556	601	curl https://git.zx2c4.com/cgit/plain/filters/syntax-highlighting.py > syntax-highlighting.py
557	602	chmod 755 syntax-highlighting.py
558		```
	603	#+end_src
559	604
560		Finally, download the HTML conversion files you need.
561		The example below downloads the Markdown converter:
	605	Finally, download the HTML conversion files you need. The example below
	606	downloads the Markdown converter:
562	607
563		```sh
	608	#+begin_src sh
564	609	cd html-converters
565	610	curl https://git.zx2c4.com/cgit/plain/filters/html-converters/md2html > md2html
566	611	chmod 755 md2html
567		```
	612	#+end_src
568	613
569		If you need other filters or html-converters found within [the cgit project
570		files](https://git.zx2c4.com/cgit/tree/filters), repeat the `curl` and `chmod`
571		process above for whichever files you need.
	614	If you need other filters or html-converters found within
	615	[[https://git.zx2c4.com/cgit/tree/filters][the cgit project files]],
	616	repeat the =curl= and =chmod= process above for whichever files you
	617	need.
572	618
573		However, formatting will not work quite yet since the Docker cgit container
574		we're using doesn't have the formatting package installed. You can install this
575		easily by install Python 3+ and the `pygments` package:
	619	However, formatting will not work quite yet since the Docker cgit
	620	container we're using doesn't have the formatting package installed. You
	621	can install this easily by install Python 3+ and the =pygments= package:
576	622
577		```sh
	623	#+begin_src sh
578	624	# Enter the container's command line
579	625	sudo docker exec -it cgit bash
580		```
	626	#+end_src
581	627
582		```sh
	628	#+begin_src sh
583	629	# Install the necessary packages and then exit
584	630	yum update -y && \
585	631	yum upgrade -y && \
586	632	yum install python3 python3-pip -y && \
587	633	pip3 install markdown pygments && \
588	634	exit
589		```
	635	#+end_src
590	636
591		**You will need to enter the cgit docker container and re-run these `yum`
592		commands every time you kill and restart the container!**
	637	*You will need to enter the cgit docker container and re-run these =yum=
	638	commands every time you kill and restart the container!*
593	639
594		If not done already, we need to add the following variables to our
595		`cgitrc` file in order for `cgit` to know where our filtering files are:
	640	If not done already, we need to add the following variables to our
	641	=cgitrc= file in order for =cgit= to know where our filtering files are:
596	642
597		```conf
	643	#+begin_src conf
598	644	# Highlight source code with python pygments-based highlighter
599	645	source-filter=/var/www/htdocs/cgit/filters/syntax-highlighting.py
600	646
601	647	# Format markdown, restructuredtext, manpages, text files, and html files
602	648	# through the right converters
603	649	about-filter=/var/www/htdocs/cgit/filters/about-formatting.sh
604		```
605
606		Now you should see that syntax highlighting and README rendering to the `about`
607		tab is fixed.
608
609		### Theming
610
611		I won't go into much detail in this section, but you can fully theme your
612		installation of `cgit` since you have access to the `cgit.css` file in your web
613		root. This is another file you can add as a volume to the `docker-compose.yml`
614		file if you want to edit this without entering the container's command line.
615
616		## :warning: Remember to Back Up Your Data!
617
618		The last thing to note is that running services on your own equipment means that
619		you're assuming a level of risk that exists regarding data loss, catastrophes,
620		etc. In order to reduce the impact of any such occurrence, I suggest backing up
621		your data regularly.
622
623		Backups can be automated via `cron`, by hooking your base directory up to a
624		cloud provider, or even setting up hooks to push all repository info to git
625		mirrors on other git hosts. Whatever the method, make sure that your data
626		doesn't vanish in the event that your drives or servers fail.
	650	#+end_src
	651
	652	Now you should see that syntax highlighting and README rendering to the
	653	=about= tab is fixed.
	654
	655	*** Theming
	656	:PROPERTIES:
	657	:CUSTOM_ID: theming
	658	:END:
	659	I won't go into much detail in this section, but you can fully theme
	660	your installation of =cgit= since you have access to the =cgit.css= file
	661	in your web root. This is another file you can add as a volume to the
	662	=docker-compose.yml= file if you want to edit this without entering the
	663	container's command line.
	664
	665	** :warning: Remember to Back Up Your Data!
	666	:PROPERTIES:
	667	:CUSTOM_ID: warning-remember-to-back-up-your-data
	668	:END:
	669	The last thing to note is that running services on your own equipment
	670	means that you're assuming a level of risk that exists regarding data
	671	loss, catastrophes, etc. In order to reduce the impact of any such
	672	occurrence, I suggest backing up your data regularly.
	673
	674	Backups can be automated via =cron=, by hooking your base directory up
	675	to a cloud provider, or even setting up hooks to push all repository
	676	info to git mirrors on other git hosts. Whatever the method, make sure
	677	that your data doesn't vanish in the event that your drives or servers
	678	fail.

blog/2022-07-14-gnupg.org +220 −197

		@@ -1,39 +1,41 @@
1		+++
2		date = 2022-07-14
3		title = "GNU Privacy Guard (GPG)"
4		description = "An overview of the GPG encryption program and its uses."
5		draft = false
6		+++
7
8		## The History of GPG
9
10		[GNU Privacy Guard](https://gnupg.org/), also known as GnuPG and GPG, is a free
11		("free" as in both speech and beer) software that fully implements the OpenPGP
12		Message Format documented in [RFC 4880](https://www.rfc-editor.org/rfc/rfc4880).
13
14		I won't go in-depth on the full history of the software in this post, but it is
15		important to understand that GPG is not the same as PGP (Pretty Good Privacy),
16		which is a different implementation of RFC 4880. However, GPG was designed to
17		interoperate with PGP.
18
19		GPG was originally developed in the late 1990s by [Werner
20		Koch](https://en.wikipedia.org/wiki/Werner_Koch) and has historically been
21		funded generously by the German government.
22
23		Now that we have all the high-level info out of the way, let's dive into the
24		different aspects of GPG and its uses.
25
26		## Encryption Algorithms
27
28		GPG supports a wide range of different encryption algorithms, including
29		public-key, cipher, hash, and compression algorithms. The support for these
30		algorithms has grown since the adoption of the Libgcrypt library in the 2.x
31		versions of GPG.
32
33		As you will be able to see below in an example of a full key generation with the
34		GPG command line tool, GPG recommends the following algorithms to new users:
35
36		```sh
	1	#+title: GNU Privacy Guard (GPG)
	2	#+date: 2022-07-14
	3
	4	** The History of GPG
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-history-of-gpg
	7	:END:
	8	[[https://gnupg.org/][GNU Privacy Guard]], also known as GnuPG and GPG,
	9	is a free ("free" as in both speech and beer) software that fully
	10	implements the OpenPGP Message Format documented in
	11	[[https://www.rfc-editor.org/rfc/rfc4880][RFC 4880]].
	12
	13	I won't go in-depth on the full history of the software in this post,
	14	but it is important to understand that GPG is not the same as PGP
	15	(Pretty Good Privacy), which is a different implementation of RFC 4880.
	16	However, GPG was designed to interoperate with PGP.
	17
	18	GPG was originally developed in the late 1990s by
	19	[[https://en.wikipedia.org/wiki/Werner_Koch][Werner Koch]] and has
	20	historically been funded generously by the German government.
	21
	22	Now that we have all the high-level info out of the way, let's dive into
	23	the different aspects of GPG and its uses.
	24
	25	** Encryption Algorithms
	26	:PROPERTIES:
	27	:CUSTOM_ID: encryption-algorithms
	28	:END:
	29	GPG supports a wide range of different encryption algorithms, including
	30	public-key, cipher, hash, and compression algorithms. The support for
	31	these algorithms has grown since the adoption of the Libgcrypt library
	32	in the 2.x versions of GPG.
	33
	34	As you will be able to see below in an example of a full key generation
	35	with the GPG command line tool, GPG recommends the following algorithms
	36	to new users:
	37
	38	#+begin_src sh
37	39	Please select what kind of key you want:
38	40	(1) RSA and RSA
39	41	(2) DSA and Elgamal
		@@ -41,80 +43,84 @@ Please select what kind of key you want:
41	43	(4) RSA (sign only)
42	44	(9) ECC (sign and encrypt) default
43	45	(10) ECC (sign only)
44		```
45
46		I am not doing an in-depth explanation here in order to keep the focus on GPG
47		and not encryption algorithms. If you want a deep dive into cryptography
48		or encryption algorithms, please read my other posts:
49
50		- [AES Encryption](/blog/aes-encryption/) (2018)
51		- [Cryptography Basics](/blog/cryptography-basics/) (2020)
52
53		### Vulnerabilities
54
55		As of 2022-07-14, there are a few different vulnerabilities associated with
56		GPG or the libraries it uses:
57
58		- GPG versions 1.0.2–1.2.3 contains a bug where "as soon as one
59		(GPG-generated) ElGamal signature of an arbitrary message is released, one
60		can recover the signer's private key in less than a second on a PC."
61		([Source](https://www.di.ens.fr/~pnguyen/pub_Ng04.htm))
62		- GPG versions prior to 1.4.2.1 contain a false positive signature
	46	#+end_src
	47
	48	I am not doing an in-depth explanation here in order to keep the focus
	49	on GPG and not encryption algorithms. If you want a deep dive into
	50	cryptography or encryption algorithms, please read my other posts:
	51
	52	- [[/blog/aes-encryption/][AES Encryption]] (2018)
	53	- [[/blog/cryptography-basics/][Cryptography Basics]] (2020)
	54
	55	*** Vulnerabilities
	56	:PROPERTIES:
	57	:CUSTOM_ID: vulnerabilities
	58	:END:
	59	As of 2022-07-14, there are a few different vulnerabilities associated
	60	with GPG or the libraries it uses:
	61
	62	- GPG versions 1.0.2--1.2.3 contains a bug where "as soon as one
	63	(GPG-generated) ElGamal signature of an arbitrary message is released,
	64	one can recover the signer's private key in less than a second on a
	65	PC." ([[https://www.di.ens.fr/~pnguyen/pub_Ng04.htm][Source]])
	66	- GPG versions prior to 1.4.2.1 contain a false positive signature
63	67	verification bug.
64		([Source](https://lists.gnupg.
65		org/pipermail/gnupg-announce/2006q1/000211.html))
66		- GPG versions prior to 1.4.2.2 cannot detect injection of unsigned data.
67		(
68		[Source](https://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000218.html))
69		- Libgcrypt, a library used by GPG, contained a bug which enabled full key
70		recovery for RSA-1024 and some RSA-2048 keys.
71		This was resolved in a GPG update in 2017.
72		([Source](https://lwn.net/Articles/727179/))
73		- The [ROCA Vulnerability](https://en.wikipedia.org/wiki/ROCA_vulnerability)
74		affects RSA keys generated by YubiKey 4 tokens.
75		([Source](https://crocs.fi.
76		muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf))
77		- The [SigSpoof Attack](https://en.wikipedia.org/wiki/SigSpoof) allows an
78		attacker to spoof digital signatures.
79		([Source](https://arstechnica.
80		com/information-technology/2018/06/decades-old-pgp-bug-allowed-hackers-to-spoof-just-about-anyones-signature/))
81		- Libgcrypt 1.9.0 contains a severe flaw related to a heap buffer overflow,
82		fixed in Libgcrypt 1.9.1 ([Source](https://web.archive.
83		org/web/20210221012505/https://www.theregister.com/2021/01/29/severe_libgcrypt_bug/))
84
85		## Platforms
86
87		Originally developed as a command-line program for *nix systems, GPG now has a
88		wealth of front-end applications and libraries available for end-users. However,
89		the most recommended programs remain the same:
90
91		- [GnuPG](https://gnupg.org) for Linux (depending on distro)
92		- [Gpg4win](https://gpg4win.org) for Windows
93		- [GPGTools](https://gpgtools.org) for macOS
94
95		## Creating a Key Pair
96
97		In order to create a GPG key pair, a user would first need to install GPG on
98		their system. If we're assuming that the user is on Fedora Linux, they would
99		execute the following:
100
101		```sh
	68	([[https://lists.gnupg.%20org/pipermail/gnupg-announce/2006q1/000211.html][Source]])
	69	- GPG versions prior to 1.4.2.2 cannot detect injection of unsigned
	70	data. (
	71	[[https://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000218.html][Source]])
	72	- Libgcrypt, a library used by GPG, contained a bug which enabled full
	73	key recovery for RSA-1024 and some RSA-2048 keys. This was resolved in
	74	a GPG update in 2017. ([[https://lwn.net/Articles/727179/][Source]])
	75	- The [[https://en.wikipedia.org/wiki/ROCA_vulnerability][ROCA
	76	Vulnerability]] affects RSA keys generated by YubiKey 4 tokens.
	77	([[https://crocs.fi.%20muni.cz/_media/public/papers/nemec_roca_ccs17_preprint.pdf][Source]])
	78	- The [[https://en.wikipedia.org/wiki/SigSpoof][SigSpoof Attack]] allows
	79	an attacker to spoof digital signatures.
	80	([[https://arstechnica.%20com/information-technology/2018/06/decades-old-pgp-bug-allowed-hackers-to-spoof-just-about-anyones-signature/][Source]])
	81	- Libgcrypt 1.9.0 contains a severe flaw related to a heap buffer
	82	overflow, fixed in Libgcrypt 1.9.1
	83	([[https://web.archive.%20org/web/20210221012505/https://www.theregister.com/2021/01/29/severe_libgcrypt_bug/][Source]])
	84
	85	** Platforms
	86	:PROPERTIES:
	87	:CUSTOM_ID: platforms
	88	:END:
	89	Originally developed as a command-line program for *nix systems, GPG now
	90	has a wealth of front-end applications and libraries available for
	91	end-users. However, the most recommended programs remain the same:
	92
	93	- [[https://gnupg.org][GnuPG]] for Linux (depending on distro)
	94	- [[https://gpg4win.org][Gpg4win]] for Windows
	95	- [[https://gpgtools.org][GPGTools]] for macOS
	96
	97	** Creating a Key Pair
	98	:PROPERTIES:
	99	:CUSTOM_ID: creating-a-key-pair
	100	:END:
	101	In order to create a GPG key pair, a user would first need to install
	102	GPG on their system. If we're assuming that the user is on Fedora Linux,
	103	they would execute the following:
	104
	105	#+begin_src sh
102	106	sudo dnf install gpg
103		```
	107	#+end_src
104	108
105		Once installed, a user can create a new key pair with the following command(s):
	109	Once installed, a user can create a new key pair with the following
	110	command(s):
106	111
107		```sh
	112	#+begin_src sh
108	113	gpg --full-generate-key
109		```
	114	#+end_src
110	115
111		GPG will walk the user through an interactive setup that asks for an algorithm
112		preference, expiration date, name, and email to associate with this key.
	116	GPG will walk the user through an interactive setup that asks for an
	117	algorithm preference, expiration date, name, and email to associate with
	118	this key.
113	119
114		See the following example key set-up for a default key generation using the
115		GnuPG command-line interface:
	120	See the following example key set-up for a default key generation using
	121	the GnuPG command-line interface:
116	122
117		```sh
	123	#+begin_src sh
118	124	gpg (GnuPG) 2.3.6; Copyright (C) 2021 Free Software Foundation, Inc.
119	125	This is free software: you are free to change and redistribute it.
120	126	There is NO WARRANTY, to the extent permitted by law.
		@@ -166,13 +172,15 @@ pub ed25519 2022-07-14 [SC]
166	172	E955B7700FFC11EF51C2BA1FE096AACDD4C32E9C
167	173	uid John Doe (test key) <johndoe@example.com>
168	174	sub cv25519 2022-07-14 [E]
169		```
	175	#+end_src
170	176
171		Please note that GUI apps may differ slightly from the GPG command-line
	177	Please note that GUI apps may differ slightly from the GPG command-line
172	178	interface.
173	179
174		## Common Usage
175
	180	** Common Usage
	181	:PROPERTIES:
	182	:CUSTOM_ID: common-usage
	183	:END:
176	184	As noted in RFC 4880, the general functions of OpenPGP are as follows:
177	185
178	186	- digital signatures
		@@ -181,98 +189,110 @@ As noted in RFC 4880, the general functions of OpenPGP are as follows:
181	189	- Radix-64 conversion
182	190	- key management and certificate services
183	191
184		From this, you can probably gather that the main use of GPG is for encrypting
185		data and/or signing the data with a key. The purpose of encrypting data with GPG
186		is to ensure that no one except the intended recipient(s) can access the data.
	192	From this, you can probably gather that the main use of GPG is for
	193	encrypting data and/or signing the data with a key. The purpose of
	194	encrypting data with GPG is to ensure that no one except the intended
	195	recipient(s) can access the data.
187	196
188	197	Let's explore some specific GPG use-cases.
189	198
190		### Email
191
192		One of the more popular uses of GPG is to sign and/or encrypt emails. With the
193		use of a GPG keypair, you can encrypt a message, its subject, and even the
194		attachments within.
195
196		The first process, regarding the signing of a message without any encryption, is
197		generally used to provide assurance that an email is truly coming from the
198		sender that the message claims. When I send an email, and it's signed with my
199		public key, the recipient(s) of the message can verify that the message was
200		signed with my personal key.
201
202		The second process, regarding the actual encryption of the message and its
203		contents, works by using a combination of the sender's keys and the recipient's
204		keys. This process may vary slightly by implementation, but it most commonly
205		uses asymmetric cryptography, also known as public-key cryptography. In this
206		version of encryption, the sender's private key to sign the message and a
207		combination of the sender's keys and the recipient's public key to encrypt the
208		message.
209
210		If two people each have their own private keys and exchange their public keys,
211		they can send encrypted messages back and forth with GPG. This is also possible
212		with symmetric cryptography, but the process differs since there are no key
213		pairs.
214
215		Implementation of email encryption varies greatly between email clients, so you
216		will need to reference your email client's documentation to ensure you are
217		setting it up correctly for that specific client.
218
219		### File Encryption
220
221		As noted in the section above regarding emails, GPG enables users to be able to
222		send a message to each other if they are both set-up with GPG keys.
223		In this example, I am going to show how a user could send a file called
224		`example_file.txt` to another user via the recipient's email.
225
226		The sender would find the file they want to send and execute the following
227		command:
228
229		```sh
	199	*** Email
	200	:PROPERTIES:
	201	:CUSTOM_ID: email
	202	:END:
	203	One of the more popular uses of GPG is to sign and/or encrypt emails.
	204	With the use of a GPG keypair, you can encrypt a message, its subject,
	205	and even the attachments within.
	206
	207	The first process, regarding the signing of a message without any
	208	encryption, is generally used to provide assurance that an email is
	209	truly coming from the sender that the message claims. When I send an
	210	email, and it's signed with my public key, the recipient(s) of the
	211	message can verify that the message was signed with my personal key.
	212
	213	The second process, regarding the actual encryption of the message and
	214	its contents, works by using a combination of the sender's keys and the
	215	recipient's keys. This process may vary slightly by implementation, but
	216	it most commonly uses asymmetric cryptography, also known as public-key
	217	cryptography. In this version of encryption, the sender's private key to
	218	sign the message and a combination of the sender's keys and the
	219	recipient's public key to encrypt the message.
	220
	221	If two people each have their own private keys and exchange their public
	222	keys, they can send encrypted messages back and forth with GPG. This is
	223	also possible with symmetric cryptography, but the process differs since
	224	there are no key pairs.
	225
	226	Implementation of email encryption varies greatly between email clients,
	227	so you will need to reference your email client's documentation to
	228	ensure you are setting it up correctly for that specific client.
	229
	230	*** File Encryption
	231	:PROPERTIES:
	232	:CUSTOM_ID: file-encryption
	233	:END:
	234	As noted in the section above regarding emails, GPG enables users to be
	235	able to send a message to each other if they are both set-up with GPG
	236	keys. In this example, I am going to show how a user could send a file
	237	called =example_file.txt= to another user via the recipient's email.
	238
	239	The sender would find the file they want to send and execute the
	240	following command:
	241
	242	#+begin_src sh
230	243	gpg --encrypt --output example_file.txt.gpg --recipient \
231	244	recipient@example.com example_file.txt
232		```
	245	#+end_src
233	246
234		Once received, the recipient can decrypt the file with the following command:
	247	Once received, the recipient can decrypt the file with the following
	248	command:
235	249
236		```sh
	250	#+begin_src sh
237	251	gpg --decrypt --output example_file.txt example_file.txt.gpg
238		```
239
240		### Ownership Signatures
241
242		One important aspect of GPG, especially for developers, is the ability to sign
243		data without encrypting it. For example, developers often sign code changes when
244		they commit the changes back to a central repository, in order to display
245		ownership of who made the changes. This allows other users to look at a code
246		change and determine that the change was valid.
247
248		In order to do this using [Git](https://git-scm.com), the developer simply needs
249		to alter the `git commit` command to include the `-S` flag. Here's an example:
250
251		```sh
	252	#+end_src
	253
	254	*** Ownership Signatures
	255	:PROPERTIES:
	256	:CUSTOM_ID: ownership-signatures
	257	:END:
	258	One important aspect of GPG, especially for developers, is the ability
	259	to sign data without encrypting it. For example, developers often sign
	260	code changes when they commit the changes back to a central repository,
	261	in order to display ownership of who made the changes. This allows other
	262	users to look at a code change and determine that the change was valid.
	263
	264	In order to do this using [[https://git-scm.com][Git]], the developer
	265	simply needs to alter the =git commit= command to include the =-S= flag.
	266	Here's an example:
	267
	268	#+begin_src sh
252	269	git commit -S -m "my commit message"
253		```
	270	#+end_src
254	271
255		As an expansion of the example above, Git users can configure their environment
256		with a default key to use by adding their GPG signature:
	272	As an expansion of the example above, Git users can configure their
	273	environment with a default key to use by adding their GPG signature:
257	274
258		```sh
	275	#+begin_src sh
259	276	git config --global user.signingkey XXXXXXXXXXXXXXXX
260		```
	277	#+end_src
261	278
262		If you're not sure what your signature is, you can find it titled `sig` in the
263		output of this command:
	279	If you're not sure what your signature is, you can find it titled =sig=
	280	in the output of this command:
264	281
265		```sh
	282	#+begin_src sh
266	283	gpg --list-signatures
267		```
268
269		### File Integrity
270
271		When a person generates a signature for data, they are allowing users the
272		ability to verify the signature on that data in the future to ensure the data
273		has not been corrupted. This is most common with software applications hosted on
274		the internet - developers provide signatures so that users can verify a website
275		was not hijacked and download links replaced with dangerous software.
	284	#+end_src
	285
	286	*** File Integrity
	287	:PROPERTIES:
	288	:CUSTOM_ID: file-integrity
	289	:END:
	290	When a person generates a signature for data, they are allowing users
	291	the ability to verify the signature on that data in the future to ensure
	292	the data has not been corrupted. This is most common with software
	293	applications hosted on the internet - developers provide signatures so
	294	that users can verify a website was not hijacked and download links
	295	replaced with dangerous software.
276	296
277	297	In order to verify signed data, a user needs to have:
278	298
		@@ -280,26 +300,29 @@ In order to verify signed data, a user needs to have:
280	300	2. A signature file
281	301	3. The public GPG key of the signer
282	302
283		Once the signer's public key is imported on the user's system, and they have
284		the data and signature, they can verify the data with the following commands:
	303	Once the signer's public key is imported on the user's system, and they
	304	have the data and signature, they can verify the data with the following
	305	commands:
285	306
286		```sh
	307	#+begin_src sh
287	308	# If the signature is attached to the data
288	309	gpg --verify [signature-file]
289	310
290	311	# If the signature is detached as a separate file from the data
291	312	gpg --verify [signature-file] [original-file]
292		```
293
294		## Finding Public Keys
295
296		In order to use GPG with others, a user needs to know the other user(s) keys.
297		This is easy to do if the user knows the other user(s) in person, but may be
298		hard if the relationship is strictly digital. Luckily, there are a few options.
299		The first option is to look at a user's web page or social pages if they have
300		them.
	313	#+end_src
	314
	315	** Finding Public Keys
	316	:PROPERTIES:
	317	:CUSTOM_ID: finding-public-keys
	318	:END:
	319	In order to use GPG with others, a user needs to know the other user(s)
	320	keys. This is easy to do if the user knows the other user(s) in person,
	321	but may be hard if the relationship is strictly digital. Luckily, there
	322	are a few options. The first option is to look at a user's web page or
	323	social pages if they have them.
301	324
302	325	Otherwise, the best option is to use a keyserver, such as:
303	326
304		- [pgp.mit.edu](https://pgp.mit.edu)
305		- [keys.openpgp.org](https://keys.openpgp.org)
	327	- [[https://pgp.mit.edu][pgp.mit.edu]]
	328	- [[https://keys.openpgp.org][keys.openpgp.org]]

blog/2022-07-25-curseradio.org +94 −79

		@@ -1,99 +1,114 @@
1		+++
2		date = 2022-07-25
3		title = "CurseRadio: Listening to the Radio on the Command Line"
4		description = "A quick and easy installation for CurseRadio on Fedora Linux."
5		+++
6
7		## Overview
8
9		While exploring some interesting Linux applications, I stumbled across
10		[curseradio](https://github.com/chronitis/curseradio), a command-line radio
11		player based on Python.
12
13		This application is fantastic and incredibly easy to install, so I wanted to
14		dedicate a post today to this app. Let's look at the features within the app and
15		then walk through the installation process I took to get `curseradio` working.
16
17		## Features
18
19		![curseradio](https://img.cleberg.net/blog/20220725-curseradio/curseradio.png "curseradio")
20
21		The radio player itself is quite minimal. As you can see in the screenshot
22		above, it contains a simple plaintext list of all available categories, which
23		can be broken down further and further. In addition, radio shows are available
24		for listening, alongside regular radio stations.
25
26		For example, the `Sports` > `Pro Basketball` > `Shows` category contains a
27		number of specific shows related to Professional Basketball.
28
29		Aside from being able to play any of the listed stations/shows, you can make
30		a channel your favorite by pressing `f`.
31		It will now show up at the top of the radio player in the `Favourites` category.
32
33		### Commands/Shortcuts
34
35		\| Key(s) \| Command \|
36		\|:----------:\|:-------------------------------:\|
37		\| ↑, ↓ \| navigate \|
38		\| PgUp, PgDn \| navigate quickly \|
39		\| Home, End \| to top/bottom \|
40		\| Enter \| open/close folders, play stream \|
41		\| k \| stop playing stream \|
42		\| q \| quit \|
43		\| f \| toggle favourite \|
44
45		## Installation
46
47		### Dependencies
48
49		Before installing `curseradio`, a handful of system and Python packages are
50		required. To get started, install `python3`, `pip3`, and `mpv` on your system.
51		In this example, I'm using Fedora Linux, which uses the `dnf` package manager.
52		You may need to adjust this if you're using a different system.
53
54		```sh
	1	#+title: CurseRadio: Listening to the Radio on the Command Line
	2	#+date: 2022-07-25
	3
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	While exploring some interesting Linux applications, I stumbled across
	9	[[https://github.com/chronitis/curseradio][curseradio]], a command-line
	10	radio player based on Python.
	11
	12	This application is fantastic and incredibly easy to install, so I
	13	wanted to dedicate a post today to this app. Let's look at the features
	14	within the app and then walk through the installation process I took to
	15	get =curseradio= working.
	16
	17	** Features
	18	:PROPERTIES:
	19	:CUSTOM_ID: features
	20	:END:
	21	#+caption: curseradio
	22	[[https://img.cleberg.net/blog/20220725-curseradio/curseradio.png]]
	23
	24	The radio player itself is quite minimal. As you can see in the
	25	screenshot above, it contains a simple plaintext list of all available
	26	categories, which can be broken down further and further. In addition,
	27	radio shows are available for listening, alongside regular radio
	28	stations.
	29
	30	For example, the =Sports= > =Pro Basketball= > =Shows= category contains
	31	a number of specific shows related to Professional Basketball.
	32
	33	Aside from being able to play any of the listed stations/shows, you can
	34	make a channel your favorite by pressing =f=. It will now show up at the
	35	top of the radio player in the =Favourites= category.
	36
	37	*** Commands/Shortcuts
	38	:PROPERTIES:
	39	:CUSTOM_ID: commandsshortcuts
	40	:END:
	41	\| Key(s) \| Command \|
	42	\|------------+---------------------------------\|
	43	\| ↑, ↓ \| navigate \|
	44	\| PgUp, PgDn \| navigate quickly \|
	45	\| Home, End \| to top/bottom \|
	46	\| Enter \| open/close folders, play stream \|
	47	\| k \| stop playing stream \|
	48	\| q \| quit \|
	49	\| f \| toggle favourite \|
	50
	51	** Installation
	52	:PROPERTIES:
	53	:CUSTOM_ID: installation
	54	:END:
	55	*** Dependencies
	56	:PROPERTIES:
	57	:CUSTOM_ID: dependencies
	58	:END:
	59	Before installing =curseradio=, a handful of system and Python packages
	60	are required. To get started, install =python3=, =pip3=, and =mpv= on
	61	your system. In this example, I'm using Fedora Linux, which uses the
	62	=dnf= package manager. You may need to adjust this if you're using a
	63	different system.
	64
	65	#+begin_src sh
55	66	sudo dnf install python3 pip3 mpv
56		```
	67	#+end_src
57	68
58		Next, use `pip3` to install `requests`, `xdg`, and `lxml`:
	69	Next, use =pip3= to install =requests=, =xdg=, and =lxml=:
59	70
60		```sh
	71	#+begin_src sh
61	72	pip3 install requests xdg lxml
62		```
	73	#+end_src
63	74
64		### Repository Source Installation
	75	*** Repository Source Installation
	76	:PROPERTIES:
	77	:CUSTOM_ID: repository-source-installation
	78	:END:
	79	Once all the dependencies are installed, we can clone the source code
	80	and enter that directory:
65	81
66		Once all the dependencies are installed, we can clone the source code and enter
67		that directory:
68
69		```sh
	82	#+begin_src sh
70	83	git clone https://github.com/chronitis/curseradio && cd curseradio
71		```
	84	#+end_src
72	85
73		Once you're within the `curseradio` directory, you can install the application
74		with the provided `setup.py` script.
	86	Once you're within the =curseradio= directory, you can install the
	87	application with the provided =setup.py= script.
75	88
76		```sh
	89	#+begin_src sh
77	90	sudo python3 setup.py install
78		```
	91	#+end_src
79	92
80		In my case, I ran into a few errors and needed to create the folders that
81		curseradio wanted to use for its installation. If you don't get any errors, you
82		can skip this and run the app.
	93	In my case, I ran into a few errors and needed to create the folders
	94	that curseradio wanted to use for its installation. If you don't get any
	95	errors, you can skip this and run the app.
83	96
84		```sh
	97	#+begin_src sh
85	98	sudo mkdir /usr/local/lib/python3.10/
86	99	sudo mkdir /usr/local/lib/python3.10/site-packages/
87		```
	100	#+end_src
88	101
89		```sh
	102	#+begin_src sh
90	103	sudo chown -R $USER:$USER /usr/local/lib/python3.10/
91		```
92
93		## Run the Application
	104	#+end_src
94	105
	106	** Run the Application
	107	:PROPERTIES:
	108	:CUSTOM_ID: run-the-application
	109	:END:
95	110	Once fully installed without errors, you can run the application!
96	111
97		```sh
	112	#+begin_src sh
98	113	python3 /usr/local/bin/curseradio
99		```
	114	#+end_src

blog/2022-07-30-flac-to-opus.org +89 −81

		@@ -1,67 +1,72 @@
1		+++
2		date = 2022-07-30
3		title = "Recursive Command-Line FLAC to Opus Conversion"
4		description = "A retrospective on how I recursively converting my FLAC file music library to OPUS with opusenc."
5		+++
6
7		## Converting FLAC to OPUS
8
9		I am currently rebuilding my music library from scratch so that I can
10		effectively archive all the music I own in the [FLAC file
11		format](https://en.wikipedia.org/wiki/FLAC), a lossless audio codec.
12
13		However, streaming FLAC files outside the home can be difficult due to the
14		size of the files, especially if you're using a weak connection.
15
16		So, in order to archive the music in a lossless format and still be able to
17		stream it easily, I opted to create a copy of my FLAC files in the [Opus audio
18		codec](https://en.wikipedia.org/wiki/Opus_(audio_format)). This allows me to
19		archive a quality, lossless version of the music and then point my streaming
20		service to the smaller, stream-ready version.
21
22		### Dependencies
23
24		The process I follow utilizes the `opus-tools` package in Ubuntu. Before
	1	#+title: Recursive Command-Line FLAC to Opus Conversion
	2	#+date: 2022-07-30
	3
	4	** Converting FLAC to OPUS
	5	:PROPERTIES:
	6	:CUSTOM_ID: converting-flac-to-opus
	7	:END:
	8	I am currently rebuilding my music library from scratch so that I can
	9	effectively archive all the music I own in the
	10	[[https://en.wikipedia.org/wiki/FLAC][FLAC file format]], a lossless
	11	audio codec.
	12
	13	However, streaming FLAC files outside the home can be difficult due to
	14	the size of the files, especially if you're using a weak connection.
	15
	16	So, in order to archive the music in a lossless format and still be able
	17	to stream it easily, I opted to create a copy of my FLAC files in the
	18	[[https://en.wikipedia.org/wiki/Opus_(audio_format)][Opus audio codec]].
	19	This allows me to archive a quality, lossless version of the music and
	20	then point my streaming service to the smaller, stream-ready version.
	21
	22	*** Dependencies
	23	:PROPERTIES:
	24	:CUSTOM_ID: dependencies
	25	:END:
	26	The process I follow utilizes the =opus-tools= package in Ubuntu. Before
25	27	proceeding, install the package:
26	28
27		```sh
	29	#+begin_src sh
28	30	sudo apt install opus-tools
29		```
	31	#+end_src
30	32
31		If you want to use a different conversion method, such as `ffmpeg` or `avconv`,
32		simply install that package instead.
	33	If you want to use a different conversion method, such as =ffmpeg= or
	34	=avconv=, simply install that package instead.
33	35
34		### Conversion Process
	36	*** Conversion Process
	37	:PROPERTIES:
	38	:CUSTOM_ID: conversion-process
	39	:END:
	40	The script I'm using is stored in my home directory, but feel free to
	41	create it wherever you want. It does not need to be in the same
	42	directory as your music files.
35	43
36		The script I'm using is stored in my home directory, but feel free to create it
37		wherever you want. It does not need to be in the same directory as your music
38		files.
39
40		```sh
	44	#+begin_src sh
41	45	cd ~ && nano transform.sh
42		```
	46	#+end_src
43	47
44		Once you have your new bash script opened in an editor, go ahead and paste the
45		following logic into the script.
	48	Once you have your new bash script opened in an editor, go ahead and
	49	paste the following logic into the script.
46	50
47		You MUST edit the following variables in order for it to work:
	51	You MUST edit the following variables in order for it to work:
48	52
49		- `source`: The source directory where your FLAC files are stored.
50		- `dest`: The destination directory where you want the resulting Opus files to
51		be stored.
	53	- =source=: The source directory where your FLAC files are stored.
	54	- =dest=: The destination directory where you want the resulting Opus
	55	files to be stored.
52	56
53		You MAY want to edit the following variables to suit your needs:
	57	You MAY want to edit the following variables to suit your needs:
54	58
55		- `filename`: If you are converting to a file format other than Opus, you'll
56		need to edit this so that your resulting files have the correct filename
57		extension.
58		- `reldir`: This variable can be edited to strip out more leading directories in
59		the file path. As you'll see later, I ignore this for now and simply clean it up
60		afterward.
61		- `opusenc`: This is the actual conversion process. You may want to edit the
62		bitrate to suit your needs. I set mine at 128 but some prefer 160 or higher.
	59	- =filename=: If you are converting to a file format other than Opus,
	60	you'll need to edit this so that your resulting files have the correct
	61	filename extension.
	62	- =reldir=: This variable can be edited to strip out more leading
	63	directories in the file path. As you'll see later, I ignore this for
	64	now and simply clean it up afterward.
	65	- =opusenc=: This is the actual conversion process. You may want to edit
	66	the bitrate to suit your needs. I set mine at 128 but some prefer 160
	67	or higher.
63	68
64		```sh
	69	#+begin_src sh
65	70	#!/bin/bash
66	71	## - The IFS takes care of spaces in file and dirnames
67	72	## - your folders may vary
		@@ -123,52 +128,55 @@ opusenc --vbr --bitrate 128 --date "$DATE" \
123	128	## just for testing
124	129	# sleep 1
125	130	done
126		```
	131	#+end_src
127	132
128		Once you're done, simply save the file and exit your editor. Don't forget to
129		enable execution of the script:
	133	Once you're done, simply save the file and exit your editor. Don't
	134	forget to enable execution of the script:
130	135
131		```sh
	136	#+begin_src sh
132	137	chmod +x transform.sh
133		```
	138	#+end_src
134	139
135	140	Finally, you may now run the script:
136	141
137		```sh
	142	#+begin_src sh
138	143	./transform.sh
139		```
140
141		If you used `opusenc`, you'll see the conversions happen within the terminal as
142		it progresses.
143		You will also see variables printed if you uncommented any of the bash
144		script's comments.
145
146		### Cleanup
147
148		As I noted above, I didn't customize my `reldir` variable in the script, which
149		caused my output directory to be `/mnt/music/library/archives` instead of
150		`/mnt/music/library`. So, I moved the output up one level and deleted the
151		accidental directory.
152
153		```sh
	144	#+end_src
	145
	146	If you used =opusenc=, you'll see the conversions happen within the
	147	terminal as it progresses. You will also see variables printed if you
	148	uncommented any of the bash script's comments.
	149
	150	*** Cleanup
	151	:PROPERTIES:
	152	:CUSTOM_ID: cleanup
	153	:END:
	154	As I noted above, I didn't customize my =reldir= variable in the script,
	155	which caused my output directory to be =/mnt/music/library/archives=
	156	instead of =/mnt/music/library=. So, I moved the output up one level and
	157	deleted the accidental directory.
	158
	159	#+begin_src sh
154	160	cd /mnt/music/library
155	161	mv archives/* .
156	162	rm -rf archives
157		```
158
159		### Check the Resulting Size
	163	#+end_src
160	164
161		If you want to see what kind of file size savings you've gained, you can always
162		use the `du` command to check:
	165	*** Check the Resulting Size
	166	:PROPERTIES:
	167	:CUSTOM_ID: check-the-resulting-size
	168	:END:
	169	If you want to see what kind of file size savings you've gained, you can
	170	always use the =du= command to check:
163	171
164		```sh
	172	#+begin_src sh
165	173	cd /mnt/music
166	174	du -h --max-depth=1 .
167		```
	175	#+end_src
168	176
169	177	In my case, my small library went from 78GB to 6.3GB!
170	178
171		```txt
	179	#+begin_src txt
172	180	78G ./archives
173	181	6.3G ./library
174		```
	182	#+end_src

blog/2022-07-31-bash-it.org +161 −140

		@@ -1,116 +1,126 @@
1		+++
2		date = 2022-07-31
3		title = "Upgrade Bash with Bash-It & Ble.sh"
4		description = "In this post, I walk through the Bash-It and Ble.sh projects, their features, and how they help users power-up their bash shell."
5		+++
6
7		## Bash
8
9		For those who are not familiar,
10		[Bash](https://en.wikipedia.org/wiki/Bash_(Unix_shell)) is a Unix shell that is
11		used as the default login shell for most Linux distributions. This shell and
12		command processor should be familiar if you've used Linux (or older version of
13		macOS) before.
14
15		However, bash is not the only option.
16		There are numerous other shells that exist.
17		Here are some popular examples:
18
19		- [zsh](https://en.wikipedia.org/wiki/Z_shell)
20		- [fish](https://en.wikipedia.org/wiki/Fish_(Unix_shell))
21		- [oksh](https://github.com/ibara/oksh)
22		- [mksh](https://wiki.gentoo.org/wiki/Mksh)
23		- [dash](https://en.wikipedia.org/wiki/Debian_Almquist_shell)
24
25		While each shell has its differences, bash is POSIX compliant and the default
26		for many Linux users. Because of this, I am going to explore a program called
27		`bash-it` below that helps bash users increase the utility of their shell
28		without installing a completely new shell.
29
30		### Installation
31
32		First, if bash is not already installed on your system, you can [download bash
33		from GNU](https://www.gnu.org/software/bash/) or use your package manager to
34		install it.
	1	#+title: Upgrade Bash with Bash-It & Ble.sh
	2	#+date: 2022-07-31
	3
	4	** Bash
	5	:PROPERTIES:
	6	:CUSTOM_ID: bash
	7	:END:
	8	For those who are not familiar,
	9	[[https://en.wikipedia.org/wiki/Bash_(Unix_shell)][Bash]] is a Unix
	10	shell that is used as the default login shell for most Linux
	11	distributions. This shell and command processor should be familiar if
	12	you've used Linux (or older version of macOS) before.
	13
	14	However, bash is not the only option. There are numerous other shells
	15	that exist. Here are some popular examples:
	16
	17	- [[https://en.wikipedia.org/wiki/Z_shell][zsh]]
	18	- [[https://en.wikipedia.org/wiki/Fish_(Unix_shell)][fish]]
	19	- [[https://github.com/ibara/oksh][oksh]]
	20	- [[https://wiki.gentoo.org/wiki/Mksh][mksh]]
	21	- [[https://en.wikipedia.org/wiki/Debian_Almquist_shell][dash]]
	22
	23	While each shell has its differences, bash is POSIX compliant and the
	24	default for many Linux users. Because of this, I am going to explore a
	25	program called =bash-it= below that helps bash users increase the
	26	utility of their shell without installing a completely new shell.
	27
	28	*** Installation
	29	:PROPERTIES:
	30	:CUSTOM_ID: installation
	31	:END:
	32	First, if bash is not already installed on your system, you can
	33	[[https://www.gnu.org/software/bash/][download bash from GNU]] or use
	34	your package manager to install it.
35	35
36	36	For example, this is how you can install bash on Fedora Linux:
37	37
38		```sh
	38	#+begin_src sh
39	39	sudo dnf install bash
40		```
	40	#+end_src
41	41
42		If you are not using bash as your default shell, use the `chsh` command to
43		change your shell:
	42	If you are not using bash as your default shell, use the =chsh= command
	43	to change your shell:
44	44
45		```sh
	45	#+begin_src sh
46	46	chsh
47		```
	47	#+end_src
48	48
49		You should see a prompt like the one below. If the brackets (`[]`) contain
50		`bash` already, you're done, and you can simply continue by hitting the Enter
51		key.
	49	You should see a prompt like the one below. If the brackets (=[]=)
	50	contain =bash= already, you're done, and you can simply continue by
	51	hitting the Enter key.
52	52
53		If the brackets contain another shell path (e.g. `/usr/bin/zsh`), enter the path
54		to the bash program on your system (it's most likely located at
55		`/usr/bin/bash`).
	53	If the brackets contain another shell path (e.g. =/usr/bin/zsh=), enter
	54	the path to the bash program on your system (it's most likely located at
	55	=/usr/bin/bash=).
56	56
57		```sh
	57	#+begin_src sh
58	58	Changing shell for <user>.
59	59	New shell [/usr/bin/bash]:
60		```
	60	#+end_src
61	61
62		You must log out or restart the machine in order for the login shell to be
63		refreshed. You can do it now or wait until you're finished customizing the
64		shell.
	62	You must log out or restart the machine in order for the login shell to
	63	be refreshed. You can do it now or wait until you're finished
	64	customizing the shell.
65	65
66		```sh
	66	#+begin_src sh
67	67	sudo reboot now
68		```
	68	#+end_src
69	69
70		## Bash-it
	70	** Bash-it
	71	:PROPERTIES:
	72	:CUSTOM_ID: bash-it
	73	:END:
	74	As noted on the [[https://github.com/Bash-it/bash-it][Bash-it]]
	75	repository:
71	76
72		As noted on the [Bash-it](https://github.com/Bash-it/bash-it) repository:
	77	#+begin_quote
	78	Bash-it is a collection of community Bash commands and scripts for Bash
	79	3.2+. (And a shameless ripoff of oh-my-zsh 😃)
73	80
74		> Bash-it is a collection of community Bash commands and scripts for Bash 3.2+.
75		> (And a shameless ripoff of oh-my-zsh 😃)
	81	#+end_quote
76	82
77		Bash-it makes it easy to install plugins, set up aliases for common commands,
78		and easily change the visual theme of your shell.
	83	Bash-it makes it easy to install plugins, set up aliases for common
	84	commands, and easily change the visual theme of your shell.
79	85
80		### Installation
	86	*** Installation
	87	:PROPERTIES:
	88	:CUSTOM_ID: installation-1
	89	:END:
	90	To install the framework, simply copy the repository files and use the
	91	=install.sh= script provided. If you want, you can (and should!) inspect
	92	the contents of the installation script before you run it.
81	93
82		To install the framework, simply copy the repository files and use the
83		`install.sh` script provided. If you want, you can (and should!) inspect the
84		contents of the installation script before you run it.
85
86		```sh
	94	#+begin_src sh
87	95	git clone --depth=1 https://github.com/Bash-it/bash-it.git ~/.bash_it
88	96	~/.bash_it/install.sh
89		```
	97	#+end_src
90	98
91		If you didn't restart your session after making bash the default, and are
92		currently working within another shell, be sure to enter a bash session before
93		using `bash-it`:
	99	If you didn't restart your session after making bash the default, and
	100	are currently working within another shell, be sure to enter a bash
	101	session before using =bash-it=:
94	102
95		```sh
	103	#+begin_src sh
96	104	bash
97		```
98
99		### Aliases
	105	#+end_src
100	106
101		Bash-it contains a number of aliases for common commands to help improve
102		efficiency in the terminal. To list all available options, use the following
103		command:
	107	*** Aliases
	108	:PROPERTIES:
	109	:CUSTOM_ID: aliases
	110	:END:
	111	Bash-it contains a number of aliases for common commands to help improve
	112	efficiency in the terminal. To list all available options, use the
	113	following command:
104	114
105		```sh
	115	#+begin_src sh
106	116	bash-it show aliases
107		```
	117	#+end_src
108	118
109	119	This will provide you a list that looks like the following text block.
110		Within this screen, you will be able to see all available options and which
111		ones are currently enabled.
	120	Within this screen, you will be able to see all available options and
	121	which ones are currently enabled.
112	122
113		```txt
	123	#+begin_src txt
114	124	Alias Enabled? Description
115	125	ag [ ] the silver searcher (ag) aliases
116	126	ansible [ ] ansible abbreviations
		@@ -123,32 +133,35 @@ clipboard [ ] xclip shortcuts
123	133	composer [ ] common composer abbreviations
124	134	curl [x] Curl aliases for convenience.
125	135	...
126		```
	136	#+end_src
127	137
128	138	To enable an alias, do:
129	139
130		```sh
	140	#+begin_src sh
131	141	bash-it enable alias <alias name> [alias name]... -or- $ bash-it enable alias all
132		```
	142	#+end_src
133	143
134	144	To disable an alias, do:
135	145
136		```sh
	146	#+begin_src sh
137	147	bash-it disable alias <alias name> [alias name]... -or- $ bash-it disable alias all
138		```
	148	#+end_src
139	149
140		### Plugins
	150	*** Plugins
	151	:PROPERTIES:
	152	:CUSTOM_ID: plugins
	153	:END:
	154	Similar to aliases, plugins are available with bash-it. You can find a
	155	complete list of plugins in the same way as aliases. Simply execute the
	156	following:
141	157
142		Similar to aliases, plugins are available with bash-it. You can find a complete
143		list of plugins in the same way as aliases. Simply execute the following:
144
145		```sh
	158	#+begin_src sh
146	159	bash-it show plugins
147		```
	160	#+end_src
148	161
149	162	You will see the following output showing enabled and disabled plugins:
150	163
151		```txt
	164	#+begin_src txt
152	165	Plugin Enabled? Description
153	166	alias-completion [ ]
154	167	autojump [ ] Autojump configuration, see https://github.com/wting/autojump for more details
		@@ -159,79 +172,87 @@ battery [x] display info about your battery charge level
159	172	blesh [ ] load ble.sh, the Bash line editor!
160	173	boot2docker [ ] Helpers to get Docker setup correctly for boot2docker
161	174	browser [ ] render commandline output in your browser
162		```
	175	#+end_src
163	176
164	177	To enable a plugin, do:
165	178
166		```sh
	179	#+begin_src sh
167	180	bash-it enable plugin <plugin name> [plugin name]... -or- $ bash-it enable plugin all
168		```
	181	#+end_src
169	182
170	183	To disable a plugin, do:
171	184
172		```sh
	185	#+begin_src sh
173	186	bash-it disable plugin <plugin name> [plugin name]... -or- $ bash-it disable plugin all
174		```
175
176		### Themes
177
178		There are quite a few pre-defined
179		[themes](https://bash-it.readthedocs.io/en/latest/themes-list/#list-of-themes)
	187	#+end_src
	188
	189	*** Themes
	190	:PROPERTIES:
	191	:CUSTOM_ID: themes
	192	:END:
	193	There are quite a few pre-defined
	194	[[https://bash-it.readthedocs.io/en/latest/themes-list/#list-of-themes][themes]]
180	195	available with bash-it.
181	196
182	197	To list all themes:
183	198
184		```sh
	199	#+begin_src sh
185	200	ls ~/.bash_it/themes/
186		```
	201	#+end_src
187	202
188		To use a new theme, you'll need to edit `.bashrc` and alter the `BASH_IT_THEME`
189		variable to your desired theme. For example, I am using the `zork` theme.
	203	To use a new theme, you'll need to edit =.bashrc= and alter the
	204	=BASH_IT_THEME= variable to your desired theme. For example, I am using
	205	the =zork= theme.
190	206
191		```sh
	207	#+begin_src sh
192	208	nano ~/.bashrc
193		```
	209	#+end_src
194	210
195		```sh
	211	#+begin_src sh
196	212	export BASH_IT_THEME='zork'
197		```
198
199		Once you save your changes, you just need to exit your terminal and create a new
200		one in order to see your changes to the `.bashrc` file. You can also `source`
201		the file to see changes, but I recommend starting a completely new shell
202		instead.
203
204		## ble.sh
205
206		One big feature I was missing in Bash that both `zsh` and `fish` have is an
207		autosuggestion feature. To explain: as you type, an autosuggestion feature in
208		the shell will offer suggestions in a lighter font color beyond the characters
209		already typed. Once you see the command you want, you can click the right arrow
210		and have the shell auto-complete that line for you.
211
212		Luckily, the [Bash Line Editor](https://github.com/akinomyoga/ble.sh) (ble.sh)
213		exists! This program provides a wonderful autosuggestions feature perfectly,
214		among other features that I haven't tested yet.
	213	#+end_src
	214
	215	Once you save your changes, you just need to exit your terminal and
	216	create a new one in order to see your changes to the =.bashrc= file. You
	217	can also =source= the file to see changes, but I recommend starting a
	218	completely new shell instead.
	219
	220	** ble.sh
	221	:PROPERTIES:
	222	:CUSTOM_ID: ble.sh
	223	:END:
	224	One big feature I was missing in Bash that both =zsh= and =fish= have is
	225	an autosuggestion feature. To explain: as you type, an autosuggestion
	226	feature in the shell will offer suggestions in a lighter font color
	227	beyond the characters already typed. Once you see the command you want,
	228	you can click the right arrow and have the shell auto-complete that line
	229	for you.
	230
	231	Luckily, the [[https://github.com/akinomyoga/ble.sh][Bash Line Editor]]
	232	(ble.sh) exists! This program provides a wonderful autosuggestions
	233	feature perfectly, among other features that I haven't tested yet.
215	234
216	235	In order to install ble.sh, execute the following:
217	236
218		```sh
	237	#+begin_src sh
219	238	git clone --recursive https://github.com/akinomyoga/ble.sh.git
220	239	make -C ble.sh install PREFIX=~/.local
221	240	echo 'source ~/.local/share/blesh/ble.sh' >> ~/.bashrc
222		```
223
224		Again, exit the terminal and open a new one in order to see the newly-configured
225		shell.
	241	#+end_src
226	242
227		## Restart the Session
	243	Again, exit the terminal and open a new one in order to see the
	244	newly-configured shell.
228	245
229		Finally, as mentioned above, you'll need to restart the session to ensure that
230		your user is using bash by default.
	246	** Restart the Session
	247	:PROPERTIES:
	248	:CUSTOM_ID: restart-the-session
	249	:END:
	250	Finally, as mentioned above, you'll need to restart the session to
	251	ensure that your user is using bash by default.
231	252
232		You will also need to exit and re-open a shell (e.g., terminal or terminal tab)
233		any time you make changes to the `.bashrc` file.
	253	You will also need to exit and re-open a shell (e.g., terminal or
	254	terminal tab) any time you make changes to the =.bashrc= file.
234	255
235		```sh
	256	#+begin_src sh
236	257	sudo reboot now
237		```
	258	#+end_src

blog/2022-08-31-privacy.com-changes.org +103 −85

		@@ -1,92 +1,110 @@
1		+++
2		date = 2022-08-31
3		title = "Concerning Changes on Privacy.com"
4		description = "A quick description of the recent changes of Privacy.com toward a credit card model."
5		+++
6
7		## Privacy.com Changes Their Terms
8
9		Recently, Privacy.com reached out to their customers regarding a change in their
10		terms of use. Further, all customers are required to agree to the changes in
11		order to continue using their accounts.
12
13		[You can view the new cardholder agreement
14		here](https://privacy.com/commercial-cardholder-agreement).
15
16		When you log in, you'll be greeted with a pop-up window asking you to review
17		and agree to the new terms of use.
18		You will also not be able to open any new cards until the terms are agreed to.
19
20		### Changing from a "Prepaid Debit" Model to a "Charge Card" Model
21
22		The actual content of the changes is interesting. While the historical model of
23		using Privacy.com was akin to prepaid debit cards, the new model is very similar
24		to a credit card (they use the term "charge card").
25
26		I have used Privacy.com for 1-2 years, and the process was always that you
27		would create a single-use or merchant-locked card.
28		This card could be used for any dollar limit you set and would immediately
29		draw the funds from whatever funding source you connected, e.g. PayPal
30		account or a bank account.
31
32		The benefit this service provides with a premium account is masking the merchant
33		names from your funding source. If you have a concern that your bank account
34		uses merchant data from your account, you could direct all charges through
35		Privacy.com and set the merchant as one of their pre-set options, such as
36		"Smiley's Corner Store" or "NSA Gift Shop."
37
38		The new model still works with a bank account as a funding source, but the model
39		is changed so that you get a "line of credit" set according to a 14-day billing
40		cycle. It seems that Privacy.com will now allow charges to be incurred without
41		being immediately paid.
42
43		### Daily Payments and Available Credit
44
45		Instead of paying as charges are incurred, you must make a "Daily Payment" and
46		your "Available Credit" will be locked until you make that payment. There are
47		also "End of Billing Cycle Payments" that are assigned a due date.
48
49		Further, Privacy.com will decline charges that would cause you to exceed your
50		Available Credit or Credit Limit.
	1	#+title: Concerning Changes on Privacy.com
	2	#+date: 2022-08-31
	3
	4	** Privacy.com Changes Their Terms
	5	:PROPERTIES:
	6	:CUSTOM_ID: privacy.com-changes-their-terms
	7	:END:
	8	Recently, Privacy.com reached out to their customers regarding a change
	9	in their terms of use. Further, all customers are required to agree to
	10	the changes in order to continue using their accounts.
	11
	12	[[https://privacy.com/commercial-cardholder-agreement][You can view the
	13	new cardholder agreement here]].
	14
	15	When you log in, you'll be greeted with a pop-up window asking you to
	16	review and agree to the new terms of use. You will also not be able to
	17	open any new cards until the terms are agreed to.
	18
	19	*** Changing from a "Prepaid Debit" Model to a "Charge Card" Model
	20	:PROPERTIES:
	21	:CUSTOM_ID: changing-from-a-prepaid-debit-model-to-a-charge-card-model
	22	:END:
	23	The actual content of the changes is interesting. While the historical
	24	model of using Privacy.com was akin to prepaid debit cards, the new
	25	model is very similar to a credit card (they use the term "charge
	26	card").
	27
	28	I have used Privacy.com for 1-2 years, and the process was always that
	29	you would create a single-use or merchant-locked card. This card could
	30	be used for any dollar limit you set and would immediately draw the
	31	funds from whatever funding source you connected, e.g. PayPal account or
	32	a bank account.
	33
	34	The benefit this service provides with a premium account is masking the
	35	merchant names from your funding source. If you have a concern that your
	36	bank account uses merchant data from your account, you could direct all
	37	charges through Privacy.com and set the merchant as one of their pre-set
	38	options, such as "Smiley's Corner Store" or "NSA Gift Shop."
	39
	40	The new model still works with a bank account as a funding source, but
	41	the model is changed so that you get a "line of credit" set according to
	42	a 14-day billing cycle. It seems that Privacy.com will now allow charges
	43	to be incurred without being immediately paid.
	44
	45	*** Daily Payments and Available Credit
	46	:PROPERTIES:
	47	:CUSTOM_ID: daily-payments-and-available-credit
	48	:END:
	49	Instead of paying as charges are incurred, you must make a "Daily
	50	Payment" and your "Available Credit" will be locked until you make that
	51	payment. There are also "End of Billing Cycle Payments" that are
	52	assigned a due date.
	53
	54	Further, Privacy.com will decline charges that would cause you to exceed
	55	your Available Credit or Credit Limit.
51	56
52	57	One particular interesting section states the following:
53	58
54		> YOUR OBLIGATION TO PAY US BACK FOR ALL CARD TRANSACTIONS AND OTHER OBLIGATIONS
55		> YOU INCUR IS SECURED BY THE SECURED ACCOUNT. IF YOU DO NOT PAY US BACK FOR ANY
56		> AMOUNT YOU OWE US WHEN YOUR PAYMENTS ARE DUE, WE WILL EXERCISE OUR INTEREST
57		> AND DEBIT THE SECURED ACCOUNT, AND YOU WILL LOSE THE MONEY IN THE SECURED
58		> ACCOUNT. SEE SECTION 8: SECURITY AGREEMENT FOR MORE INFORMATION.
59
60		### Personal Information
61
62		Now that Privacy.com is more of a financial institution, they are obligated to
63		comply with the [know your
64		customer](https://en.wikipedia.org/wiki/Know_your_customer) guidelines/laws.
65
66		I did not proceed with the change to my Privacy.com account, but I have heard
67		from some peers that the changes require more personal information to be
68		submitted, such as SSN. I am not aware of all new personal information required
69		or if the funding source is now required to only be a bank account.
70
71		### Fees
72
73		Luckily, the fees section did not change much. The subscription fees for a
74		premium account are still the only fees.
75
76		## My Thoughts
77
78		Personally, I wiped my personal information from my account and then permanently
79		deleted it when I heard about these changes. I have no interest in yet another
80		method of credit lending offered by private companies. While I accepted that
81		they would have access to my bank account information for the purposes of paying
82		off my prepaid debit payments, I have no interest in incurring charges that will
83		need to be paid back at a later date. I also have no interest in submitting
	59	#+begin_quote
	60	YOUR OBLIGATION TO PAY US BACK FOR ALL CARD TRANSACTIONS AND OTHER
	61	OBLIGATIONS YOU INCUR IS SECURED BY THE SECURED ACCOUNT. IF YOU DO NOT
	62	PAY US BACK FOR ANY AMOUNT YOU OWE US WHEN YOUR PAYMENTS ARE DUE, WE
	63	WILL EXERCISE OUR INTEREST AND DEBIT THE SECURED ACCOUNT, AND YOU WILL
	64	LOSE THE MONEY IN THE SECURED ACCOUNT. SEE SECTION 8: SECURITY AGREEMENT
	65	FOR MORE INFORMATION.
	66
	67	#+end_quote
	68
	69	*** Personal Information
	70	:PROPERTIES:
	71	:CUSTOM_ID: personal-information
	72	:END:
	73	Now that Privacy.com is more of a financial institution, they are
	74	obligated to comply with the
	75	[[https://en.wikipedia.org/wiki/Know_your_customer][know your customer]]
	76	guidelines/laws.
	77
	78	I did not proceed with the change to my Privacy.com account, but I have
	79	heard from some peers that the changes require more personal information
	80	to be submitted, such as SSN. I am not aware of all new personal
	81	information required or if the funding source is now required to only be
	82	a bank account.
	83
	84	*** Fees
	85	:PROPERTIES:
	86	:CUSTOM_ID: fees
	87	:END:
	88	Luckily, the fees section did not change much. The subscription fees for
	89	a premium account are still the only fees.
	90
	91	** My Thoughts
	92	:PROPERTIES:
	93	:CUSTOM_ID: my-thoughts
	94	:END:
	95	Personally, I wiped my personal information from my account and then
	96	permanently deleted it when I heard about these changes. I have no
	97	interest in yet another method of credit lending offered by private
	98	companies. While I accepted that they would have access to my bank
	99	account information for the purposes of paying off my prepaid debit
	100	payments, I have no interest in incurring charges that will need to be
	101	paid back at a later date. I also have no interest in submitting
84	102	personal information to Privacy.com.
85	103
86		This type of change toward a "buy it now, pay us later" model is concerning,
87		and I will be watching Privacy.com to see if they further their interests in
88		the credit model as time goes on.
	104	This type of change toward a "buy it now, pay us later" model is
	105	concerning, and I will be watching Privacy.com to see if they further
	106	their interests in the credit model as time goes on.
89	107
90		Could we see them start charging interest, fees, etc.? I'm not sure, but
91		this change does not inspire confidence in their mission as a
	108	Could we see them start charging interest, fees, etc.? I'm not sure, but
	109	this change does not inspire confidence in their mission as a
92	110	privacy-focused company.

blog/2022-09-17-serenity-os.org +96 −81

		@@ -1,113 +1,128 @@
1		+++
2		date = 2022-09-17
3		title = "Serenity OS: Testing Out a Unique System"
4		description = "Walking through my exploration of Serenity OS, a unique 90s-esque system."
5		+++
	1	#+title: Serenity OS: Testing Out a Unique System
	2	#+date: 2022-09-17
6	3
7		## Overview
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	[[https://serenityos.org][SerenityOS]] is a unique operating system (OS)
	9	that I have seen pop up in my news feed a few times over the last few
	10	years, but I have never had time to test it out until now.
8	11
9		[SerenityOS](https://serenityos.org) is a unique operating system (OS) that I
10		have seen pop up in my news feed a few times over the last few years, but I have
11		never had time to test it out until now.
12
13		Testing out this system brought back fond memories of yellowed,
14		modem-screeching, 100-pound computers that brought so many fond memories to my
15		youth.
	12	Testing out this system brought back fond memories of yellowed,
	13	modem-screeching, 100-pound computers that brought so many fond memories
	14	to my youth.
16	15
17	16	Per their website:
18	17
19		> A graphical Unix-like operating system for desktop computers!
20		>
21		> SerenityOS is a love letter to '90s user interfaces with a custom Unix-like
22		> core.
23		> It flatters with sincerity by stealing beautiful ideas from various
24		> other systems.
25		>
26		> Roughly speaking, the goal is a marriage between the aesthetic of late-1990s
27		> productivity software and the power-user accessibility of late-2000s *nix.
28		>
29		> This is a system by us, for us, based on the things we like.
30
31		## Building
32
33		Your first question may be "Where's the iso?" and the answer is... there are
34		none. SerenityOS does not provide pre-built images for testing. You must build
35		the images yourself. This seems intentionally to limit participation to only
36		those who are truly interested enough to learn how to build the OS.
	18	#+begin_quote
	19	A graphical Unix-like operating system for desktop computers!
37	20
38		### Clone
39
40		In order to get started, you'll need to clone the source repository:
	21	SerenityOS is a love letter to '90s user interfaces with a custom
	22	Unix-like core. It flatters with sincerity by stealing beautiful ideas
	23	from various other systems.
41	24
42		```sh
43		git clone https://github.com/SerenityOS/serenity && cd serenity
44		```
	25	Roughly speaking, the goal is a marriage between the aesthetic of
	26	late-1990s productivity software and the power-user accessibility of
	27	late-2000s *nix.
45	28
46		### Build
	29	This is a system by us, for us, based on the things we like.
47	30
48		Note that I followed the [Build
49		Instructions](https://github.com/SerenityOS/serenity/blob/master/Documentation/BuildInstructions.md)
50		in the SerenityOS repository as of commit
51		`660d2b53b1206e868d5470eee80b5e62d7e30da7`.
52		Things may have changed since my installation, and you should double-check
53		the instructions first.
	31	#+end_quote
54	32
55		Regardless, I want to repeat my steps here to illustrate any errors or differing
56		commands I needed to run in order to build and run SerenityOS.
	33	** Building
	34	:PROPERTIES:
	35	:CUSTOM_ID: building
	36	:END:
	37	Your first question may be "Where's the iso?" and the answer is... there
	38	are none. SerenityOS does not provide pre-built images for testing. You
	39	must build the images yourself. This seems intentionally to limit
	40	participation to only those who are truly interested enough to learn how
	41	to build the OS.
57	42
58		Since I am running Fedora, I needed to install these packages in order to build
59		the OS images:
	43	*** Clone
	44	:PROPERTIES:
	45	:CUSTOM_ID: clone
	46	:END:
	47	In order to get started, you'll need to clone the source repository:
60	48
61		```sh
	49	#+begin_src sh
	50	git clone https://github.com/SerenityOS/serenity && cd serenity
	51	#+end_src
	52
	53	*** Build
	54	:PROPERTIES:
	55	:CUSTOM_ID: build
	56	:END:
	57	Note that I followed the
	58	[[https://github.com/SerenityOS/serenity/blob/master/Documentation/BuildInstructions.md][Build
	59	Instructions]] in the SerenityOS repository as of commit
	60	=660d2b53b1206e868d5470eee80b5e62d7e30da7=. Things may have changed
	61	since my installation, and you should double-check the instructions
	62	first.
	63
	64	Regardless, I want to repeat my steps here to illustrate any errors or
	65	differing commands I needed to run in order to build and run SerenityOS.
	66
	67	Since I am running Fedora, I needed to install these packages in order
	68	to build the OS images:
	69
	70	#+begin_src sh
62	71	sudo dnf install texinfo binutils-devel curl cmake mpfr-devel libmpc-devel gmp-devel e2fsprogs ninja-build patch ccache rsync @"C Development Tools and Libraries" @Virtualization
63		```
	72	#+end_src
64	73
65		Next, make sure you're inside the `serenity` directory created earlier
	74	Next, make sure you're inside the =serenity= directory created earlier
66	75	during the git cloning process and process to build the toolchain:
67	76
68		```sh
	77	#+begin_src sh
69	78	Meta/serenity.sh rebuild-toolchain
70		```
	79	#+end_src
71	80
72	81	Once the toolchain is built, you can Build and run the OS!
73	82
74		```sh
	83	#+begin_src sh
75	84	Meta/serenity.sh run
76		```
77
78		After this process is completed, the image should run automatically and launch.
79
80		## Issues
	85	#+end_src
81	86
82		I played around in SerenityOS for an hour or two in order to see what I could do
83		and had a lot of fun with it. The only issue I ran into was a lack of working
84		internet. I didn't try very hard, but I could tell that the main network link
85		wasn't connecting to my Fedora host properly.
	87	After this process is completed, the image should run automatically and
	88	launch.
86	89
87		## Screenshots
	90	** Issues
	91	:PROPERTIES:
	92	:CUSTOM_ID: issues
	93	:END:
	94	I played around in SerenityOS for an hour or two in order to see what I
	95	could do and had a lot of fun with it. The only issue I ran into was a
	96	lack of working internet. I didn't try very hard, but I could tell that
	97	the main network link wasn't connecting to my Fedora host properly.
88	98
89		The initial launch of the image displays the SerenityOS desktop, with a simple
90		terminal already launched:
	99	** Screenshots
	100	:PROPERTIES:
	101	:CUSTOM_ID: screenshots
	102	:END:
	103	The initial launch of the image displays the SerenityOS desktop, with a
	104	simple terminal already launched:
91	105
92		![](https://img.cleberg.net/blog/20220917-serenityos/initial_launch.png)
	106	[[https://img.cleberg.net/blog/20220917-serenityos/initial_launch.png]]
93	107
94		Here you can see the Fire application (literally just shows fire burning), a
95		browser with the local Serenity Browser page loaded, and a text editor.
	108	Here you can see the Fire application (literally just shows fire
	109	burning), a browser with the local Serenity Browser page loaded, and a
	110	text editor.
96	111
97		![](https://img.cleberg.net/blog/20220917-serenityos/basic_apps.png)
	112	[[https://img.cleberg.net/blog/20220917-serenityos/basic_apps.png]]
98	113
99		I also poked around the system utilities and found most tools you'd expect to
100		find within a standard desktop.
	114	I also poked around the system utilities and found most tools you'd
	115	expect to find within a standard desktop.
101	116
102		![](https://img.cleberg.net/blog/20220917-serenityos/system_monitor.png)
	117	[[https://img.cleberg.net/blog/20220917-serenityos/system_monitor.png]]
103	118
104		Lastly, I noted that the default desktop contains numerous pre-defined themes to
105		choose from. This is a small piece, but it's actually wonderful to see desktop
106		developers consider theming directly out of the box rather than using an
107		addon-based mentality.
	119	Lastly, I noted that the default desktop contains numerous pre-defined
	120	themes to choose from. This is a small piece, but it's actually
	121	wonderful to see desktop developers consider theming directly out of the
	122	box rather than using an addon-based mentality.
108	123
109		![](https://img.cleberg.net/blog/20220917-serenityos/themes.png)
	124	[[https://img.cleberg.net/blog/20220917-serenityos/themes.png]]
110	125
111		I didn't take a screenshot of the other pre-installed games, but I did spend
112		nearly 30 minutes playing Solitaire before remembering that I was supposed to be
113		writing a post about the OS.
	126	I didn't take a screenshot of the other pre-installed games, but I did
	127	spend nearly 30 minutes playing Solitaire before remembering that I was
	128	supposed to be writing a post about the OS.

blog/2022-09-21-graphene-os.org +142 −116

		@@ -1,160 +1,186 @@
1		+++
2		date = 2022-09-21
3		title = "Installing Graphene OS on the Pixel 6 Pro"
4		description = "A walkthrough tutorial on how to install GrapheneOS on the Pixel 6 Pro with Fedora Linux."
5		+++
6
7		## Introduction
8
9		After using iOS for a couple of years, I finally took the plunge and
	1	#+title: Installing Graphene OS on the Pixel 6 Pro
	2	#+date: 2022-09-21
	3
	4	** Introduction
	5	:PROPERTIES:
	6	:CUSTOM_ID: introduction
	7	:END:
	8	After using iOS for a couple of years, I finally took the plunge and
10	9	purchased a Pixel 6 Pro in order to test and use [GrapheneOS]
11	10	(https://grapheneos.org).
12	11
13		The installation process was rather quick once you have the tools and files you
14		need. Overall, it can be done in just a few minutes.
15
16		## Gathering Tools & Files
17
18		### Android Tools
19
20		First, in order to interact with the device, we will need the [Android
21		platform
22		tools](https://developer.android.com/studio/releases/platform-tools.html). Find
23		the Linux download and save the ZIP folder to your preferred location.
24
25		Once we've downloaded the files, we will need to unzip them, enter the
26		directory, and move the necessary executables to a central location, such as
27		`/usr/bin/`. For this installation, we only need the `fastboot` and `adb`
28		executables.
29
30		```sh
	12	The installation process was rather quick once you have the tools and
	13	files you need. Overall, it can be done in just a few minutes.
	14
	15	** Gathering Tools & Files
	16	:PROPERTIES:
	17	:CUSTOM_ID: gathering-tools-files
	18	:END:
	19	*** Android Tools
	20	:PROPERTIES:
	21	:CUSTOM_ID: android-tools
	22	:END:
	23	First, in order to interact with the device, we will need the
	24	[[https://developer.android.com/studio/releases/platform-tools.html][Android
	25	platform tools]]. Find the Linux download and save the ZIP folder to
	26	your preferred location.
	27
	28	Once we've downloaded the files, we will need to unzip them, enter the
	29	directory, and move the necessary executables to a central location,
	30	such as =/usr/bin/=. For this installation, we only need the =fastboot=
	31	and =adb= executables.
	32
	33	#+begin_src sh
31	34	cd ~/Downloads
32		```
	35	#+end_src
33	36
34		```sh
	37	#+begin_src sh
35	38	unzip platform-tools_r33.0.3-linux.zip
36	39	cd platform-tools
37	40	sudo mv fastboot /usr/bin/
38	41	sudo mv adb /usr/bin
39		```
40
41		### GrapheneOS Files
	42	#+end_src
42	43
43		Next, we need the [GrapheneOS files](https://grapheneos.org/releases) for
44		our device and model. For example, the Pixel 6 Pro is codenamed `raven` on the
45		release page.
	44	*** GrapheneOS Files
	45	:PROPERTIES:
	46	:CUSTOM_ID: grapheneos-files
	47	:END:
	48	Next, we need the [[https://grapheneos.org/releases][GrapheneOS files]]
	49	for our device and model. For example, the Pixel 6 Pro is codenamed
	50	=raven= on the release page.
46	51
47	52	Once we have the links, let's download them to our working directory:
48	53
49		```sh
	54	#+begin_src sh
50	55	curl -O https://releases.grapheneos.org/factory.pub
51	56	curl -0 https://releases.grapheneos.org/raven-factory-2022091400.zip
52	57	curl -0 https://releases.grapheneos.org/raven-factory-2022091400.zip.sig
53		```
54
55		#### Validate Integrity
	58	#+end_src
56	59
57		In order to validate the integrity of the downloaded files, we will need the
58		`signify` package and Graphene's `factory.pub` file.
	60	**** Validate Integrity
	61	:PROPERTIES:
	62	:CUSTOM_ID: validate-integrity
	63	:END:
	64	In order to validate the integrity of the downloaded files, we will need
	65	the =signify= package and Graphene's =factory.pub= file.
59	66
60		```sh
	67	#+begin_src sh
61	68	sudo dnf install signify
62		```
	69	#+end_src
63	70
64		```sh
	71	#+begin_src sh
65	72	curl -O https://releases.grapheneos.org/factory.pub
66		```
	73	#+end_src
67	74
68		Then we can validate the files and ensure that no data was corrupted or
	75	Then we can validate the files and ensure that no data was corrupted or
69	76	modified before it was saved to our device.
70	77
71		```sh
	78	#+begin_src sh
72	79	signify -Cqp factory.pub -x raven-factory-2022091400.zip.sig && echo verified
73		```
	80	#+end_src
74	81
75		#### Unzip Files
	82	**** Unzip Files
	83	:PROPERTIES:
	84	:CUSTOM_ID: unzip-files
	85	:END:
	86	Once the files are verified, we can unzip the Graphene image and enter
	87	the directory:
76	88
77		Once the files are verified, we can unzip the Graphene image and enter the
78		directory:
79
80		```sh
	89	#+begin_src sh
81	90	unzip raven-factory-2022091400.zip && cd raven-factory-2022091400
82		```
83
84		## Installation Process
85
86		### Enable Developer Debugging & OEM Unlock
87
88		Before we can actually flash anything to the phone, we will need to enable
89		OEM Unlocking, as well as either USB Debugging or Wireless Debugging, depending on
90		which method we will be using.
91
92		To start, enable developer mode by going to `Settings` > `About` and tapping
93		`Build Number` seven (7) times. You may need to enter your PIN to enable this
94		mode.
95
96		Once developer mode is enabled, go to `Settings` > `System` > `Devloper
97		Options` and enable OEM Unlocking, as well as USB or Wireless Debugging. In my
98		case, I chose USB Debugging and performed all actions via USB cable.
99
100		Once these options are enabled, plug the phone into the computer and execute the
101		following command:
102
103		```sh
	91	#+end_src
	92
	93	** Installation Process
	94	:PROPERTIES:
	95	:CUSTOM_ID: installation-process
	96	:END:
	97	*** Enable Developer Debugging & OEM Unlock
	98	:PROPERTIES:
	99	:CUSTOM_ID: enable-developer-debugging-oem-unlock
	100	:END:
	101	Before we can actually flash anything to the phone, we will need to
	102	enable OEM Unlocking, as well as either USB Debugging or Wireless
	103	Debugging, depending on which method we will be using.
	104
	105	To start, enable developer mode by going to =Settings= > =About= and
	106	tapping =Build Number= seven (7) times. You may need to enter your PIN
	107	to enable this mode.
	108
	109	Once developer mode is enabled, go to =Settings= > =System= >
	110	=Devloper Options= and enable OEM Unlocking, as well as USB or Wireless
	111	Debugging. In my case, I chose USB Debugging and performed all actions
	112	via USB cable.
	113
	114	Once these options are enabled, plug the phone into the computer and
	115	execute the following command:
	116
	117	#+begin_src sh
104	118	adb devices
105		```
106
107		If an unauthorized error occurs, make sure the USB mode on the phone is
108		changed from charging to something like "File Transfer" or "PTP."
109		You can find the USB mode in the notification tray.
	119	#+end_src
110	120
111		### Reboot Device
	121	If an unauthorized error occurs, make sure the USB mode on the phone is
	122	changed from charging to something like "File Transfer" or "PTP." You
	123	can find the USB mode in the notification tray.
112	124
113		Once we have found the device via `adb`, we can either boot into the
114		bootloader interface by holding the volume down button while the phone reboots
115		or by executing the following command:
	125	*** Reboot Device
	126	:PROPERTIES:
	127	:CUSTOM_ID: reboot-device
	128	:END:
	129	Once we have found the device via =adb=, we can either boot into the
	130	bootloader interface by holding the volume down button while the phone
	131	reboots or by executing the following command:
116	132
117		```sh
	133	#+begin_src sh
118	134	adb reboot bootloader
119		```
	135	#+end_src
120	136
121		### Unlock the Bootloader
	137	*** Unlock the Bootloader
	138	:PROPERTIES:
	139	:CUSTOM_ID: unlock-the-bootloader
	140	:END:
	141	The phone will reboot and load the bootloader screen upon startup. At
	142	this point, we are ready to start the actual flashing of GrapheneOS onto
	143	the device.
122	144
123		The phone will reboot and load the bootloader screen upon startup. At this
124		point, we are ready to start the actual flashing of GrapheneOS onto the device.
	145	NOTE: In my situation, I needed to use =sudo= with every =fastboot=
	146	command, but not with =adb= commands. I am not sure if this is standard
	147	or a Fedora quirk, but I'm documenting my commands verbatim in this
	148	post.
125	149
126		NOTE: In my situation, I needed to use `sudo` with every `fastboot`
127		command, but not with `adb` commands. I am not sure if this is standard or a
128		Fedora quirk, but I'm documenting my commands verbatim in this post.
	150	First, we start by unlocking the bootloader so that we can load other
	151	ROMs:
129	152
130		First, we start by unlocking the bootloader so that we can load other ROMs:
131
132		```sh
	153	#+begin_src sh
133	154	sudo fastboot flashing unlock
134		```
135
136		### Flashing Factory Images
	155	#+end_src
137	156
138		Once the phone is unlocked, we can flash it with the `flash-all.sh` script found
139		inside the `raven-factory-2022091400` folder we entered earlier:
	157	*** Flashing Factory Images
	158	:PROPERTIES:
	159	:CUSTOM_ID: flashing-factory-images
	160	:END:
	161	Once the phone is unlocked, we can flash it with the =flash-all.sh=
	162	script found inside the =raven-factory-2022091400= folder we entered
	163	earlier:
140	164
141		```sh
	165	#+begin_src sh
142	166	sudo ./flash-all.sh
143		```
144
145		This process should take a few minutes and will print informational messages as
146		things progress. Avoid doing anything on the phone while this process is
147		operating.
148
149		### Lock the Bootloader
150
151		If everything was successful, the phone should reboot a few times and finally
152		land back on the bootloader screen. At this point, we can re-lock the
153		bootloader to enable full verified boot and protect the device from unwanted
154		flashing or erasure of data.
155
156		```sh
	167	#+end_src
	168
	169	This process should take a few minutes and will print informational
	170	messages as things progress. Avoid doing anything on the phone while
	171	this process is operating.
	172
	173	*** Lock the Bootloader
	174	:PROPERTIES:
	175	:CUSTOM_ID: lock-the-bootloader
	176	:END:
	177	If everything was successful, the phone should reboot a few times and
	178	finally land back on the bootloader screen. At this point, we can
	179	re-lock the bootloader to enable full verified boot and protect the
	180	device from unwanted flashing or erasure of data.
	181
	182	#+begin_src sh
157	183	sudo fastboot flashing lock
158		```
	184	#+end_src
159	185
160	186	Once done, the device will be wiped and ready for a fresh set-up!

blog/2022-10-04-mtp-linux.org +61 −55

		@@ -1,79 +1,85 @@
1		+++
2		date = 2022-10-04
3		title = "How to Mount an MTP Mobile Device on Linux"
4		description = "Learn how to easily mount Android MTP smartphones on Linux using the command line."
5		+++
6
7		I recently ran into trouble attempting to mount my GrapheneOS phone to my laptop
8		running Fedora Linux via the [Media Transfer
9		Protocol](https://en.wikipedia.org/wiki/Media_transfer_protocol) (MTP) and
10		discovered a simple and effective solution.
11
12		## Use a USB 3.0 Port
13
14		First, ensure that the device was plugged in to the laptop through a
15		USB 3.0 port, if possible. From a brief glance online, it seems that USB 2.0
16		ports may cause issues with dropped connections over MTP. This is purely
17		anecdotal since I don't have any evidence to link showing that USB 2.0 causes
18		issues, but I can confirm that switching to a USB 3.0 port seemed to cut out
19		most
20		of my issues.
21
22		## Switch USB Preferences to MTP
23
24		Secondly, you need to ensure that the phone's USB preferences/mode is
25		changed to MTP or File Transfer once the phone is plugged in. Other modes will
26		not allow you to access the phone's file system.
27
28		## Install `jmtpfs`
29
30		Next, I used the `jmtpfs` package to mount my phone to my laptop. There are
31		other packages that exist, but this one worked perfectly for me. On Fedora
32		Linux, you can install it like this:
33
34		```sh
	1	#+title: How to Mount an MTP Mobile Device on Linux
	2	#+date: 2022-10-04
	3
	4	I recently ran into trouble attempting to mount my GrapheneOS phone to my laptop
	5	running Fedora Linux via the [[https://en.wikipedia.org/wiki/Media_transfer_protocol][Media Transfer Protocol]] (MTP) and discovered a
	6	simple and effective solution.
	7
	8	** Use a USB 3.0 Port
	9	:PROPERTIES:
	10	:CUSTOM_ID: use-a-usb-3.0-port
	11	:END:
	12	First, ensure that the device was plugged in to the laptop through a USB
	13	3.0 port, if possible. From a brief glance online, it seems that USB 2.0
	14	ports may cause issues with dropped connections over MTP. This is purely
	15	anecdotal since I don't have any evidence to link showing that USB 2.0
	16	causes issues, but I can confirm that switching to a USB 3.0 port seemed
	17	to cut out most of my issues.
	18
	19	** Switch USB Preferences to MTP
	20	:PROPERTIES:
	21	:CUSTOM_ID: switch-usb-preferences-to-mtp
	22	:END:
	23	Secondly, you need to ensure that the phone's USB preferences/mode is
	24	changed to MTP or File Transfer once the phone is plugged in. Other
	25	modes will not allow you to access the phone's file system.
	26
	27	** Install =jmtpfs=
	28	:PROPERTIES:
	29	:CUSTOM_ID: install-jmtpfs
	30	:END:
	31	Next, I used the =jmtpfs= package to mount my phone to my laptop. There
	32	are other packages that exist, but this one worked perfectly for me. On
	33	Fedora Linux, you can install it like this:
	34
	35	#+begin_src sh
35	36	sudo dnf install jmtpfs -y
36		```
	37	#+end_src
37	38
38		## Create a Mount Point
	39	** Create a Mount Point
	40	:PROPERTIES:
	41	:CUSTOM_ID: create-a-mount-point
	42	:END:
	43	Once you have the package installed, you just need to create a folder
	44	for the device to use as a mount point. In my case, I used =/mnt/pixel=:
39	45
40		Once you have the package installed, you just need to create a folder for the
41		device to use as a mount point. In my case, I used `/mnt/pixel`:
42
43		```sh
	46	#+begin_src sh
44	47	sudo mkdir /mnt/pixel
45	48	sudo chown -R $USER:$USER /mnt/pixel
46		```
47
48		## Mount & Access the Phone's File System
	49	#+end_src
49	50
50		Finally, plug-in and mount the device, and you should be able to see all
	51	** Mount & Access the Phone's File System
	52	:PROPERTIES:
	53	:CUSTOM_ID: mount-access-the-phones-file-system
	54	:END:
	55	Finally, plug-in and mount the device, and you should be able to see all
51	56	storage (internal and external) inside your new folder!
52	57
53		```sh
	58	#+begin_src sh
54	59	jmtpfs /mnt/pixel
55		```
	60	#+end_src
56	61
57	62	The output should look something like this:
58	63
59		```sh
	64	#+begin_src sh
60	65	Device 0 (VID=18d1 and PID=4ee1) is a Google Inc Nexus/Pixel (MTP).
61	66	Android device detected, assigning default bug flags
62		```
	67	#+end_src
63	68
64		Now you are mounted and can do anything you'd like with the device's files:
	69	Now you are mounted and can do anything you'd like with the device's
	70	files:
65	71
66		```sh
	72	#+begin_src sh
67	73	cd /mnt/pixel
68	74	ls -lha
69		```
	75	#+end_src
70	76
71		From here, you will be able to see any internal or external storage available on
72		the device:
	77	From here, you will be able to see any internal or external storage
	78	available on the device:
73	79
74		```sh
	80	#+begin_src sh
75	81	total 0
76	82	drwxr-xr-x. 3 user user 0 Jan 1 1970 .
77	83	drwxr-xr-x. 1 root root 10 Oct 4 13:29 ..
78	84	drwxr-xr-x. 16 user user 0 Apr 21 4426383 'Internal shared storage'
79		```
	85	#+end_src

blog/2022-10-20-syncthing.org +176 −144

		@@ -1,166 +1,198 @@
1		+++
2		date = 2022-10-20
3		title = "Syncthing: A Minimal Self-Hosted Cloud Storage Solution"
4		description = "In this post, I walk through the Syncthing software and how to set it up on multiple devices."
5		+++
6
7		## An Overview of Syncthing
8
9		If you've been looking around the self-hosted cloud storage space for a while,
10		you've undoubtedly run into someone suggesting
11		[Syncthing](https://syncthing.net) as an option. However, it is an unusual
12		alternative for those users out there who are used to having a centralized cloud
13		server that serves as the "controller" of the data and interacts with clients on
14		devices to fetch files.
15
16		This post is a walkthrough of the Syncthing software, how I set up my personal
17		storage, and some pros and cons of using the software.
18
19		## Installing Syncthing
20
21		To install Syncthing, visit the [Downloads](https://syncthing.net/downloads/)
22		page or install via your device's package manager.
23
24		### Server & Desktop
25
26		You can install Syncthing on servers and desktops via the Downloads page linked
27		above or via the command-line.
	1	#+title: Syncthing: A Minimal Self-Hosted Cloud Storage Solution
	2	#+date: 2022-10-20
	3
	4	** An Overview of Syncthing
	5	:PROPERTIES:
	6	:CUSTOM_ID: an-overview-of-syncthing
	7	:END:
	8	If you've been looking around the self-hosted cloud storage space for a
	9	while, you've undoubtedly run into someone suggesting
	10	[[https://syncthing.net][Syncthing]] as an option. However, it is an
	11	unusual alternative for those users out there who are used to having a
	12	centralized cloud server that serves as the "controller" of the data and
	13	interacts with clients on devices to fetch files.
	14
	15	This post is a walkthrough of the Syncthing software, how I set up my
	16	personal storage, and some pros and cons of using the software.
	17
	18	** Installing Syncthing
	19	:PROPERTIES:
	20	:CUSTOM_ID: installing-syncthing
	21	:END:
	22	To install Syncthing, visit the
	23	[[https://syncthing.net/downloads/][Downloads]] page or install via your
	24	device's package manager.
	25
	26	*** Server & Desktop
	27	:PROPERTIES:
	28	:CUSTOM_ID: server-desktop
	29	:END:
	30	You can install Syncthing on servers and desktops via the Downloads page
	31	linked above or via the command-line.
28	32
29	33	For Debian-based distros:
30	34
31		```sh
	35	#+begin_src sh
32	36	sudo apt install syncthing
33		```
	37	#+end_src
34	38
35	39	For Fedora-based distros:
36	40
37		```sh
	41	#+begin_src sh
38	42	sudo dnf install syncthing
39		```
40
41		### Mobile
42
43		Syncthing for Android is available on
44		[F-Droid](https://f-droid.org/packages/com.nutomic.syncthingandroid/) and
45		[Google Play](https://play.google.com/store/apps/details?id=com.nutomic.syncthingandroid).
46		Syncthing does not have an official iOS client, but there is a third-party
47		client called [Möbius
48		Sync](https://apps.apple.com/us/app/m%C3%B6bius-sync/id1539203216).
49
50		## How Does Syncthing Work?
51
52		To start, I wanted to include the main marketing blurb from their website:
53
54		> Syncthing is a continuous file synchronization program. It synchronizes files
55		> between two or more computers in real time, safely protected from prying eyes.
56		> Your data is your data alone, and you deserve to choose where it is stored,
57		> whether it is shared with some third party, and how it's transmitted over the
58		> internet.
59
60		Let's break this apart and add in some other details to help explain what
61		exactly Syncthing does in order to sync files between devices.
62
63		### Local Syncthing Server(s)
64
65		Syncthing syncs files between multiple devices by creating a local server on
66		each device. These local servers handle a few different things, such as
67		watching files and directories for changes, hosting an administrative GUI
68		website, and authenticating with connected devices.
69
70		You can also start, stop, and restart the Syncthing server via the command-line
71		or web dashboard. If you're running Syncthing on a device with `systemd`, you
72		can use the following commands:
73
74		```sh
	43	#+end_src
	44
	45	*** Mobile
	46	:PROPERTIES:
	47	:CUSTOM_ID: mobile
	48	:END:
	49	Syncthing for Android is available on
	50	[[https://f-droid.org/packages/com.nutomic.syncthingandroid/][F-Droid]]
	51	and
	52	[[https://play.google.com/store/apps/details?id=com.nutomic.syncthingandroid][Google
	53	Play]]. Syncthing does not have an official iOS client, but there is a
	54	third-party client called
	55	[[https://apps.apple.com/us/app/m%C3%B6bius-sync/id1539203216][Möbius
	56	Sync]].
	57
	58	** How Does Syncthing Work?
	59	:PROPERTIES:
	60	:CUSTOM_ID: how-does-syncthing-work
	61	:END:
	62	To start, I wanted to include the main marketing blurb from their
	63	website:
	64
	65	#+begin_quote
	66	Syncthing is a continuous file synchronization program. It synchronizes
	67	files between two or more computers in real time, safely protected from
	68	prying eyes. Your data is your data alone, and you deserve to choose
	69	where it is stored, whether it is shared with some third party, and how
	70	it's transmitted over the internet.
	71
	72	#+end_quote
	73
	74	Let's break this apart and add in some other details to help explain
	75	what exactly Syncthing does in order to sync files between devices.
	76
	77	*** Local Syncthing Server(s)
	78	:PROPERTIES:
	79	:CUSTOM_ID: local-syncthing-servers
	80	:END:
	81	Syncthing syncs files between multiple devices by creating a local
	82	server on each device. These local servers handle a few different
	83	things, such as watching files and directories for changes, hosting an
	84	administrative GUI website, and authenticating with connected devices.
	85
	86	You can also start, stop, and restart the Syncthing server via the
	87	command-line or web dashboard. If you're running Syncthing on a device
	88	with =systemd=, you can use the following commands:
	89
	90	#+begin_src sh
75	91	sudo systemctl start syncthing@username.service
76	92	sudo systemctl restart syncthing@username.service
77	93	sudo systemctl stop syncthing@username.service
78		```
79
80		### Syncthing Dashboard
81
82		This biggest part of Syncthing is the admin GUI website that runs on each
83		device (note that mobile devices will use the Syncthing app rather than the
84		web GUI). The admin GUI is available through the web browser on the
85		local device that is running Syncthing - simply go to `http://localhost:8384`
86		or `http://127.0.0.1:8384`. This web page is the place where you will change
87		settings, add/modify synced files, and add/modify connected devices.
	94	#+end_src
	95
	96	*** Syncthing Dashboard
	97	:PROPERTIES:
	98	:CUSTOM_ID: syncthing-dashboard
	99	:END:
	100	This biggest part of Syncthing is the admin GUI website that runs on
	101	each device (note that mobile devices will use the Syncthing app rather
	102	than the web GUI). The admin GUI is available through the web browser on
	103	the local device that is running Syncthing - simply go to
	104	=http://localhost:8384= or =http://127.0.0.1:8384=. This web page is the
	105	place where you will change settings, add/modify synced files, and
	106	add/modify connected devices.
88	107
89	108	Here's an example web GUI dashboard:
90	109
91		![Syncthing Dashboard](https://img.cleberg.net/blog/20221020-syncthing/syncthing_gui.png "Syncthing Dashboard")
92
93		### Remote Devices
94
95		A cloud storage solution wouldn't be very useful if you aren't able to share
96		data among various devices. Syncthing does this by sharing Device IDs to connect
97		servers, and then by manually sharing Folders with devices that have been
98		connected.
99
100		For instance, if you have a laptop running Syncthing and then install the
101		Syncthing mobile app on a phone, you could scan the laptop's QR code for Device
102		ID and then accept the authentication on the laptop's dashboard. Next, you can
103		use either device to select a folder for sharing and dictating which device
104		should send, receive, or both.
105
106		When you connect devices, you can set one device as an "Introducer," which can
107		add devices from the introducer to the device list, for mutually shared folders.
108		You can also configure Auto Accept, compression, rate limits, and more settings
109		per device.
110
111		## My Personal Cloud Storage Set-up
112
113		Personally, I use a model similar to a traditional cloud storage service. I have
114		a "centralized" server running 24/7 that acts as an Introducer for my Syncthing
115		network. I think of this as my main storage and all other devices as tertiary
116		client devices. I will likely add additional servers as backups as time goes on
117		so that I don't have to rely on my laptop or phone as the only backups.
118
119		Currently, I have one desktop and one mobile device connected to the network,
120		both running intermittently as they are not powered-on 24/7.
121
122		The initial set-up of the software was easy enough, but data transfer rates were
123		incredibly slow for me due to the Wi-Fi. Instead, I plugged my laptop into the
124		ethernet network that my server is on and manually copied my folders over to the
125		server with `scp`. Once complete, Syncthing validated that all files were there
126		and not missing, and it did not need to transfer any data through the WAN.
127
128		As slow as the transfer was going, this probably saved me a few days of waiting
129		for my ~100GB sync.
130
131		## Pros & Cons
132
133		I've put together a short list of pros and cons for Syncthing. I thought about
134		my experiences with Nextcloud, WebDAV, proprietary services (Google Drive,
135		iCloud, etc.), and privacy-focused cloud solutions (pCloud, Tresorit, etc.).
136
137		Pros:
	110	#+caption: Syncthing Dashboard
	111	[[https://img.cleberg.net/blog/20221020-syncthing/syncthing_gui.png]]
	112
	113	*** Remote Devices
	114	:PROPERTIES:
	115	:CUSTOM_ID: remote-devices
	116	:END:
	117	A cloud storage solution wouldn't be very useful if you aren't able to
	118	share data among various devices. Syncthing does this by sharing Device
	119	IDs to connect servers, and then by manually sharing Folders with
	120	devices that have been connected.
	121
	122	For instance, if you have a laptop running Syncthing and then install
	123	the Syncthing mobile app on a phone, you could scan the laptop's QR code
	124	for Device ID and then accept the authentication on the laptop's
	125	dashboard. Next, you can use either device to select a folder for
	126	sharing and dictating which device should send, receive, or both.
	127
	128	When you connect devices, you can set one device as an "Introducer,"
	129	which can add devices from the introducer to the device list, for
	130	mutually shared folders. You can also configure Auto Accept,
	131	compression, rate limits, and more settings per device.
	132
	133	** My Personal Cloud Storage Set-up
	134	:PROPERTIES:
	135	:CUSTOM_ID: my-personal-cloud-storage-set-up
	136	:END:
	137	Personally, I use a model similar to a traditional cloud storage
	138	service. I have a "centralized" server running 24/7 that acts as an
	139	Introducer for my Syncthing network. I think of this as my main storage
	140	and all other devices as tertiary client devices. I will likely add
	141	additional servers as backups as time goes on so that I don't have to
	142	rely on my laptop or phone as the only backups.
	143
	144	Currently, I have one desktop and one mobile device connected to the
	145	network, both running intermittently as they are not powered-on 24/7.
	146
	147	The initial set-up of the software was easy enough, but data transfer
	148	rates were incredibly slow for me due to the Wi-Fi. Instead, I plugged
	149	my laptop into the ethernet network that my server is on and manually
	150	copied my folders over to the server with =scp=. Once complete,
	151	Syncthing validated that all files were there and not missing, and it
	152	did not need to transfer any data through the WAN.
	153
	154	As slow as the transfer was going, this probably saved me a few days of
	155	waiting for my ~100GB sync.
	156
	157	** Pros & Cons
	158	:PROPERTIES:
	159	:CUSTOM_ID: pros-cons
	160	:END:
	161	I've put together a short list of pros and cons for Syncthing. I thought
	162	about my experiences with Nextcloud, WebDAV, proprietary services
	163	(Google Drive, iCloud, etc.), and privacy-focused cloud solutions
	164	(pCloud, Tresorit, etc.).
	165
	166	Pros:
138	167
139	168	- I've faced no data loss at all through my two-month trial run.
140	169	- No third-parties store your data on their servers.
141		- You have full control over your data and can take your data and leave at any
142		time.
143		- It's possible to encrypt client-side easily with software like Cryptomator.
144		- No proprietary clients or mounted volumes, just plain files and folders.
	170	- You have full control over your data and can take your data and leave
	171	at any time.
	172	- It's possible to encrypt client-side easily with software like
	173	Cryptomator.
	174	- No proprietary clients or mounted volumes, just plain files and
	175	folders.
145	176
146		Cons:
	177	Cons:
147	178
148		- The learning curve is steeper than traditional cloud services and is
	179	- The learning curve is steeper than traditional cloud services and is
149	180	focused on a technical audience.
150		- If a device needs to modify files in a Folder, the devices will need to
151		sync ALL files from the folder, which may be large. To avoid size
	181	- If a device needs to modify files in a Folder, the devices will need
	182	to sync ALL files from the folder, which may be large. To avoid size
152	183	restraints, split large folders into smaller folders for syncing.
153		- Syncing can be slow due to the clients/servers initially connecting or
	184	- Syncing can be slow due to the clients/servers initially connecting or
154	185	re-connecting after sleeping.
155		- Multiple personal devices are required and require the user to own or rent
156		them as no third-party servers are involved in the storage of data.
157
158		Overall, I've had a great experience with Syncthing so far. I've had no data
159		loss, syncing has been quick and easy when changes are made to files, device
160		connections are reliable, and I love the freedom of controlling the clients and
161		servers as I choose.
162
163		Not to mention that I appreciate that I - or someone else - could pull the
164		Syncthing [source code](https://github.com/syncthing) and continue
165		development/support if the Syncthing Foundation decides to stop developing the
166		software or sells the business.
	186	- Multiple personal devices are required and require the user to own or
	187	rent them as no third-party servers are involved in the storage of
	188	data.
	189
	190	Overall, I've had a great experience with Syncthing so far. I've had no
	191	data loss, syncing has been quick and easy when changes are made to
	192	files, device connections are reliable, and I love the freedom of
	193	controlling the clients and servers as I choose.
	194
	195	Not to mention that I appreciate that I - or someone else - could pull
	196	the Syncthing [[https://github.com/syncthing][source code]] and continue
	197	development/support if the Syncthing Foundation decides to stop
	198	developing the software or sells the business.

blog/2022-10-22-alpine-linux.org +223 −186

		@@ -1,264 +1,301 @@
1		+++
2		date = 2022-10-22
3		title = "Alpine Linux: My New Server OS"
4		description = "In this post, I explain Alpine Linux's benefits as a server OS and explain my current setup."
5		+++
6
7		## Alpine Linux
8
9		[Alpine Linux](https://alpinelinux.org) is a very small distro, built on musl
10		libc and busybox. It uses ash as the default shell, OpenRC as the init
11		system, and apk as the package manager. According to their website, an Alpine
12		container "requires no more than 8 MB and a minimal installation to disk
13		requires around 130 MB of storage." An actual bare metal machine is recommended
14		to have 100 MB of RAM and 0-700 MB of storage space.
15
16		Historically, I've used Ubuntu's minimal installation image as my server OS for
17		the last five years. Ubuntu worked well and helped as my original server
18		contained an nVidia GPU and no onboard graphics, so quite a few distros won't
19		boot or install without a lot of tinkering.
20
21		Alpine has given me a huge increase in performance across my Docker apps and
22		Nginx websites. CPU load for the new server I'm using to test Alpine hovers
23		around 0-5% on average with an Intel(R) Core(TM) i3-6100 CPU @ 3.70GHz.
24
25		The only services I haven't moved over to Alpine are Plex Media Server and
26		Syncthing, which may increase CPU load quite a bit depending on how many
27		streams are running.
28
29		### Installation
30
31		In terms of installation, Alpine has an incredibly useful
32		[wiki](https://wiki.alpinelinux.org/wiki/Installation) that will guide a user
33		throughout the installation and post-installation processes, as well as various
34		other articles and guides.
35
36		To install Alpine, find an appropriate [image to
37		download](https://alpinelinux.org/downloads/) and flash it to a USB using
38		software such as Rufus or Etcher. I opted to use the Standard image for my
39		x86_64 architecture.
40
41		Once the USB is ready, plug it into the machine and reboot.
42		Note that you may have to use a key such as `Esc` or `F1-12` to access the
43		boot menu.
44		The Alpine Linux terminal will load quickly and for a login.
45
46		To log in to the installation image, use the `root` account; there is no
	1	#+title: Alpine Linux: My New Server OS
	2	#+date: 2022-10-22
	3
	4	** Alpine Linux
	5	:PROPERTIES:
	6	:CUSTOM_ID: alpine-linux
	7	:END:
	8	[[https://alpinelinux.org][Alpine Linux]] is a very small distro, built
	9	on musl libc and busybox. It uses ash as the default shell, OpenRC as
	10	the init system, and apk as the package manager. According to their
	11	website, an Alpine container "requires no more than 8 MB and a minimal
	12	installation to disk requires around 130 MB of storage." An actual bare
	13	metal machine is recommended to have 100 MB of RAM and 0-700 MB of
	14	storage space.
	15
	16	Historically, I've used Ubuntu's minimal installation image as my server
	17	OS for the last five years. Ubuntu worked well and helped as my original
	18	server contained an nVidia GPU and no onboard graphics, so quite a few
	19	distros won't boot or install without a lot of tinkering.
	20
	21	Alpine has given me a huge increase in performance across my Docker apps
	22	and Nginx websites. CPU load for the new server I'm using to test Alpine
	23	hovers around 0-5% on average with an Intel(R) Core(TM) i3-6100 CPU @
	24	3.70GHz.
	25
	26	The only services I haven't moved over to Alpine are Plex Media Server
	27	and Syncthing, which may increase CPU load quite a bit depending on how
	28	many streams are running.
	29
	30	*** Installation
	31	:PROPERTIES:
	32	:CUSTOM_ID: installation
	33	:END:
	34	In terms of installation, Alpine has an incredibly useful
	35	[[https://wiki.alpinelinux.org/wiki/Installation][wiki]] that will guide
	36	a user throughout the installation and post-installation processes, as
	37	well as various other articles and guides.
	38
	39	To install Alpine, find an appropriate
	40	[[https://alpinelinux.org/downloads/][image to download]] and flash it
	41	to a USB using software such as Rufus or Etcher. I opted to use the
	42	Standard image for my x86_64 architecture.
	43
	44	Once the USB is ready, plug it into the machine and reboot. Note that
	45	you may have to use a key such as =Esc= or =F1-12= to access the boot
	46	menu. The Alpine Linux terminal will load quickly and for a login.
	47
	48	To log in to the installation image, use the =root= account; there is no
47	49	password. Once logged-in, execute the setup command:
48	50
49		```sh
	51	#+begin_src sh
50	52	setup-alpine
51		```
	53	#+end_src
52	54
53		The setup script will ask a series of questions to configure the system. Be sure
54		to answer carefully or else you may have to re-configure the system after boot.
	55	The setup script will ask a series of questions to configure the system.
	56	Be sure to answer carefully or else you may have to re-configure the
	57	system after boot.
55	58
56		- Keyboard Layout (Local keyboard language and usage mode, e.g., us and variant
57		of us-nodeadkeys.)
	59	- Keyboard Layout (Local keyboard language and usage mode, e.g., us and
	60	variant of us-nodeadkeys.)
58	61	- Hostname (The name for the computer.)
59		- Network (For example, automatic IP address discovery with the "DHCP"
60		protocol.)
61		- DNS Servers (Domain Name Servers to query. For privacy reasons, it is NOT
62		recommended to route every local request to servers like Google's 8.8.8.8 .)
	62	- Network (For example, automatic IP address discovery with the "DHCP"
	63	protocol.)
	64	- DNS Servers (Domain Name Servers to query. For privacy reasons, it is
	65	NOT recommended to route every local request to servers like Google's
	66	8.8.8.8 .)
63	67	- Timezone
64		- Proxy (Proxy server to use for accessing the web. Use "none" for direct
65		connections to the internet.)
66		- Mirror (From where to download packages. Choose the organization you trust
67		giving your usage patterns to.)
68		- SSH (Secure SHell remote access server. "Openssh" is part of the default
69		install image. Use "none" to disable remote login, e.g. on laptops.)
70		- NTP (Network Time Protocol client used for keeping the system clock in sync
71		with a time-server. Package "chrony" is part of the default install image.)
72		- Disk Mode (Select between diskless (disk="none"), "data" or "sys", as
73		described above.)
74
75		Once the setup script is finished, be sure to reboot the machine and remove the
76		USB device.
77
78		```sh
	68	- Proxy (Proxy server to use for accessing the web. Use "none" for
	69	direct connections to the internet.)
	70	- Mirror (From where to download packages. Choose the organization you
	71	trust giving your usage patterns to.)
	72	- SSH (Secure SHell remote access server. "Openssh" is part of the
	73	default install image. Use "none" to disable remote login, e.g. on
	74	laptops.)
	75	- NTP (Network Time Protocol client used for keeping the system clock in
	76	sync with a time-server. Package "chrony" is part of the default
	77	install image.)
	78	- Disk Mode (Select between diskless (disk="none"), "data" or "sys", as
	79	described above.)
	80
	81	Once the setup script is finished, be sure to reboot the machine and
	82	remove the USB device.
	83
	84	#+begin_src sh
79	85	reboot
80		```
81
82		### Post-Installation
83
84		There are many things you can do once your Alpine Linux system is up and
85		running, and it largely depends on what you'll use the machine for.
86		I'm going to walk through my personal post-installation setup for my web server.
87
88		#### Upgrade the System
89
90		First, login as `root` in order to update and upgrade the system:
91
92		```sh
	86	#+end_src
	87
	88	*** Post-Installation
	89	:PROPERTIES:
	90	:CUSTOM_ID: post-installation
	91	:END:
	92	There are many things you can do once your Alpine Linux system is up and
	93	running, and it largely depends on what you'll use the machine for. I'm
	94	going to walk through my personal post-installation setup for my web
	95	server.
	96
	97	**** Upgrade the System
	98	:PROPERTIES:
	99	:CUSTOM_ID: upgrade-the-system
	100	:END:
	101	First, login as =root= in order to update and upgrade the system:
	102
	103	#+begin_src sh
93	104	apk -U upgrade
94		```
95
96		#### Adding a User
	105	#+end_src
97	106
98		I needed to add a user so that I don't need to log in as root.
99		Note that if you're used to using the `sudo` command, you will now need to
100		use the `doas` command on Alpine Linux.
	107	**** Adding a User
	108	:PROPERTIES:
	109	:CUSTOM_ID: adding-a-user
	110	:END:
	111	I needed to add a user so that I don't need to log in as root. Note that
	112	if you're used to using the =sudo= command, you will now need to use the
	113	=doas= command on Alpine Linux.
101	114
102		```sh
	115	#+begin_src sh
103	116	apk add doas
104	117	adduser <username>
105	118	adduser <username> wheel
106		```
	119	#+end_src
107	120
108	121	You can now log out and log back in using the newly-created user:
109	122
110		```sh
	123	#+begin_src sh
111	124	exit
112		```
	125	#+end_src
113	126
114		#### Enable Community Packages
	127	**** Enable Community Packages
	128	:PROPERTIES:
	129	:CUSTOM_ID: enable-community-packages
	130	:END:
	131	In order to install more common packages that aren't found in the =main=
	132	repository, you will need to enable the =community= repository:
115	133
116		In order to install more common packages that aren't found in the `main`
117		repository, you will need to enable the `community` repository:
118
119		```sh
	134	#+begin_src sh
120	135	doas nano /etc/apk/repositories
121		```
	136	#+end_src
122	137
123		Uncomment the community line for whichever version of Alpine you're running:
	138	Uncomment the community line for whichever version of Alpine you're
	139	running:
124	140
125		```sh
	141	#+begin_src sh
126	142	/media/usb/apks
127	143	http://dl-cdn.alpinelinux.org/alpine/v3.16/main
128	144	http://dl-cdn.alpinelinux.org/alpine/v3.16/community
129	145	#http://dl-cdn.alpinelinux.org/alpine/edge/main
130	146	#http://dl-cdn.alpinelinux.org/alpine/edge/community
131	147	#http://dl-cdn.alpinelinux.org/alpine/edge/testing
132		```
133
134		#### Install Required Packages
	148	#+end_src
135	149
136		Now that the community packages are available, you can install any packages you
137		need. In my case, I installed the web server packages I need for my services:
	150	**** Install Required Packages
	151	:PROPERTIES:
	152	:CUSTOM_ID: install-required-packages
	153	:END:
	154	Now that the community packages are available, you can install any
	155	packages you need. In my case, I installed the web server packages I
	156	need for my services:
138	157
139		```sh
	158	#+begin_src sh
140	159	doas apk add nano nginx docker docker-compose ufw
141		```
142
143		#### SSH
	160	#+end_src
144	161
145		If you didn't install OpenSSH as part of the installation, you can do so now:
	162	**** SSH
	163	:PROPERTIES:
	164	:CUSTOM_ID: ssh
	165	:END:
	166	If you didn't install OpenSSH as part of the installation, you can do so
	167	now:
146	168
147		```sh
	169	#+begin_src sh
148	170	doas apk add openssh
149		```
	171	#+end_src
150	172
151		Next, either create a new key or copy your SSH key to the server from your
152		current machines:
	173	Next, either create a new key or copy your SSH key to the server from
	174	your current machines:
153	175
154		```sh
	176	#+begin_src sh
155	177	# Create a new key
156	178	ssh-keygen
157		```
	179	#+end_src
158	180
159	181	If you need to copy an existing SSH key from a current machine:
160	182
161		```sh
	183	#+begin_src sh
162	184	# Copy key from existing machines
163	185	ssh-copy-id <username>@<ip_address>
164		```
	186	#+end_src
165	187
166		#### Firewall
	188	**** Firewall
	189	:PROPERTIES:
	190	:CUSTOM_ID: firewall
	191	:END:
	192	Lastly, I installed =ufw= above as my firewall. To set up, default to
	193	deny incoming and allow outgoing connections. Then selectively allow
	194	other ports or apps as needed.
167	195
168		Lastly, I installed `ufw` above as my firewall.
169		To set up, default to deny incoming and allow outgoing connections.
170		Then selectively allow other ports or apps as needed.
171
172		```sh
	196	#+begin_src sh
173	197	doas ufw default deny incoming
174	198	doas ufw default allow outgoing
175	199	doas ufw allow SSH
176	200	doas ufw allow "WWW Full"
177	201	doas ufw allow 9418 # Git server port
178		```
179
180		#### Change Hostname
	202	#+end_src
181	203
182		If you don't like the hostname set during installation, you just need to edit
183		two files. First, edit the simple hostname file:
	204	**** Change Hostname
	205	:PROPERTIES:
	206	:CUSTOM_ID: change-hostname
	207	:END:
	208	If you don't like the hostname set during installation, you just need to
	209	edit two files. First, edit the simple hostname file:
184	210
185		```sh
	211	#+begin_src sh
186	212	doas nano /etc/hostname
187		```
	213	#+end_src
188	214
189		```sh
	215	#+begin_src sh
190	216	<hostname>
191		```
	217	#+end_src
192	218
193		Next, edit the `hosts` file:
	219	Next, edit the =hosts= file:
194	220
195		```sh
	221	#+begin_src sh
196	222	doas nano /etc/hosts
197		```
198
199		```sh
200		127.0.0.1 <hostname>.local <hostname> localhost.local localhost
201		::1 <hostname> <hostname>.local
202		```
203
204		## Nginx Web Server
205
206		To set up my web server, I simply created the `www` user and created the
	223	#+end_src
	224
	225	#+begin_src sh
	226	127.0.0.1 <hostname>.local <hostname> localhost.local localhost
	227	::1 <hostname> <hostname>.local
	228	#+end_src
	229
	230	** Nginx Web Server
	231	:PROPERTIES:
	232	:CUSTOM_ID: nginx-web-server
	233	:END:
	234	To set up my web server, I simply created the =www= user and created the
207	235	necessary files.
208	236
209		```sh
	237	#+begin_src sh
210	238	doas adduser -D -g 'www' www
211	239	mkdir /www
212	240	doas mkdir /www
213	241	doas chown -R www:www /var/lib/nginx/
214	242	doas chown -R www:www /www
215		```
	243	#+end_src
216	244
217		If you're running a simple webroot, you can alter the main `nginx.conf` file.
218		Otherwise, you can drop configuration files in the following directory. You
219		don't need to enable or symlink the configuration file like you do in other
220		systems.
	245	If you're running a simple webroot, you can alter the main =nginx.conf=
	246	file. Otherwise, you can drop configuration files in the following
	247	directory. You don't need to enable or symlink the configuration file
	248	like you do in other systems.
221	249
222		```sh
	250	#+begin_src sh
223	251	doas nano /etc/nginx/http.d/example_website.conf
224		```
	252	#+end_src
225	253
226		Once the configuration is set and pointed at the `/www` directory to serve
227		files, enable the Nginx service:
	254	Once the configuration is set and pointed at the =/www= directory to
	255	serve files, enable the Nginx service:
228	256
229		```sh
	257	#+begin_src sh
230	258	# Note that 'default' must be included or Nginx will not start on boot
231	259	doas rc-update add nginx default
232		```
233
234		## Docker Containers
235
236		Docker works exactly the same as other systems. Either execute a `docker run`
237		command or create a `docker-compose.yml` file and do `docker-compose up -d`.
238
239		## Git Server
240
241		I went in-depth on how to self-host a git server in another post:
242		[Self-Hosting a Personal Git Server](/blog/git-server/).
243
244		However, there are a few differences with Alpine. First note that in order to
245		change the `git` user's shell, you must do a few things a little different:
246
247		```sh
	260	#+end_src
	261
	262	** Docker Containers
	263	:PROPERTIES:
	264	:CUSTOM_ID: docker-containers
	265	:END:
	266	Docker works exactly the same as other systems. Either execute a
	267	=docker run= command or create a =docker-compose.yml= file and do
	268	=docker-compose up -d=.
	269
	270	** Git Server
	271	:PROPERTIES:
	272	:CUSTOM_ID: git-server
	273	:END:
	274	I went in-depth on how to self-host a git server in another post:
	275	[[/blog/git-server/][Self-Hosting a Personal Git Server]].
	276
	277	However, there are a few differences with Alpine. First note that in
	278	order to change the =git= user's shell, you must do a few things a
	279	little different:
	280
	281	#+begin_src sh
248	282	doas apk add libuser
249	283	doas touch /etc/login.defs
250	284	doas mkdir /etc/default
251	285	doas touch /etc/default/useradd
252	286	doas lchsh git
253		```
254
255		## Thoughts on Alpine
256
257		So far, I love Alpine Linux. I have no complaints about anything at this point,
258		but I'm not completely finished with the migration yet. Once I'm able to upgrade
259		my hardware to a rack-mounted server, I will migrate Plex and Syncthing over to
260		Alpine as well - possibly putting Plex into a container or VM.
261
262		The performance is stellar, the `apk` package manager is seamless, and system
263		administration tasks are effortless. My only regret is that I didn't
264		install Alpine sooner.
	287	#+end_src
	288
	289	** Thoughts on Alpine
	290	:PROPERTIES:
	291	:CUSTOM_ID: thoughts-on-alpine
	292	:END:
	293	So far, I love Alpine Linux. I have no complaints about anything at this
	294	point, but I'm not completely finished with the migration yet. Once I'm
	295	able to upgrade my hardware to a rack-mounted server, I will migrate
	296	Plex and Syncthing over to Alpine as well - possibly putting Plex into a
	297	container or VM.
	298
	299	The performance is stellar, the =apk= package manager is seamless, and
	300	system administration tasks are effortless. My only regret is that I
	301	didn't install Alpine sooner.

blog/2022-10-30-linux-display-manager.org +65 −58

		@@ -1,78 +1,85 @@
1		+++
2		date = 2022-10-30
3		title = "How to Disable or Change the Display Manager on Void Linux"
4		description = "Learn how to change the default dm on Void Linux or disable it completely."
5		+++
6
7		## Display Manager Services
8
9		In order to change the [display
10		manager](https://en.wikipedia.org/wiki/Display_manager) on Void Linux - or any
11		other Linux distro - you need to identify the currently enabled display manager.
12
13		### Disabling the Current Display Manager
14
15		Void Linux only has one ISO available for download with a pre-built display
16		manager at the time of this post: the XFCE ISO. If you've installed this
17		version, the pre-assigned display manager is `lxdm`. If you installed another
18		display manager, replace `lxdm` in the following command with the display
19		manager you have installed.
20
21		To disable `lxdm`, simply remove the service symlink:
22
23		```sh
	1	#+title: How to Disable or Change the Display Manager on Void Linux
	2	#+date: 2022-10-30
	3
	4	** Display Manager Services
	5	:PROPERTIES:
	6	:CUSTOM_ID: display-manager-services
	7	:END:
	8	In order to change the
	9	[[https://en.wikipedia.org/wiki/Display_manager][display manager]] on
	10	Void Linux - or any other Linux distro - you need to identify the
	11	currently enabled display manager.
	12
	13	*** Disabling the Current Display Manager
	14	:PROPERTIES:
	15	:CUSTOM_ID: disabling-the-current-display-manager
	16	:END:
	17	Void Linux only has one ISO available for download with a pre-built
	18	display manager at the time of this post: the XFCE ISO. If you've
	19	installed this version, the pre-assigned display manager is =lxdm=. If
	20	you installed another display manager, replace =lxdm= in the following
	21	command with the display manager you have installed.
	22
	23	To disable =lxdm=, simply remove the service symlink:
	24
	25	#+begin_src sh
24	26	sudo rm /var/service/lxdm
25		```
26
27		### Enabling a New Display Manager
28
29		If you want to enable a new display manager, you can do so after `lxdm` is
30		disabled. Make sure to replace `<new_display_manager>` with your new DM, such as
31		`gdm`, `xdm`, etc.
	27	#+end_src
32	28
	29	*** Enabling a New Display Manager
	30	:PROPERTIES:
	31	:CUSTOM_ID: enabling-a-new-display-manager
	32	:END:
	33	If you want to enable a new display manager, you can do so after =lxdm=
	34	is disabled. Make sure to replace =<new_display_manager>= with your new
	35	DM, such as =gdm=, =xdm=, etc.
33	36
34		```sh
	37	#+begin_src sh
35	38	sudo ln -s /etc/sv/<new_display_manager> /var/service
36		```
	39	#+end_src
37	40
38		## Set Up `.xinitrc`
	41	** Set Up =.xinitrc=
	42	:PROPERTIES:
	43	:CUSTOM_ID: set-up-.xinitrc
	44	:END:
	45	Depending on your setup, you may need to create a few X files, such as
	46	=~/.xinitrc=. For my personal set-up, I created this file to launch the
	47	i3wm as my desktop.
39	48
40		Depending on your setup, you may need to create a few X files, such as
41		`~/.xinitrc`. For my personal set-up, I created this file to launch the i3wm as
42		my desktop.
43
44		```sh
	49	#+begin_src sh
45	50	nano ~/.xinitrc
46		```
	51	#+end_src
47	52
48		```sh
	53	#+begin_src sh
49	54	#!/bin/sh
50	55
51	56	exec i3
52		```
53
54		If you run a desktop other than i3, simply replace `i3` with the shell command
55		that launches that desktop.
	57	#+end_src
56	58
57		## Set Up Your Shell Profile
	59	If you run a desktop other than i3, simply replace =i3= with the shell
	60	command that launches that desktop.
58	61
59		Finally, in order to automatically launch an X session upon login, you will need
60		to edit the `.bash_profile` (bash) or `.zprofile` (zsh) files for your
61		shell:
	62	** Set Up Your Shell Profile
	63	:PROPERTIES:
	64	:CUSTOM_ID: set-up-your-shell-profile
	65	:END:
	66	Finally, in order to automatically launch an X session upon login, you
	67	will need to edit the =.bash_profile= (bash) or =.zprofile= (zsh) files
	68	for your shell:
62	69
63		```sh
	70	#+begin_src sh
64	71	nano ~/.zprofile
65		```
	72	#+end_src
66	73
67		Add the following snippet to the end of the shell profile file. This will
68		execute the `startx` command upon login.
	74	Add the following snippet to the end of the shell profile file. This
	75	will execute the =startx= command upon login.
69	76
70		```sh
	77	#+begin_src sh
71	78	if [ -z "${DISPLAY}" ] && [ "${XDG_VTNR}" -eq 1 ]; then
72		exec startx
	79	exec startx
73	80	fi
74		```
	81	#+end_src
75	82
76		Alternatively, you can ignore this step and simply choose to manually execute
77		`startx` upon login. This can be useful if you have issues with your desktop or
78		like to manually launch different desktops by choice.
	83	Alternatively, you can ignore this step and simply choose to manually
	84	execute =startx= upon login. This can be useful if you have issues with
	85	your desktop or like to manually launch different desktops by choice.

blog/2022-11-07-matrix-synapse.org +124 −107

		@@ -1,103 +1,114 @@
1		+++
2		date = 2022-11-07
3		title = "Self-Hosting Matrix Synapse on Alpine Linux"
4		description = "A short guide on how I was able to get Synapse working on Alpine Linux."
5		+++
6
7		## Synpase
8
9		If you're reading this, you likely know that
10		[Synapse](https://github.com/matrix-org/synapse/) is a popular
11		[Matrix](https://matrix.org/) home server software that allows users to run
12		their own Matrix home server.
13
14		This post is a short guide describing how I was able to get Synapse working in a
15		minimally-usable state on Alpine Linux.
16
17		## Installation Process
18
19		### Dependencies
20
21		First, since there is no Alpine-specific package for Synapse, we need to ensure
22		that Alpine has the required dependencies for the Python-based installation
23		method.
24
25		```sh
	1	#+title: Self-Hosting Matrix Synapse on Alpine Linux
	2	#+date: 2022-11-07
	3
	4	** Synpase
	5	:PROPERTIES:
	6	:CUSTOM_ID: synpase
	7	:END:
	8	If you're reading this, you likely know that
	9	[[https://github.com/matrix-org/synapse/][Synapse]] is a popular
	10	[[https://matrix.org/][Matrix]] home server software that allows users
	11	to run their own Matrix home server.
	12
	13	This post is a short guide describing how I was able to get Synapse
	14	working in a minimally-usable state on Alpine Linux.
	15
	16	** Installation Process
	17	:PROPERTIES:
	18	:CUSTOM_ID: installation-process
	19	:END:
	20	*** Dependencies
	21	:PROPERTIES:
	22	:CUSTOM_ID: dependencies
	23	:END:
	24	First, since there is no Alpine-specific package for Synapse, we need to
	25	ensure that Alpine has the required dependencies for the Python-based
	26	installation method.
	27
	28	#+begin_src sh
26	29	doas apk -U update
27	30	doas apk add python3 py3-virtualenv
28		```
	31	#+end_src
29	32
30	33	Next, we need to set up a Python virtual environment for Synapse:
31	34
32		```sh
	35	#+begin_src sh
33	36	mkdir -p ~/synapse && cd ~/synapse
34	37	virtualenv -p python3 ~/synapse/env
35	38	source ~/synapse/env/bin/activate
36	39	pip install --upgrade pip
37	40	pip install --upgrade setuptools
38	41	pip install matrix-synapse
39		```
40
41		### Running Synapse
42
43		Once installed, running Synapse is easy. Simply execute the following command,
44		replacing `example.com` with the domain name that will be used with this
45		home server. This will generate the configuration files needed to run the
46		server.
47
48		```sh
	42	#+end_src
	43
	44	*** Running Synapse
	45	:PROPERTIES:
	46	:CUSTOM_ID: running-synapse
	47	:END:
	48	Once installed, running Synapse is easy. Simply execute the following
	49	command, replacing =example.com= with the domain name that will be used
	50	with this home server. This will generate the configuration files needed
	51	to run the server.
	52
	53	#+begin_src sh
49	54	python -m synapse.app.homeserver \
50	55	--server-name example.com \
51	56	--config-path homeserver.yaml \
52	57	--generate-config \
53	58	--report-stats=no
54		```
	59	#+end_src
55	60
56	61	Once the configuration is generated, we can start up the Synapse server:
57	62
58		```sh
	63	#+begin_src sh
59	64	synctl start
60		```
	65	#+end_src
61	66
62		### Configuring Synapse
	67	*** Configuring Synapse
	68	:PROPERTIES:
	69	:CUSTOM_ID: configuring-synapse
	70	:END:
	71	To make any change to Synapse, we need to edit the =YAML= configuration
	72	file:
63	73
64		To make any change to Synapse, we need to edit the `YAML` configuration file:
65
66		```sh
	74	#+begin_src sh
67	75	nano ~/synapse/homeserver.yaml
68		```
	76	#+end_src
69	77
70		For now, we just need to ensure the `server_name` is accurate. However, there
71		are a lot of other configuration options found in the [Configuring
72		Synapse](https://matrix-org.github.io/synapse/develop/usage/configuration/config_documentation.html)
73		documentation that can be enabled/disabled at any point.
	78	For now, we just need to ensure the =server_name= is accurate. However,
	79	there are a lot of other configuration options found in the
	80	[[https://matrix-org.github.io/synapse/develop/usage/configuration/config_documentation.html][Configuring
	81	Synapse]] documentation that can be enabled/disabled at any point.
74	82
75		```yaml
	83	#+begin_src yaml
76	84	server_name: "example.com"
77		```
	85	#+end_src
78	86
79	87	Make sure to restart Synapse when you make changes to the configuration:
80	88
81		```sh
	89	#+begin_src sh
82	90	synctl restart
83		```
84
85		### Nginx Reverse-Proxy
	91	#+end_src
86	92
87		To ensure that Synapse is reachable from the public, we need to connect our
88		domain to the Synapse server.
89		In my case, I use a Nginx reverse-proxy for this purpose.
	93	*** Nginx Reverse-Proxy
	94	:PROPERTIES:
	95	:CUSTOM_ID: nginx-reverse-proxy
	96	:END:
	97	To ensure that Synapse is reachable from the public, we need to connect
	98	our domain to the Synapse server. In my case, I use a Nginx
	99	reverse-proxy for this purpose.
90	100
91	101	To use Nginx, we need to create a reverse-proxy configuration file:
92	102
93		```sh
	103	#+begin_src sh
94	104	doas nano /etc/nginx/http.d/example.com.conf
95		```
	105	#+end_src
96	106
97		If you already have TLS certificates for this domain (`example.com`), you can
98		simply use the SSL configuration and point toward your TLS certificates.
	107	If you already have TLS certificates for this domain (=example.com=),
	108	you can simply use the SSL configuration and point toward your TLS
	109	certificates.
99	110
100		```conf
	111	#+begin_src conf
101	112	server {
102	113	listen 443 ssl http2;
103	114	listen [::]:443 ssl http2;
		@@ -128,22 +139,23 @@ server {
128	139	}
129	140
130	141	server {
131		if ($host = example.com) {
132		return 301 https://$host$request_uri;
133		}
	142	if ($host = example.com) {
	143	return 301 https://$host$request_uri;
	144	}
134	145
135	146	server_name example.com;
136	147	listen 80;
137		return 404;
	148	return 404;
138	149	}
139		```
	150	#+end_src
140	151
141		If you need to generate TLS certificates (I recommend
142		[Certbot](https://certbot.eff.org/)), you'll need a more minimal Nginx conf file
143		before you can use the TLS-enabled example above. Instead, use this
144		configuration file during the Certbot certificate generation process:
	152	If you need to generate TLS certificates (I recommend
	153	[[https://certbot.eff.org/][Certbot]]), you'll need a more minimal Nginx
	154	conf file before you can use the TLS-enabled example above. Instead, use
	155	this configuration file during the Certbot certificate generation
	156	process:
145	157
146		```conf
	158	#+begin_src conf
147	159	server {
148	160	server_name example.com;
149	161	location / {
		@@ -151,62 +163,67 @@ server {
151	163	}
152	164	listen 80;
153	165	}
154		```
	166	#+end_src
155	167
156	168	Once you're done editing the Nginx conf file, restart Nginx:
157	169
158		```sh
	170	#+begin_src sh
159	171	doas rc-service nginx restart
160		```
	172	#+end_src
161	173
162		If you still need to generate TLS certificates, run `certbot` now and obtain the
163		certificates. Certbot will ask if you want to use a webroot or spin up a
164		temporary web server. I highly recommend using the temporary web server due
165		to the many issues with using a webroot.
	174	If you still need to generate TLS certificates, run =certbot= now and
	175	obtain the certificates. Certbot will ask if you want to use a webroot
	176	or spin up a temporary web server. I highly recommend using the
	177	temporary web server due to the many issues with using a webroot.
166	178
167		You will need to stop Nginx in order to user the temporary web server option
168		with Certbot:
	179	You will need to stop Nginx in order to user the temporary web server
	180	option with Certbot:
169	181
170		```sh
	182	#+begin_src sh
171	183	# Stop Nginx so certbot can spin up a temp webserver for cert generation
172	184	doas rc-service nginx stop
173	185	doas certbot certonly -v
174	186	doas rc-service nginx start
175		```
176
177		### Open Firewall & Router Ports
178
179		If you use a firewall on the server, open the `8448` port for discovery and
180		federation, as well as the normal web server ports if you're using a reverse
181		proxy. If you want additional services, such as voice calls, you will need
182		to read the Synapse documentation to see which ports need to be opened for those
183		features.
	187	#+end_src
	188
	189	*** Open Firewall & Router Ports
	190	:PROPERTIES:
	191	:CUSTOM_ID: open-firewall-router-ports
	192	:END:
	193	If you use a firewall on the server, open the =8448= port for discovery
	194	and federation, as well as the normal web server ports if you're using a
	195	reverse proxy. If you want additional services, such as voice calls, you
	196	will need to read the Synapse documentation to see which ports need to
	197	be opened for those features.
184	198
185	199	Here's an example of the Universal Firewall (UFW) software:
186	200
187		```sh
	201	#+begin_src sh
188	202	# Matrix port
189	203	doas ufw allow 8448
190	204	# Standard web server ports
191	205	doas ufw allow "Nginx Full"
192		```
193
194		Remember to forward any Synapse ports, such as `8448`, `80`, and `443`, in your
195		Router from the internet to your server's IP address.
	206	#+end_src
196	207
197		### Adding Matrix Users
	208	Remember to forward any Synapse ports, such as =8448=, =80=, and =443=,
	209	in your Router from the internet to your server's IP address.
198	210
199		Finally, if you didn't enable public registration in the `homeserver.yaml` file,
200		you can manually create users via the command-line:
	211	*** Adding Matrix Users
	212	:PROPERTIES:
	213	:CUSTOM_ID: adding-matrix-users
	214	:END:
	215	Finally, if you didn't enable public registration in the
	216	=homeserver.yaml= file, you can manually create users via the
	217	command-line:
201	218
202		```sh
	219	#+begin_src sh
203	220	cd ~/synapse
204	221	register_new_matrix_user -c homeserver.yaml
205		```
	222	#+end_src
206	223
207		Remember that the format for federated Matrix usernames is
208		`@username:example.com` when logging in to client applications.
	224	Remember that the format for federated Matrix usernames is
	225	=@username:example.com= when logging in to client applications.
209	226
210		Once Synapse is running, and you have a username, you are ready to log in to a
211		Matrix client and start sending messages, joining rooms, and utilizing your very
212		own Matrix server.
	227	Once Synapse is running, and you have a username, you are ready to log
	228	in to a Matrix client and start sending messages, joining rooms, and
	229	utilizing your very own Matrix server.

blog/2022-11-11-nginx-tmp-errors.org +41 −38

		@@ -1,58 +1,61 @@
1		+++
2		date = 2022-11-11
3		title = "Fixing Permission Errors in /var/lib/nginx"
4		description = "A quick fix for Nginx permission errors on the tmp directory."
5		+++
	1	#+title: Fixing Permission Errors in /var/lib/nginx" description
	2	#+date: 2022-11-11
6	3
7		*This is a brief post so that I personally remember the solution as it has
8		occurred multiple times for me.*
	4	/This is a brief post so that I personally remember the solution as it
	5	has occurred multiple times for me./
9	6
10		## The Problem
11
12		After migrating to a new server OS, I started receiving quite a few permission
13		errors like the one below. These popped up for various different websites I'm
14		serving via Nginx on this server, but did not prevent the website from loading.
	7	** The Problem
	8	:PROPERTIES:
	9	:CUSTOM_ID: the-problem
	10	:END:
	11	After migrating to a new server OS, I started receiving quite a few
	12	permission errors like the one below. These popped up for various
	13	different websites I'm serving via Nginx on this server, but did not
	14	prevent the website from loading.
15	15
16	16	I found the errors in the standard log file:
17	17
18		```sh
	18	#+begin_src sh
19	19	cat /var/log/nginx/error.log
20		```
	20	#+end_src
21	21
22		```sh
	22	#+begin_src sh
23	23	2022/11/11 11:30:34 [crit] 8970#8970: *10 open() "/var/lib/nginx/tmp/proxy/3/00/0000000003" failed (13: Permission denied) while reading upstream, client: 169.150.203.10, server: cyberchef.example.com, request: "GET /assets/main.css HTTP/2.0", upstream: "http://127.0.0.1:8111/assets/main.css", host: "cyberchef.example.com", referrer: "https://cyberchef.example.com/"
24		```
	24	#+end_src
25	25
26		You can see that the error is `13: Permission denied` and it occurs in the
27		`/var/lib/nginx/tmp/` directory. In my case, I had thousands of errors where
28		Nginx was denied permission to read/write files in this directory.
	26	You can see that the error is =13: Permission denied= and it occurs in
	27	the =/var/lib/nginx/tmp/= directory. In my case, I had thousands of
	28	errors where Nginx was denied permission to read/write files in this
	29	directory.
29	30
30	31	So how do I fix it?
31	32
32		## The Solution
33
34		In order to resolve the issue, I had to ensure the `/var/lib/nginx`
35		directory is owned by Nginx. Mine was owned by the `www` user and Nginx was not
36		able to read or write files within that directory. This prevented Nginx from
37		caching temporary files.
	33	** The Solution
	34	:PROPERTIES:
	35	:CUSTOM_ID: the-solution
	36	:END:
	37	In order to resolve the issue, I had to ensure the =/var/lib/nginx=
	38	directory is owned by Nginx. Mine was owned by the =www= user and Nginx
	39	was not able to read or write files within that directory. This
	40	prevented Nginx from caching temporary files.
38	41
39		```sh
	42	#+begin_src sh
40	43	# Alpine Linux
41	44	doas chown -R nginx:nginx /var/lib/nginx
42	45
43	46	# Other Distros
44	47	sudo chown -R nginx:nginx /var/lib/nginx
45		```
	48	#+end_src
46	49
47		You may also be able to change the `proxy_temp_path` in your Nginx config, but
48		I did not try this. Here's a suggestion I found online that may work if the
49		above solution does not:
	50	You /may/ also be able to change the =proxy_temp_path= in your Nginx
	51	config, but I did not try this. Here's a suggestion I found online that
	52	may work if the above solution does not:
50	53
51		```sh
	54	#+begin_src sh
52	55	nano /etc/nginx/http.d/example.com.conf
53		```
	56	#+end_src
54	57
55		```conf
	58	#+begin_src conf
56	59	server {
57	60	...
58	61
		@@ -62,15 +65,15 @@ server {
62	65
63	66	...
64	67	}
65		```
	68	#+end_src
66	69
67		Finally, restart Nginx and your server should be able to cache temporary files
68		again.
	70	Finally, restart Nginx and your server should be able to cache temporary
	71	files again.
69	72
70		```sh
	73	#+begin_src sh
71	74	# Alpine Linux (OpenRC)
72	75	doas rc-service nginx restart
73	76
74	77	# Other Distros (systemd)
75	78	sudo systemctl restart nginx
76		```
	79	#+end_src

blog/2022-11-27-server-build.org +127 −114

		@@ -1,113 +1,124 @@
1		+++
2		date = 2022-11-27
3		title = "Building a Custom Rack-Mount Server"
4		description = "I finally built my own custom rack-mounted server after years of indecision."
5		+++
6
7		## The Dilemma
8
9		For years, I have been using desktops and a Raspberry Pi as the backbone of my
10		homelab. I have always wanted to move toward a single dedicated server that
11		could handle all of my tasks, but was often put off by the complexity of the
12		choices (and financial roadblocks at some times).
13
14		However, after purchasing a small server rack this past year, I have been
15		researching to see what kind of rack-mounted server I could buy. I initially
16		bought a Dell R720XD loaded up with everything I could ever want in a server -
17		but I did not care for it. It was far too loud, and the age of the CPU/RAM was
18		something I wanted to improve upon.
19
20		After returning the R720XD, I decided that I wanted to build my own server with
21		modern, consumer-grade PC components. This time, I am very happy with the
22		results of my server.
23
24		## Components
25
	1	#+title: Building a Custom Rack-Mount Server
	2	#+date: 2022-11-27
	3
	4	** The Dilemma
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-dilemma
	7	:END:
	8	For years, I have been using desktops and a Raspberry Pi as the backbone
	9	of my homelab. I have always wanted to move toward a single dedicated
	10	server that could handle all of my tasks, but was often put off by the
	11	complexity of the choices (and financial roadblocks at some times).
	12
	13	However, after purchasing a small server rack this past year, I have
	14	been researching to see what kind of rack-mounted server I could buy. I
	15	initially bought a Dell R720XD loaded up with everything I could ever
	16	want in a server - but I did not care for it. It was far too loud, and
	17	the age of the CPU/RAM was something I wanted to improve upon.
	18
	19	After returning the R720XD, I decided that I wanted to build my own
	20	server with modern, consumer-grade PC components. This time, I am very
	21	happy with the results of my server.
	22
	23	** Components
	24	:PROPERTIES:
	25	:CUSTOM_ID: components
	26	:END:
26	27	I'll start by listing all the components I used for this server build:
27	28
28		- Case: [Rosewill RSV-R4100U 4U Server Chassis Rackmount
29		Case](https://www.rosewill.com/rosewill-rsv-r4100u-black/p/9SIA072GJ92825)
30		- Motherboard: [NZXT B550](https://nzxt.com/product/n7-b550)
31		- CPU: AMD Ryzen 7 5700G with Radeon Graphics
32		- GPU: N/A - I specifically chose one of the few AMD CPUs that support
33		onboard graphics.
34		- RAM: 64GB RAM (2x32GB) _Max of 128GB RAM on this motherboard_
35		- Boot Drive: Western Digital 500GB M.2 NVME SSD
36		- HDD Bay:
37		- 10TB WD White _(shucked, moved from previous server)_
38		- 8TB WD White _(shucked, moved from previous server)_
39		- 2 x 8TB WD Red Plus _(Black Friday lined up perfectly with this build, so I
40		grabbed two of these)_
41		- PSU: Corsair RM850 PSU
42		- Extras:
	29	- Case:
	30	[[https://www.rosewill.com/rosewill-rsv-r4100u-black/p/9SIA072GJ92825][Rosewill
	31	RSV-R4100U 4U Server Chassis Rackmount Case]]
	32	- Motherboard: [[https://nzxt.com/product/n7-b550][NZXT B550]]
	33	- CPU: AMD Ryzen 7 5700G with Radeon Graphics
	34	- GPU: N/A - I specifically chose one of the few AMD CPUs that support
	35	onboard graphics.
	36	- RAM: 64GB RAM (2x32GB) /Max of 128GB RAM on this motherboard/
	37	- Boot Drive: Western Digital 500GB M.2 NVME SSD
	38	- HDD Bay:
	39	- 10TB WD White /(shucked, moved from previous server)/
	40	- 8TB WD White /(shucked, moved from previous server)/
	41	- 2 x 8TB WD Red Plus /(Black Friday lined up perfectly with this
	42	build, so I grabbed two of these)/
	43	- PSU: Corsair RM850 PSU
	44	- Extras:
43	45	- Corsair TM3Q Thermal Paste
44		- Noctua 120mm fan _(replacement for front case fan)_
45		- 2 x Noctua 80mm fans _(replacement for rear case fans)_
	46	- Noctua 120mm fan /(replacement for front case fan)/
	47	- 2 x Noctua 80mm fans /(replacement for rear case fans)/
46	48	- CableMatters 6Gbps SATA Cables
47	49
48		## Building the Server
49
50		This took quite a while for me to build (in my opinion of time), totaling
51		around 3 hours from start to finish. The case has some peculiar construction, so
52		you have to completely remove the ODD & HDD cages to install the motherboard and
53		other components first.
54
55		Now, I've never built a computer of any kind before, so I was quite
56		nervous. Personally, the only challenging part was getting the CPU cooler to
57		screw into the motherboard without sliding the thermal paste around too much
58		underneath. I'm still not entirely sure if I did a great job of it, but
59		nothing's broken yet.
60
61		The main components were all fine and simple.
62		However, installing the hard drives is slightly tedious as I need to power
63		off the server and completely unscrew the HDD cage to install or remove any
64		drives.
65		Additionally, the drives are screwed directly into the metal cage with small
66		screws, which are quite a bit different from the HDD trays I'm used to in
67		other machines.
68
69		Seeing that the cases with hot-swap bays were 3-4x the price, I'm okay dealing
70		with the tedium of removing the cage to install new drives.
71
72		## Software
73
74		I'm not going to dive into the software as I have done so in other recent posts.
75		However, I wanted to note that I am using Alpine Linux on this server and
76		hosting most services inside Docker. No virtual machines (VMs) and very few
77		bare-metal services.
78
79		## The Results
80
81		How did my build turn out? Well, after migrating my other servers and their
82		services over, I found that my server is blazing fast. The heaviest of my
83		applications, Plex, is handled with ease. Even 4k streaming seems to be
84		effortless.
85
86		I am very happy with the results and will likely continue to improve on this
87		server as the years go by rather than buying another used server online.
88
89		### Mistakes I Made
90
91		This post wouldn't be complete unless I wrote about the mistakes I made while
92		building. The only real mistake I made beyond a "whoops I dropped a screw"
93		related to airflow and fan direction.
94
95		While installing the two new hard drives that showed up on 2022-11-30 and
96		getting ready to install the case in my rack, I noticed that the hard drive
97		temperatures were quite high.
98
99		I used the `smartctl` command for each of my drives (`/dev/sda` through
100		`/dev/sdd`):
101
102		```sh
	50	** Building the Server
	51	:PROPERTIES:
	52	:CUSTOM_ID: building-the-server
	53	:END:
	54	This took quite a while for me to build (in my opinion of time),
	55	totaling around 3 hours from start to finish. The case has some peculiar
	56	construction, so you have to completely remove the ODD & HDD cages to
	57	install the motherboard and other components first.
	58
	59	Now, I've never built a computer of any kind before, so I was quite
	60	nervous. Personally, the only challenging part was getting the CPU
	61	cooler to screw into the motherboard without sliding the thermal paste
	62	around too much underneath. I'm still not entirely sure if I did a great
	63	job of it, but nothing's broken yet.
	64
	65	The main components were all fine and simple. However, installing the
	66	hard drives is slightly tedious as I need to power off the server and
	67	completely unscrew the HDD cage to install or remove any drives.
	68	Additionally, the drives are screwed directly into the metal cage with
	69	small screws, which are quite a bit different from the HDD trays I'm
	70	used to in other machines.
	71
	72	Seeing that the cases with hot-swap bays were 3-4x the price, I'm okay
	73	dealing with the tedium of removing the cage to install new drives.
	74
	75	** Software
	76	:PROPERTIES:
	77	:CUSTOM_ID: software
	78	:END:
	79	I'm not going to dive into the software as I have done so in other
	80	recent posts. However, I wanted to note that I am using Alpine Linux on
	81	this server and hosting most services inside Docker. No virtual machines
	82	(VMs) and very few bare-metal services.
	83
	84	** The Results
	85	:PROPERTIES:
	86	:CUSTOM_ID: the-results
	87	:END:
	88	How did my build turn out? Well, after migrating my other servers and
	89	their services over, I found that my server is blazing fast. The
	90	heaviest of my applications, Plex, is handled with ease. Even 4k
	91	streaming seems to be effortless.
	92
	93	I am very happy with the results and will likely continue to improve on
	94	this server as the years go by rather than buying another used server
	95	online.
	96
	97	*** Mistakes I Made
	98	:PROPERTIES:
	99	:CUSTOM_ID: mistakes-i-made
	100	:END:
	101	This post wouldn't be complete unless I wrote about the mistakes I made
	102	while building. The only real mistake I made beyond a "whoops I dropped
	103	a screw" related to airflow and fan direction.
	104
	105	While installing the two new hard drives that showed up on 2022-11-30
	106	and getting ready to install the case in my rack, I noticed that the
	107	hard drive temperatures were quite high.
	108
	109	I used the =smartctl= command for each of my drives (=/dev/sda= through
	110	=/dev/sdd=):
	111
	112	#+begin_src sh
103	113	doas smartctl -a /dev/sda \| grep Temperature_Celsius
104		```
	114	#+end_src
105	115
106		The results were unusual - all four drives were idling at ~44-46 degrees
107		Celsius. The only drive that was cooler was my 10TB drive, which was at 38
108		degrees Celsius. I noted that this 10TB drive was also closest to the case fan.
	116	The results were unusual - all four drives were idling at ~44-46 degrees
	117	Celsius. The only drive that was cooler was my 10TB drive, which was at
	118	38 degrees Celsius. I noted that this 10TB drive was also closest to the
	119	case fan.
109	120
110		```sh
	121	#+begin_src sh
111	122	ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
112	123	# /dev/sda
113	124	194 Temperature_Celsius 0x0002 147 147 000 Old_age Always - 44 (Min/Max 22/46)
		@@ -117,18 +128,19 @@ ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_
117	128	194 Temperature_Celsius 0x0002 144 144 000 Old_age Always - 45 (Min/Max 19/61)
118	129	# /dev/sdd
119	130	194 Temperature_Celsius 0x0002 171 171 000 Old_age Always - 38 (Min/Max 14/56)
120		```
	131	#+end_src
121	132
122		After looking to see if I could fit more fans into the case, I noticed that the
123		120mm fan used for intake from the front of the case was actually pushing air
124		out of the case by mistake. This fan sits right in front of the hard drive bay.
	133	After looking to see if I could fit more fans into the case, I noticed
	134	that the 120mm fan used for intake from the front of the case was
	135	actually pushing air out of the case by mistake. This fan sits right in
	136	front of the hard drive bay.
125	137
126		Once I flipped the fan around to act as an intake fan, the temperatures dropped
127		immediately! They are now idling at ~31-33 degrees Celsius. A single fan
128		spinning the wrong way caused my drives to idle 10-15 degrees higher than they
129		should have.
	138	Once I flipped the fan around to act as an intake fan, the temperatures
	139	dropped immediately! They are now idling at ~31-33 degrees Celsius. A
	140	single fan spinning the wrong way caused my drives to idle 10-15 degrees
	141	higher than they should have.
130	142
131		```sh
	143	#+begin_src sh
132	144	ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
133	145	# /dev/sda
134	146	194 Temperature_Celsius 0x0002 209 209 000 Old_age Always - 31 (Min/Max 14/56)
		@@ -138,7 +150,8 @@ ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_
138	150	194 Temperature_Celsius 0x0002 203 203 000 Old_age Always - 32 (Min/Max 21/48)
139	151	# /dev/sdd
140	152	194 Temperature_Celsius 0x0002 196 196 000 Old_age Always - 33 (Min/Max 22/46)
141		```
	153	#+end_src
142	154
143		This was a silly error to make, but I'm glad I found it today before I screwed
144		the case into the rack and made things a lot more tedious to fix.
	155	This was a silly error to make, but I'm glad I found it today before I
	156	screwed the case into the rack and made things a lot more tedious to
	157	fix.

blog/2022-11-29-nginx-referrer-ban-list.org +71 −65

		@@ -1,26 +1,24 @@
1		+++
2		date = 2022-11-29
3		title = "Creating a Referrer Ban List on Nginx"
4		description = "A quick explanation detailing my own way of banning referral domains on Nginx."
5		+++
	1	#+title: Creating a Referrer Ban List on Nginx
	2	#+date: 2022-11-29
6	3
7		## Creating the Ban List
8
9		In order to ban list referral domains or websites with Nginx, you need to
10		create a ban list file.
11		The file below will accept regexes for different domains or websites you
12		wish to block.
	4	** Creating the Ban List
	5	:PROPERTIES:
	6	:CUSTOM_ID: creating-the-ban-list
	7	:END:
	8	In order to ban list referral domains or websites with Nginx, you need
	9	to create a ban list file. The file below will accept regexes for
	10	different domains or websites you wish to block.
13	11
14	12	First, create the file in your nginx directory:
15	13
16		```sh
	14	#+begin_src sh
17	15	doas nano /etc/nginx/banlist.conf
18		```
	16	#+end_src
19	17
20		Next, paste the following contents in and fill out the regexes with whichever
21		domains you're blocking.
	18	Next, paste the following contents in and fill out the regexes with
	19	whichever domains you're blocking.
22	20
23		```conf
	21	#+begin_src conf
24	22	# /etc/nginx/banlist.conf
25	23
26	24	map $http_referer $bad_referer {
		@@ -31,21 +29,23 @@ map $http_referer $bad_referer {
31	29	# Put regexes for undesired referrers here
32	30	"~news.ycombinator.com" 1;
33	31	}
34		```
35
36		## Configuring Nginx
	32	#+end_src
37	33
38		In order for the ban list to work, Nginx needs to know it exists and how to
39		handle it. For this, edit the `nginx.conf` file.
	34	** Configuring Nginx
	35	:PROPERTIES:
	36	:CUSTOM_ID: configuring-nginx
	37	:END:
	38	In order for the ban list to work, Nginx needs to know it exists and how
	39	to handle it. For this, edit the =nginx.conf= file.
40	40
41		```sh
	41	#+begin_src sh
42	42	doas nano /etc/nginx/nginx.conf
43		```
	43	#+end_src
44	44
45		Within this file, find the `http` block and add your ban list file location to
46		the end of the block.
	45	Within this file, find the =http= block and add your ban list file
	46	location to the end of the block.
47	47
48		```conf
	48	#+begin_src conf
49	49	# /etc/nginx/nginx.conf
50	50
51	51	http {
		@@ -54,29 +54,31 @@ http {
54	54	# Include ban list
55	55	include /etc/nginx/banlist.conf;
56	56	}
57		```
58
59		## Enabling the Ban List
60
61		Finally, we need to take action when a bad referral site is found. To do so,
62		edit the configuration file for your website. For example, I have all website
63		configuration files in the `http.d` directory. You may have them in the
64		`sites-available` directory on some distributions.
65
66		```sh
	57	#+end_src
	58
	59	** Enabling the Ban List
	60	:PROPERTIES:
	61	:CUSTOM_ID: enabling-the-ban-list
	62	:END:
	63	Finally, we need to take action when a bad referral site is found. To do
	64	so, edit the configuration file for your website. For example, I have
	65	all website configuration files in the =http.d= directory. You may have
	66	them in the =sites-available= directory on some distributions.
	67
	68	#+begin_src sh
67	69	doas nano /etc/nginx/http.d/example.com.conf
68		```
	70	#+end_src
69	71
70		Within each website's configuration file, edit the `server` blocks that are
71		listening to ports 80 and 443 and create a check for the `$bad_referrer`
72		variable we created in the ban list file.
	72	Within each website's configuration file, edit the =server= blocks that
	73	are listening to ports 80 and 443 and create a check for the
	74	=$bad_referrer= variable we created in the ban list file.
73	75
74		If a matching site is found, you can return any [HTTP Status
75		Code](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes) you want. Code
76		403 (Forbidden) is logical in this case since you are preventing a client
77		connection due to a banned domain.
	76	If a matching site is found, you can return any
	77	[[https://en.wikipedia.org/wiki/List_of_HTTP_status_codes][HTTP Status
	78	Code]] you want. Code 403 (Forbidden) is logical in this case since you
	79	are preventing a client connection due to a banned domain.
78	80
79		```conf
	81	#+begin_src conf
80	82	server {
81	83	...
82	84
		@@ -87,42 +89,46 @@ server {
87	89
88	90	...
89	91	}
90		```
91
92		## Restart Nginx
	92	#+end_src
93	93
	94	** Restart Nginx
	95	:PROPERTIES:
	96	:CUSTOM_ID: restart-nginx
	97	:END:
94	98	Lastly, restart Nginx to enable all changes made.
95	99
96		```sh
	100	#+begin_src sh
97	101	doas rc-service nginx restart
98		```
99
100		## Testing Results
	102	#+end_src
101	103
102		In order to test the results, let's curl the contents of our site. To start,
103		I'll curl the site normally:
	104	** Testing Results
	105	:PROPERTIES:
	106	:CUSTOM_ID: testing-results
	107	:END:
	108	In order to test the results, let's curl the contents of our site. To
	109	start, I'll curl the site normally:
104	110
105		```sh
	111	#+begin_src sh
106	112	curl https://cleberg.net
107		```
	113	#+end_src
108	114
109	115	The HTML contents of the page come back successfully:
110	116
111		```html
	117	#+begin_src html
112	118	<!doctype html>...</html>
113		```
	119	#+end_src
114	120
115	121	Next, let's include a banned referrer:
116	122
117		```sh
	123	#+begin_src sh
118	124	curl --referer https://news.ycombinator.com https://cleberg.net
119		```
	125	#+end_src
120	126
121		This time, I'm met with a 403 Forbidden response page. That means we are
122		successful and any clients being referred from a banned domain will be met
123		with this same response code.
	127	This time, I'm met with a 403 Forbidden response page. That means we are
	128	successful and any clients being referred from a banned domain will be
	129	met with this same response code.
124	130
125		```html
	131	#+begin_src html
126	132	<html>
127	133	<head><title>403 Forbidden</title></head>
128	134	<body>
		@@ -130,4 +136,4 @@ with this same response code.
130	136	<hr><center>nginx</center>
131	137	</body>
132	138	</html>
133		```
	139	#+end_src

blog/2022-12-01-nginx-compression.org +59 −50

		@@ -1,40 +1,44 @@
1		+++
2		date = 2022-12-01
3		title = "Enable GZIP Compression on Nginx"
4		desciption = "Enable gzip compression on Nginx to server small text-based resources faster."
5		+++
	1	#+title: Enable GZIP Compression on Nginx
	2	#+date: 2022-12-01
6	3
7		## Text Compression
	4	** Text Compression
	5	:PROPERTIES:
	6	:CUSTOM_ID: text-compression
	7	:ID: 24C2F6E7-129E-42F3-91F0-A6C6C519FA01
	8	:END:
	9	Text compression allows a web server to serve text-based resources
	10	faster than uncompressed data. This can speed up things like First
	11	Contentful Paint, Tie to Interactive, and Speed Index.
8	12
9		Text compression allows a web server to serve text-based resources faster than
10		uncompressed data. This can speed up things like First Contentful Paint, Tie to
11		Interactive, and Speed Index.
	13	** Enable Nginx Compression with gzip
	14	:PROPERTIES:
	15	:CUSTOM_ID: enable-nginx-compression-with-gzip
	16	:ID: C018C991-E253-4779-A702-AEB69614499F
	17	:END:
	18	In order to enable text compression on Nginx, we need to enable it
	19	within the configuration file:
12	20
13		## Enable Nginx Compression with gzip
14
15		In order to enable text compression on Nginx, we need to enable it within the
16		configuration file:
17
18		```sh
	21	#+begin_src sh
19	22	nano /etc/nginx/nginx.conf
20		```
	23	#+end_src
21	24
22		Within the `http` block, find the section that shows something like the block
23		below. This is the default gzip configuration I found in my `nginx.conf` file on
24		Alpine Linux 3.17. Yours may look slightly different, just make sure that
25		you're not creating any duplicate gzip options.
	25	Within the =http= block, find the section that shows something like the
	26	block below. This is the default gzip configuration I found in my
	27	=nginx.conf= file on Alpine Linux 3.17. Yours may look slightly
	28	different, just make sure that you're not creating any duplicate gzip
	29	options.
26	30
27		```conf
	31	#+begin_src conf
28	32	# Enable gzipping of responses.
29	33	#gzip on;
30	34
31	35	# Set the Vary HTTP header as defined in the RFC 2616. Default is 'off'.
32	36	gzip_vary on;
33		```
	37	#+end_src
34	38
35	39	Remove the default gzip lines and replace them with the following:
36	40
37		```conf
	41	#+begin_src conf
38	42	# Enable gzipping of responses.
39	43	gzip on;
40	44	gzip_vary on;
		@@ -42,33 +46,38 @@ gzip_min_length 10240;
42	46	gzip_proxied expired no-cache no-store private auth;
43	47	gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml;
44	48	gzip_disable "MSIE [1-6]\.";
45		```
46
47		## Explanations of ngx_http_gzip_module Options
48
49		Each of the lines above enables a different aspect of the gzip response for
50		Nginx. Here are the full explanations:
	49	#+end_src
51	50
	51	** Explanations of ngx_http_gzip_module Options
	52	:PROPERTIES:
	53	:CUSTOM_ID: explanations-of-ngx_http_gzip_module-options
	54	:ID: C180752B-E1B9-49A5-B180-84488068A76A
	55	:END:
	56	Each of the lines above enables a different aspect of the gzip response
	57	for Nginx. Here are the full explanations:
52	58
53		- `gzip` – Enables or disables gzipping of responses.
54		- `gzip_vary` – Enables or disables inserting the “Vary: Accept-Encoding”
55		response header field if the directives gzip, gzip_static, or gunzip are active.
56		- `gzip_min_length` – Sets the minimum length of a response that will be
57		gzipped. The length is determined only from the “Content-Length” response header field.
58		- `gzip_proxied` – Enables or disables gzipping of responses for proxied
59		requests depending on the request and response. The fact that the request is
60		proxied is determined by the presence of the “Via” request header field.
61		- `gzip_types` – Enables gzipping of responses for the specified MIME types in
62		addition to “text/html”. The special value “*” matches any MIME type (0.8.29).
63		Responses with the “text/html” type are always compressed.
64		- `gzip_disable` – Disables gzipping of responses for requests
65		with “User-Agent” header fields matching any of the specified regular
66		expressions.
67		- The special mask “msie6” (0.7.12) corresponds to the regular expression “MSIE
68		[4-6]\.”, but works faster. Starting from version 0.8.11, “MSIE 6.0; ... SV1” is
69		excluded from this mask.
	59	- =gzip= -- Enables or disables gzipping of responses.
	60	- =gzip_vary= -- Enables or disables inserting the "Vary:
	61	Accept-Encoding" response header field if the directives gzip,
	62	gzip_static, or gunzip are active.
	63	- =gzip_min_length= -- Sets the minimum length of a response that will
	64	be gzipped. The length is determined only from the "Content-Length"
	65	response header field.
	66	- =gzip_proxied= -- Enables or disables gzipping of responses for
	67	proxied requests depending on the request and response. The fact that
	68	the request is proxied is determined by the presence of the "Via"
	69	request header field.
	70	- =gzip_types= -- Enables gzipping of responses for the specified MIME
	71	types in addition to "text/html". The special value “*” matches any
	72	MIME type (0.8.29). Responses with the "text/html" type are always
	73	compressed.
	74	- =gzip_disable= -- Disables gzipping of responses for requests with
	75	"User-Agent" header fields matching any of the specified regular
	76	expressions.
	77	- The special mask "msie6" (0.7.12) corresponds to the regular
	78	expression "MSIE [4-6].", but works faster. Starting from version
	79	0.8.11, "MSIE 6.0; ... SV1" is excluded from this mask.
70	80
71		More information on these directives and their options can be found on the
72		[Module
73		ngx_http_gzip_module](https://nginx.org/en/docs/http/ngx_http_gzip_module.html)
74		page in Nginx's documentation.
	81	More information on these directives and their options can be found on
	82	the [[https://nginx.org/en/docs/http/ngx_http_gzip_module.html][Module
	83	ngx_http_gzip_module]] page in Nginx's documentation.

blog/2022-12-07-nginx-wildcard-redirect.org +60 −56

		@@ -1,25 +1,26 @@
1		+++
2		date = 2022-12-07
3		title = "Redirect Nginx Subdomains & Trailing Content with Regex"
4		description= "You can easily redirect Nginx traffic from subdomains and TLDs to a new domain while preserving trailing content."
5		+++
6
7		## Problem
8
9		I recently migrated domains and replaced the
10		old webpage with a simple info page with instructions to users on how
11		to edit their bookmarks and URLs to get to the page they were seeking.
12
13		This was not ideal as it left the work up to the user and may have caused
14		friction for users who accessed my RSS feed.
15
16		## Solution
17
18		Instead, I finally found a solution that allows me to redirect both subdomains
19		AND trailing content. For example, both of these URLs now redirect properly
20		using the logic I'll explain below:
21
22		```txt
	1	#+title: Redirect Nginx Subdomains & Trailing Content with Regex
	2	#+date: 2022-12-07
	3
	4	** Problem
	5	:PROPERTIES:
	6	:CUSTOM_ID: problem
	7	:END:
	8	I recently migrated domains and replaced the old webpage with a simple
	9	info page with instructions to users on how to edit their bookmarks and
	10	URLs to get to the page they were seeking.
	11
	12	This was not ideal as it left the work up to the user and may have
	13	caused friction for users who accessed my RSS feed.
	14
	15	** Solution
	16	:PROPERTIES:
	17	:CUSTOM_ID: solution
	18	:END:
	19	Instead, I finally found a solution that allows me to redirect both
	20	subdomains AND trailing content. For example, both of these URLs now
	21	redirect properly using the logic I'll explain below:
	22
	23	#+begin_src txt
23	24	# Example 1 - Simple base domain redirect with trailing content
24	25	https://domain1.com/blog/alpine-linux/ -> https://domain2.com/blog/alpine-linux/
25	26
		@@ -27,23 +28,25 @@ https://domain1.com/blog/alpine-linux/ -> https://domain2.com/blog/alpine-linux/
27	28	https://libreddit.domain1.com/r/history/comments/7z8cbg/new_discovery_mode_turns_video_game_assassins/
28	29	->
29	30	https://libreddit.domain2.com/r/history/comments/7z8cbg/new_discovery_mode_turns_video_game_assassins/
30		```
	31	#+end_src
31	32
32	33	Go ahead, try the URLs if you want to test them.
33	34
34		### Nginx Config
	35	*** Nginx Config
	36	:PROPERTIES:
	37	:CUSTOM_ID: nginx-config
	38	:END:
	39	To make this possible. I needed to configure a proper redirect scheme in
	40	my Nginx configuration.
35	41
36		To make this possible. I needed to configure a proper redirect scheme in my
37		Nginx configuration.
38
39		```sh
	42	#+begin_src sh
40	43	doas nano /etc/nginx/http.d/domain1.conf
41		```
	44	#+end_src
42	45
43		Within this file, I had one block configured to redirect HTTP requests to HTTPS
44		for the base domain and all subdomains.
	46	Within this file, I had one block configured to redirect HTTP requests
	47	to HTTPS for the base domain and all subdomains.
45	48
46		```conf
	49	#+begin_src conf
47	50	server {
48	51	listen [::]:80;
49	52	listen 80;
		@@ -59,13 +62,14 @@ server {
59	62
60	63	return 404;
61	64	}
62		```
	65	#+end_src
63	66
64		For the base domain, I have another `server` block dedicated to redirecting all
65		base domain requests. You can see that the `rewrite` line is instructing Nginx
66		to gather all trailing content and append it to the new `domain2.com` URL.
	67	For the base domain, I have another =server= block dedicated to
	68	redirecting all base domain requests. You can see that the =rewrite=
	69	line is instructing Nginx to gather all trailing content and append it
	70	to the new =domain2.com= URL.
67	71
68		```conf
	72	#+begin_src conf
69	73	server {
70	74	listen [::]:443 ssl http2;
71	75	listen 443 ssl http2;
		@@ -77,20 +81,21 @@ server {
77	81	ssl_certificate /etc/letsencrypt/live/domain1.com/fullchain.pem;
78	82	ssl_certificate_key /etc/letsencrypt/live/domain1.com/privkey.pem;
79	83	}
80		```
	84	#+end_src
81	85
82		Finally, the tricky part is figuring out how to tell Nginx to redirect while
83		keeping both a subdomain and trailing content intact. I found that the easiest
84		way to do this is to give it a `server` block of its own.
	86	Finally, the tricky part is figuring out how to tell Nginx to redirect
	87	while keeping both a subdomain and trailing content intact. I found that
	88	the easiest way to do this is to give it a =server= block of its own.
85	89
86		Within this block, we need to do some regex on the `server_name` line before we
87		can rewrite anything. This creates a variable called `subdomain`.
	90	Within this block, we need to do some regex on the =server_name= line
	91	before we can rewrite anything. This creates a variable called
	92	=subdomain=.
88	93
89		Once the server gets to the `rewrite` line, it pulls the `subdomain` variable
90		from above and uses it on the new `domain2.com` domain before appending the
91		trailing content (`$request_uri`).
	94	Once the server gets to the =rewrite= line, it pulls the =subdomain=
	95	variable from above and uses it on the new =domain2.com= domain before
	96	appending the trailing content (=$request_uri=).
92	97
93		```conf
	98	#+begin_src conf
94	99	server {
95	100	listen [::]:443 ssl http2;
96	101	listen 443 ssl http2;
		@@ -102,18 +107,17 @@ server {
102	107	ssl_certificate /etc/letsencrypt/live/domain1.com/fullchain.pem;
103	108	ssl_certificate_key /etc/letsencrypt/live/domain1.com/privkey.pem;
104	109	}
105		```
	110	#+end_src
106	111
107		That's all there is to it. With this, I simply restarted Nginx and watched the
108		redirections work in-action.
	112	That's all there is to it. With this, I simply restarted Nginx and
	113	watched the redirections work in-action.
109	114
110		```sh
	115	#+begin_src sh
111	116	doas rc-service nginx restart
112		```
113
	117	#+end_src
114	118
115		Looking back on it, I wish I had done this sooner. Who knows how many people
116		went looking for my sites or bookmarks and gave up when they saw the redirect
117		instructions page.
	119	Looking back on it, I wish I had done this sooner. Who knows how many
	120	people went looking for my sites or bookmarks and gave up when they saw
	121	the redirect instructions page.
118	122
119	123	Oh well, it's done now. Live and learn.

blog/2022-12-17-st.org +71 −60

		@@ -1,89 +1,100 @@
1		+++
2		date = 2022-12-17
3		title = "Simple Terminal"
4		description = "An easy guide on how to build st on Fedora Workstation."
5		+++
6
7		## st
8
9		[st](https://st.suckless.org) standards for Simple Terminal, a simple terminal
10		implementation for X made by the [suckless](https://suckless.org) team.
11
12		This post walks through the dependencies needed and process to build and install
13		`st` on Fedora Workstation.
14
15		### Obtain Files
16
17		To start, obtain the source files for `st` via `git clone`.
18
19		```sh
	1	#+title: Simple Terminal
	2	#+date: 2022-12-17
	3
	4	** st
	5	:PROPERTIES:
	6	:CUSTOM_ID: st
	7	:END:
	8	[[https://st.suckless.org][st]] standards for Simple Terminal, a simple
	9	terminal implementation for X made by the
	10	[[https://suckless.org][suckless]] team.
	11
	12	This post walks through the dependencies needed and process to build and
	13	install =st= on Fedora Workstation.
	14
	15	*** Obtain Files
	16	:PROPERTIES:
	17	:CUSTOM_ID: obtain-files
	18	:END:
	19	To start, obtain the source files for =st= via =git clone=.
	20
	21	#+begin_src sh
20	22	mkdir ~/suckless && cd ~/suckless
21	23	git clone https://git.suckless.org/st && cd st
22		```
23
24		### Dependencies
	24	#+end_src
25	25
26		Once you have the files and are in the `st` directory, ensure the following
27		packages are installed.
	26	*** Dependencies
	27	:PROPERTIES:
	28	:CUSTOM_ID: dependencies
	29	:END:
	30	Once you have the files and are in the =st= directory, ensure the
	31	following packages are installed.
28	32
29		```sh
	33	#+begin_src sh
30	34	sudo dnf update && sudo dnf upgrade
31	35	sudo dnf install gcc patch libX11-devel libXft-devel
32		```
33
34		### Building
	36	#+end_src
35	37
	38	*** Building
	39	:PROPERTIES:
	40	:CUSTOM_ID: building
	41	:END:
36	42	Before building, ensure that you read the README file.
37	43
38		```sh
	44	#+begin_src sh
39	45	cat README
40		```
	46	#+end_src
41	47
42		Once you've read the instructions, open the `config.mk` file and ensure it
43		matches your setup. If you're not sure, leave the default options within the
44		file.
	48	Once you've read the instructions, open the =config.mk= file and ensure
	49	it matches your setup. If you're not sure, leave the default options
	50	within the file.
45	51
46		Finally, you can build `st` with the following command. Ensure you run as root
47		(e.g., `sudo`) or else you may not end up with a usable application file.
	52	Finally, you can build =st= with the following command. Ensure you run
	53	as root (e.g., =sudo=) or else you may not end up with a usable
	54	application file.
48	55
49		```sh
	56	#+begin_src sh
50	57	sudo make clean install
51		```
52
53		### Customization (Patches)
	58	#+end_src
54	59
55		Note that customizing `st` requires you to modify the source files or to
56		download one of the [available patches](https://st.suckless.org/patches/) for
57		suckless.org.
	60	*** Customization (Patches)
	61	:PROPERTIES:
	62	:CUSTOM_ID: customization-patches
	63	:END:
	64	Note that customizing =st= requires you to modify the source files or to
	65	download one of the [[https://st.suckless.org/patches/][available
	66	patches]] for suckless.org.
58	67
59		If you've already installed `st` and want to customize or install a patch, start
60		by uninstalling the current program.
	68	If you've already installed =st= and want to customize or install a
	69	patch, start by uninstalling the current program.
61	70
62		```sh
	71	#+begin_src sh
63	72	cd ~/suckless/st
64	73	sudo make uninstall
65		```
	74	#+end_src
66	75
67		Next, grab the `<path>.diff` file from the page of the patch you chose. For
68		example, I will be using the
69		[defaultfontsize](https://st.suckless.org/patches/defaultfontsize/) patch in the below example.
	76	Next, grab the =<path>.diff= file from the page of the patch you chose.
	77	For example, I will be using the
	78	[[https://st.suckless.org/patches/defaultfontsize/][defaultfontsize]]
	79	patch in the below example.
70	80
71		```sh
	81	#+begin_src sh
72	82	wget https://st.suckless.org/patches/defaultfontsize/st-defaultfontsize-20210225-4ef0cbd.diff
73		```
	83	#+end_src
74	84
75		Once the file is downloaded inside the `st` folder, apply the patch and
76		re-install the program. You may need to install the `patch` command if you don't
77		have it installed already (you should have installed it above).
	85	Once the file is downloaded inside the =st= folder, apply the patch and
	86	re-install the program. You may need to install the =patch= command if
	87	you don't have it installed already (you should have installed it
	88	above).
78	89
79		```sh
	90	#+begin_src sh
80	91	patch -i st-defaultfontsize-20210225-4ef0cbd.diff
81	92	sudo make clean install
82		```
	93	#+end_src
83	94
84		Once installed, you can use the default font size patch to launch `st` with any
85		font size you wish:
	95	Once installed, you can use the default font size patch to launch =st=
	96	with any font size you wish:
86	97
87		```sh
	98	#+begin_src sh
88	99	st -z 16
89		```
	100	#+end_src

blog/2022-12-23-alpine-desktop.org +141 −125

		@@ -1,89 +1,95 @@
1		+++
2		date = 2022-12-23
3		title = "Alpine Linux as a Desktop OS"
4		description = "Documenting my steps to a useable Alpine Linux desktop experience."
5		+++
6
7		## Isn't Alpine Linux for Servers?
8
9		This is a question I see a lot when people are presented with an example of
10		Alpine Linux running as a desktop OS.
11
12		While Alpine is small, fast, and minimal, that doesn't stop it from functioning
13		at a productive level for desktop users.
14
15		This post is documentation of how I installed and modified Alpine Linux to
16		become my daily desktop OS.
17
18		## Installation
19
20		Note that I cover the installation of Alpine Linux in my other post, so I
21		won't repeat it here: [Alpine Linux: My New Server OS](/blog/alpine-linux/).
22
23		Basically, get a bootable USB or whatever you prefer with Alpine on it, boot the
24		ISO, and run the setup script.
25
26		```sh
	1	#+title: Alpine Linux as a Desktop OS
	2	#+date: 2022-12-23
	3
	4	** Isn't Alpine Linux for Servers?
	5	:PROPERTIES:
	6	:CUSTOM_ID: isnt-alpine-linux-for-servers
	7	:END:
	8	This is a question I see a lot when people are presented with an example
	9	of Alpine Linux running as a desktop OS.
	10
	11	While Alpine is small, fast, and minimal, that doesn't stop it from
	12	functioning at a productive level for desktop users.
	13
	14	This post is documentation of how I installed and modified Alpine Linux
	15	to become my daily desktop OS.
	16
	17	** Installation
	18	:PROPERTIES:
	19	:CUSTOM_ID: installation
	20	:END:
	21	Note that I cover the installation of Alpine Linux in my other post, so
	22	I won't repeat it here: [[/blog/alpine-linux/][Alpine Linux: My New
	23	Server OS]].
	24
	25	Basically, get a bootable USB or whatever you prefer with Alpine on it,
	26	boot the ISO, and run the setup script.
	27
	28	#+begin_src sh
27	29	setup-alpine
28		```
	30	#+end_src
29	31
30		Once you have gone through all the options and installer finishes without
31		errors, reboot.
	32	Once you have gone through all the options and installer finishes
	33	without errors, reboot.
32	34
33		```sh
	35	#+begin_src sh
34	36	reboot
35		```
36
37		## Initial Setup
38
39		Once Alpine is installed and the machine has rebooted, login is as root
40		initially or `su` to root once you log in as your user.
41		From here, you should start by updating and upgrading the system in case the
42		ISO was not fully up-to-date.
43
44		```sh
	37	#+end_src
	38
	39	** Initial Setup
	40	:PROPERTIES:
	41	:CUSTOM_ID: initial-setup
	42	:END:
	43	Once Alpine is installed and the machine has rebooted, login is as root
	44	initially or =su= to root once you log in as your user. From here, you
	45	should start by updating and upgrading the system in case the ISO was
	46	not fully up-to-date.
	47
	48	#+begin_src sh
45	49	# Update and upgrade system
46	50	apk -U update && apk -U upgrade
47	51
48	52	# Add an editor so we can enable the community repository
49	53	apk add nano
50		```
	54	#+end_src
51	55
52		You need to uncomment the `community` repository for your version of Alpine
53		Linux.
	56	You need to uncomment the =community= repository for your version of
	57	Alpine Linux.
54	58
55		For v3.17, the `repositories` file should look like this:
	59	For v3.17, the =repositories= file should look like this:
56	60
57		```sh
	61	#+begin_src sh
58	62	nano /etc/apk/repositories
59		```
	63	#+end_src
60	64
61		```conf
	65	#+begin_src conf
62	66	#/media/sda/apks
63	67	http://mirrors.gigenet.com/alpinelinux/v3.17/main
64	68	http://mirrors.gigenet.com/alpinelinux/v3.17/community
65	69	#http://mirrors.gigenet.com/alpinelinux/edge/main
66	70	#http://mirrors.gigenet.com/alpinelinux/edge/community
67	71	#http://mirrors.gigenet.com/alpinelinux/edge/testing
68		```
	72	#+end_src
69	73
70		```sh
	74	#+begin_src sh
71	75	# Add the rest of your packages
72	76	apk add linux-firmware iwd doas git curl wget
73	77
74	78	# Add yourself to the wheel group so you can use the doas command
75	79	adduser $USER wheel
76		```
77
78		## Window Manager (Desktop)
	80	#+end_src
79	81
80		The [Sway installation guide](https://wiki.alpinelinux.org/wiki/Sway) has
81		everything you need to get Sway working on Alpine.
	82	** Window Manager (Desktop)
	83	:PROPERTIES:
	84	:CUSTOM_ID: window-manager-desktop
	85	:END:
	86	The [[https://wiki.alpinelinux.org/wiki/Sway][Sway installation guide]]
	87	has everything you need to get Sway working on Alpine.
82	88
83		However, I'll include a brief list of the commands I ran and their purpose for
84		posterity here.
	89	However, I'll include a brief list of the commands I ran and their
	90	purpose for posterity here.
85	91
86		```sh
	92	#+begin_src sh
87	93	# Add eudev and set it up
88	94	apk add eudev
89	95	setup-devd udev
		@@ -120,21 +126,21 @@ apk add \ # Install optional dependencies:
120	126	swaylock swaylockd \ # lockscreen tool
121	127	swaybg \ # wallpaper daemon
122	128	swayidle # idle management (DPMS) daemon
123		```
	129	#+end_src
124	130
125		Once you have the packages installed and set-up, you need to export the
126		`XDG_RUNTIME_DIR` upon login. To do this, edit your `.profile` file.
	131	Once you have the packages installed and set-up, you need to export the
	132	=XDG_RUNTIME_DIR= upon login. To do this, edit your =.profile= file.
127	133
128		If you use another shell, such as `zsh`, you need to edit that shell's profile
129		(e.g., `~/.zprofile`)!
	134	If you use another shell, such as =zsh=, you need to edit that shell's
	135	profile (e.g., =~/.zprofile=)!
130	136
131		```sh
	137	#+begin_src sh
132	138	nano ~/.profile
133		```
	139	#+end_src
134	140
135	141	Within the file, paste this:
136	142
137		```sh
	143	#+begin_src sh
138	144	if test -z "${XDG_RUNTIME_DIR}"; then
139	145	export XDG_RUNTIME_DIR=/tmp/$(id -u)-runtime-dir
140	146	if ! test -d "${XDG_RUNTIME_DIR}"; then
		@@ -142,19 +148,22 @@ if test -z "${XDG_RUNTIME_DIR}"; then
142	148	chmod 0700 "${XDG_RUNTIME_DIR}"
143	149	fi
144	150	fi
145		```
	151	#+end_src
146	152
147	153	Once that's complete, you can launch Sway manually.
148	154
149		```sh
	155	#+begin_src sh
150	156	dbus-run-session -- sway
151		```
152
153		## Personal Touches
	157	#+end_src
154	158
155		I also added the following packages, per my personal preferences and situation.
	159	** Personal Touches
	160	:PROPERTIES:
	161	:CUSTOM_ID: personal-touches
	162	:END:
	163	I also added the following packages, per my personal preferences and
	164	situation.
156	165
157		```sh
	166	#+begin_src sh
158	167	doas apk add brightnessctl \ # Brightness controller
159	168	zsh \ # Shell
160	169	firefox \ # Browser
		@@ -164,91 +173,98 @@ doas apk add brightnessctl \ # Brightness controller
164	173	neomutt \ # CLI email client
165	174	thunderbird \ # GUI email client
166	175	gnupg # GPG key manager
167		```
168
169		From here, I use my Syncthing storage to pull all the configuration files I
170		stored from prior desktops, such as [my
171		dotfiles](https://git.sr.ht/~cmc/dotfiles).
172
173		## Resolving Issues
174
175		### WiFi Issues
176
177		I initially tried to set up my Wi-Fi the standard way with `iwd`, but it didn't
178		work.
179
180		Here is what I initially tried (I did all of this as `root`):
181
182		```sh
	176	#+end_src
	177
	178	From here, I use my Syncthing storage to pull all the configuration
	179	files I stored from prior desktops, such as
	180	[[https://git.sr.ht/~cmc/dotfiles][my dotfiles]].
	181
	182	** Resolving Issues
	183	:PROPERTIES:
	184	:CUSTOM_ID: resolving-issues
	185	:END:
	186	*** WiFi Issues
	187	:PROPERTIES:
	188	:CUSTOM_ID: wifi-issues
	189	:END:
	190	I initially tried to set up my Wi-Fi the standard way with =iwd=, but it
	191	didn't work.
	192
	193	Here is what I initially tried (I did all of this as =root=):
	194
	195	#+begin_src sh
183	196	apk add iwd
184	197	rc-service iwd start
185	198	iwctl station wlan0 connect <SSID> # This will prompt for the password
186	199	rc-update add iwd boot && rc-update add dbus boot
187		```
	200	#+end_src
188	201
189		Then, I added the Wi-Fi entry to the bottom of the networking interface file:
	202	Then, I added the Wi-Fi entry to the bottom of the networking interface
	203	file:
190	204
191		```sh
	205	#+begin_src sh
192	206	nano /etc/network/interfaces
193		```
	207	#+end_src
194	208
195		```conf
	209	#+begin_src conf
196	210	auto wlan0
197	211	iface wlan0 inet dhcp
198		```
	212	#+end_src
199	213
200	214	Finally, restart the networking service:
201	215
202		```sh
	216	#+begin_src sh
203	217	rc-service networking restart
204		```
	218	#+end_src
205	219
206		My Wi-Fi interface would receive an IP address from the router, but it could
207		not ping anything in the network.
208		To solve the Wi-Fi issues, I originally upgraded to Alpine's `edge`
209		repositories, which was unnecessary.
	220	My Wi-Fi interface would receive an IP address from the router, but it
	221	could not ping anything in the network. To solve the Wi-Fi issues, I
	222	originally upgraded to Alpine's =edge= repositories, which was
	223	unnecessary.
210	224
211		Really, the solution was to enable the `NameResolvingService=resolvconf` in
212		`/etc/iwd/main.conf`.
	225	Really, the solution was to enable the =NameResolvingService=resolvconf=
	226	in =/etc/iwd/main.conf=.
213	227
214		```sh
	228	#+begin_src sh
215	229	doas nano /etc/iwd/main.conf
216		```
	230	#+end_src
217	231
218		```conf
	232	#+begin_src conf
219	233	[Network]
220	234
221	235	NameResolvingService=resolvconf
222		```
	236	#+end_src
223	237
224	238	Once I finished this process, my Wi-Fi is working flawlessly.
225	239
226		### Sound Issues
227
228		Same as with the Wi-Fi, I had no sound and could not control the mute/unmute or
229		volume buttons on my laptop.
	240	*** Sound Issues
	241	:PROPERTIES:
	242	:CUSTOM_ID: sound-issues
	243	:END:
	244	Same as with the Wi-Fi, I had no sound and could not control the
	245	mute/unmute or volume buttons on my laptop.
230	246
231		To resolve this, I installed
232		[pipewire](https://wiki.alpinelinux.org/wiki/PipeWire).
	247	To resolve this, I installed
	248	[[https://wiki.alpinelinux.org/wiki/PipeWire][pipewire]].
233	249
234		```sh
	250	#+begin_src sh
235	251	# Add your user to the following groups
236	252	addgroup $USER audio
237	253	addgroup $USER video
238	254
239	255	# Install pipewire and other useful packages
240	256	apk add pipewire wireplumber pipewire-pulse pipewire-jack pipewire-alsa
241		```
	257	#+end_src
242	258
243		Finally, I needed to add `/usr/libexec/pipewire-launcher` to my
244		`.config/sway/config` file so that Pipewire would run every time I launched
245		sway.
	259	Finally, I needed to add =/usr/libexec/pipewire-launcher= to my
	260	=.config/sway/config= file so that Pipewire would run every time I
	261	launched sway.
246	262
247		```sh
	263	#+begin_src sh
248	264	nano ~/.config/sway/config
249		```
	265	#+end_src
250	266
251		```conf
	267	#+begin_src conf
252	268	# Run pipewire audio server
253	269	exec /usr/libexec/pipewire-launcher
254	270
		@@ -257,10 +273,10 @@ bindsym XF86AudioRaiseVolume exec --no-startup-id pactl set-sink-volume @DEFAULT
257	273	bindsym XF86AudioLowerVolume exec --no-startup-id pactl set-sink-volume @DEFAULT_SINK@ -5%
258	274	bindsym XF86AudioMute exec --no-startup-id pactl set-sink-mute @DEFAULT_SINK@ toggle
259	275	bindsym XF86AudioMicMute exec --no-startup-id pactl set-source-mute @DEFAULT_SOURCE@ toggle
260		```
	276	#+end_src
261	277
262		Note that I do not use bluetooth or screen sharing, so I won't cover those
263		options in this post.
	278	Note that I do not use bluetooth or screen sharing, so I won't cover
	279	those options in this post.
264	280
265		Other than these issues, I have a working Alpine desktop. No other complaints
266		thus far!
	281	Other than these issues, I have a working Alpine desktop. No other
	282	complaints thus far!

blog/2023-01-03-recent-website-changes.org +90 −79

		@@ -1,82 +1,93 @@
1		+++
2		date = 2023-01-03
3		title = "Recent Website Changes"
4		description = "A quick review on this website's recent changes."
5		+++
6
7		## The State of This Website
8
9		Over the years, this website has changed URLs, styles, content focus, and much
10		more. However, it seems that I am never done, as I am yet again changing this
11		page to fit my current needs and wants.
12
13		While this site was already minimal (~12kb), it contained a lot of disorganized
14		content and some poorly chosen color schemes.
15
16		The recent updates attempt to fix these items while focusing on what I truly
17		care about here: the content within each page.
18
19		## Recent Changes
20
21		I've made quite a few changes to the style of this website today, both in the
22		CSS and in the HTML.
	1	#+title: Recent Website Changes
	2	#+date: 2023-01-03
	3
	4	** The State of This Website
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-state-of-this-website
	7	:END:
	8	Over the years, this website has changed URLs, styles, content focus,
	9	and much more. However, it seems that I am never done, as I am yet again
	10	changing this page to fit my current needs and wants.
	11
	12	While this site was already minimal (~12kb), it contained a lot of
	13	disorganized content and some poorly chosen color schemes.
	14
	15	The recent updates attempt to fix these items while focusing on what I
	16	truly care about here: the content within each page.
	17
	18	** Recent Changes
	19	:PROPERTIES:
	20	:CUSTOM_ID: recent-changes
	21	:END:
	22	I've made quite a few changes to the style of this website today, both
	23	in the CSS and in the HTML.
23	24
24	25	Here are some of the key takeaways from today's changes:
25	26
26		1. Reduce the width of the website from `60em` to `40em`.
27		2. Remove breadcrumb navigation and replaced with a simple "Return Home" link
28		when visiting anything other than the homepage.
29		3. Remove syntax highlighting from code blocks. CSS now loads from a single
30		file.
31		4. Move blog posts on the homepage to the top, pushing tertiary content down.
32		5. Update font-family from `monospace` to `sans-serif` for readability.
33
34		## Future Focus
35
36		### Accessibility
37
38		My main focus amidst all the changes this past year was accessibility.
39		I tried to improve the accessibility of all pages on this site as well as I
40		know how.
41		For example, I added aria labels to identify different navigation menus in
42		November.
43
44		I want to continue this in 2023 and learn more about the accessibility features
45		I can utilize to help those who may need them.
46
47		### Content First
48
49		Beyond accessibility, I am making a concerted effort to bring the content of
50		this site to the forefront and push the tertiary information (e.g., About Me,
51		Services, etc.) down below the content.
52
53		Further, I want to review and edit previous blog posts for grammar, accuracy,
54		dead links, and more. Where necessary, I may even add a blurb at the top of old
55		posts that are no longer accurate or helpful.
56
57		### Style
58
59		As always, I will be searching for ways to reduce distractions and bring a
60		minimalistic approach to this site. While there are certainly more drastic
61		measures I could take, such as making this a [Shinobi
62		Website](https://shinobi.bt.ht) or a [No CSS Website](https://nocss.club), I
63		prefer to keep some modern features here.
64
65		Two ideas have been floating around in my head, but I am not sure how I feel
66		about these approaches yet:
67
68		1. Going all-in with Emacs org-mode and creating a script to auto-publish all my
69		blog posts from org-mode to plain HTML files and then letting my CSS style it
70		after the fact.
71		2. Focus on publishing for Gemini or Gopher and then utilize a conversion
72		program to translate the pages to HTML.
73
74		## Looking Back
75
76		As I sit here and finalize the changes, as well as this post, I am happy with
77		the current state of this website. It's certainly a long way from my first
78		attempts (parallax background images, anyone?) and it's good to see the
79		progress.
80
81		I can only hope and work hard to ensure that I make more meaningful progress by
82		this time next year.
	27	1. Reduce the width of the website from =60em= to =40em=.
	28	2. Remove breadcrumb navigation and replaced with a simple "Return Home"
	29	link when visiting anything other than the homepage.
	30	3. Remove syntax highlighting from code blocks. CSS now loads from a
	31	single file.
	32	4. Move blog posts on the homepage to the top, pushing tertiary content
	33	down.
	34	5. Update font-family from =monospace= to =sans-serif= for readability.
	35
	36	** Future Focus
	37	:PROPERTIES:
	38	:CUSTOM_ID: future-focus
	39	:END:
	40	*** Accessibility
	41	:PROPERTIES:
	42	:CUSTOM_ID: accessibility
	43	:END:
	44	My main focus amidst all the changes this past year was accessibility. I
	45	tried to improve the accessibility of all pages on this site as well as
	46	I know how. For example, I added aria labels to identify different
	47	navigation menus in November.
	48
	49	I want to continue this in 2023 and learn more about the accessibility
	50	features I can utilize to help those who may need them.
	51
	52	*** Content First
	53	:PROPERTIES:
	54	:CUSTOM_ID: content-first
	55	:END:
	56	Beyond accessibility, I am making a concerted effort to bring the
	57	content of this site to the forefront and push the tertiary information
	58	(e.g., About Me, Services, etc.) down below the content.
	59
	60	Further, I want to review and edit previous blog posts for grammar,
	61	accuracy, dead links, and more. Where necessary, I may even add a blurb
	62	at the top of old posts that are no longer accurate or helpful.
	63
	64	*** Style
	65	:PROPERTIES:
	66	:CUSTOM_ID: style
	67	:END:
	68	As always, I will be searching for ways to reduce distractions and bring
	69	a minimalistic approach to this site. While there are certainly more
	70	drastic measures I could take, such as making this a
	71	[[https://shinobi.bt.ht][Shinobi Website]] or a [[https://nocss.club][No
	72	CSS Website]], I prefer to keep some modern features here.
	73
	74	Two ideas have been floating around in my head, but I am not sure how I
	75	feel about these approaches yet:
	76
	77	1. Going all-in with Emacs org-mode and creating a script to
	78	auto-publish all my blog posts from org-mode to plain HTML files and
	79	then letting my CSS style it after the fact.
	80	2. Focus on publishing for Gemini or Gopher and then utilize a
	81	conversion program to translate the pages to HTML.
	82
	83	** Looking Back
	84	:PROPERTIES:
	85	:CUSTOM_ID: looking-back
	86	:END:
	87	As I sit here and finalize the changes, as well as this post, I am happy
	88	with the current state of this website. It's certainly a long way from
	89	my first attempts (parallax background images, anyone?) and it's good to
	90	see the progress.
	91
	92	I can only hope and work hard to ensure that I make more meaningful
	93	progress by this time next year.

blog/2023-01-05-mass-unlike-tumblr-posts.org +78 −65

		@@ -1,31 +1,37 @@
1		+++
2		date = 2023-01-05
3		title = "How to Easily Mass Unlike Tumblr Posts With Javascript"
4		description = "A quick Javascript snippet that allows you to quickly unlike your Tumblr likes."
5		+++
6
7		## The Dilemma
8
9		The dilemma I had was pretty simple: I wanted to unlike all the posts I have
10		liked on Tumblr so that I could follow a new focus on blogs and start fresh.
11		Otherwise, Tumblr will keep recommending content based on your previous likes.
12
13		## The Solution
14
15		I searched the web for a while and noted that most solutions referenced Tumblr
16		setting and dashboard pages that no longer exist. Additionally, I did not want
17		to install a third party extension to do this, as some suggested.
18
19		Luckily, I used Javascript for a while a few years ago and figured it would be
20		easy enough to script a solution, as long as Tumblr had a system for the unlike
21		buttons.
22
23		### Identifying Unlike Buttons
24
25		Tumblr's unlike buttons are structured as you can see in the following code
26		block. All unlike buttons have an `aria-label` with a value of `Unlike`.
27
28		```html
	1	#+title: How to Easily Mass Unlike Tumblr Posts With Javascript
	2	#+date: 2023-01-05
	3
	4	** The Dilemma
	5	:PROPERTIES:
	6	:CUSTOM_ID: the-dilemma
	7	:END:
	8	The dilemma I had was pretty simple: I wanted to unlike all the posts I
	9	have liked on Tumblr so that I could follow a new focus on blogs and
	10	start fresh. Otherwise, Tumblr will keep recommending content based on
	11	your previous likes.
	12
	13	** The Solution
	14	:PROPERTIES:
	15	:CUSTOM_ID: the-solution
	16	:END:
	17	I searched the web for a while and noted that most solutions referenced
	18	Tumblr setting and dashboard pages that no longer exist. Additionally, I
	19	did not want to install a third party extension to do this, as some
	20	suggested.
	21
	22	Luckily, I used Javascript for a while a few years ago and figured it
	23	would be easy enough to script a solution, as long as Tumblr had a
	24	system for the unlike buttons.
	25
	26	*** Identifying Unlike Buttons
	27	:PROPERTIES:
	28	:CUSTOM_ID: identifying-unlike-buttons
	29	:END:
	30	Tumblr's unlike buttons are structured as you can see in the following
	31	code block. All unlike buttons have an =aria-label= with a value of
	32	=Unlike=.
	33
	34	#+begin_src html
29	35	<button class="TRX6J" aria-label="Unlike">
30	36	<span class="EvhBA B1Z5w ztpfZ" tabindex="-1">
31	37	<svg xmlns="http://www.w3.org/2000/svg" height="21" width="23"
		@@ -34,33 +40,36 @@ block. All unlike buttons have an `aria-label` with a value of `Unlike`.
34	40	</svg>
35	41	</span>
36	42	</button>
37		```
38
39		### Running a Script to Unlike All Likes
	43	#+end_src
40	44
41		To run this script, you will need to load the [Likes \|
42		Tumblr](https://www.tumblr.com/likes) page while logged in to your account.
	45	*** Running a Script to Unlike All Likes
	46	:PROPERTIES:
	47	:CUSTOM_ID: running-a-script-to-unlike-all-likes
	48	:END:
	49	To run this script, you will need to load the
	50	[[https://www.tumblr.com/likes][Likes \| Tumblr]] page while logged in to
	51	your account.
43	52
44		Further, be sure to scroll down to the bottom and force Tumblr to load more
45		posts so that this script unlikes more posts at a time.
	53	Further, be sure to scroll down to the bottom and force Tumblr to load
	54	more posts so that this script unlikes more posts at a time.
46	55
47		Once you are logged in and the page is loaded, open the Developer Tools and be
48		sure you're on the "Console" tab. It should look something like this (this is
49		in Firefox, Chromium should be similar):
	56	Once you are logged in and the page is loaded, open the Developer Tools
	57	and be sure you're on the "Console" tab. It should look something like
	58	this (this is in Firefox, Chromium should be similar):
50	59
51		![Firefox Dev
52		!Tools](https:///img.cleberg.net/blog/20230105-mass-unlike-tumblr-posts/dev_console.png "Firefox Dev Tools")
	60	#+caption: Firefox Dev !Tools
	61	[[https:///img.cleberg.net/blog/20230105-mass-unlike-tumblr-posts/dev_console.png]]
53	62
54		All you need to do is paste the following snippet into the dev console. This
55		code will collect all unlike buttons (`elements`) and then click each button to
56		unlike it.
	63	All you need to do is paste the following snippet into the dev console.
	64	This code will collect all unlike buttons (=elements=) and then click
	65	each button to unlike it.
57	66
58		Optionally, you can comment-out the line `elements[i].click();` and uncomment
59		the `console.log()` lines to simply print out information without performing any
60		actions. This can be useful to debug issues or confirm that the code below isn't
61		doing anything you don't want it to.
	67	Optionally, you can comment-out the line =elements[i].click();= and
	68	uncomment the =console.log()= lines to simply print out information
	69	without performing any actions. This can be useful to debug issues or
	70	confirm that the code below isn't doing anything you don't want it to.
62	71
63		```javascript
	72	#+begin_src javascript
64	73	const elements = document.querySelectorAll('[aria-label="Unlike"]');
65	74	// console.log(elements); // 👉 [button]
66	75
		@@ -68,20 +77,24 @@ for (let i=0; i < elements.length; i++) {
68	77	// console.log(elements[i]);
69	78	elements[i].click();
70	79	}
71		```
72
73		## Results
74
75		The results were quick for my situation, as it unliked ~200 posts within 2-3
76		seconds. I am not sure how this will perform on larger sets of likes (or if
77		Tumblr has a limit to unliking posts).
78
79		You can see the below screenshot showing that I pasted the snippet into the
80		console, pressed Enter, and then the posts are automatically unliked.
81
82		![Script
83		!Results](https:///img.cleberg.net/blog/20230105-mass-unlike-tumblr-posts/script_results.png "Script Results")
84
85		Thinking about this further, I would bet that this would be fairly simple to
86		package into a browser add-on so that users could install the add-on, go to
87		their Likes page, and click a button to run the script. Food for thought.
	80	#+end_src
	81
	82	** Results
	83	:PROPERTIES:
	84	:CUSTOM_ID: results
	85	:END:
	86	The results were quick for my situation, as it unliked ~200 posts within
	87	2-3 seconds. I am not sure how this will perform on larger sets of likes
	88	(or if Tumblr has a limit to unliking posts).
	89
	90	You can see the below screenshot showing that I pasted the snippet into
	91	the console, pressed Enter, and then the posts are automatically
	92	unliked.
	93
	94	#+caption: Script !Results
	95	[[https:///img.cleberg.net/blog/20230105-mass-unlike-tumblr-posts/script_results.png]]
	96
	97	Thinking about this further, I would bet that this would be fairly
	98	simple to package into a browser add-on so that users could install the
	99	add-on, go to their Likes page, and click a button to run the script.
	100	Food for thought.

blog/2023-01-08-fedora-remove-login-manager.org +36 −33

		@@ -1,44 +1,47 @@
1		+++
2		date = 2023-01-08
3		title = "Remove the Login Manager from Fedora i3"
4		description = "Quickly remove Fedora i3's login manager to launch your desktop manually."
5		+++
6
7		## Fedora i3's Login Manager
8
9		Since I use the i3 spin of Fedora Workstation, I don't like to have a login
10		manager installed by default. As of the current version of Fedora i3, the
11		default login manager is LightDM.
12
13		If this is no longer the case, you can search for currently-installed packages
14		with the following command and see if you can identify a different login
15		manager.
16
17		```sh
	1	#+title: Remove the Login Manager from Fedora i3
	2	#+date: 2023-01-08
	3
	4	** Fedora i3's Login Manager
	5	:PROPERTIES:
	6	:CUSTOM_ID: fedora-i3s-login-manager
	7	:END:
	8	Since I use the i3 spin of Fedora Workstation, I don't like to have a
	9	login manager installed by default. As of the current version of Fedora
	10	i3, the default login manager is LightDM.
	11
	12	If this is no longer the case, you can search for currently-installed
	13	packages with the following command and see if you can identify a
	14	different login manager.
	15
	16	#+begin_src sh
18	17	sudo dnf list installed
19		```
20
21		## Removing the Login Manager
	18	#+end_src
22	19
	20	** Removing the Login Manager
	21	:PROPERTIES:
	22	:CUSTOM_ID: removing-the-login-manager
	23	:END:
23	24	In order to remove the login manager, simply uninstall the package.
24	25
25		```sh
	26	#+begin_src sh
26	27	sudo dnf remove lightdm
27		```
28
29		## Launching i3 Manually
	28	#+end_src
30	29
31		In order to launch i3 manually, you need to set up your X session properly.
32		To start, create or edit the `~/.xinitrc` file to include the following at
33		the bottom.
	30	** Launching i3 Manually
	31	:PROPERTIES:
	32	:CUSTOM_ID: launching-i3-manually
	33	:END:
	34	In order to launch i3 manually, you need to set up your X session
	35	properly. To start, create or edit the =~/.xinitrc= file to include the
	36	following at the bottom.
34	37
35		```config
	38	#+begin_src config
36	39	exec i3
37		```
	40	#+end_src
38	41
39		Now, whenever you log in to the TTY, you can launch your desktop with the
40		following command.
	42	Now, whenever you log in to the TTY, you can launch your desktop with
	43	the following command.
41	44
42		```sh
	45	#+begin_src sh
43	46	startx
44		```
	47	#+end_src

blog/2023-01-21-running-flatpak-apps-easily.org +34 −29

		@@ -1,45 +1,50 @@
1		+++
2		date = 2023-01-21
3		title = "Running Flatpak Apps with Symlinks"
4		description = "Run flatpak apps faster and easier with a simple symlink solution."
5		+++
	1	#+title: Running Flatpak Apps with Symlinks
	2	#+date: 2023-01-21
6	3
7		## Running Flatpak Apps Should Be Faster
	4	** Running Flatpak Apps Should Be Faster
	5	:PROPERTIES:
	6	:CUSTOM_ID: running-flatpak-apps-should-be-faster
	7	:END:
	8	If you're like me and use Flatpak for those pesky apps that cannot run
	9	on your system for one reason or another, you likely get annoyed with
	10	opening a terminal and manually running the Flatpak app with the lengthy
	11	=flatpak run ...= command.
8	12
9		If you're like me and use Flatpak for those pesky apps that cannot run on your
10		system for one reason or another, you likely get annoyed with opening a terminal
11		and manually running the Flatpak app with the lengthy `flatpak run ...` command.
12
13		In the past, I manually created aliases in my `.zshrc` file for certain apps.
14		For example, an alias would look like the example below.
	13	In the past, I manually created aliases in my =.zshrc= file for certain
	14	apps. For example, an alias would look like the example below.
15	15
16	16	This would allow me to run the command fast within the terminal, but it
17	17	wouldn't allow me to run it in an application launcher.
18	18
19		```sh
	19	#+begin_src sh
20	20	# ~/.zshrc
21	21	alias librewolf = "flatpak run io.gitlab.librewolf-community"
22		```
23
24		However, I now use a much faster and better method that integrates with the
25		tiling WMs I use and their application launchers - `dmenu` and `bemenu`.
	22	#+end_src
26	23
27		## Creating Symlinks for Flatpak Apps
	24	However, I now use a much faster and better method that integrates with
	25	the tiling WMs I use and their application launchers - =dmenu= and
	26	=bemenu=.
28	27
29		Let's use the example of Librewolf below. I can install the application like so:
	28	** Creating Symlinks for Flatpak Apps
	29	:PROPERTIES:
	30	:CUSTOM_ID: creating-symlinks-for-flatpak-apps
	31	:END:
	32	Let's use the example of Librewolf below. I can install the application
	33	like so:
30	34
31		```sh
	35	#+begin_src sh
32	36	flatpak install flathub io.gitlab.librewolf-community
33		```
	37	#+end_src
34	38
35		Once installed, I can create a symlink to link the flatpak app to my new symlink
36		in a location commonly included in your PATH. In this case, I chose `/usr/bin`.
37		You may need to choose a different location if `/usr/bin` isn't in your PATH.
	39	Once installed, I can create a symlink to link the flatpak app to my new
	40	symlink in a location commonly included in your PATH. In this case, I
	41	chose =/usr/bin=. You may need to choose a different location if
	42	=/usr/bin= isn't in your PATH.
38	43
39		```sh
	44	#+begin_src sh
40	45	ln -s /var/lib/flatpak/exports/bin/io.gitlab.librewolf-community /usr/bin/librewolf
41		```
	46	#+end_src
42	47
43		Once complete, you should be able to launch the app using the command name you
44		chose above in the symlink (`librewolf`) from a terminal or from your
45		application launcher!
	48	Once complete, you should be able to launch the app using the command
	49	name you chose above in the symlink (=librewolf=) from a terminal or
	50	from your application launcher!

blog/2023-01-23-random-mullvad-wireguard.org +60 −55

		@@ -1,47 +1,49 @@
1		+++
2		date = 2023-01-23
3		title = "Connecting to a Random Mullvad Wireguard Host"
4		description = "Read to see how I used a shell script to randomly connect to a Mullvad Wireguard host each time I run the script."
5		+++
	1	#+title: Connecting to a Random Mullvad Wireguard Host
	2	#+date: 2023-01-23
6	3
7		## Mullvad Wireguard
8
9		If you're using an OS that does not support one of Mullvad's apps, you're
10		likely using the Wireguard configuration files instead.
	4	** Mullvad Wireguard
	5	:PROPERTIES:
	6	:CUSTOM_ID: mullvad-wireguard
	7	:END:
	8	If you're using an OS that does not support one of Mullvad's apps,
	9	you're likely using the Wireguard configuration files instead.
11	10
12	11	If not, the first step is to visit Mullvad's
13		[Wireguard configuration
14		files](https://mullvad.net/en/account/#/wireguard-config) page and download a
15		ZIP of the configuration files you want to use.
	12	[[https://mullvad.net/en/account/#/wireguard-config][Wireguard
	13	configuration files]] page and download a ZIP of the configuration files
	14	you want to use.
16	15
17		Personally, I downloaded all configuration files across the world and chose my
18		connections using the script below.
	16	Personally, I downloaded all configuration files across the world and
	17	chose my connections using the script below.
19	18
20		Once the files are downloaded, unzip them and move them to your preferred
21		location:
	19	Once the files are downloaded, unzip them and move them to your
	20	preferred location:
22	21
23		```sh
	22	#+begin_src sh
24	23	cd Downloads
25	24	unzip mullvad_wireguard_linux_all_all.zip
26	25	mkdir ~/mullvad && mv ~/Downloads/*.conf ~/mullvad/
27		```
28
29		## Creating a Script to Connect to a Random Host
	26	#+end_src
30	27
31		Once you have a folder of Wireguard configuration files from Mullvad, you can
32		create a script to randomly connect to any one of the locations.
	28	** Creating a Script to Connect to a Random Host
	29	:PROPERTIES:
	30	:CUSTOM_ID: creating-a-script-to-connect-to-a-random-host
	31	:END:
	32	Once you have a folder of Wireguard configuration files from Mullvad,
	33	you can create a script to randomly connect to any one of the locations.
33	34
34		Start by creating a shell script - mine is called `vpn.sh`.
	35	Start by creating a shell script - mine is called =vpn.sh=.
35	36
36		```sh
	37	#+begin_src sh
37	38	nano ~/vpn.sh
38		```
	39	#+end_src
39	40
40		Within this script, you can paste the following info. Note that I specify `us-*`
41		in my script, which means that it will only consider US-based VPN locations. You
42		can alter this or simply change it `*` to consider all locations.
	41	Within this script, you can paste the following info. Note that I
	42	specify =us-*= in my script, which means that it will only consider
	43	US-based VPN locations. You can alter this or simply change it =*= to
	44	consider all locations.
43	45
44		```sh
	46	#+begin_src sh
45	47	#!/bin/sh
46	48
47	49	ls /home/$USER/mullvad/us-* \|sort -R \|tail -n 1 \|while read file; do
		@@ -52,19 +54,19 @@ ls /home/$USER/mullvad/us-* \|sort -R \|tail -n 1 \|while read file; do
52	54	printf "\n\nPrinting new IP info:\n"
53	55	curl https://am.i.mullvad.net/connected
54	56	done
55		```
	57	#+end_src
56	58
57		Once you've modified the script to your liking, add executable permissions
58		and run the script:
	59	Once you've modified the script to your liking, add executable
	60	permissions and run the script:
59	61
60		```sh
	62	#+begin_src sh
61	63	chmod +x ~/vpn.sh
62	64	~/vpn.sh
63		```
	65	#+end_src
64	66
65	67	The output should look like the following:
66	68
67		```txt
	69	#+begin_src txt
68	70	doas (user@host) password:
69	71
70	72	# ... The script will process all of the iptables and wg commands here
		@@ -73,42 +75,45 @@ Created Mullvad wireguard connection with file: /home/user/mullvad/us-nyc-wg-210
73	75
74	76	Printing new IP info:
75	77	You are connected to Mullvad (server country-city-wg-num). Your IP address is 12.345.678.99
76		```
	78	#+end_src
77	79
78	80	That's all there is to it. You can see your new location and IP via the
79		`printf` and `curl` commands included in the script.
80
81		You can also go to the [Connection Check \|
82		Mullvad](https://mullvad.net/en/check/) page to see if you are fully connected
83		to Mullvad and if any leaks exist.
	81	=printf= and =curl= commands included in the script.
84	82
85		![Mullvad Connection Check](https://img.cleberg.net/blog/20230123-random-mullvad-wireguard/mullvad_check.png "Mullvad Connection Check")
	83	You can also go to the [[https://mullvad.net/en/check/][Connection Check
	84	\| Mullvad]] page to see if you are fully connected to Mullvad and if any
	85	leaks exist.
86	86
87		## Disconnecting from the Wireguard Connection
	87	#+caption: Mullvad Connection Check
	88	[[https://img.cleberg.net/blog/20230123-random-mullvad-wireguard/mullvad_check.png]]
88	89
89		If you forget which connection you're using, you can execute the following
90		command to see where Wireguard is currently connected:
	90	** Disconnecting from the Wireguard Connection
	91	:PROPERTIES:
	92	:CUSTOM_ID: disconnecting-from-the-wireguard-connection
	93	:END:
	94	If you forget which connection you're using, you can execute the
	95	following command to see where Wireguard is currently connected:
91	96
92		```sh
	97	#+begin_src sh
93	98	wg show
94		```
	99	#+end_src
95	100
96	101	This command will show you the Wireguard interfaces and should output a
97		connection like so: `interface: us-lax-wg-104`.
	102	connection like so: =interface: us-lax-wg-104=.
98	103
99	104	Once you have this, just disconnect using that files' full path:
100	105
101		```sh
	106	#+begin_src sh
102	107	wg-quick down /home/user/mullvad/us-lax-wg-104.conf
103		```
	108	#+end_src
104	109
105		I have a TODO item on figuring out how to easily export an environment variable
106		that contains the configuration file's full name, so that I can just execute the
107		following:
	110	I have a TODO item on figuring out how to easily export an environment
	111	variable that contains the configuration file's full name, so that I can
	112	just execute the following:
108	113
109		```sh
	114	#+begin_src sh
110	115	# Ideal situation if I can export the $file variable to the environment
111	116	wg-quick down $file
112		```
	117	#+end_src
113	118
114	119	If you have an idea on how to do this, email me!

blog/2023-01-28-self-hosting-wger-workout-manager.org +100 −78

		@@ -1,27 +1,33 @@
1		+++
2		date = 2023-01-28
3		title = "Self-Hosting Wger Workout Manager"
4		description = "A walkthrough on how to host Wger with Docker on Linux."
5		+++
6
7		## Wger: The Self-Hosted Workout Manager
8
9		[Wger Workout Manager](https://wger.de) is a fitness tracking tool for those who
10		enjoy self-hosting their data. You can also register an account on their main
11		website if you'd prefer to try without self-hosting.
12
13		### Features
14
15		I didn't see a full listing of features anywhere, so I compiled this list of my
16		own after installing wger:
17
18		#### Dashboard
19
20		- Dashboard view of Workout Schedule, Nutrition Plan, Weight Graph, & last 5
21		Weight Logs
22
23		#### Training
24
	1	#+title: Self-Hosting Wger Workout Manager
	2	#+date: 2023-01-28
	3
	4	** Wger: The Self-Hosted Workout Manager
	5	:PROPERTIES:
	6	:CUSTOM_ID: wger-the-self-hosted-workout-manager
	7	:END:
	8	[[https://wger.de][Wger Workout Manager]] is a fitness tracking tool for
	9	those who enjoy self-hosting their data. You can also register an
	10	account on their main website if you'd prefer to try without
	11	self-hosting.
	12
	13	*** Features
	14	:PROPERTIES:
	15	:CUSTOM_ID: features
	16	:END:
	17	I didn't see a full listing of features anywhere, so I compiled this
	18	list of my own after installing wger:
	19
	20	**** Dashboard
	21	:PROPERTIES:
	22	:CUSTOM_ID: dashboard
	23	:END:
	24	- Dashboard view of Workout Schedule, Nutrition Plan, Weight Graph, &
	25	last 5 Weight Logs
	26
	27	**** Training
	28	:PROPERTIES:
	29	:CUSTOM_ID: training
	30	:END:
25	31	- Workout Log
26	32	- Workout Schedule
27	33	- Calendar (shows weight logs and Bad/Neutral/Good days)
		@@ -30,72 +36,83 @@ Weight Logs
30	36	- Public templates
31	37	- Exercises
32	38
33		#### Nutrition
34
	39	**** Nutrition
	40	:PROPERTIES:
	41	:CUSTOM_ID: nutrition
	42	:END:
35	43	- Nutrition plans
36	44	- BMI calculator
37	45	- Daily calories calculator
38	46	- Ingredient overview
39	47
40		#### Body Weight
41
	48	**** Body Weight
	49	:PROPERTIES:
	50	:CUSTOM_ID: body-weight
	51	:END:
42	52	- Weight overview
43	53
44		### Documentation
45
	54	*** Documentation
	55	:PROPERTIES:
	56	:CUSTOM_ID: documentation
	57	:END:
46	58	In order to self-host wger, I opted to use the Docker version of the
47	59	application. You can read the README within the
48		[wger-project/docker](https://github.com/wger-project/docker) project on GitHub
49		for information and installation instructions.
	60	[[https://github.com/wger-project/docker][wger-project/docker]] project
	61	on GitHub for information and installation instructions.
50	62
51		### Installation
	63	*** Installation
	64	:PROPERTIES:
	65	:CUSTOM_ID: installation
	66	:END:
	67	To start the installation, I created a folder for wger and started
	68	creating the three necessary files:
52	69
53		To start the installation, I created a folder for wger and started creating the
54		three necessary files:
55
56		```sh
	70	#+begin_src sh
57	71	mkdir ~/wger && mkdir ~/wger/config
58	72	touch ~/wger/docker-compose.yml && \
59	73	touch ~/wger/config/prod.env && \
60	74	touch ~/wger/config/nginx.conf
61		```
	75	#+end_src
62	76
63		Once you have the folders and files created, you will need to copy the contents
64		of the `docker-compose.yml`, `prod.env`, and `nginx.conf` from the GitHub link
65		above.
	77	Once you have the folders and files created, you will need to copy the
	78	contents of the =docker-compose.yml=, =prod.env=, and =nginx.conf= from
	79	the GitHub link above.
66	80
67	81	A few notes to explain the changes I made to the default files:
68	82
69		- I updated the `ALLOW_REGISTRAION` variable in `prod.env` to `False` after I
70		created an account via my LAN connection, before I connected this app to a
71		publicly-available domain.
72		- I uncommented and updated `CSRF_TRUSTED_ORIGINS` to be equal to the public
73		version of this app: `https://wger.example.com`.
74		- I updated the port within `docker-compose.yml`, within the `nginx` block. The
75		port I updated this to will be reflected in my nginx configuration file on the
76		server (NOT the wger nginx.conf file).
77
78		### Deploy
79
	83	- I updated the =ALLOW_REGISTRAION= variable in =prod.env= to =False=
	84	after I created an account via my LAN connection, before I connected
	85	this app to a publicly-available domain.
	86	- I uncommented and updated =CSRF_TRUSTED_ORIGINS= to be equal to the
	87	public version of this app: =https://wger.example.com=.
	88	- I updated the port within =docker-compose.yml=, within the =nginx=
	89	block. The port I updated this to will be reflected in my nginx
	90	configuration file on the server (NOT the wger nginx.conf file).
	91
	92	*** Deploy
	93	:PROPERTIES:
	94	:CUSTOM_ID: deploy
	95	:END:
80	96	Once all files are created and modified to your needs, simply start the
81	97	container.
82	98
83		```sh
	99	#+begin_src sh
84	100	docker-compose up -d
85		```
	101	#+end_src
86	102
87		You can now visit the website on your LAN by going to `localhost:YOUR_PORT` or
88		by the server's IP, if you're not on the same machine that is running the
89		container.
	103	You can now visit the website on your LAN by going to
	104	=localhost:YOUR_PORT= or by the server's IP, if you're not on the same
	105	machine that is running the container.
90	106
91		If you wish to connect this app to a public domain name, you'll need to point an
92		`A` DNS record from the domain to your server's public IP. You'll then need to
93		create a configuration file for whichever web server or reverse proxy you're
94		using.
	107	If you wish to connect this app to a public domain name, you'll need to
	108	point an =A= DNS record from the domain to your server's public IP.
	109	You'll then need to create a configuration file for whichever web server
	110	or reverse proxy you're using.
95	111
96		Wger's README suggests the following reverse proxy configuration for Nginx:
	112	Wger's README suggests the following reverse proxy configuration for
	113	Nginx:
97	114
98		```conf
	115	#+begin_src conf
99	116	upstream wger {
100	117	# This port should match the port in the `nginx` block of docker-compose.yml
101	118	# If the container is running on this same machine, replace this with
		@@ -122,27 +139,32 @@ server {
122	139	ssl_certificate /path/to/https/certificate.crt;
123	140	ssl_certificate_key /path/to/https/certificate.key;
124	141	}
125		```
126
127		## Thoughts on Wger
	142	#+end_src
128	143
	144	** Thoughts on Wger
	145	:PROPERTIES:
	146	:CUSTOM_ID: thoughts-on-wger
	147	:END:
129	148	I'm still playing around with the app itself, but it seems to be a solid
130	149	all-around workout manager, weight log, and food log.
131	150
132		I like that the weight log graph is fluid and updates quickly. You can also
133		import or export data in CSV format if you'd like to move your data elsewhere.
134
135		The workout manager is slightly odd, as it requires you to enter sets and reps
136		for each exercise when you enter it into the plan. Then, when you add a log
137		entry for performing a workout, you then add what you actually performed, in
138		terms of reps and weight.
	151	I like that the weight log graph is fluid and updates quickly. You can
	152	also import or export data in CSV format if you'd like to move your data
	153	elsewhere.
139	154
140		I haven't tried the food log yet and I likely will not, at least for a
141		while.
142		I have no need for a food log or calorie tracker at the moment.
	155	The workout manager is slightly odd, as it requires you to enter sets
	156	and reps for each exercise when you enter it into the plan. Then, when
	157	you add a log entry for performing a workout, you then add what you
	158	actually performed, in terms of reps and weight.
143	159
144		### Screenshot Example
	160	I haven't tried the food log yet and I likely will not, at least for a
	161	while. I have no need for a food log or calorie tracker at the moment.
145	162
	163	*** Screenshot Example
	164	:PROPERTIES:
	165	:CUSTOM_ID: screenshot-example
	166	:END:
146	167	You can see an example of a dashboard with placeholder data here:
147	168
148		![wger dashboard](https://img.cleberg.net/blog/20230128-wger/wger.png "wger dashboard")
	169	#+caption: wger dashboard
	170	[[https://img.cleberg.net/blog/20230128-wger/wger.png]]

blog/2023-02-02-exploring-hare.org +145 −118

		@@ -1,162 +1,189 @@
1		+++
2		date = 2023-02-02
3		title = "Exploring the Hare Programming Language"
4		description = "Walking back through my first project using the Hare programming language."
5		aliases = ["/blog/testing-out-hare"]
6		+++
7
8		## A Quick Note
9
10		By no means am I a professional developer, so this post will be rather short.
11		I won't be going into depth on the specification or anything that technical.
12
13		Instead, I will simply be talking about how I (a relatively basic hobbyist
14		programmer) have been playing with Hare and what intrigues me about the
15		language.
16
17		## Hare
18
19		The [Hare](https://harelang.org) programming language is a straightforward
20		language that should look familiar if you've ever programmed with C, Rust,
21		or other languages that aim to build software at the system-level.
	1	#+title: Exploring the Hare Programming Language
	2	#+date: 2023-02-02
	3
	4	** A Quick Note
	5	:PROPERTIES:
	6	:CUSTOM_ID: a-quick-note
	7	:END:
	8	By no means am I a professional developer, so this post will be rather
	9	short. I won't be going into depth on the specification or anything that
	10	technical.
	11
	12	Instead, I will simply be talking about how I (a relatively basic
	13	hobbyist programmer) have been playing with Hare and what intrigues me
	14	about the language.
	15
	16	** Hare
	17	:PROPERTIES:
	18	:CUSTOM_ID: hare
	19	:END:
	20	The [[https://harelang.org][Hare]] programming language is a
	21	straightforward language that should look familiar if you've ever
	22	programmed with C, Rust, or other languages that aim to build software
	23	at the system-level.
22	24
23	25	The Hare homepage states the following:
24	26
25		> Hare is a systems programming language designed to be simple, stable, and
26		> robust. Hare uses a static type system, manual memory management, and
27		> minimal runtime. It is well-suited to writing operating systems, system
28		> tools, compilers, networking software, and other low-level, high performance
29		> tasks.
	27	#+begin_quote
	28	Hare is a systems programming language designed to be simple, stable,
	29	and robust. Hare uses a static type system, manual memory management,
	30	and minimal runtime. It is well-suited to writing operating systems,
	31	system tools, compilers, networking software, and other low-level, high
	32	performance tasks.
30	33
31		I have found this all to be true while playing with it for the first time today.
32		In the next few sections, I'm going to walk through my installation and first
33		program.
	34	#+end_quote
34	35
35		### Installation
	36	I have found this all to be true while playing with it for the first
	37	time today. In the next few sections, I'm going to walk through my
	38	installation and first program.
36	39
37		I'm currently running Alpine Linux on my Thinkpad, so the installation was quite
38		easy as there is a package for Hare in the `apk` repositories.
	40	*** Installation
	41	:PROPERTIES:
	42	:CUSTOM_ID: installation
	43	:END:
	44	I'm currently running Alpine Linux on my Thinkpad, so the installation
	45	was quite easy as there is a package for Hare in the =apk= repositories.
39	46
40		```sh
	47	#+begin_src sh
41	48	doas apk add hare hare-doc
42		```
	49	#+end_src
43	50
44		However, I was able to install Hare from scratch on Fedora Linux a short while
45		ago, which was also very easy to do. If you need further instructions and Hare
46		doesn't have a package on your system, take a look at the [Hare
47		Installation](https://harelang.org/installation/) page.
48
49		### Creating a Test Project
	51	However, I was able to install Hare from scratch on Fedora Linux a short
	52	while ago, which was also very easy to do. If you need further
	53	instructions and Hare doesn't have a package on your system, take a look
	54	at the [[https://harelang.org/installation/][Hare Installation]] page.
50	55
	56	*** Creating a Test Project
	57	:PROPERTIES:
	58	:CUSTOM_ID: creating-a-test-project
	59	:END:
51	60	In order to play with the language, I created
52		[hare-test](https://git.sr.ht/~cmc/hare-projects) and will be
53		putting any of my Hare-related adventures in here.
	61	[[https://git.sr.ht/~cmc/hare-projects][hare-test]] and will be putting
	62	any of my Hare-related adventures in here.
	63
	64	#+begin_quote
	65	Update: I also created a simple Hare program for creating a file from
	66	user input:
	67	[[https://git.sr.ht/~cmc/hare-projects/tree/main/item/files/files.ha][files.ha]]
54	68
55		> Update: I also created a simple Hare program for creating a file from user
56		> input:
57		> [files.ha](https://git.sr.ht/~cmc/hare-projects/tree/main/item/files/files.ha)
	69	#+end_quote
58	70
59		Luckily, Hare doesn't require any complex set-up tools or build environment.
60		Once you have Hare installed, you simply need to create a file ending with `.ha`
61		and you can run a Hare program.
	71	Luckily, Hare doesn't require any complex set-up tools or build
	72	environment. Once you have Hare installed, you simply need to create a
	73	file ending with =.ha= and you can run a Hare program.
62	74
63		I created a file called `rgb.ha` in order to test out the random number
	75	I created a file called =rgb.ha= in order to test out the random number
64	76	generation and passing parameters between functions.
65	77
66		```sh
	78	#+begin_src sh
67	79	nano rgb.ha
68		```
	80	#+end_src
69	81
70		Within this file, I was able to easily import a few of the [standard library
71		modules](https://harelang.org/tutorials/stdlib/): `fmt`, `math::random`, and
72		`datetime`.
	82	Within this file, I was able to easily import a few of the
	83	[[https://harelang.org/tutorials/stdlib/][standard library modules]]:
	84	=fmt=, =math::random=, and =datetime=.
73	85
74	86	With these modules, I created two functions:
75	87
76		1. `main`: This function calls the `generate_rgb` function and then prints out
77		the returned values.
78		2. `generate_rgb`: This function uses the current Unix epoch time to generate a
79		pseudo-random value and uses this value to create three more random values
80		between 0 and 255. These three numbers represent a color in RGB format.
	88	1. =main=: This function calls the =generate_rgb= function and then
	89	prints out the returned values.
	90	2. =generate_rgb=: This function uses the current Unix epoch time to
	91	generate a pseudo-random value and uses this value to create three
	92	more random values between 0 and 255. These three numbers represent a
	93	color in RGB format.
81	94
82		> Note: Some syntax coloring may look odd, as Zola currently doesn't have a
83		> syntax highlighting theme for Hare. Instead, I'm using the C theme, which may
84		> not be exactly accurate when coloring the code below.
	95	#+begin_quote
	96	Note: Some syntax coloring may look odd, as Zola currently doesn't
	97	have a syntax highlighting theme for Hare. Instead, I'm using the C
	98	theme, which may not be exactly accurate when coloring the code below.
85	99
86		```c
	100	#+end_quote
	101
	102	#+begin_src C
87	103	use datetime;
88	104	use fmt;
89	105	use math::random;
90	106
91	107	export fn main() void = {
92		const rgb = generate_rgb();
93		fmt::printfln("RGB: ({}, {}, {})", rgb[0], rgb[1], rgb[2])!;
	108	const rgb = generate_rgb();
	109	fmt::printfln("RGB: ({}, {}, {})", rgb[0], rgb[1], rgb[2])!;
94	110	};
95	111
96	112	fn generate_rgb() []u64 = {
97		// Use the current Unix epoch time as the seed value
98		let datetime = datetime::epochunix(&datetime::now());
	113	// Use the current Unix epoch time as the seed value
	114	let datetime = datetime::epochunix(&datetime::now());
99	115
100		// Generate initial pseudo-random value
101		// You must cast the datetime from int to u64
102		let x = random::init(datetime: u64);
	116	// Generate initial pseudo-random value
	117	// You must cast the datetime from int to u64
	118	let x = random::init(datetime: u64);
103	119
104		// Generate RGB values between (0, 255) using pseudo-random init value
105		let r = random::u64n(&x, 255);
106		let g = random::u64n(&x, 255);
107		let b = random::u64n(&x, 255);
	120	// Generate RGB values between (0, 255) using pseudo-random init value
	121	let r = random::u64n(&x, 255);
	122	let g = random::u64n(&x, 255);
	123	let b = random::u64n(&x, 255);
108	124
109		// Structure data as array and return
110		let rgb_array: [3]u64 = [r, g, b];
111		return rgb_array;
	125	// Structure data as array and return
	126	let rgb_array: [3]u64 = [r, g, b];
	127	return rgb_array;
112	128	};
113		```
114
115		### Running a Program
	129	#+end_src
116	130
117		Once you have a Hare file written and ready to run, you simply need to run it:
	131	*** Running a Program
	132	:PROPERTIES:
	133	:CUSTOM_ID: running-a-program
	134	:END:
	135	Once you have a Hare file written and ready to run, you simply need to
	136	run it:
118	137
119		```sh
	138	#+begin_src sh
120	139	hare run file.ha
121		```
	140	#+end_src
122	141
123	142	You can also compile the program into an executable:
124	143
125		```sh
	144	#+begin_src sh
126	145	hare build -o example file.ha
127	146	./example
128		```
129
130		### Initial Thoughts
131
132		#### Documentation Improvements Would Help
133
134		While I was able to piece everything together eventually, the biggest downfall
135		right now in Hare's documentation. For such a new project, the documentation is
136		in a great spot. However, bare specifications don't help as much as a brief
137		examples section would.
138
139		For example, it took me a while to figure out what the `u64n` function was
140		looking for. I could tell that it took two parameters and the second was my max
141		value (255), but couldn't figure out what the first value should be. Eventually,
142		I inspected the `random.ha` file in the [Hare source
143		code](https://git.sr.ht/~sircmpwn/hare/tree/master/item/math/random/random.ha)
144		and found the test suite that helped me discover that it needed an `init()`
145		value in the form of `&var`.
146
147		#### More Basic Modules
148
	147	#+end_src
	148
	149	*** Initial Thoughts
	150	:PROPERTIES:
	151	:CUSTOM_ID: initial-thoughts
	152	:END:
	153	**** Documentation Improvements Would Help
	154	:PROPERTIES:
	155	:CUSTOM_ID: documentation-improvements-would-help
	156	:END:
	157	While I was able to piece everything together eventually, the biggest
	158	downfall right now in Hare's documentation. For such a new project, the
	159	documentation is in a great spot. However, bare specifications don't
	160	help as much as a brief examples section would.
	161
	162	For example, it took me a while to figure out what the =u64n= function
	163	was looking for. I could tell that it took two parameters and the second
	164	was my max value (255), but couldn't figure out what the first value
	165	should be. Eventually, I inspected the =random.ha= file in the
	166	[[https://git.sr.ht/~sircmpwn/hare/tree/master/item/math/random/random.ha][Hare
	167	source code]] and found the test suite that helped me discover that it
	168	needed an =init()= value in the form of =&var=.
	169
	170	**** More Basic Modules
	171	:PROPERTIES:
	172	:CUSTOM_ID: more-basic-modules
	173	:END:
149	174	This is another point that comes from Hare being new and awaiting more
150		contributions, but there are some basic functions that I would personally enjoy
151		seeing in Hare, such as one to convert decimal (base 10) values to hexadecimal
152		(base 16).
153
154		If I'm feeling comfortable with my math, I may work on the list of functions I
155		want and see if any can make it into the Hare source code.
156
157		#### Overall Thoughts
158
159		Overall, I actually really enjoy Hare. It's not as tedious to get a project up
160		and running as Rust, but it's also simpler and more user-friendly than learning
161		C. I am going to continue playing with it and see if I can make anything of
162		particular value.
	175	contributions, but there are some basic functions that I would
	176	personally enjoy seeing in Hare, such as one to convert decimal
	177	(base 10) values to hexadecimal (base 16).
	178
	179	If I'm feeling comfortable with my math, I may work on the list of
	180	functions I want and see if any can make it into the Hare source code.
	181
	182	**** Overall Thoughts
	183	:PROPERTIES:
	184	:CUSTOM_ID: overall-thoughts
	185	:END:
	186	Overall, I actually really enjoy Hare. It's not as tedious to get a
	187	project up and running as Rust, but it's also simpler and more
	188	user-friendly than learning C. I am going to continue playing with it
	189	and see if I can make anything of particular value.

blog/2023-05-22-burnout.org +47 −42

		@@ -1,43 +1,48 @@
1		+++
2		date = 2023-05-22
3		title = "Burnout"
4		description = "Dealing with burnout."
5		+++
6
7		## RE: Burnout
8
9		I recently read [Drew DeVault's post on burnout](https://drewdevault.com/2023/05/01/2023-05-01-Burnout.html)
10		around the same time I was pulling out of a burnout rut myself earlier this month.
11		Finally, seeing the light at the end of my burnout tunnel made me want to
12		write my first post back on this topic.
13
14		## Busy Seasons on Busy Seasons
15
	1	#+title: Burnout
	2	#+date: 2023-05-22
	3
	4	** RE: Burnout
	5	:PROPERTIES:
	6	:CUSTOM_ID: re-burnout
	7	:END:
	8	I recently read
	9	[[https://drewdevault.com/2023/05/01/2023-05-01-Burnout.html][Drew
	10	DeVault's post on burnout]] around the same time I was pulling out of a
	11	burnout rut myself earlier this month. Finally, seeing the light at the
	12	end of my burnout tunnel made me want to write my first post back on
	13	this topic.
	14
	15	** Busy Seasons on Busy Seasons
	16	:PROPERTIES:
	17	:CUSTOM_ID: busy-seasons-on-busy-seasons
	18	:END:
16	19	My career deals with busy seasons, generally driven by client demand.
17		This last year, I dealt with a harsh busy season from Aug to Oct 2022 to
18		issue a few SOC reports for the period ending 2022-09-30.
19		Immediately following that, I had to pivot and found another busy season
20		from Oct to Jan for financial statement audits ending on 2022-12-31.
21		Then again, supporting other clients from Jan to Mar 2023, followed by my
22		current client workload aiming for SOC reports due on 2023-06-30.
23
24		The result? A busy season that has lasted from August 2022 through today. I
25		will likely be rushing throughout the next month or two before I have a brief
26		break and need to focus on the 2023-09-30 SOC reports again. While auditing and
27		consulting always involve a busy season, this is the first time I've
28		had one last 9+ months without a break.
29
30		While it's been tough, I have a handful of breaks pre-planned throughout this
31		next cycle and should be able to moderate the level of commitment required for
32		each client.
33
34		## Refocusing
35
36		Outside of work, I finally have time to work on hobbies such as this website,
37		programming, athletics, games, etc.
38
39		You may have noticed my absence if you're in the same channels, forums, and
40		rooms that I am, but I should finally be active again.
41
42		I'm hoping to break an item out of my backlog soon and start working on building
43		a new project or hack around with a stale one.
	20	This last year, I dealt with a harsh busy season from Aug to Oct 2022 to
	21	issue a few SOC reports for the period ending 2022-09-30. Immediately
	22	following that, I had to pivot and found another busy season from Oct to
	23	Jan for financial statement audits ending on 2022-12-31. Then again,
	24	supporting other clients from Jan to Mar 2023, followed by my current
	25	client workload aiming for SOC reports due on 2023-06-30.
	26
	27	The result? A busy season that has lasted from August 2022 through
	28	today. I will likely be rushing throughout the next month or two before
	29	I have a brief break and need to focus on the 2023-09-30 SOC reports
	30	again. While auditing and consulting always involve a busy season, this
	31	is the first time I've had one last 9+ months without a break.
	32
	33	While it's been tough, I have a handful of breaks pre-planned throughout
	34	this next cycle and should be able to moderate the level of commitment
	35	required for each client.
	36
	37	** Refocusing
	38	:PROPERTIES:
	39	:CUSTOM_ID: refocusing
	40	:END:
	41	Outside of work, I finally have time to work on hobbies such as this
	42	website, programming, athletics, games, etc.
	43
	44	You may have noticed my absence if you're in the same channels, forums,
	45	and rooms that I am, but I should finally be active again.
	46
	47	I'm hoping to break an item out of my backlog soon and start working on
	48	building a new project or hack around with a stale one.

blog/2023-06-08-goaccess-geoip.org +54 −45

		@@ -1,46 +1,51 @@
1		+++
2		date = 2023-06-08T22:05:00Z
3		title = "Inspecting Nginx Logs with GoAccess and MaxMind GeoIP Data"
4		description = ""
5		+++
6
7		## Overview
8
9		[GoAccess](https://goaccess.io/) is an open source real-time web log analyzer
10		and interactive viewer that runs in a terminal in *nix systems or through your
11		browser.
12
13		## Installation
14
15		To start, you'll need to install GoAccess for your OS. Here's an example for
16		Debian-based distros:
17
18		```bash
	1	#+title: Inspecting Nginx Logs with GoAccess and MaxMind GeoIP Data
	2	#+date: 2023-06-08
	3
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	[[https://goaccess.io/][GoAccess]] is an open source real-time web log
	9	analyzer and interactive viewer that runs in a terminal in *nix systems
	10	or through your browser.
	11
	12	** Installation
	13	:PROPERTIES:
	14	:CUSTOM_ID: installation
	15	:END:
	16	To start, you'll need to install GoAccess for your OS. Here's an example
	17	for Debian-based distros:
	18
	19	#+begin_src sh
19	20	sudo apt install goaccess
20		```
	21	#+end_src
21	22
22		Next, find any number of the MaxMind GeoIP database files on GitHub or another
23		file hosting website. We're going to use P3TERX's version in this example:
	23	Next, find any number of the MaxMind GeoIP database files on GitHub or
	24	another file hosting website. We're going to use P3TERX's version in
	25	this example:
24	26
25		```bash
	27	#+begin_src sh
26	28	wget https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-City.mmdb
27		```
	29	#+end_src
28	30
29	31	Be sure to save this file in an easy to remember location!
30	32
31		## Usage
32
33		In order to utilize the full capabilities of GoAccess and MMDB, start with the
34		command template below and customize as necessary. This will export an HTML
35		view of the GoAccess dashboard, showing all relevant information related to
36		that site's access log. You can also omit the `-o output.html` parameter if you
37		prefer to view the data within the CLI instead of creating an HTML file.
38
39		With the addition of the GeoIP Database parameter, section `16 - Geo Location`
40		will be added with the various countries that are associated with the collected
41		IP addresses.
42
43		```bash
	33	** Usage
	34	:PROPERTIES:
	35	:CUSTOM_ID: usage
	36	:END:
	37	In order to utilize the full capabilities of GoAccess and MMDB, start
	38	with the command template below and customize as necessary. This will
	39	export an HTML view of the GoAccess dashboard, showing all relevant
	40	information related to that site's access log. You can also omit the
	41	=-o output.html= parameter if you prefer to view the data within the CLI
	42	instead of creating an HTML file.
	43
	44	With the addition of the GeoIP Database parameter, section
	45	=16 - Geo Location= will be added with the various countries that are
	46	associated with the collected IP addresses.
	47
	48	#+begin_src sh
44	49	zcat /var/log/nginx/example.access.log.*.gz \| goaccess \
45	50	--geoip-database=/home/user/GeoLite2-City.mmdb \
46	51	--date-format=%d/%b/%Y \
		@@ -48,18 +53,22 @@ zcat /var/log/nginx/example.access.log.*.gz \| goaccess \
48	53	--log-format=COMBINED \
49	54	-o output.html \
50	55	/var/log/nginx/example.access.log -
51		```
52
53		### Example Output
	56	#+end_src
54	57
	58	*** Example Output
	59	:PROPERTIES:
	60	:CUSTOM_ID: example-output
	61	:END:
55	62	See below for an example of the HTML output:
56	63
57		![GoAccess HTML](https://img.cleberg.net/blog/20230608-goaccess/goaccess-dashboard.png "GoAccess HTML")
	64	#+caption: GoAccess HTML
	65	[[https://img.cleberg.net/blog/20230608-goaccess/goaccess-dashboard.png]]
58	66
59		You can also see the GeoIP card created by the integration of the MaxMind
60		database information.
	67	You can also see the GeoIP card created by the integration of the
	68	MaxMind database information.
61	69
62		![GoAccess GeoIP](https://img.cleberg.net/blog/20230608-goaccess/goaccess-geoip.png "GoAccess GeoIP")
	70	#+caption: GoAccess GeoIP
	71	[[https://img.cleberg.net/blog/20230608-goaccess/goaccess-geoip.png]]
63	72
64		That's all there is to it!
65		Informational data is provided in an organized fashion with minimal effort.
	73	That's all there is to it! Informational data is provided in an
	74	organized fashion with minimal effort.

blog/2023-06-08-self-hosting-baikal-server.org +96 −87

		@@ -1,34 +1,34 @@
1		+++
2		date = 2023-06-08T21:48:00Z
3		title = "Self-Hosting Baïkal Server (CalDAV & CardDAV)"
4		description = "A quick guide on install Baïkal with docker-compose."
5		+++
6
7		## What is Baïkal?
8
9		[Baïkal](https://sabre.io/baikal/) is a lightweight CalDAV + CardDAV server
10		that you can self-host on your own machine.
11		While I have tried (& failed) to get this CalDAV + CardDAV server running
12		before, it was quite easy this time.
13		Not really sure what I did differently this time, but I'm documenting my
14		process here to ensure I don't forget.
15
16		## Installation
17
18		First, create a folder on your server and open a `docker-compose.yml` file for
19		editing:
20
21		```bash
	1	#+title: Self-Hosting Baïkal Server
	2	#+date: 2023-06-08
	3
	4	** What is Baïkal?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-baïkal
	7	:END:
	8	[[https://sabre.io/baikal/][Baïkal]] is a lightweight CalDAV + CardDAV
	9	server that you can self-host on your own machine. While I have tried (&
	10	failed) to get this CalDAV + CardDAV server running before, it was quite
	11	easy this time. Not really sure what I did differently this time, but
	12	I'm documenting my process here to ensure I don't forget.
	13
	14	** Installation
	15	:PROPERTIES:
	16	:CUSTOM_ID: installation
	17	:END:
	18	First, create a folder on your server and open a =docker-compose.yml=
	19	file for editing:
	20
	21	#+begin_src sh
22	22	mkdir baikal && cd baikal
23	23	nano docker-compose.yml
24		```
	24	#+end_src
25	25
26		Within this file, you'll need to paste the information below. You can customize
27		the `ports` section to use any port on your server to pass through to port 80 in
28		the container. You can also edit the `volumes` section to use docker volumes
29		instead of local folders.
	26	Within this file, you'll need to paste the information below. You can
	27	customize the =ports= section to use any port on your server to pass
	28	through to port 80 in the container. You can also edit the =volumes=
	29	section to use docker volumes instead of local folders.
30	30
31		```conf
	31	#+begin_src conf
32	32	version: "2"
33	33	services:
34	34	baikal:
		@@ -39,61 +39,68 @@ services:
39	39	volumes:
40	40	- ./config:/var/www/baikal/config
41	41	- ./data:/var/www/baikal/Specific
42		```
	42	#+end_src
43	43
44		Once finished with editing, save and close the file. Then, launch the docker
45		container:
	44	Once finished with editing, save and close the file. Then, launch the
	45	docker container:
46	46
47		```bash
	47	#+begin_src sh
48	48	sudo docker-compose up -d
49		```
50
51		## Intial Setup
52
53		As long as no issues came up when starting the container, you should be able
54		to visit the server's set-up page at `http://<server_ip>:<port>`.
55		The application will ask you to create an administrator account and choose
56		the database type for your storage.
57		Personally, I opted to use SQLite.
58
59		Make sure the administrator credentials are adequate to protect against
	49	#+end_src
	50
	51	** Intial Setup
	52	:PROPERTIES:
	53	:CUSTOM_ID: intial-setup
	54	:END:
	55	As long as no issues came up when starting the container, you should be
	56	able to visit the server's set-up page at =http://<server_ip>:<port>=.
	57	The application will ask you to create an administrator account and
	58	choose the database type for your storage. Personally, I opted to use
	59	SQLite.
	60
	61	Make sure the administrator credentials are adequate to protect against
60	62	common attacks.
61	63
62		## Creating Users
63
64		Once you've set up the application, you will be greeted by the Dashboard page,
65		which will show the version of the app, status of the admin/CalDAV/CardDAV
66		services, and the number of users, calendars, events, address books, and
67		contacts.
	64	** Creating Users
	65	:PROPERTIES:
	66	:CUSTOM_ID: creating-users
	67	:END:
	68	Once you've set up the application, you will be greeted by the Dashboard
	69	page, which will show the version of the app, status of the
	70	admin/CalDAV/CardDAV services, and the number of users, calendars,
	71	events, address books, and contacts.
68	72
69		![Baïkal Dashboard](https://img.cleberg.net/blog/20230608-baikal/baikal-dashboard.png "Baïkal Dashboard")
	73	#+caption: Baïkal Dashboard
	74	[[https://img.cleberg.net/blog/20230608-baikal/baikal-dashboard.png]]
70	75
71		To create a new user, navigate to the `Users and resources` page. This process
72		is as simple as entering a username, password, and email.
	76	To create a new user, navigate to the =Users and resources= page. This
	77	process is as simple as entering a username, password, and email.
73	78
74		Once a user has been created, you can create any number of calendars and address
75		books for user, as well as inspect their information.
	79	Once a user has been created, you can create any number of calendars and
	80	address books for user, as well as inspect their information.
76	81
77		## Setting Up a Public URL
	82	** Setting Up a Public URL
	83	:PROPERTIES:
	84	:CUSTOM_ID: setting-up-a-public-url
	85	:END:
	86	Once your application is working locally, you can open access remotely
	87	via a URL by using a reverse-proxy like Nginx.
78	88
79		Once your application is working locally, you can open access remotely via a URL
80		by using a reverse-proxy like Nginx.
	89	As a prerequisite, you must own a domain name and set up DNS records to
	90	point a domain name to the server hosting Baïkal.
81	91
82		As a prerequisite, you must own a domain name and set up DNS records
83		to point a domain name to the server hosting Baïkal.
	92	Start by navigating to your web server's configuration directory and
	93	create a new file for this application.
84	94
85		Start by navigating to your web server's configuration directory and create a
86		new file for this application.
87
88		```bash
	95	#+begin_src sh
89	96	cd /etc/nginx/sites-available/
90	97	nano dav
91		```
	98	#+end_src
92	99
93		Within this file, paste in the configuration from below and change
94		`dav.example.com` to match the URL you'll be using.
	100	Within this file, paste in the configuration from below and change
	101	=dav.example.com= to match the URL you'll be using.
95	102
96		```conf
	103	#+begin_src conf
97	104	server {
98	105	if ($host ~ ^[^.]+\.example\.com$) {
99	106	return 301 https://$host$request_uri;
		@@ -123,35 +130,37 @@ server {
123	130	include /etc/letsencrypt/options-ssl-nginx.conf;
124	131	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
125	132	}
126		```
	133	#+end_src
127	134
128		For Nginx on Ubuntu, you'll need to symlink the configuration file to the
129		`sites-enabled` directory and then restart Nginx.
	135	For Nginx on Ubuntu, you'll need to symlink the configuration file to
	136	the =sites-enabled= directory and then restart Nginx.
130	137
131		```bash
	138	#+begin_src sh
132	139	sudo ln -s /etc/nginx/sites-available/dav /etc/nginx/sites-enabled/dav
133	140	sudo systemctl restart nginx.service
134		```
135
136		At this point, the Baïkal server should be available over the internet at the
137		URL configured above!
	141	#+end_src
138	142
139		## Configuring Clients
	143	At this point, the Baïkal server should be available over the internet
	144	at the URL configured above!
140	145
141		Lastly, configuring clients and applications is essential to making sure the DAV
142		server is being fully utilized.
	146	** Configuring Clients
	147	:PROPERTIES:
	148	:CUSTOM_ID: configuring-clients
	149	:END:
	150	Lastly, configuring clients and applications is essential to making sure
	151	the DAV server is being fully utilized.
143	152
144		You can also use the `Users and resources` page to inspect a user's personal
145		link to their calendars and address books by clicking the info (i) button. It
146		will show a URI like
147		`/dav.php/calendars/your-user/default/`.
	153	You can also use the =Users and resources= page to inspect a user's
	154	personal link to their calendars and address books by clicking the info
	155	(i) button. It will show a URI like
	156	=/dav.php/calendars/your-user/default/=.
148	157
149		However, I found that the following URL works for most applications:
150		`/dav.php/principals/your-user/`.
	158	However, I found that the following URL works for most applications:
	159	=/dav.php/principals/your-user/=.
151	160
152		I used the `principals` URL above for Thunderbird (calendar, tasks, and
153		contacts), as well as iOS (calendar, tasks, and contacts) and everything works
154		flawlessly so far.
	161	I used the =principals= URL above for Thunderbird (calendar, tasks, and
	162	contacts), as well as iOS (calendar, tasks, and contacts) and everything
	163	works flawlessly so far.
155	164
156		Syncing is quick between the server and clients, and I haven't seen any
	165	Syncing is quick between the server and clients, and I haven't seen any
157	166	disruptions in the service or data integrity.

blog/2023-06-18-unifi-ip-blocklist.org +72 −60

		@@ -1,37 +1,40 @@
1		+++
2		date = 2023-06-18
3		title = "Block IP Addresses and Subnets with Unifi Network Firewall"
4		description = "A short tutorial on how to create IP Groups in Unifi's Network application and block them via the firewall."
5		+++
6
7		## Identifying Abusive IPs
8
9		If you're like me and use Unifi network equipment at the edge of the network you
10		manage, you may know that Unifi is only somewhat decent at identifying and
11		blocking IPs that represent abusive or threat actors.
12
13		While Unifi has a [threat
14		management](https://help.ui.com/hc/en-us/articles/360006893234-UniFi-Gateway-Threat-Management)
15		tool inside their Network application, it can be lacking in functionality and
16		identification. For example, I have my UDM Pro set to identify and block almost
17		all categories of threats available within the Unifi settings. However, I
18		regularly identify abusive actors on my web server via the server logs.
19
20		In addition, I have identified IP addresses and subnets directly within Unifi's
21		logs that the UDM did not block for whatever reason.
22
23		This guide is meant to be another step in the process to manually block abusive
24		IP addresses or subnets that you have identified but are not being automatically
25		blocked yet.
26
27		## Create an IP Group Profile
28
29		To start, login to the Unifi machine's web GUI and navigate to the Network app >
30		Settings > Profiles.
31
32		Within this page, choose the `IP Groups` tab and click `Create New`.
33
34		![Network Profiles](https://img.cleberg.net/blog/20230618-unifi-ip-blocklist/unifi_profiles.png "Network Profiles")
	1	#+title: Block IP Addresses and Subnets with the Unifi Network Firewall
	2	#+date: 2023-06-18
	3
	4	** Identifying Abusive IPs
	5	:PROPERTIES:
	6	:CUSTOM_ID: identifying-abusive-ips
	7	:END:
	8	If you're like me and use Unifi network equipment at the edge of the
	9	network you manage, you may know that Unifi is only somewhat decent at
	10	identifying and blocking IPs that represent abusive or threat actors.
	11
	12	While Unifi has a
	13	[[https://help.ui.com/hc/en-us/articles/360006893234-UniFi-Gateway-Threat-Management][threat
	14	management]] tool inside their Network application, it can be lacking in
	15	functionality and identification. For example, I have my UDM Pro set to
	16	identify and block almost all categories of threats available within the
	17	Unifi settings. However, I regularly identify abusive actors on my web
	18	server via the server logs.
	19
	20	In addition, I have identified IP addresses and subnets directly within
	21	Unifi's logs that the UDM did not block for whatever reason.
	22
	23	This guide is meant to be another step in the process to manually block
	24	abusive IP addresses or subnets that you have identified but are not
	25	being automatically blocked yet.
	26
	27	** Create an IP Group Profile
	28	:PROPERTIES:
	29	:CUSTOM_ID: create-an-ip-group-profile
	30	:END:
	31	To start, login to the Unifi machine's web GUI and navigate to the
	32	Network app > Settings > Profiles.
	33
	34	Within this page, choose the =IP Groups= tab and click =Create New=.
	35
	36	#+caption: Network Profiles
	37	[[https://img.cleberg.net/blog/20230618-unifi-ip-blocklist/unifi_profiles.png]]
35	38
36	39	Each IP Group profile can be used as one of three options:
37	40
		@@ -39,39 +42,48 @@ Each IP Group profile can be used as one of three options:
39	42	2. IPv4 Address/Subnet
40	43	3. IPv6 Address/Subnet
41	44
42		In this example, I'm creating an IPv4 Address/Subnet group and adding a few
43		different IP addresses and a subnet.
44		Once you've added all IP addresses and subnets, click the `Apply` button
45		that should appear at the bottom.
	45	In this example, I'm creating an IPv4 Address/Subnet group and adding a
	46	few different IP addresses and a subnet. Once you've added all IP
	47	addresses and subnets, click the =Apply= button that should appear at
	48	the bottom.
46	49
47		![Network Profile IPs](https://img.cleberg.net/blog/20230618-unifi-ip-blocklist/abusive_ips.png "Network Profile IPs")
	50	#+caption: Network Profile IPs
	51	[[https://img.cleberg.net/blog/20230618-unifi-ip-blocklist/abusive_ips.png]]
48	52
49		At this point, the IPv4 Address/Subnet has been created but not yet used.
	53	At this point, the IPv4 Address/Subnet has been created but not yet
	54	used.
50	55
51		## Drop IP Group Profile via the Unifi Firewall
	56	** Drop IP Group Profile via the Unifi Firewall
	57	:PROPERTIES:
	58	:CUSTOM_ID: drop-ip-group-profile-via-the-unifi-firewall
	59	:END:
	60	To instruct the Unifi machine to block the profile we just created, we
	61	need to navigate to the Network app > Settings > Firewall & Security.
52	62
53		To instruct the Unifi machine to block the profile we just created, we need
54		to navigate to the Network app > Settings > Firewall & Security.
	63	Within this screen, find the Firewall Rules table and click
	64	=Create Entry=. This entry should contain the following settings:
55	65
56		Within this screen, find the Firewall Rules table and click `Create Entry`. This
57		entry should contain the following settings:
	66	- Type: =Internet In=
	67	- Description: =<Your Custom Rule>=
	68	- Rule Applied: =Before Predefined Rules=
	69	- Action: =Drop=
	70	- Source Type: =Port/IP Group=
	71	- IPv4 Address Group: =<Name of the Group Profile You Created Above>=
58	72
59		- Type: `Internet In`
60		- Description: `<Your Custom Rule>`
61		- Rule Applied: `Before Predefined Rules`
62		- Action: `Drop`
63		- Source Type: `Port/IP Group`
64		- IPv4 Address Group: `<Name of the Group Profile You Created Above>`
	73	Customize the remaining configurations to your liking, and then save and
	74	enable the firewall rule.
65	75
66		Customize the remaining configurations to your liking, and then save and enable
67		the firewall rule.
	76	#+caption: Firewall Rule
	77	[[https://img.cleberg.net/blog/20230618-unifi-ip-blocklist/firewall_drop_rule.png]]
68	78
69		![Firewall Rule](https://img.cleberg.net/blog/20230618-unifi-ip-blocklist/firewall_drop_rule.png "Firewall Rule")
	79	Once enabled, the Unifi machine will be able to drop all incoming
	80	connections from the defined IP addresses and subnets within the created
	81	profile.
70	82
71		Once enabled, the Unifi machine will be able to drop all incoming connections
72		from the defined IP addresses and subnets within the created profile.
	83	#+begin_quote
	84	As a personal aside to this topic, I'm looking for a convenient way to
	85	update the firewall rules or profiles remotely (within the LAN) from the
	86	web server to accelerate this process. If you have an idea on how to
	87	automatically update Unifi IP groups or firewall rules, let me know!
73	88
74		> As a personal aside to this topic, I'm looking for a convenient way to update
75		> the firewall rules or profiles remotely (within the LAN) from the web server
76		> to accelerate this process. If you have an idea on how to automatically update
77		> Unifi IP groups or firewall rules, let me know!
	89	#+end_quote

blog/2023-06-20-audit-review-cheatsheet.org +72 −66

		@@ -1,75 +1,81 @@
1		+++
2		date = 2023-06-20
3		title = "Cheatsheet: Review Audit Test Results"
4		description = "A handy cheatsheet for reviewing audit testing on FSA and SOC report engagements."
5		+++
	1	#+title: Audit Review Checklist
	2	#+date: 2023-06-20
6	3
7		## Overview
8	4
9		This post is a very brief overview on the basic process to review audit
10		test results, focusing on work done as part of a financial statement audit
11		(FSA) or service organization controls (SOC) report.
	5	** Overview
	6	:PROPERTIES:
	7	:CUSTOM_ID: overview
	8	:END:
	9	This post is a /very/ brief overview on the basic process to review
	10	audit test results, focusing on work done as part of a financial
	11	statement audit (FSA) or service organization controls (SOC) report.
12	12
13		While there are numerous different things to review and look for - all varying
14		wildly depending on the report, client, and tester - this list serves as a solid
15		base foundation for a reviewer.
	13	While there are numerous different things to review and look for - all
	14	varying wildly depending on the report, client, and tester - this list
	15	serves as a solid base foundation for a reviewer.
16	16
17		I have used this throughout my career as a starting point to my reviews, and it
18		has worked wonders for creating a consistent and objective template to my
19		reviews. The goal is to keep this base high-level enough to be used on a wide
20		variety of engagements, while still ensuring that all key areas are covered.
21
22		## Cheatsheet
	17	I have used this throughout my career as a starting point to my reviews,
	18	and it has worked wonders for creating a consistent and objective
	19	template to my reviews. The goal is to keep this base high-level enough
	20	to be used on a wide variety of engagements, while still ensuring that
	21	all key areas are covered.
23	22
	23	** Cheatsheet
	24	:PROPERTIES:
	25	:CUSTOM_ID: cheatsheet
	26	:END:
24	27	1. [ ] Check all documents for spelling and grammar.
25	28	2. [ ] Ensure all acronyms are fully explained upon first use.
26		3. [ ] For all people referenced, use their full names and job titles upon
27		first use.
28		4. [ ] All supporting documents must cross-reference to the lead sheet and
29		vice-versa.
	29	3. [ ] For all people referenced, use their full names and job titles
	30	upon first use.
	31	4. [ ] All supporting documents must cross-reference to the lead sheet
	32	and vice-versa.
30	33	5. [ ] Verify that the control has been adequately tested:
31		- [ ] Test of Design: Did the tester obtain information regarding how
32		the control should perform normally and abnormally (e.g., emergency
33		scenarios)?
34		- [ ] Test of Operating Effectiveness: Did the tester inquire, observe,
35		inspect, or re-perform sufficient evidence to support their
36		conclusion over the control? Inquiry alone is not adequate!
37		6. [ ] For any information used in the control, whether by the control operator
38		or by the tester, did the tester appropriately document the source (system or
39		person), extraction method, parameters, and completeness and accuracy (C&A)?
40		- [ ] For any reports, queries, etc. used in the extraction, did the tester
41		include a copy and notate C&A considerations?
42		7. [ ] Did the tester document the specific criteria that the control is being
43		tested against?
44		8. [ ] Did the tester notate in the supporting documents where each criterion
45		was satisfied?
46		9. [ ] If testing specific policies or procedures, are the documents adequate?
47		- [ ] e.g., a test to validate that a review of policy XYZ occurs
48		periodically should also evaluate the sufficiency of the policy itself, if
49		meant to cover the risk that such a policy does not exist and is not
50		reviewed.
	34	- [ ] Test of Design: Did the tester obtain information regarding
	35	how the control should perform normally and abnormally (e.g.,
	36	emergency scenarios)?
	37	- [ ] Test of Operating Effectiveness: Did the tester inquire,
	38	observe, inspect, or re-perform sufficient evidence to support
	39	their conclusion over the control? Inquiry alone is not adequate!
	40	6. [ ] For any information used in the control, whether by the control
	41	operator or by the tester, did the tester appropriately document the
	42	source (system or person), extraction method, parameters, and
	43	completeness and accuracy (C&A)?
	44	- [ ] For any reports, queries, etc. used in the extraction, did the
	45	tester include a copy and notate C&A considerations?
	46	7. [ ] Did the tester document the specific criteria that the control is
	47	being tested against?
	48	8. [ ] Did the tester notate in the supporting documents where each
	49	criterion was satisfied?
	50	9. [ ] If testing specific policies or procedures, are the documents
	51	adequate?
	52	- [ ] e.g., a test to validate that a review of policy XYZ occurs
	53	periodically should also evaluate the sufficiency of the policy
	54	itself, if meant to cover the risk that such a policy does not
	55	exist and is not reviewed.
51	56	10. [ ] Does the test cover the appropriate period under review?
52		- [ ] If the test is meant to cover only a portion of the audit period, do
53		other controls exist to mitigate the risks that exist for the remainder of
54		the period?
55		11. [ ] For any computer-aided audit tools (CAATs) or other automation
56		techniques used in the test, is the use of such tools explained and
57		appropriately documented?
58		12. [ ] If prior-period documentation exists, are there any missing pieces of
59		evidence that would further enhance the quality of the test?
60		13. [ ] Was any information discovered during the walkthrough or inquiry phase
61		that was not incorporated into the test?
62		14. [ ] Are there new rules or expectations from your company's internal
63		guidance or your regulatory bodies that would affect the audit approach for this
64		control?
65		15. [ ] Was an exception, finding, or deficiency identified as a result of this
66		test?
67		- [ ] Was the control deficient in design, operation, or both?
68		- [ ] What was the root cause of the finding?
69		- [ ] Does the finding indicate other findings or potential fraud?
70		- [ ] What's the severity and scope of the finding?
71		- [ ] Do other controls exist as a form of compensation against the
72		finding's severity, and do they mitigate the risk within the control
73		objective?
74		- [ ] Does the finding exist at the end of the period, or was it resolved
75		within the audit period?
		\ No newline at end of file
	57	- [ ] If the test is meant to cover only a portion of the audit
	58	period, do other controls exist to mitigate the risks that exist
	59	for the remainder of the period?
	60	11. [ ] For any computer-aided audit tools (CAATs) or other automation
	61	techniques used in the test, is the use of such tools explained and
	62	appropriately documented?
	63	12. [ ] If prior-period documentation exists, are there any missing
	64	pieces of evidence that would further enhance the quality of the
	65	test?
	66	13. [ ] Was any information discovered during the walkthrough or inquiry
	67	phase that was not incorporated into the test?
	68	14. [ ] Are there new rules or expectations from your company's internal
	69	guidance or your regulatory bodies that would affect the audit
	70	approach for this control?
	71	15. [ ] Was an exception, finding, or deficiency identified as a result
	72	of this test?
	73	- [ ] Was the control deficient in design, operation, or both?
	74	- [ ] What was the root cause of the finding?
	75	- [ ] Does the finding indicate other findings or potential fraud?
	76	- [ ] What's the severity and scope of the finding?
	77	- [ ] Do other controls exist as a form of compensation against the
	78	finding's severity, and do they mitigate the risk within the
	79	control objective?
	80	- [ ] Does the finding exist at the end of the period, or was it
	81	resolved within the audit period?

blog/2023-06-23-byobu.org +33 −28

		@@ -1,43 +1,48 @@
1		+++
2		date = 2023-06-23T19:15:28
3		title = "Byobu"
4		description = "A quick look at byobu, a text based window manager."
5		+++
	1	#+title: Byobu
	2	#+date: 2023-06-23
6	3
7		## Byobu
	4	** Byobu
	5	:PROPERTIES:
	6	:CUSTOM_ID: byobu
	7	:END:
	8	[[https://www.byobu.org][byobu]] is a command-line tool that allows you
	9	to use numerous screens within a single terminal emulator instance. More
	10	specifically, it's a text based window manager, using either =screen= or
	11	=tmux=.
8	12
9		[byobu](https://www.byobu.org) is a command-line tool that allows you to use
10		numerous screens within a single terminal emulator instance. More specifically,
11		it's a text based window manager, using either `screen` or `tmux`.
	13	This post is mostly just a self-reference as I explore byobu, so I may
	14	come back later and update this post with more content.
12	15
13		This post is mostly just a self-reference as I explore byobu, so I may come back
14		later and update this post with more content.
	16	*** Screenshot
	17	:PROPERTIES:
	18	:CUSTOM_ID: screenshot
	19	:END:
	20	Take a look below at my current multi-window set-up in byobu while I
	21	write this blog post:
15	22
16		### Screenshot
	23	#+caption: byobu
	24	[[https://img.cleberg.net/blog/20230623-byobu/byobu.png]]
17	25
18		Take a look below at my current multi-window set-up in byobu while I write this
19		blog post:
	26	** Keybindings
	27	:PROPERTIES:
	28	:CUSTOM_ID: keybindings
	29	:END:
	30	You can open the help menu with either of the following commands; they
	31	will both open the same manpage:
20	32
21		![byobu](https://img.cleberg.net/blog/20230623-byobu/byobu.png "byobu")
22
23		## Keybindings
24
25		You can open the help menu with either of the following commands; they will both
26		open the same manpage:
27
28		```sh
	33	#+begin_src sh
29	34	byobu --help
30	35	# or
31	36	man byobu
32		```
	37	#+end_src
33	38
34		While the manpage contains a ton of information about the functionality of
35		byobu (such as status notifications, sessions, and windows), the first location
36		to explore should be the keybindings section.
	39	While the manpage contains a ton of information about the functionality
	40	of byobu (such as status notifications, sessions, and windows), the
	41	first location to explore should be the keybindings section.
37	42
38	43	The keybindings are configured as follows:
39	44
40		```txt
	45	#+begin_src txt
41	46	byobu keybindings can be user defined in /usr/share/byobu/keybindings/ (or
42	47	within .screenrc if byobu-export was used). The common key bindings are:
43	48
		@@ -65,4 +70,4 @@ Ctrl-a R - Reload profile
65	70	Ctrl-a ! - Toggle key bindings on and off
66	71	Ctrl-a k - Kill the current window
67	72	Ctrl-a ~ - Save the current window's scrollback buffer
68		```
	73	#+end_src

blog/2023-06-23-self-hosting-convos-irc.org +112 −103

		@@ -1,40 +1,43 @@
1		+++
2		date = 2023-06-23T20:50:00
3		title = "Self-Hosting Convos IRC Web Client"
4		description = ""
5		+++
	1	#+title: Self-Hosting Convos: IRC Web Client
	2	#+date: 2023-06-23
6	3
7		## Convos
8
9		[Convos](https://convos.chat/) is an always-online web client for IRC. It
10		has a few features that made it attractive to me as a self-hosted option:
	4	** Convos
	5	:PROPERTIES:
	6	:CUSTOM_ID: convos
	7	:END:
	8	[[https://convos.chat/][Convos]] is an always-online web client for IRC.
	9	It has a few features that made it attractive to me as a self-hosted
	10	option:
11	11
12	12	- Extremely simple Docker Compose installation method.
13		- Runs in the background and monitors chats even while you're not logged in.
	13	- Runs in the background and monitors chats even while you're not logged
	14	in.
14	15	- Neatly organized sidebar for conversation and client settings.
15	16	- Ability to connect to different hosts and create profiles for hosts.
16		- By default, registration is closed to the public. You can enable public
17		registration on the Settings page or generate invitation links on the
18		Users page.
19		- Customization of the client theme, organization name and URL, admin email,
20		and video service.
21
22		## Docker Installation
23
24		To install Convos, simply create a directory and a `docker-compose.yml` file:
25
26		```sh
	17	- By default, registration is closed to the public. You can enable
	18	public registration on the Settings page or generate invitation links
	19	on the Users page.
	20	- Customization of the client theme, organization name and URL, admin
	21	email, and video service.
	22
	23	** Docker Installation
	24	:PROPERTIES:
	25	:CUSTOM_ID: docker-installation
	26	:END:
	27	To install Convos, simply create a directory and a =docker-compose.yml=
	28	file:
	29
	30	#+begin_src sh
27	31	mkdir ~/convos && cd ~/convos
28	32	nano docker-compose.yml
29		```
	33	#+end_src
30	34
31		With the `docker-compose.yml` file open, paste the configuration below into
32		the file.
33		You can customize the host port to be something unique, such as `21897:3000`.
34		You can also change the `data` folder to be a docker volume instead, if you
35		prefer.
	35	With the =docker-compose.yml= file open, paste the configuration below
	36	into the file. You can customize the host port to be something unique,
	37	such as =21897:3000=. You can also change the =data= folder to be a
	38	docker volume instead, if you prefer.
36	39
37		```config
	40	#+begin_src config
38	41	version: '3'
39	42
40	43	services:
		@@ -47,118 +50,124 @@ services:
47	50	environment:
48	51	- CONVOS_REVERSE_PROXY=1
49	52	restart: always
50		```
	53	#+end_src
51	54
52		Save the `docker-compose.yml` file and bring the container up:
	55	Save the =docker-compose.yml= file and bring the container up:
53	56
54		```sh
	57	#+begin_src sh
55	58	sudo docker-compose up -d
56		```
	59	#+end_src
57	60
58		At this point, Convos is available at `<server_ip>:3000` but not available
59		to the public.
	61	At this point, Convos is available at =<server_ip>:3000= but not
	62	available to the public.
60	63
61		## Nginx Reverse Proxy
	64	** Nginx Reverse Proxy
	65	:PROPERTIES:
	66	:CUSTOM_ID: nginx-reverse-proxy
	67	:END:
	68	If you're using Nginx, you can create a configuration file for the
	69	convos application. Start by opening the file:
62	70
63		If you're using Nginx, you can create a configuration file for the convos
64		application.
65		Start by opening the file:
66
67		```sh
	71	#+begin_src sh
68	72	nano /etc/nginx/sites-available/convos
69		```
	73	#+end_src
70	74
71		Within the nginx configuration file, paste the following content and be sure
72		to update `convos.example.com` to match your domain and `127.0.0.1:3000` to
73		match the port you opened in the `docker-compose.yml` file.
	75	Within the nginx configuration file, paste the following content and be
	76	sure to update =convos.example.com= to match your domain and
	77	=127.0.0.1:3000= to match the port you opened in the
	78	=docker-compose.yml= file.
74	79
75		```config
	80	#+begin_src config
76	81	# Host and port where convos is running
77	82	upstream convos_upstream { server 127.0.0.1:3000; }
78	83
79	84	server {
80		if ($host ~ ^[^.]+\.example\.com$) {
81		return 301 https://$host$request_uri;
82		}
83
84		listen [::]:80;
85		listen 80;
86		server_name convos.example.com;
87		return 404;
	85	if ($host ~ ^[^.]+\.example\.com$) {
	86	return 301 https://$host$request_uri;
	87	}
	88
	89	listen [::]:80;
	90	listen 80;
	91	server_name convos.example.com;
	92	return 404;
88	93	}
89	94
90	95	server {
91		listen [::]:443 ssl http2;
92		listen 443 ssl http2;
93		server_name convos.example.com;
94		access_log /var/log/nginx/convos.access.log;
95		error_log /var/log/nginx/convos.error.log;
96
97		location / {
98		proxy_pass http://convos_upstream;
99		proxy_http_version 1.1;
100		proxy_set_header Upgrade $http_upgrade;
101		proxy_set_header Connection "upgrade";
102		client_max_body_size 0;
103		proxy_set_header Host $host;
104		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
105		proxy_set_header X-Request-Base "$scheme://$host/";
106		}
107
108		ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
109		ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
110		include /etc/letsencrypt/options-ssl-nginx.conf;
111		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	96	listen [::]:443 ssl http2;
	97	listen 443 ssl http2;
	98	server_name convos.example.com;
	99	access_log /var/log/nginx/convos.access.log;
	100	error_log /var/log/nginx/convos.error.log;
	101
	102	location / {
	103	proxy_pass http://convos_upstream;
	104	proxy_http_version 1.1;
	105	proxy_set_header Upgrade $http_upgrade;
	106	proxy_set_header Connection "upgrade";
	107	client_max_body_size 0;
	108	proxy_set_header Host $host;
	109	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	110	proxy_set_header X-Request-Base "$scheme://$host/";
	111	}
	112
	113	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
	114	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
	115	include /etc/letsencrypt/options-ssl-nginx.conf;
	116	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
112	117	}
113		```
	118	#+end_src
114	119
115		Once the file is saved, link it to the `sites-enabled` directory and restart
116		Nginx.
	120	Once the file is saved, link it to the =sites-enabled= directory and
	121	restart Nginx.
117	122
118		```sh
	123	#+begin_src sh
119	124	sudo ln -s /etc/nginx/sites-available/convos /etc/nginx/sites-enabled/convos
120	125	sudo systemctl restart nginx.service
121		```
122
123		## Screenshots
	126	#+end_src
124	127
125		See the screenshots below for an example of the Convos homepage and an
	128	** Screenshots
	129	:PROPERTIES:
	130	:CUSTOM_ID: screenshots
	131	:END:
	132	See the screenshots below for an example of the Convos homepage and an
126	133	excerpt of the chat screen.
127	134
128		There are numerous themes to choose from; the theme shown in the images
	135	There are numerous themes to choose from; the theme shown in the images
129	136	below is Dracula.
130	137
131		![Convos Home](https://img.cleberg.net/blog/20230623-convos/convos_home.png
132		"Convos Home")
133
134		![Convos Chat](https://img.cleberg.net/blog/20230623-convos/convos_chat.png
135		"Convos Chat")
	138	#+caption: Convos Home
	139	[[https://img.cleberg.net/blog/20230623-convos/convos_home.png%20%22Convos%20Home%22]]
136	140
137		## Registering a Nickname
	141	#+caption: Convos Chat
	142	[[https://img.cleberg.net/blog/20230623-convos/convos_chat.png%20%22Convos%20Chat%22]]
138	143
139		Hop into the server channel so that you can message NickServ. In the case of
140		Convos, the default sever is libera.chat.
141		Simply click the `libera` conversation at the top of the sidebar to open it.
142		Once the chat is open, you can claim a nickname by typing:
	144	** Registering a Nickname
	145	:PROPERTIES:
	146	:CUSTOM_ID: registering-a-nickname
	147	:END:
	148	Hop into the server channel so that you can message NickServ. In the
	149	case of Convos, the default sever is libera.chat. Simply click the
	150	=libera= conversation at the top of the sidebar to open it. Once the
	151	chat is open, you can claim a nickname by typing:
143	152
144		```txt
	153	#+begin_src txt
145	154	/nick <nick>
146		```
	155	#+end_src
147	156
148		If the nickname is available, and you'd like to register the nickname to
	157	If the nickname is available, and you'd like to register the nickname to
149	158	yourself, you'll need to type another command:
150	159
151		```txt
	160	#+begin_src txt
152	161	/msg NickServ REGISTER
153	162	<password> <email>
154		```
	163	#+end_src
155	164
156		On libera.chat, the server will send a confirmation email with a command
	165	On libera.chat, the server will send a confirmation email with a command
157	166	that you must message in IRC to verify registration of the nickname:
158	167
159		```txt
	168	#+begin_src txt
160	169	/msg NickServ VERIFY REGISTER <nick> <verification_code>
161		```
	170	#+end_src
162	171
163		Once entered, the server should confirm registration of the nickname to the
164		supplied email with the password specified.
	172	Once entered, the server should confirm registration of the nickname to
	173	the supplied email with the password specified.

blog/2023-06-28-backblaze-b2.org +151 −125

		@@ -1,16 +1,16 @@
1		+++
2		date = 2023-06-28T16:00:00
3		title = "Getting Started with Backblaze B2 Cloud Storage"
4		description = "A simple tutorial to create a Backblaze B2 account for free and back up data from Linux."
5		+++
	1	#+title: Getting Started with Backblaze B2 Cloud Storage
	2	#+date: 2023-06-28
6	3
7		## Overview
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	Backblaze [[https://www.backblaze.com/b2/cloud-storage.html][B2 Cloud
	9	Storage]] is an inexpensive and reliable on-demand cloud storage and
	10	backup solution.
8	11
9		Backblaze [B2 Cloud Storage](https://www.backblaze.com/b2/cloud-storage.html) is
10		an inexpensive and reliable on-demand cloud storage and backup solution.
11
12		The service starts at $5/TB/month ($0.005/GB/month) with a download rate of
13		$0.01/GB/month.
	12	The service starts at $5/TB/month ($0.005/GB/month) with a download rate
	13	of $0.01/GB/month.
14	14
15	15	However, there are free tiers:
16	16
		@@ -20,162 +20,188 @@ However, there are free tiers:
20	20	- The first 2500 Class B transactions each day are free.
21	21	- The first 2500 Class C transactions each day are free.
22	22
23		You can see which API calls fall into categories A, B, or C here:
24		[Pricing Organized by API
25		Calls](https://www.backblaze.com/b2/b2-transactions-price.html).
26
27		For someone like me, who wants an offsite backup of their server's `/home/`
28		directory and various other server configs that fall under 10 GB total,
29		Backblaze is a great solution from a financial perspective.
30
31		## Create An Account
32
33		To start with Backblaze, you'll need to [create a free
34		account](https://www.backblaze.com/b2/sign-up.html) - no payment method is
35		required to sign up.
36
37		Once you have an account, you can test out the service with their web GUI, their
38		mobile app, or their CLI tool. I'm going to use the CLI tool below to test a
39		file upload and then sync an entire directory to my Backblaze bucket.
40
41		## Create a Bucket
42
43		Before you can start uploading, you need to create a bucket. If you're familiar
44		with other object storage services, this will feel familiar. If not, it's pretty
45		simple to create one.
	23	You can see which API calls fall into categories A, B, or C here:
	24	[[https://www.backblaze.com/b2/b2-transactions-price.html][Pricing
	25	Organized by API Calls]].
	26
	27	For someone like me, who wants an offsite backup of their server's
	28	=/home/= directory and various other server configs that fall under 10
	29	GB total, Backblaze is a great solution from a financial perspective.
	30
	31	** Create An Account
	32	:PROPERTIES:
	33	:CUSTOM_ID: create-an-account
	34	:END:
	35	To start with Backblaze, you'll need to
	36	[[https://www.backblaze.com/b2/sign-up.html][create a free account]] -
	37	no payment method is required to sign up.
	38
	39	Once you have an account, you can test out the service with their web
	40	GUI, their mobile app, or their CLI tool. I'm going to use the CLI tool
	41	below to test a file upload and then sync an entire directory to my
	42	Backblaze bucket.
	43
	44	** Create a Bucket
	45	:PROPERTIES:
	46	:CUSTOM_ID: create-a-bucket
	47	:END:
	48	Before you can start uploading, you need to create a bucket. If you're
	49	familiar with other object storage services, this will feel familiar. If
	50	not, it's pretty simple to create one.
46	51
47	52	As their webpage says:
48	53
49		> A bucket is a container that holds files that are uploaded into B2 Cloud
50		> Storage. The bucket name must be globally unique and must have a minimum of 6
51		> characters. A limit of 100 buckets may be created per account. An unlimited
52		> number of files may be uploaded into a bucket.
53
54		Once you click the `Create a Bucket` button on their webpage or mobile app, you
55		need to provide the following:
56
57		- Bucket Unique Name
58		- Files in Bucket are: `Private` or `Public`
59		- Default Encryption: `Disable` or `Enable`
60		- Object Lock: `Disable` or `Enable`
61
62		For my bucket, I created a private bucket with encryption enabled and object
63		lock disabled.
64
65		Once your bucket is created, you can test the upload/download feature on their
66		web GUI or mobile app! At this point, you have a fully functional bucket and
67		account.
68
69		## Linux CLI Tool
	54	#+begin_quote
	55	A bucket is a container that holds files that are uploaded into B2 Cloud
	56	Storage. The bucket name must be globally unique and must have a minimum
	57	of 6 characters. A limit of 100 buckets may be created per account. An
	58	unlimited number of files may be uploaded into a bucket.
70	59
71		### Installation
	60	#+end_quote
72	61
73		To install the `b2` CLI tool, you'll need to download it from the [CLI
74		Tools](https://www.backblaze.com/docs/cloud-storage-command-line-tools) page.
75		I recommend copying the URL from the link that says `Linux` and using wget to
76		download it, as shown below.
	62	Once you click the =Create a Bucket= button on their webpage or mobile
	63	app, you need to provide the following:
77	64
78		Once downloaded, make the file executable and move it to a location on your
79		`$PATH`, so that you can execute that command from anywhere on the machine.
80
81		```sh
	65	- Bucket Unique Name
	66	- Files in Bucket are: =Private= or =Public=
	67	- Default Encryption: =Disable= or =Enable=
	68	- Object Lock: =Disable= or =Enable=
	69
	70	For my bucket, I created a private bucket with encryption enabled and
	71	object lock disabled.
	72
	73	Once your bucket is created, you can test the upload/download feature on
	74	their web GUI or mobile app! At this point, you have a fully functional
	75	bucket and account.
	76
	77	** Linux CLI Tool
	78	:PROPERTIES:
	79	:CUSTOM_ID: linux-cli-tool
	80	:END:
	81	*** Installation
	82	:PROPERTIES:
	83	:CUSTOM_ID: installation
	84	:END:
	85	To install the =b2= CLI tool, you'll need to download it from the
	86	[[https://www.backblaze.com/docs/cloud-storage-command-line-tools][CLI
	87	Tools]] page. I recommend copying the URL from the link that says
	88	=Linux= and using wget to download it, as shown below.
	89
	90	Once downloaded, make the file executable and move it to a location on
	91	your =$PATH=, so that you can execute that command from anywhere on the
	92	machine.
	93
	94	#+begin_src sh
82	95	wget <b2_cli_url>
83	96	chmod +x b2_linux
84	97	mv b2_linux /usr/bin/b2
85		```
86
87		### Log In
	98	#+end_src
88	99
89		The first step after installation is to log in. To do this, execute the
90		following command and provide your `<applicationKeyId>` and `<applicationKey>`.
	100	*** Log In
	101	:PROPERTIES:
	102	:CUSTOM_ID: log-in
	103	:END:
	104	The first step after installation is to log in. To do this, execute the
	105	following command and provide your =<applicationKeyId>= and
	106	=<applicationKey>=.
91	107
92		If you don't want to provide these values in the command itself, you can simply
93		execute the base command and it will request them in an interactive prompt.
	108	If you don't want to provide these values in the command itself, you can
	109	simply execute the base command and it will request them in an
	110	interactive prompt.
94	111
95		```sh
	112	#+begin_src sh
96	113	# if you want to provide the keys directly:
97	114	b2 authorize-account [<applicationKeyId>] [<applicationKey>]
98	115
99	116	# or, if you don't want your keys in your shell history:
100	117	b2 authorize-account
101		```
	118	#+end_src
102	119
103		### Upload a Test File
104
105		In order to test the functionality of the CLI tool, I'll start by uploading
106		a single test file to the bucket I created above.
107		We can do this with the `upload_file` function.
	120	*** Upload a Test File
	121	:PROPERTIES:
	122	:CUSTOM_ID: upload-a-test-file
	123	:END:
	124	In order to test the functionality of the CLI tool, I'll start by
	125	uploading a single test file to the bucket I created above. We can do
	126	this with the =upload_file= function.
108	127
109	128	The command is issued as follows:
110	129
111		```sh
	130	#+begin_src sh
112	131	b2 upload_file <bucket_name> <local_file> <remote_file>
113		```
	132	#+end_src
114	133
115	134	In my situation, I executed the following command with my username.
116	135
117		```sh
	136	#+begin_src sh
118	137	b2 upload_file my_unique_bucket /home/<user>/test.md test.md
119		```
	138	#+end_src
120	139
121		To confirm that the file was uploaded successfully, list the files in your
122		bucket:
	140	To confirm that the file was uploaded successfully, list the files in
	141	your bucket:
123	142
124		```sh
	143	#+begin_src sh
125	144	b2 ls <bucket_name>
126		```
	145	#+end_src
127	146
128		```txt
	147	#+begin_src txt
129	148	test.md
130		```
131
132		### Sync a Directory
	149	#+end_src
133	150
134		If you have numerous files, you can use the `sync` function to perform
135		functionality similar to `rsync`, where you can check what's in your bucket
136		and sync anything that is new or modified.
	151	*** Sync a Directory
	152	:PROPERTIES:
	153	:CUSTOM_ID: sync-a-directory
	154	:END:
	155	If you have numerous files, you can use the =sync= function to perform
	156	functionality similar to =rsync=, where you can check what's in your
	157	bucket and sync anything that is new or modified.
137	158
138	159	The command is issued as follows:
139	160
140		```sh
	161	#+begin_src sh
141	162	b2 sync <source file location> <B2 bucket destination>
142		```
	163	#+end_src
143	164
144		In my case, I can sync my user's entire home directory to my bucket without
145		specifying any of the files directly:
	165	In my case, I can sync my user's entire home directory to my bucket
	166	without specifying any of the files directly:
146	167
147		```sh
	168	#+begin_src sh
148	169	b2 sync /home/<user>/ "b2://<bucketName>/home/<user>"
149		```
150
151		## Caveats
152
153		### Timing of Updates to the Web GUI
154
155		When performing actions over a bucket, there is a slight delay in the web
156		GUI when inspecting a bucket or its file.
157		Note that simple actions such as uploading or deleting files may have a
158		delay of a few minutes up to 24 hours.
159		In my experience (<10 GB and ~20,000 files), any actions took only a few
160		minutes to update across clients.
161
162		### Symlinks
163
164		Note that symlinks are resolved by b2, so if you have a link from
165		`/home/<user>/nas-storage` that symlinks out to a `/mnt/nas-storage` folder
166		that has 10TB of data, `b2` will resolve that link and start uploading all 10TB
167		of data linked within the folder.
168
169		If you're not sure if you have any symlinks, a symlink will look like this
170		(note the `->` symbol):
171
172		```sh
	170	#+end_src
	171
	172	** Caveats
	173	:PROPERTIES:
	174	:CUSTOM_ID: caveats
	175	:END:
	176	*** Timing of Updates to the Web GUI
	177	:PROPERTIES:
	178	:CUSTOM_ID: timing-of-updates-to-the-web-gui
	179	:END:
	180	When performing actions over a bucket, there is a slight delay in the
	181	web GUI when inspecting a bucket or its file. Note that simple actions
	182	such as uploading or deleting files may have a delay of a few minutes up
	183	to 24 hours. In my experience (<10 GB and ~20,000 files), any actions
	184	took only a few minutes to update across clients.
	185
	186	*** Symlinks
	187	:PROPERTIES:
	188	:CUSTOM_ID: symlinks
	189	:END:
	190	Note that symlinks are resolved by b2, so if you have a link from
	191	=/home/<user>/nas-storage= that symlinks out to a =/mnt/nas-storage=
	192	folder that has 10TB of data, =b2= will resolve that link and start
	193	uploading all 10TB of data linked within the folder.
	194
	195	If you're not sure if you have any symlinks, a symlink will look like
	196	this (note the =->= symbol):
	197
	198	#+begin_src sh
173	199	> ls -lha
174	200	lrwxrwxrwx 1 root root 20 Jun 28 13:32 nas -> /mnt/nas-storage/
175		```
	201	#+end_src
176	202
177	203	You can recursively find symlink in a path with the following command:
178	204
179		```sh
	205	#+begin_src sh
180	206	ls -lR /path/to/search \| grep '^l'
181		```
	207	#+end_src

blog/2023-06-30-self-hosting-voyager-lemmy-client.org +88 −83

		@@ -1,54 +1,57 @@
1		+++
2		date = 2023-06-30
3		title = "Self Hosting Voyager - A Lemmy Web Client"
4		description = "A guide on how to self-host your own instance of Voyager, a mobile-first Lemmy web client."
5		+++
6
7		## Installation Guide
8
9		[Voyager](https://github.com/aeharding/voyager) is a mobile-first Lemmy web
10		client, based on iOS design standards. It follows very closely to Apollo's
11		design.
12
13		This post is a guide showing how I was able to build and launch my own instance
14		of Voyager via Docker Compose.
15
16		### Clone the Repository
17
	1	#+title: Self-Hosting Voyager: A Lemmy Web Client
	2	#+date: 2023-06-30
	3
	4	** Installation Guide
	5	:PROPERTIES:
	6	:CUSTOM_ID: installation-guide
	7	:END:
	8	[[https://github.com/aeharding/voyager][Voyager]] is a mobile-first
	9	Lemmy web client, based on iOS design standards. It follows very closely
	10	to Apollo's design.
	11
	12	This post is a guide showing how I was able to build and launch my own
	13	instance of Voyager via Docker Compose.
	14
	15	*** Clone the Repository
	16	:PROPERTIES:
	17	:CUSTOM_ID: clone-the-repository
	18	:END:
18	19	Start by cloning the repository and entering it:
19	20
20		```sh
	21	#+begin_src sh
21	22	git clone https://github.com/aeharding/voyager
22	23	cd voyager
23		```
24
25		### Build the Image
	24	#+end_src
26	25
27		With this repository, you can build the image yourself without any further
28		configuration.
29		When complete, it'll give you the image ID for you to run.
	26	*** Build the Image
	27	:PROPERTIES:
	28	:CUSTOM_ID: build-the-image
	29	:END:
	30	With this repository, you can build the image yourself without any
	31	further configuration. When complete, it'll give you the image ID for
	32	you to run.
30	33
31		```sh
	34	#+begin_src sh
32	35	sudo docker build .
33	36	# Successfully built 5f00723cb5be
34		```
	37	#+end_src
35	38
36		With the image ID above, you can run the container and pass the requested port
37		`5314` through or use a custom port, if you wish.
	39	With the image ID above, you can run the container and pass the
	40	requested port =5314= through or use a custom port, if you wish.
38	41
39		You can also set the `CUSTOM_LEMMY_SERVERS` environment variable if you want to
40		add to the default suggested login servers.
41		This must be set with a comma separated list of suggested servers.
42		The first instance in the list will be the default view for logged-out users.
	42	You can also set the =CUSTOM_LEMMY_SERVERS= environment variable if you
	43	want to add to the default suggested login servers. This must be set
	44	with a comma separated list of suggested servers. The first instance in
	45	the list will be the default view for logged-out users.
43	46
44		I will be using a `docker-compose.yml` file to run this container, instead of a
45		`docker run` command.
	47	I will be using a =docker-compose.yml= file to run this container,
	48	instead of a =docker run= command.
46	49
47		```sh
	50	#+begin_src sh
48	51	nano docker-compose.yml
49		```
	52	#+end_src
50	53
51		```conf
	54	#+begin_src conf
52	55	version: "2"
53	56	services:
54	57	voyager:
		@@ -58,67 +61,69 @@ services:
58	61	- "<custom_port>:5314"
59	62	environment:
60	63	- CUSTOM_LEMMY_SERVERS=lemmy.dbzer0.com,lemmy.world,lemmy.ml,beehaw.org
61		```
	64	#+end_src
62	65
63		```sh
	66	#+begin_src sh
64	67	sudo docker-compose up -d
65		```
66
67		The web app will now be available at the following address:
68		`<machine_ip>:<custom_port>`.
69		If you are running it on your local device, try `localhost:<custom_port>`.
	68	#+end_src
70	69
71		### Reverse Proxy
	70	The web app will now be available at the following address:
	71	=<machine_ip>:<custom_port>=. If you are running it on your local
	72	device, try =localhost:<custom_port>=.
72	73
73		If you want to visit this app via an external URL or domain name, you'll need to
74		set up a reverse proxy.
75		The example below uses Nginx as a reverse proxy.
	74	*** Reverse Proxy
	75	:PROPERTIES:
	76	:CUSTOM_ID: reverse-proxy
	77	:END:
	78	If you want to visit this app via an external URL or domain name, you'll
	79	need to set up a reverse proxy. The example below uses Nginx as a
	80	reverse proxy.
76	81
77		Simply create the configuration file, paste the contents below, save the file,
78		symlink the file, and restart Nginx.
	82	Simply create the configuration file, paste the contents below, save the
	83	file, symlink the file, and restart Nginx.
79	84
80		```sh
	85	#+begin_src sh
81	86	sudo nano /etc/nginx/sites-available/voyager
82		```
	87	#+end_src
83	88
84		```conf
	89	#+begin_src conf
85	90	server {
86		if ($host ~ ^[^.]+\.example\.com$) {
87		return 301 https://$host$request_uri;
88		}
89
90		listen [::]:80;
91		listen 80;
92		server_name voyager.example.com;
93		return 404;
	91	if ($host ~ ^[^.]+\.example\.com$) {
	92	return 301 https://$host$request_uri;
	93	}
	94
	95	listen [::]:80;
	96	listen 80;
	97	server_name voyager.example.com;
	98	return 404;
94	99	}
95	100
96	101	server {
97		listen [::]:443 ssl http2;
98		listen 443 ssl http2;
99		server_name voyager.example.com;
100		access_log /var/log/nginx/voyager.access.log;
101		error_log /var/log/nginx/voyager.error.log;
102
103		location / {
104		proxy_http_version 1.1;
105		proxy_pass http://localhost:5314;
106		proxy_set_header Host $host;
107		}
108
109		ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
110		ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
111		include /etc/letsencrypt/options-ssl-nginx.conf;
112		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	102	listen [::]:443 ssl http2;
	103	listen 443 ssl http2;
	104	server_name voyager.example.com;
	105	access_log /var/log/nginx/voyager.access.log;
	106	error_log /var/log/nginx/voyager.error.log;
	107
	108	location / {
	109	proxy_http_version 1.1;
	110	proxy_pass http://localhost:5314;
	111	proxy_set_header Host $host;
	112	}
	113
	114	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
	115	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
	116	include /etc/letsencrypt/options-ssl-nginx.conf;
	117	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
113	118	}
114		```
	119	#+end_src
115	120
116		```sh
	121	#+begin_src sh
117	122	sudo ln sudo ln -s /etc/nginx/sites-available/voyager /etc/nginx/sites-enabled/voyager
118	123	sudo systemctl restart nginx.service
119		```
	124	#+end_src
120	125
121		The site will now be available at the `server_name` you specified above!
	126	The site will now be available at the =server_name= you specified above!
122	127
123		You can visit my instance at [voyager.cleberg.net](https://voyager.cleberg.net)
124		for an example.
	128	You can visit my instance at
	129	[[https://voyager.cleberg.net][voyager.cleberg.net]] for an example.

blog/2023-07-12-mullvad-wireguard-lan.org +80 −71

		@@ -1,31 +1,32 @@
1		+++
2		date = 2023-07-12T19:31:00
3		title = "Enabling LAN Access in Mullvad Wireguard Conf Files"
4		description = ""
5		+++
6
7		## Download Configuration Files from Mullvad
8
9		To begin, you'll need [Wireguard configuration files from
10		Mullvad](https://mullvad.net/account/wireguard-config).
11		You can choose any of the options as you download them.
12		For example, I enabled the kill switch, selected all countries, and selected a
13		few content filters.
14
15		Once downloaded, unzip the files and move them to the Wireguard folder on your
16		system.
17
18		```sh
	1	#+title: Enabling LAN Access in Mullvad Wireguard Conf Files
	2	#+date: 2023-07-12
	3
	4	** Download Configuration Files from Mullvad
	5	:PROPERTIES:
	6	:CUSTOM_ID: download-configuration-files-from-mullvad
	7	:END:
	8	To begin, you'll need
	9	[[https://mullvad.net/account/wireguard-config][Wireguard configuration
	10	files from Mullvad]]. You can choose any of the options as you download
	11	them. For example, I enabled the kill switch, selected all countries,
	12	and selected a few content filters.
	13
	14	Once downloaded, unzip the files and move them to the Wireguard folder
	15	on your system.
	16
	17	#+begin_src sh
19	18	cd ~/Downloads
20	19	unzip mullvad_wireguard_linux_all_all.zip
21	20	doas mv *.conf /etc/wireguard/
22		```
23
24		### Configuration File Layout
	21	#+end_src
25	22
	23	*** Configuration File Layout
	24	:PROPERTIES:
	25	:CUSTOM_ID: configuration-file-layout
	26	:END:
26	27	The default configuration files will look something like this:
27	28
28		```conf
	29	#+begin_src conf
29	30	[Interface]
30	31	# Device: <redacted>
31	32	PrivateKey = <redacted>
		@@ -38,43 +39,50 @@ PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m ad
38	39	PublicKey = <redacted>
39	40	AllowedIPs = <redacted>
40	41	Endpoint = <redacted>
41		```
	42	#+end_src
42	43
43		> Note: If you didn't select the kill switch option, you won't see the `PostUp`
44		> and `PreDown` lines.
45		> In this case, you'll need to modify the script below to simply append those
46		> lines to the `[Interface]` block.
	44	#+begin_quote
	45	Note: If you didn't select the kill switch option, you won't see the
	46	=PostUp= and =PreDown= lines. In this case, you'll need to modify the
	47	script below to simply append those lines to the =[Interface]= block.
47	48
48		## Editing the Configuration Files
	49	#+end_quote
49	50
50		Once you have the files, you'll need to edit them and replace the `PostUp` and
51		`PreDown` lines to enable LAN access.
	51	** Editing the Configuration Files
	52	:PROPERTIES:
	53	:CUSTOM_ID: editing-the-configuration-files
	54	:END:
	55	Once you have the files, you'll need to edit them and replace the
	56	=PostUp= and =PreDown= lines to enable LAN access.
52	57
53		I recommend that you do this process as root, since you'll need to be able to
54		access files in `/etc/wireguard`, which are generally owned by root.
55		You can also try using `sudo` or `doas`, but I didn't test that scenario so you
56		may need to adjust, as necessary.
	58	I recommend that you do this process as root, since you'll need to be
	59	able to access files in =/etc/wireguard=, which are generally owned by
	60	root. You can also try using =sudo= or =doas=, but I didn't test that
	61	scenario so you may need to adjust, as necessary.
57	62
58		```sh
	63	#+begin_src sh
59	64	su
60		```
	65	#+end_src
61	66
62		Create the Python file that we'll be using to update the Wireguard configuration
63		files.
	67	Create the Python file that we'll be using to update the Wireguard
	68	configuration files.
64	69
65		```sh
	70	#+begin_src sh
66	71	nano replace.py
67		```
	72	#+end_src
68	73
69		Within the Python file, copy and paste the logic below.
70		This script will open a directory, loop through every configuration file within
71		the directory, and replace the `PostUp` and `PreDown` lines with the new
	74	Within the Python file, copy and paste the logic below. This script will
	75	open a directory, loop through every configuration file within the
	76	directory, and replace the =PostUp= and =PreDown= lines with the new
72	77	LAN-enabled iptables commands.
73	78
74		> Note: If your LAN is on a subnet other than `192.168.1.0/24`, you'll need to
75		> update the Python script below appropriately.
	79	#+begin_quote
	80	Note: If your LAN is on a subnet other than =192.168.1.0/24=, you'll
	81	need to update the Python script below appropriately.
	82
	83	#+end_quote
76	84
77		```python
	85	#+begin_src python
78	86	import os
79	87	import fileinput
80	88
		@@ -83,35 +91,35 @@ print("--- starting ---")
83	91	dir = "/etc/wireguard/"
84	92
85	93	for file in os.listdir(dir):
86		print(os.path.join(dir, file))
87		for line in fileinput.input(os.path.join(dir, file), inplace=True):
88		if "PostUp" in line:
89		print("PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL ! -d 192.168.1.0/24 -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT")
90		elif "PreDown" in line:
91		print("PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL ! -d 192.168.1.0/24 -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT")
92		else:
93		print(line, end="")
	94	print(os.path.join(dir, file))
	95	for line in fileinput.input(os.path.join(dir, file), inplace=True):
	96	if "PostUp" in line:
	97	print("PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL ! -d 192.168.1.0/24 -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT")
	98	elif "PreDown" in line:
	99	print("PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL ! -d 192.168.1.0/24 -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT")
	100	else:
	101	print(line, end="")
94	102
95	103	print("--- done ---")
96		```
	104	#+end_src
97	105
98		Once you're done, save and close the file. You can now run the Python script
99		and watch as each file is updated.
	106	Once you're done, save and close the file. You can now run the Python
	107	script and watch as each file is updated.
100	108
101		```sh
	109	#+begin_src sh
102	110	python3 replace.py
103		```
	111	#+end_src
104	112
105		To confirm it worked, you can `cat` one of the configuration files to inspect
106		the new logic and connect to one to test it out.
	113	To confirm it worked, you can =cat= one of the configuration files to
	114	inspect the new logic and connect to one to test it out.
107	115
108		```sh
	116	#+begin_src sh
109	117	cat /etc/wireguard/us-chi-wg-001.conf
110		```
	118	#+end_src
111	119
112	120	The configuration files should now look like this:
113	121
114		```conf
	122	#+begin_src conf
115	123	[Interface]
116	124	# Device: <redacted>
117	125	PrivateKey = <redacted>
		@@ -124,19 +132,20 @@ PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m ad
124	132	PublicKey = <redacted>
125	133	AllowedIPs = <redacted>
126	134	Endpoint = <redacted>
127		```
	135	#+end_src
128	136
129		If you connect to a Wireguard interface, such as `us-chi-wg-001`, you can test
130		your SSH functionality and see that it works even while on the VPN.
	137	If you connect to a Wireguard interface, such as =us-chi-wg-001=, you
	138	can test your SSH functionality and see that it works even while on the
	139	VPN.
131	140
132		```sh
	141	#+begin_src sh
133	142	wg-quick up us-chi-wg-001
134	143	ssh user@lan-host
135		```
	144	#+end_src
136	145
137	146	To confirm your VPN connection, you can curl Mullvad's connection API:
138	147
139		```sh
	148	#+begin_src sh
140	149	curl https://am.i.mullvad.net/connected
141	150	# You are connected to Mullvad (server us-chi-wg-001). Your IP address is <redacted>
142		```
	151	#+end_src

blog/2023-07-19-plex-transcoder-errors.org +47 −41

		@@ -1,62 +1,68 @@
1		+++
2		date = 2023-07-19T17:00:00
3		title = "How to Fix Plex Error: 'Conversion failed. The transcoder failed to start up.'"
4		description = "Read to learn how to fix a common Plex error where the transcoder crashes due to SRT subtitle files."
5		+++
6
7		## Plex Transcoder Error
	1	#+title: How to Fix Plex Error: 'Conversion failed. The transcoder failed to start up.'
	2	#+date: 2023-07-19
8	3
	4	** Plex Transcoder Error
	5	:PROPERTIES:
	6	:CUSTOM_ID: plex-transcoder-error
	7	:END:
9	8	Occasionally, you may see an error in your Plex client that references a
10		failure with the transcoder conversion process.
11		The specific error wording is:
	9	failure with the transcoder conversion process. The specific error
	10	wording is:
12	11
13		```txt
	12	#+begin_src txt
14	13	Conversion failed. The transcoder failed to start up.
15		```
16
17		## Debugging the Cause
	14	#+end_src
18	15
19		In order to get a better look at what is causing the error, I'm going to observe
20		the Plex console while the error occurs.
21		To do this, open the Plex web client, go to `Settings` > `Manage` > `Console`.
22		Now, try to play the title again and watch to see which errors occur.
	16	** Debugging the Cause
	17	:PROPERTIES:
	18	:CUSTOM_ID: debugging-the-cause
	19	:END:
	20	In order to get a better look at what is causing the error, I'm going to
	21	observe the Plex console while the error occurs. To do this, open the
	22	Plex web client, go to =Settings= > =Manage= > =Console=. Now, try to
	23	play the title again and watch to see which errors occur.
23	24
24		In my case, you can see the errors below are related to a subtitle file (`.srt`)
25		causing the transcoder to crash.
	25	In my case, you can see the errors below are related to a subtitle file
	26	(=.srt=) causing the transcoder to crash.
26	27
27		```txt
	28	#+begin_src txt
28	29	Jul 19, 2023 16:49:34.945 [140184571120440] Error — Couldn't find the file to stream: /movies/Movie Title (2021)/Movie Title (2021).srt
29	30	Jul 19, 2023 16:49:34.947 [140184532732728] Error — [Req#7611/Transcode/42935159-67C1-4192-9336-DDC6F7BC9330] Error configuring transcoder: TPU: Failed to download sub-stream to temporary file
30	31	Jul 19, 2023 16:49:35.225 [140184532732728] Warning — [Req#760d/Transcode] Got a request to stop a transcode session without a valid session GUID.
31	32	Jul 19, 2023 16:49:45.561 [140184532732728] Info — [Req#7648] AutoUpdate: no updates available
32	33	Jul 19, 2023 16:51:23.402 [140184510081848] Info — Library section 1 (Movies) will be updated because of a change in "/movies/Movie Title (2021)/Movie Title (2021).srt"
33		```
	34	#+end_src
34	35
35		## Solving the Error
	36	** Solving the Error
	37	:PROPERTIES:
	38	:CUSTOM_ID: solving-the-error
	39	:END:
	40	In my case, I simply removed the subtitle file because it was not
	41	critical to keep. You may also avoid this by turning off subtitles if
	42	you don't want to delete the file.
36	43
37		In my case, I simply removed the subtitle file because it was not critical to
38		keep.
39		You may also avoid this by turning off subtitles if you don't want to delete the
40		file.
41
42		```sh
	44	#+begin_src sh
43	45	rm -rf "/movies/Movie Title (2021)/Movie Title (2021).srt"
44		```
	46	#+end_src
45	47
46		Once the subtitle is removed from the directory or subtitles are turned off,
47		try to play the title again.
48		At this point, it should play without error.
49		If not, reopen or refresh your Plex client and the Plex server:
	48	Once the subtitle is removed from the directory or subtitles are turned
	49	off, try to play the title again. At this point, it should play without
	50	error. If not, reopen or refresh your Plex client and the Plex server:
50	51
51		```sh
	52	#+begin_src sh
52	53	sudo systemctl restart plexmediaserver.service
53		```
54
55		## Related Discussion
	54	#+end_src
56	55
57		Looking at [a related Plex forum post](https://forums.plex.tv/t/subtitles-crashing-plex-transcoder-samsung-q80-tv-with-or-without-hardware-transcode/741441/2),
58		it seems that `.srt` subtitles are the core issue here.
59		However, Plex does not seem to have a resolution that fixes these errors.
	56	** Related Discussion
	57	:PROPERTIES:
	58	:CUSTOM_ID: related-discussion
	59	:END:
	60	Looking at
	61	[[https://forums.plex.tv/t/subtitles-crashing-plex-transcoder-samsung-q80-tv-with-or-without-hardware-transcode/741441/2][a
	62	related Plex forum post]], it seems that =.srt= subtitles are the core
	63	issue here. However, Plex does not seem to have a resolution that fixes
	64	these errors.
60	65
61	66	Unfortunately, I would suggest converting subtitle formats, burning the
62		subtitles into the title, or simply removing subtitles when they cause crashes.
	67	subtitles into the title, or simply removing subtitles when they cause
	68	crashes.

blog/2023-08-18-agile-auditing.org +142 −122

		@@ -1,152 +1,172 @@
1		+++
2		date = 2023-08-18T17:11:38+00:00
3		title = "Agile Auditing: An Introduction"
4		description = "A quick introduction to Agile, Scrum, and Kanban for audit engagement teams."
5		+++
6
7		## What is Agile Auditing?
8
9		[Agile](https://en.wikipedia.org/wiki/Agile_software_development), the
10		collaborative philosophy behind many software development methods, has been
11		picking up steam as a beneficial tool to use in the external and internal
12		auditing world.
13
14		This blog post will walk through commonly used terms within Agile, Scrum,
15		and Kanban in order to translate these terms and roles into audit-specific
16		terms.
	1	#+title: Agile Auditing: An Introduction
	2	#+date: 2023-08-18
	3
	4	** What is Agile Auditing?
	5	:PROPERTIES:
	6	:CUSTOM_ID: what-is-agile-auditing
	7	:END:
	8	[[https://en.wikipedia.org/wiki/Agile_software_development][Agile]], the
	9	collaborative philosophy behind many software development methods, has
	10	been picking up steam as a beneficial tool to use in the external and
	11	internal auditing world.
	12
	13	This blog post will walk through commonly used terms within Agile,
	14	Scrum, and Kanban in order to translate these terms and roles into
	15	audit-specific terms.
17	16
18	17	Whether your team is in charge of a financial statement audit, an
19		attestation (SOC 1, SOC 2, etc.), or a unique internal audit, the terms used
20		throughout this post should still apply.
21
22		## Agile
	18	attestation (SOC 1, SOC 2, etc.), or a unique internal audit, the terms
	19	used throughout this post should still apply.
23	20
	21	** Agile
	22	:PROPERTIES:
	23	:CUSTOM_ID: agile
	24	:END:
24	25	To start, I'll take a look at Agile.
25	26
26		> The Agile methodology is a project management approach that involves
27		> breaking the project into phases and emphasizes continuous collaboration
28		> and improvement. Teams follow a cycle of planning, executing, and evaluating.
	27	#+begin_quote
	28	The Agile methodology is a project management approach that involves
	29	breaking the project into phases and emphasizes continuous collaboration
	30	and improvement. Teams follow a cycle of planning, executing, and
	31	evaluating.
29	32
30		While this approach may seem familiar to what audit teams have historically
31		done, an audit team must make distinct changes in their mentality and how
32		they approach and manage a project.
	33	#+end_quote
33	34
34		### Agile Values
	35	While this approach may seem familiar to what audit teams have
	36	historically done, an audit team must make distinct changes in their
	37	mentality and how they approach and manage a project.
35	38
36		The Agile Manifesto, written in 2001 at a summit in Utah, contain a set of four
37		main values that comprise the Agile approach:
	39	*** Agile Values
	40	:PROPERTIES:
	41	:CUSTOM_ID: agile-values
	42	:END:
	43	The Agile Manifesto, written in 2001 at a summit in Utah, contain a set
	44	of four main values that comprise the Agile approach:
38	45
39	46	1. Individuals and interactions over processes and tools.
40	47	2. Working software over comprehensive documentation.
41	48	3. Customer collaboration over contract negotiation.
42	49	4. Responding to change over following a plan.
43	50
44		Beyond the four values, [twelve
45		principles](https://agilemanifesto.org/principles.html) were also written as
46		part of the summit.
	51	Beyond the four values,
	52	[[https://agilemanifesto.org/principles.html][twelve principles]] were
	53	also written as part of the summit.
47	54
48		In order to relate these values to an audit or attestation engagement, we
49		need to shift the focus from software development to the main goal of an
50		engagement: completing sufficient audit testing to address to relevant risks
51		over the processes and controls at hand.
	55	In order to relate these values to an audit or attestation engagement,
	56	we need to shift the focus from software development to the main goal of
	57	an engagement: completing sufficient audit testing to address to
	58	relevant risks over the processes and controls at hand.
52	59
53	60	Audit Examples:
54	61
55		- Engagement teams must value the team members, client contacts, and their
56		interactions over the historical processes and tools that have been used.
57		- Engagement teams must value a final report that contains sufficient
	62	- Engagement teams must value the team members, client contacts, and
	63	their interactions over the historical processes and tools that have
	64	been used.
	65	- Engagement teams must value a final report that contains sufficient
58	66	audit documentation over excessive documentation or scope creep.
59		- Engagement teams must collaborate with the audit clients as much as
60		feasible to ensure that both sides are constantly updated with current
61		knowledge of the engagement's status and any potential findings, rather
62		than waiting for pre-set meetings or the end of the engagement to communicate.
63		- Engagement teams must be able to respond to change in an engagement's
64		schedule, scope, or environment to ensure that the project is completed in
65		a timely manner and that all relevant areas are tested.
66		- In terms of an audit department's portfolio, they must be able to
67		respond to changes in their company's or client's environment and be
68		able to dynamically change their audit plan accordingly.
69
70		## Scrum
71
72		The above section discusses the high-level details of the Agile philosophy
73		and how an audit team can potentially mold that mindset into the audit world,
74		but how does a team implement these ideas?
	67	- Engagement teams must collaborate with the audit clients as much as
	68	feasible to ensure that both sides are constantly updated with current
	69	knowledge of the engagement's status and any potential findings,
	70	rather than waiting for pre-set meetings or the end of the engagement
	71	to communicate.
	72	- Engagement teams must be able to respond to change in an engagement's
	73	schedule, scope, or environment to ensure that the project is
	74	completed in a timely manner and that all relevant areas are tested.
	75	- In terms of an audit department's portfolio, they must be able to
	76	respond to changes in their company's or client's environment and be
	77	able to dynamically change their audit plan accordingly.
	78
	79	** Scrum
	80	:PROPERTIES:
	81	:CUSTOM_ID: scrum
	82	:END:
	83	The above section discusses the high-level details of the Agile
	84	philosophy and how an audit team can potentially mold that mindset into
	85	the audit world, but how does a team implement these ideas?
75	86
76	87	There are many methods that use an Agile mindset, but I prefer
77		[Scrum](https://en.wikipedia.org/wiki/Scrum_(software_development)). Scrum
78		is a framework based on Agile that enables a team to work through a project
79		through a series of roles, ceremonies, artifacts, and values.
	88	[[https://en.wikipedia.org/wiki/Scrum_(software_development)][Scrum]].
	89	Scrum is a framework based on Agile that enables a team to work through
	90	a project through a series of roles, ceremonies, artifacts, and values.
80	91
81	92	Let's dive into each of these individually.
82	93
83		### Scrum Team
84
85		A scrum project is only as good as the team running the project. Standard
86		scrum teams are separated into three distinct areas:
87
88		1. Product Owner (Client Contact): The client contact is the audit
89		equivalent of the product owner in Scrum. They are responsible for
90		partnering with the engagement or audit team to ensure progress is being
91		made, priorities are established, and clear guidance is given when
92		questions or findings arise within each sprint.
93		2. Scrum Master (Engagement Lead): The engagement or audit team lead is
94		responsible for coaching the team and the client contact on the scrum
95		process, tracking team progress against plan, scheduling necessary
96		resources, and helping remove obstacles.
97		3. Scrum Developers (Engagement Members): The engagement or audit team
98		is the set of team members responsible for getting the work done. These
99		team members will work on each task, report progress, resolve obstacles,
100		and collaborate with other team members and the client contact to ensure
101		goals are being met.
102
103		### Scrum Ceremonies
104
	94	*** Scrum Team
	95	:PROPERTIES:
	96	:CUSTOM_ID: scrum-team
	97	:END:
	98	A scrum project is only as good as the team running the project.
	99	Standard scrum teams are separated into three distinct areas:
	100
	101	1. Product Owner (Client Contact): The client contact is the audit
	102	equivalent of the product owner in Scrum. They are responsible for
	103	partnering with the engagement or audit team to ensure progress is
	104	being made, priorities are established, and clear guidance is given
	105	when questions or findings arise within each sprint.
	106	2. Scrum Master (Engagement Lead): The engagement or audit team lead
	107	is responsible for coaching the team and the client contact on the
	108	scrum process, tracking team progress against plan, scheduling
	109	necessary resources, and helping remove obstacles.
	110	3. Scrum Developers (Engagement Members): The engagement or audit team
	111	is the set of team members responsible for getting the work done.
	112	These team members will work on each task, report progress, resolve
	113	obstacles, and collaborate with other team members and the client
	114	contact to ensure goals are being met.
	115
	116	*** Scrum Ceremonies
	117	:PROPERTIES:
	118	:CUSTOM_ID: scrum-ceremonies
	119	:END:
105	120	Scrum ceremonies are events that are performed on a regular basis.
106	121
107		1. Sprint Planning: The team works together to plan the upcoming sprint
108		goal
109		and which user stories (tasks) will be added to the sprint to achieve
110		that goal.
111		2. Sprint: The time period, typically at least one week and no more than one
112		month in length, where the team works on the stories and anything in the
113		backlog.
114		3. Daily Scrum: A very short meeting held each day, typically 15 minutes, to
115		quickly emphasize alignment on the sprint goal and plan the next 24 hours.
116		Each team member may share what they did the day before, what they'll do
117		today, and any obstacles to their work.
118		4. Sprint Review: At the end of each sprint, the team will gather and
119		discuss the progress, obstacles, and backlog from the previous sprint.
120		5. Sprint Retrospective: More specific than the sprint review, the
121		retrospective is meant to discuss what worked and what did not work
122		during the sprint. This may be processes, tools, people, or even things
123		related to the Scrum ceremonies.
124
125		One additional ceremony that may be applicable is organizing the backlog.
126		This is typically the responsibility of the engagement leader and is meant
127		to prioritize and clarify what needs to be done to complete items in the
128		backlog.
129
130		### Artifacts
131
132		While artifacts are generally not customizable in the audit world (i.e.,
133		each control test must include some kind of working paper with evidence
134		supporting the test results), I wanted to include some quick notes on
	122	1. Sprint Planning: The team works together to plan the upcoming
	123	sprint goal and which user stories (tasks) will be added to the
	124	sprint to achieve that goal.
	125	2. Sprint: The time period, typically at least one week and no more
	126	than one month in length, where the team works on the stories and
	127	anything in the backlog.
	128	3. Daily Scrum: A very short meeting held each day, typically 15
	129	minutes, to quickly emphasize alignment on the sprint goal and plan
	130	the next 24 hours. Each team member may share what they did the day
	131	before, what they'll do today, and any obstacles to their work.
	132	4. Sprint Review: At the end of each sprint, the team will gather and
	133	discuss the progress, obstacles, and backlog from the previous
	134	sprint.
	135	5. Sprint Retrospective: More specific than the sprint review, the
	136	retrospective is meant to discuss what worked and what did not work
	137	during the sprint. This may be processes, tools, people, or even
	138	things related to the Scrum ceremonies.
	139
	140	One additional ceremony that may be applicable is organizing the
	141	backlog. This is typically the responsibility of the engagement leader
	142	and is meant to prioritize and clarify what needs to be done to complete
	143	items in the backlog.
	144
	145	*** Artifacts
	146	:PROPERTIES:
	147	:CUSTOM_ID: artifacts
	148	:END:
	149	While artifacts are generally not customizable in the audit world (i.e.,
	150	each control test must include some kind of working paper with evidence
	151	supporting the test results), I wanted to include some quick notes on
135	152	associating scrum artifact terms with an audit.
136	153
137		1. Product Backlog: This is the overall backlog of unfinished audit
	154	1. Product Backlog: This is the overall backlog of unfinished audit
138	155	tasks from all prior sprints.
139		2. Sprint Backlog: This is the backlog of unfinished audit tasks from
	156	2. Sprint Backlog: This is the backlog of unfinished audit tasks from
140	157	one individual sprint.
141		3. Increment: This is the output of each sprint - generally this is best
142		thought of as any documentation prepared during the sprint, such as risk
143		assessments, control working papers, deficiency analysis, etc.
144
145		## Kanban
146
147		Last but not least, Kanban is a methodology that relies on boards to
148		categorize work into distinct, descriptive categories that allow an agile or
149		scrum team to effectively plan the work of a sprint or project.
150
151		See Atlassian's [Kanban](https://www.atlassian.com/agile/kanban) page for
152		more information.
	158	3. Increment: This is the output of each sprint - generally this is
	159	best thought of as any documentation prepared during the sprint, such
	160	as risk assessments, control working papers, deficiency analysis,
	161	etc.
	162
	163	** Kanban
	164	:PROPERTIES:
	165	:CUSTOM_ID: kanban
	166	:END:
	167	Last but not least, Kanban is a methodology that relies on boards to
	168	categorize work into distinct, descriptive categories that allow an
	169	agile or scrum team to effectively plan the work of a sprint or project.
	170
	171	See Atlassian's [[https://www.atlassian.com/agile/kanban][Kanban]] page
	172	for more information.

blog/2023-09-15-gitweb.org +42 −34

		@@ -1,39 +1,44 @@
1		+++
2		date = 2023-09-16T03:10:37+00:00
3		title = "GitWeb via Nginx"
4		description = "A short guide on how to serve GitWeb via Nginx."
5		+++
	1	#+title: GitWeb via Nginx
	2	#+date: 2023-09-16
6	3
7		## Overview
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	[[https://git-scm.com/book/en/v2/Git-on-the-Server-GitWeb][GitWeb]] is a
	9	simple web-based visualizer for git repositories. By default, GitWeb
	10	will only run with the =lighttpd= or =webrick= web servers.
8	11
9		[GitWeb](https://git-scm.com/book/en/v2/Git-on-the-Server-GitWeb) is a simple
10		web-based visualizer for git repositories.
11		By default, GitWeb will only run with the `lighttpd` or `webrick` web servers.
12
13		However, this guide will show you how to keep GitWeb running in the background
14		and display information for all repositories in a chosen directory.
	12	However, this guide will show you how to keep GitWeb running in the
	13	background and display information for all repositories in a chosen
	14	directory.
15	15
16	16	See below for the final result:
17	17
18		![Gitweb](https://img.cleberg.net/blog/20230915-gitweb/gitweb.png "Gitweb")
19
20		## Install Dependencies
	18	#+caption: Gitweb
	19	[[https://img.cleberg.net/blog/20230915-gitweb/gitweb.png]]
21	20
	21	** Install Dependencies
	22	:PROPERTIES:
	23	:CUSTOM_ID: install-dependencies
	24	:END:
22	25	To start, you'll need install the following packages:
23	26
24		```sh
	27	#+begin_src sh
25	28	sudo apt install git gitweb fcgiwrap nginx
26		```
27
28		## Configure Nginx
	29	#+end_src
29	30
	31	** Configure Nginx
	32	:PROPERTIES:
	33	:CUSTOM_ID: configure-nginx
	34	:END:
30	35	Once installed, create an Nginx configuration file.
31	36
32		```sh
	37	#+begin_src sh
33	38	sudo nano /etc/nginx/sites-available/git.example.com
34		```
	39	#+end_src
35	40
36		```conf
	41	#+begin_src conf
37	42	server {
38	43	listen 80;
39	44	server_name example.com;
		@@ -52,23 +57,26 @@ server {
52	57	index index.cgi;
53	58	}
54	59	}
55		```
	60	#+end_src
56	61
57		To make the configuration active, you need to symlink it and then restart Nginx.
	62	To make the configuration active, you need to symlink it and then
	63	restart Nginx.
58	64
59		```sh
	65	#+begin_src sh
60	66	sudo ln -s /etc/nginx/sites-available/git.example.com /etc/nginx/sites-enabled/git.example.com
61	67	sudo systemctl restart nginx.service
62		```
63
64		The GitWeb application should now be available via the URL you set in the Nginx
65		configuration above.
	68	#+end_src
66	69
67		## Customize GitWeb
	70	The GitWeb application should now be available via the URL you set in
	71	the Nginx configuration above.
68	72
69		If you need to, you can customize many things about Gitweb by editing the
70		[gitweb.conf](https://git-scm.com/docs/gitweb.conf) file.
	73	** Customize GitWeb
	74	:PROPERTIES:
	75	:CUSTOM_ID: customize-gitweb
	76	:END:
	77	If you need to, you can customize many things about Gitweb by editing
	78	the [[https://git-scm.com/docs/gitweb.conf][gitweb.conf]] file.
71	79
72		```sh
	80	#+begin_src sh
73	81	sudo nano /etc/gitweb.conf
74		```
	82	#+end_src

blog/2023-09-19-audit-sql-scripts.org +76 −64

		@@ -1,23 +1,25 @@
1		+++
2		date = 2023-09-20T01:12:51+00:00
3		title = "Useful SQL Scripts for Auditing Logical Access"
4		description = "A handful of SQL scripts in different dialects to gather user permissions on a database."
5		+++
	1	#+title: Useful SQL Scripts for Auditing Logical Access
	2	#+date: 2023-09-20
6	3
7		## Overview
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	When you have to scope a database into your engagement, you may be
	9	curious how to best extract the information from the database. While
	10	there are numerous different methods to extract this type of
	11	information, I'm going to show an example of how to gather all users and
	12	privileges from three main database types: Oracle, Microsoft SQL, and
	13	MySQL.
8	14
9		When you have to scope a database into your engagement, you may be curious
10		how to best extract the information from the database. While there are
11		numerous different methods to extract this type of information, I'm going to
12		show an example of how to gather all users and privileges from three main
13		database types: Oracle, Microsoft SQL, and MySQL.
	15	** Oracle
	16	:PROPERTIES:
	17	:CUSTOM_ID: oracle
	18	:END:
	19	You can use the following SQL script to see all users and their
	20	privileges in an Oracle database:
14	21
15		## Oracle
16
17		You can use the following SQL script to see all users and their privileges
18		in an Oracle database:
19
20		```sql
	22	#+begin_src sql
21	23	SELECT
22	24	grantee AS "User",
23	25	privilege AS "Privilege"
		@@ -33,38 +35,43 @@ FROM
33	35	dba_tab_privs
34	36	WHERE
35	37	grantee IN (SELECT DISTINCT grantee FROM dba_tab_privs);
36		```
37
38		This script queries the `dba_sys_privs` and `dba_tab_privs` views to
39		retrieve system and table-level privileges respectively. It then combines
40		the results using `UNION ALL` to show all users and their associated
41		privileges. Please note that this method does not extract information from
42		the `dba_role_privs` table - use the method below for that data.
	38	#+end_src
43	39
44		Please note that you might need appropriate privileges (e.g., DBA privileges)
45		to access these views, and you should exercise caution when querying system
46		tables in a production Oracle database.
	40	This script queries the =dba_sys_privs= and =dba_tab_privs= views to
	41	retrieve system and table-level privileges respectively. It then
	42	combines the results using =UNION ALL= to show all users and their
	43	associated privileges. Please note that this method does not extract
	44	information from the =dba_role_privs= table - use the method below for
	45	that data.
47	46
48		### Alternative Oracle Query
	47	Please note that you might need appropriate privileges (e.g., DBA
	48	privileges) to access these views, and you should exercise caution when
	49	querying system tables in a production Oracle database.
49	50
50		You can also extract each table's information separately and perform
51		processing outside the database to explore and determine the information
	51	*** Alternative Oracle Query
	52	:PROPERTIES:
	53	:CUSTOM_ID: alternative-oracle-query
	54	:END:
	55	You can also extract each table's information separately and perform
	56	processing outside the database to explore and determine the information
52	57	necessary for the audit:
53	58
54		```sql
	59	#+begin_src sql
55	60	SELECT * FROM sys.dba_role_privs;
56	61	SELECT * FROM sys.dba_sys_privs;
57	62	SELECT * FROM sys.dba_tab_privs;
58	63	SELECT * FROM sys.dba_users;
59		```
	64	#+end_src
60	65
61		## Microsoft SQL
	66	** Microsoft SQL
	67	:PROPERTIES:
	68	:CUSTOM_ID: microsoft-sql
	69	:END:
	70	You can use the following SQL script to see all users and their
	71	privileges in a Microsoft SQL Server database
	72	([[https://stackoverflow.com/a/30040784][source]]):
62	73
63		You can use the following SQL script to see all users and their privileges
64		in a Microsoft SQL Server database
65		([source](https://stackoverflow.com/a/30040784)):
66
67		```sql
	74	#+begin_src sql
68	75	/*
69	76	Security Audit Report
70	77	1) List all access provisioned to a sql user or windows user/group directly
		@@ -209,42 +216,47 @@ ORDER BY
209	216	perm.[permission_name],
210	217	perm.[state_desc],
211	218	obj.type_desc--perm.[class_desc]
212		```
213
214		## MySQL
	219	#+end_src
215	220
216		You can use the following SQL script to see all users and their privileges
217		in a MySQL database:
	221	** MySQL
	222	:PROPERTIES:
	223	:CUSTOM_ID: mysql
	224	:END:
	225	You can use the following SQL script to see all users and their
	226	privileges in a MySQL database:
218	227
219		```shell
	228	#+begin_src shell
220	229	mysql -u root -p
221		```
	230	#+end_src
222	231
223	232	Find all users and hosts with access to the database:
224	233
225		```sql
	234	#+begin_src sql
226	235	SELECT * FROM information_schema.user_privileges;
227		```
228
229		This script retrieves user information and their associated database-level
230		privileges from the `information_schema.user_privileges` table in MySQL. It
231		lists various privileges such as SELECT, INSERT, UPDATE, DELETE, CREATE, and
232		more for each user and database combination.
	236	#+end_src
233	237
234		Please note that you may need appropriate privileges (e.g., `SELECT`
235		privileges on `information_schema.user_privileges`) to access this
236		information in a MySQL database. Additionally, some privileges like GRANT
237		OPTION, EXECUTE, EVENT, and TRIGGER may not be relevant for all users and
238		databases.
	238	This script retrieves user information and their associated
	239	database-level privileges from the =information_schema.user_privileges=
	240	table in MySQL. It lists various privileges such as SELECT, INSERT,
	241	UPDATE, DELETE, CREATE, and more for each user and database combination.
239	242
240		### Alternative MySQL Query
	243	Please note that you may need appropriate privileges (e.g., =SELECT=
	244	privileges on =information_schema.user_privileges=) to access this
	245	information in a MySQL database. Additionally, some privileges like
	246	GRANT OPTION, EXECUTE, EVENT, and TRIGGER may not be relevant for all
	247	users and databases.
241	248
242		You can also grab individual sets of data from MySQL if you prefer to join them
243		after extraction. I have marked the queries below with `SELECT ...` and excluded
244		most `WHERE` clauses for brevity. You should determine the relevant privileges
245		in-scope and query for those privileges to reduce the length of time to query.
	249	*** Alternative MySQL Query
	250	:PROPERTIES:
	251	:CUSTOM_ID: alternative-mysql-query
	252	:END:
	253	You can also grab individual sets of data from MySQL if you prefer to
	254	join them after extraction. I have marked the queries below with
	255	=SELECT ...= and excluded most =WHERE= clauses for brevity. You should
	256	determine the relevant privileges in-scope and query for those
	257	privileges to reduce the length of time to query.
246	258
247		```sql
	259	#+begin_src sql
248	260	-- Global Permissions
249	261	SELECT ... FROM mysql.user;
250	262
		@@ -263,4 +275,4 @@ WHERE db = @db_name;
263	275	-- Password Configuration
264	276	SHOW GLOBAL VARIABLES LIKE 'validate_password%';
265	277	SHOW VARIABLES LIKE 'validate_password%';
266		```
	278	#+end_src

blog/2023-10-04-digital-minimalism.org +89 −77

		@@ -1,82 +1,93 @@
1		+++
2		date = 2023-10-05T02:10:47+00:00
3		title = "Digital Minimalism"
4		description = "Some personal reflections on digital minimalism."
5		+++
6
7		I've written [a note about minimalism](/notes/minimalism) before, but I wanted
8		to dedicate some time to reflect on digital minimalism and how I've been able
9		to minimize the impact of digital devices in my life.
10
11		> These changes crept up on us and happened fast, before we had a chance to step
12		> back and ask what we really wanted out of the rapid advances of the past
13		> decade. We added new technologies to the periphery of our experience for minor
14		> reasons, then woke one morning to discover that they had colonized the core
15		> of our daily life. We didn’t, in other words, sign up for the digital world in
16		> which we’re currently entrenched; we seem to have stumbled backward into it.
17		> (Digital Minimalism, 2019)
18
19		## The Principles of Digital Minimalism
20
21		As noted in Cal Newport's book, Digital Minimalism, there are three main
	1	#+title: Digital Minimalism
	2	#+date: 2023-10-05
	3
	4	I've written [[/notes/minimalism][a note about minimalism]] before, but I wanted to dedicate some time
	5	to reflect on digital minimalism and how I've been able to minimize the impact
	6	of digital devices in my life.
	7
	8	#+begin_quote
	9	These changes crept up on us and happened fast, before we had a chance to step
	10	back and ask what we really wanted out of the rapid advances of the past
	11	decade. We added new technologies to the periphery of our experience for minor
	12	reasons, then woke one morning to discover that they had colonized the core of
	13	our daily life. We didn't, in other words, sign up for the digital world in
	14	which we're currently entrenched; we seem to have stumbled backward into
	15	it.
	16
	17	/(Digital Minimalism, 2019)/
	18	#+end_quote
	19
	20	** The Principles of Digital Minimalism
	21	:PROPERTIES:
	22	:CUSTOM_ID: the-principles-of-digital-minimalism
	23	:END:
	24	As noted in Cal Newport's book, /Digital Minimalism/, there are three main
22	25	principles to digital minimalism that I tend to agree with:
23	26
24	27	1. Clutter is costly.
25		- Digital minimalists recognize that cluttering their time and attention
26		with too many devices, apps, and services creates an overall negative
27		cost that can swamp the small benefits that each individual item
28		provides in isolation.
	28	- Digital minimalists recognize that cluttering their time and attention with
	29	too many devices, apps, and services creates an overall negative cost that
	30	can swamp the small benefits that each individual item provides in
	31	isolation.
29	32	2. Optimization is important.
30		- Digital minimalists believe that deciding a particular technology
31		supports something they value is only the first step. To truly extract
32		its full potential benefit, it’s necessary to think carefully about how
33		they’ll use the technology.
	33	- Digital minimalists believe that deciding a particular technology supports
	34	something they value is only the first step. To truly extract its full
	35	potential benefit, it's necessary to think carefully about how they'll use
	36	the technology.
34	37	3. Intentionality is satisfying.
35		- Digital minimalists derive significant satisfaction from their general
36		commitment to being more intentional about how they engage with new
37		technologies. This source of satisfaction is independent of the specific
38		decisions they make and is one of the biggest reasons that minimalism
39		tends to be immensely meaningful to its practitioners.
40
41		## Taking Action
42
43		In order to put the logic into practice, I've created a few new habits and
	38	- Digital minimalists derive significant satisfaction from their general
	39	commitment to being more intentional about how they engage with new
	40	technologies. This source of satisfaction is independent of the specific
	41	decisions they make and is one of the biggest reasons that minimalism tends
	42	to be immensely meaningful to its practitioners.
	43
	44	** Taking Action
	45	:PROPERTIES:
	46	:CUSTOM_ID: taking-action
	47	:END:
	48	In order to put the logic into practice, I've created a few new habits and
44	49	continued performing old habits that are working well:
45	50
46		### Using Devices With Intention
47
48		- I already rarely use "social media", mostly limited to forums such as Hacker
49		News and Tildes, so I've just tweaked my behavior to stop looking for content in
50		those places when I'm bored.
51		- Use devices with intention. Each time I pick up a digital device, there should
52		be an intention to use the device to improve my current situation. No more
53		endless scrolling or searching for something to interest me.
54
55		### Prevent Distractions
56
57		- Disable (most) notifications on all devices. I spent 15-30 minutes going
58		through the notifications on my phone, watch, and computer to ensure that only a
59		select few apps have the ability to interrupt me: Calendar, Messages, Phone,
60		Reminders, & Signal.
	51	*** Using Devices With Intention
	52	:PROPERTIES:
	53	:CUSTOM_ID: using-devices-with-intention
	54	:END:
	55	- I already rarely use "social media", mostly limited to forums such as Hacker
	56	News and Tildes, so I've just tweaked my behavior to stop looking for content
	57	in those places when I'm bored.
	58	- Use devices with intention. Each time I pick up a digital device, there should
	59	be an intention to use the device to improve my current situation. No more
	60	endless scrolling or searching for something to interest me.
	61
	62	*** Prevent Distractions
	63	:PROPERTIES:
	64	:CUSTOM_ID: prevent-distractions
	65	:END:
	66	- Disable (most) notifications on all devices. I spent 15-30 minutes going
	67	through the notifications on my phone, watch, and computer to ensure that only
	68	a select few apps have the ability to interrupt me: Calendar, Messages, Phone,
	69	Reminders, & Signal.
61	70	- Disable badges for any apps except the ones mentioned in the bullet above.
62		- Set-up focus profiles across devices so that I can enable different modes,
63		such as Personal when I only want to see notifications from people I care about
64		or Do Not Disturb, where absolutely nothing can interrupt me.
65		- Clean up my home screens. This one was quite easy as I already maintain a
66		minimalist set-up, but I went extreme by limiting my phone to just eight apps on
67		the home screen and four in the dock. If I need another app, I'll have to search
68		or use the app library.
69		- Remove the work profile from my phone. This was a tough decision as having my
70		work profile on my device definitely makes my life easier at times, but it also
71		has quite a negative effect when I'm "always online" and can see the
72		notifications and team activity 24/7. I believe creating a distinct barrier
73		between my work and personal devices will be beneficial in the end.
74
75		### Creating Alternative Activities
76
77		This is the most difficult piece, as most of my hobbies and interests lie in the
78		digital world. However, I'm making a concerted effort to put devices down unless
79		necessary and force myself to perform other activities in the physical world
	71	- Set-up focus profiles across devices so that I can enable different modes,
	72	such as Personal when I only want to see notifications from people I care
	73	about or Do Not Disturb, where absolutely nothing can interrupt me.
	74	- Clean up my home screens. This one was quite easy as I already maintain a
	75	minimalist set-up, but I went extreme by limiting my phone to just eight apps
	76	on the home screen and four in the dock. If I need another app, I'll have to
	77	search or use the app library.
	78	- Remove the work profile from my phone. This was a tough decision as having my
	79	work profile on my device definitely makes my life easier at times, but it
	80	also has quite a negative effect when I'm "always online" and can see the
	81	notifications and team activity 24/7. I believe creating a distinct barrier
	82	between my work and personal devices will be beneficial in the end.
	83
	84	*** Creating Alternative Activities
	85	:PROPERTIES:
	86	:CUSTOM_ID: creating-alternative-activities
	87	:END:
	88	This is the most difficult piece, as most of my hobbies and interests lie in the
	89	digital world. However, I'm making a concerted effort to put devices down unless
	90	necessary and force myself to perform other activities in the physical world
80	91	instead.
81	92
82	93	I've started with a few basics that are always readily available to me:
		@@ -87,12 +98,13 @@ I've started with a few basics that are always readily available to me:
87	98	- Participate in a hobby, such as photography, birding, disc golf, etc.
88	99	- Let yourself be bored and wander into creativity.
89	100
90		## Making Progress
91
92		I'll be taking notes as I continue down this journey and hope to see positive
93		trends. I've always been a minimalist in the physical world and it feels
94		refreshing to filter out the clutter that has come to dominate my digital life
	101	** Making Progress
	102	:PROPERTIES:
	103	:CUSTOM_ID: making-progress
	104	:END:
	105	I'll be taking notes as I continue down this journey and hope to see positive
	106	trends. I've always been a minimalist in the physical world and it feels
	107	refreshing to filter out the clutter that has come to dominate my digital life
95	108	over the years.
96	109
97	110	I'm excited to see where this journey leads.
98

blog/2023-10-11-self-hosting-authelia.org +264 −247

		@@ -1,54 +1,59 @@
1		+++
2		date = 2023-10-11T02:53:29+00:00
3		title = "Self-Hosting Authelia"
4		description = "A simple tutorial to get Authelia running on a self-hosted server."
5		+++
6
7		## Overview
8
9		[Authelia](https://www.authelia.com/) is an open-source authentication service
10		that allows you to place a portal between end users on the internet and
11		self-hosted services on your server.
12
13		You can require one factor (username+password) or two factor authentication for
	1	#+title: Self-Hosting Authelia
	2	#+date: 2023-10-11
	3
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	[[https://www.authelia.com/][Authelia]] is an open-source authentication service that allows you to place a
	9	portal between end users on the internet and self-hosted services on your
	10	server.
	11
	12	You can require one factor (username+password) or two factor authentication for
14	13	any such user before allowing them to access a specific service on your domain.
15	14
16		This guide will walk through a standard installation of Authelia for
17		`example.com`, using `auth.example.com` as Authelia's authentication domain and
18		`teddit.example.com` as the website we want to protect behind the authentication
	15	This guide will walk through a standard installation of Authelia for
	16	=example.com=, using =auth.example.com= as Authelia's authentication domain and
	17	=teddit.example.com= as the website we want to protect behind the authentication
19	18	portal.
20	19
21		## Prerequisites
22
	20	** Prerequisites
	21	:PROPERTIES:
	22	:CUSTOM_ID: prerequisites
	23	:END:
23	24	This guide assumes you have the following already set-up:
24	25
25	26	- A registered domain with DNS pointing to your server.
26		- A subdomain for Authelia (`auth.example.com`) and a subdomain to protect via
27		Authelia (`app.example.com`).
	27	- A subdomain for Authelia (=auth.example.com=) and a subdomain to
	28	protect via Authelia (=app.example.com=).
28	29	- A working Nginx web server.
29	30	- Docker and docker-compose installed.
30	31
31		## Installation
32
33		This guide will walk through each installation step one-by-one, starting with
34		the container and finishing by cleaning up external access via an Nginx reverse
	32	** Installation
	33	:PROPERTIES:
	34	:CUSTOM_ID: installation
	35	:END:
	36	This guide will walk through each installation step one-by-one, starting with
	37	the container and finishing by cleaning up external access via an Nginx reverse
35	38	proxy.
36	39
37		### Docker-Compose
38
39		To start, create a directory for Authelia and create a `docker-compose.yml`
40		file.
	40	*** Docker-Compose
	41	:PROPERTIES:
	42	:CUSTOM_ID: docker-compose
	43	:END:
	44	To start, create a directory for Authelia and create a
	45	=docker-compose.yml= file.
41	46
42		```sh
	47	#+begin_src sh
43	48	mkdir ~/authelia
44	49	nano ~/authelia/docker-compose.yml
45		```
	50	#+end_src
46	51
47		Within this file, paste the following content. If you prefer a different local
48		port, modify the port on the left side of the colon on the `9091:9091` line. Be
49		sure to modify the `TZ` variable to your timezone.
	52	Within this file, paste the following content. If you prefer a different local
	53	port, modify the port on the left side of the colon on the =9091:9091= line. Be
	54	sure to modify the =TZ= variable to your timezone.
50	55
51		```yml
	56	#+begin_src yml
52	57	version: '3.3'
53	58
54	59	services:
		@@ -61,50 +66,52 @@ services:
61	66	- 9091:9091
62	67	environment:
63	68	- TZ=America/Chicago
64		```
	69	#+end_src
65	70
66	71	Start the container with docker-compose:
67	72
68		```sh
	73	#+begin_src sh
69	74	sudo docker-compose up -d
70		```
	75	#+end_src
71	76
72		After the first start, the container will automatically exit and require you to
	77	After the first start, the container will automatically exit and require you to
73	78	modify the app's configuration files before continuing. Read on to learn more.
74	79
75		### Authelia Configuration
	80	*** Authelia Configuration
	81	:PROPERTIES:
	82	:CUSTOM_ID: authelia-configuration
	83	:END:
	84	To configure Authelia before we restart the container, we need to open the
	85	=config= directory and modify the files. Start by editing the
	86	=configuration.yml= file, where all of Authelia's settings are stored.
76	87
77		To configure Authelia before we restart the container, we need to open the
78		`config` directory and modify the files. Start by editing the
79		`configuration.yml` file, where all of Authelia's settings are stored.
80
81		My personal preference is to copy the original configuration file to a backup
	88	My personal preference is to copy the original configuration file to a backup
82	89	file and edit a fresh copy.
83	90
84		```sh
	91	#+begin_src sh
85	92	sudo cp ~/authelia/config/configuration.yml ~/authelia/config/configuration.yml.bk
86	93	sudo nano ~/authelia/config/configuration.yml
87		```
	94	#+end_src
88	95
89		Within the blank `configuration.yml` file, paste the following information. You
90		will need to make quite a few updates, so be sure to read each line carefully
	96	Within the blank =configuration.yml= file, paste the following information. You
	97	will need to make quite a few updates, so be sure to read each line carefully
91	98	and modify as necessary.
92	99
93	100	The major required changes are:
94	101
95		- Any instances of `example.com` should be replaced by your domain.
96		- `jwt_secret` - Use the `pwgen 40 1` command to generate a secret for yourself.
97		- `access_control` - Set the Authelia domain to bypass here, as well as any
98		subdomains you want to protect.
99		- `session` > `secret` - Use the `pwgen 40 1` command to generate a secret for
100		yourself.
101		- `regulation` - Set the variables here to restrict login attempts and bans.
102		- `storage` > `encryption_key` - Use the `pwgen 40 1` command to generate a
103		secret for yourself.
104		- `smtp` - If you have access to an SMTP service, set up the information here to
105		active outgoing emails.
106
107		```yml
	102	- Any instances of =example.com= should be replaced by your domain.
	103	- =jwt_secret= - Use the =pwgen 40 1= command to generate a secret for yourself.
	104	- =access_control= - Set the Authelia domain to bypass here, as well as any
	105	subdomains you want to protect.
	106	- =session= > =secret= - Use the =pwgen 40 1= command to generate a secret for
	107	yourself.
	108	- =regulation= - Set the variables here to restrict login attempts and bans.
	109	- =storage= > =encryption_key= - Use the =pwgen 40 1= command to generate a
	110	secret for yourself.
	111	- =smtp= - If you have access to an SMTP service, set up the information here to
	112	active outgoing emails.
	113
	114	#+begin_src yml
108	115	# yamllint disable rule:comments-indentation
109	116	---
110	117	###############################################################################
		@@ -193,25 +200,27 @@ notifier:
193	200	skip_verify: false
194	201	minimum_version: TLS1.2
195	202	...
196		```
197
198		### Authelia Users
	203	#+end_src
199	204
	205	*** Authelia Users
	206	:PROPERTIES:
	207	:CUSTOM_ID: authelia-users
	208	:END:
200	209	Next, create the users file for authentication.
201	210
202		```sh
	211	#+begin_src sh
203	212	sudo nano ~/authelia/config/users_database.yml
204		```
	213	#+end_src
205	214
206		Within the file, you will need to create an entry for each user that needs
207		access to Authelia. The `my_username` entry will be the username used on the
	215	Within the file, you will need to create an entry for each user that needs
	216	access to Authelia. The =my_username= entry will be the username used on the
208	217	login page.
209	218
210		To generate the password, go to [Argon2 Hash Generator](https://argon2.online),
211		generate a random salt, and make sure the rest of the settings match the
212		`authentication_backend` section of `configuration.yml` file.
	219	To generate the password, go to [[https://argon2.online][Argon2 Hash Generator]], generate a random salt,
	220	and make sure the rest of the settings match the =authentication_backend=
	221	section of =configuration.yml= file.
213	222
214		```yml
	223	#+begin_src yml
215	224	users:
216	225	my_username:
217	226	displayname: "My User"
		@@ -222,225 +231,233 @@ users:
222	231	groups:
223	232	- admins
224	233	- dev
225		```
	234	#+end_src
226	235
227	236	Once the app is configured, restart the container from scratch.
228	237
229		```sh
	238	#+begin_src sh
230	239	cd ~/authelia
231	240	sudo docker-compose down && sudo docker-compose up -d
232		```
233
234		### Nginx: Authelia Domain
	241	#+end_src
235	242
236		Once the container is running and configured, the final step is to configure
	243	*** Nginx: Authelia Domain
	244	:PROPERTIES:
	245	:CUSTOM_ID: nginx-authelia-domain
	246	:END:
	247	Once the container is running and configured, the final step is to configure
237	248	external access to the server via Nginx reverse proxy.
238	249
239	250	Start by creating the Authelia domain.
240	251
241		```sh
	252	#+begin_src sh
242	253	sudo nano /etc/nginx/sites-available/auth
243		```
	254	#+end_src
244	255
245		Within this file, paste the following information and be sure to update
246		`example.com` to your domain. Make sure the `$upstream_authelia` variable
	256	Within this file, paste the following information and be sure to update
	257	=example.com= to your domain. Make sure the =$upstream_authelia= variable
247	258	matches the location of your Authelia container.
248	259
249		```conf
	260	#+begin_src conf
250	261	server {
251		if ($host ~ ^[^.]+\.example\.com$) {
252		return 301 https://$host$request_uri;
253		}
254
255		listen [::]:80;
256		listen 80;
257		server_name auth.example.com;
258		return 404;
	262	if ($host ~ ^[^.]+\.example\.com$) {
	263	return 301 https://$host$request_uri;
	264	}
	265
	266	listen [::]:80;
	267	listen 80;
	268	server_name auth.example.com;
	269	return 404;
259	270	}
260	271
261	272	server {
262		listen [::]:443 ssl http2;
263		listen 443 ssl http2;
264		server_name auth.example.com;
265		access_log /var/log/nginx/auth.access.log;
266		error_log /var/log/nginx/auth.error.log;
267
268		ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
269		ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
270		include /etc/letsencrypt/options-ssl-nginx.conf;
271		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
272
273		location / {
274		set $upstream_authelia http://127.0.0.1:9091;
275		proxy_pass $upstream_authelia;
276		client_body_buffer_size 128k;
277
278		proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
279
280		send_timeout 5m;
281		proxy_read_timeout 360;
282		proxy_send_timeout 360;
283		proxy_connect_timeout 360;
284
285		proxy_set_header Host $host;
286		proxy_set_header X-Real-IP $remote_addr;
287		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
288		proxy_set_header X-Forwarded-Proto $scheme;
289		proxy_set_header X-Forwarded-Host $http_host;
290		proxy_set_header X-Forwarded-Uri $request_uri;
291		proxy_set_header X-Forwarded-Ssl on;
292		proxy_redirect http:// $scheme://;
293		proxy_http_version 1.1;
294		proxy_set_header Connection "";
295		proxy_cache_bypass $cookie_session;
296		proxy_no_cache $cookie_session;
297		proxy_buffers 64 256k;
298		}
	273	listen [::]:443 ssl http2;
	274	listen 443 ssl http2;
	275	server_name auth.example.com;
	276	access_log /var/log/nginx/auth.access.log;
	277	error_log /var/log/nginx/auth.error.log;
	278
	279	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
	280	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
	281	include /etc/letsencrypt/options-ssl-nginx.conf;
	282	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	283
	284	location / {
	285	set $upstream_authelia http://127.0.0.1:9091;
	286	proxy_pass $upstream_authelia;
	287	client_body_buffer_size 128k;
	288
	289	proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
	290
	291	send_timeout 5m;
	292	proxy_read_timeout 360;
	293	proxy_send_timeout 360;
	294	proxy_connect_timeout 360;
	295
	296	proxy_set_header Host $host;
	297	proxy_set_header X-Real-IP $remote_addr;
	298	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	299	proxy_set_header X-Forwarded-Proto $scheme;
	300	proxy_set_header X-Forwarded-Host $http_host;
	301	proxy_set_header X-Forwarded-Uri $request_uri;
	302	proxy_set_header X-Forwarded-Ssl on;
	303	proxy_redirect http:// $scheme://;
	304	proxy_http_version 1.1;
	305	proxy_set_header Connection "";
	306	proxy_cache_bypass $cookie_session;
	307	proxy_no_cache $cookie_session;
	308	proxy_buffers 64 256k;
	309	}
299	310
300	311	}
301		```
	312	#+end_src
302	313
303		Next, symlink the file and restart Nginx. If there are errors, be sure to
	314	Next, symlink the file and restart Nginx. If there are errors, be sure to
304	315	resolve those before moving on.
305	316
306		```sh
	317	#+begin_src sh
307	318	sudo ln -s /etc/nginx/sites-available/auth /etc/nginx/sites-enabled/auth
308	319	sudo systemctl restart nginx.service
309		```
	320	#+end_src
310	321
311		### Nginx: Protected Domain(s)
	322	*** Nginx: Protected Domain(s)
	323	:PROPERTIES:
	324	:CUSTOM_ID: nginx-protected-domains
	325	:END:
	326	Now that Authelia is accessible externally, you need to configure the domain you
	327	intend to protect with Authelia. In this example, I'm protecting
	328	=teddit.example.com=.
312	329
313		Now that Authelia is accessible externally, you need to configure the domain you
314		intend to protect with Authelia. In this example, I'm protecting
315		`teddit.example.com`.
316
317		Similar to the process above, paste the content and update the relevant
	330	Similar to the process above, paste the content and update the relevant
318	331	variables.
319	332
320		```sh
	333	#+begin_src sh
321	334	sudo nano /etc/nginx/sites-available/teddit
322		```
	335	#+end_src
323	336
324		```conf
	337	#+begin_src conf
325	338	server {
326		if ($host ~ ^[^.]+\.example\.com$) {
327		return 301 https://$host$request_uri;
328		}
329
330		listen [::]:80;
331		listen 80;
332		server_name teddit.example.com;
333		return 404;
	339	if ($host ~ ^[^.]+\.example\.com$) {
	340	return 301 https://$host$request_uri;
	341	}
	342
	343	listen [::]:80;
	344	listen 80;
	345	server_name teddit.example.com;
	346	return 404;
334	347	}
335	348
336	349	server {
337		listen [::]:443 ssl http2;
338		listen 443 ssl http2;
339		server_name teddit.example.com;
340		access_log /var/log/nginx/teddit.access.log;
341		error_log /var/log/nginx/teddit.error.log;
342
343		add_header X-Content-Type-Options "nosniff";
344		add_header X-XSS-Protection "1; mode=block";
345		add_header X-Frame-Options "DENY";
346		add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
347		add_header Referrer-Policy "no-referrer";
348
349		ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
350		ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
351		include /etc/letsencrypt/options-ssl-nginx.conf;
352		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
353
354		location /authelia {
355		internal;
356		set $upstream_authelia http://127.0.0.1:9091/api/verify;
357		proxy_pass_request_body off;
358		proxy_pass $upstream_authelia;
359		proxy_set_header Content-Length "";
360
361		proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
362		client_body_buffer_size 128k;
363		proxy_set_header Host $host;
364		proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
365		proxy_set_header X-Real-IP $remote_addr;
366		proxy_set_header X-Forwarded-For $remote_addr;
367		proxy_set_header X-Forwarded-Proto $scheme;
368		proxy_set_header X-Forwarded-Host $http_host;
369		proxy_set_header X-Forwarded-Uri $request_uri;
370		proxy_set_header X-Forwarded-Ssl on;
371		proxy_redirect http:// $scheme://;
372		proxy_http_version 1.1;
373		proxy_set_header Connection "";
374		proxy_cache_bypass $cookie_session;
375		proxy_no_cache $cookie_session;
376		proxy_buffers 4 32k;
377
378		send_timeout 5m;
379		proxy_read_timeout 240;
380		proxy_send_timeout 240;
381		proxy_connect_timeout 240;
382		}
383
384		location / {
385		set $upstream_teddit http://127.0.0.1:8686;
386		proxy_pass $upstream_teddit;
387
388		auth_request /authelia;
389		auth_request_set $target_url https://$http_host$request_uri;
390		auth_request_set $user $upstream_http_remote_user;
391		auth_request_set $email $upstream_http_remote_email;
392		auth_request_set $groups $upstream_http_remote_groups;
393		proxy_set_header Remote-User $user;
394		proxy_set_header Remote-Email $email;
395		proxy_set_header Remote-Groups $groups;
396
397		error_page 401 =302 https://auth.example.com/?rd=$target_url;
398
399		client_body_buffer_size 128k;
400
401		proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
402
403		send_timeout 5m;
404		proxy_read_timeout 360;
405		proxy_send_timeout 360;
406		proxy_connect_timeout 360;
407
408		proxy_set_header Host $host;
409		proxy_set_header Upgrade $http_upgrade;
410		proxy_set_header Connection upgrade;
411		proxy_set_header Accept-Encoding gzip;
412		proxy_set_header X-Real-IP $remote_addr;
413		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
414		proxy_set_header X-Forwarded-Proto $scheme;
415		proxy_set_header X-Forwarded-Host $http_host;
416		proxy_set_header X-Forwarded-Uri $request_uri;
417		proxy_set_header X-Forwarded-Ssl on;
418		proxy_redirect http:// $scheme://;
419		proxy_http_version 1.1;
420		proxy_set_header Connection "";
421		proxy_cache_bypass $cookie_session;
422		proxy_no_cache $cookie_session;
423		proxy_buffers 64 256k;
424		}
	350	listen [::]:443 ssl http2;
	351	listen 443 ssl http2;
	352	server_name teddit.example.com;
	353	access_log /var/log/nginx/teddit.access.log;
	354	error_log /var/log/nginx/teddit.error.log;
	355
	356	add_header X-Content-Type-Options "nosniff";
	357	add_header X-XSS-Protection "1; mode=block";
	358	add_header X-Frame-Options "DENY";
	359	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	360	add_header Referrer-Policy "no-referrer";
	361
	362	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
	363	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
	364	include /etc/letsencrypt/options-ssl-nginx.conf;
	365	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	366
	367	location /authelia {
	368	internal;
	369	set $upstream_authelia http://127.0.0.1:9091/api/verify;
	370	proxy_pass_request_body off;
	371	proxy_pass $upstream_authelia;
	372	proxy_set_header Content-Length "";
	373
	374	proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
	375	client_body_buffer_size 128k;
	376	proxy_set_header Host $host;
	377	proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
	378	proxy_set_header X-Real-IP $remote_addr;
	379	proxy_set_header X-Forwarded-For $remote_addr;
	380	proxy_set_header X-Forwarded-Proto $scheme;
	381	proxy_set_header X-Forwarded-Host $http_host;
	382	proxy_set_header X-Forwarded-Uri $request_uri;
	383	proxy_set_header X-Forwarded-Ssl on;
	384	proxy_redirect http:// $scheme://;
	385	proxy_http_version 1.1;
	386	proxy_set_header Connection "";
	387	proxy_cache_bypass $cookie_session;
	388	proxy_no_cache $cookie_session;
	389	proxy_buffers 4 32k;
	390
	391	send_timeout 5m;
	392	proxy_read_timeout 240;
	393	proxy_send_timeout 240;
	394	proxy_connect_timeout 240;
	395	}
	396
	397	location / {
	398	set $upstream_teddit http://127.0.0.1:8686;
	399	proxy_pass $upstream_teddit;
	400
	401	auth_request /authelia;
	402	auth_request_set $target_url https://$http_host$request_uri;
	403	auth_request_set $user $upstream_http_remote_user;
	404	auth_request_set $email $upstream_http_remote_email;
	405	auth_request_set $groups $upstream_http_remote_groups;
	406	proxy_set_header Remote-User $user;
	407	proxy_set_header Remote-Email $email;
	408	proxy_set_header Remote-Groups $groups;
	409
	410	error_page 401 =302 https://auth.example.com/?rd=$target_url;
	411
	412	client_body_buffer_size 128k;
	413
	414	proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
	415
	416	send_timeout 5m;
	417	proxy_read_timeout 360;
	418	proxy_send_timeout 360;
	419	proxy_connect_timeout 360;
	420
	421	proxy_set_header Host $host;
	422	proxy_set_header Upgrade $http_upgrade;
	423	proxy_set_header Connection upgrade;
	424	proxy_set_header Accept-Encoding gzip;
	425	proxy_set_header X-Real-IP $remote_addr;
	426	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	427	proxy_set_header X-Forwarded-Proto $scheme;
	428	proxy_set_header X-Forwarded-Host $http_host;
	429	proxy_set_header X-Forwarded-Uri $request_uri;
	430	proxy_set_header X-Forwarded-Ssl on;
	431	proxy_redirect http:// $scheme://;
	432	proxy_http_version 1.1;
	433	proxy_set_header Connection "";
	434	proxy_cache_bypass $cookie_session;
	435	proxy_no_cache $cookie_session;
	436	proxy_buffers 64 256k;
	437	}
425	438	}
426		```
	439	#+end_src
427	440
428	441	Same as before, symlink the file and restart Nginx.
429	442
430		```sh
	443	#+begin_src sh
431	444	sudo ln -s /etc/nginx/sites-available/teddit /etc/nginx/sites-enabled/teddit
432	445	sudo systemctl restart nginx.service
433		```
434
435		## Results
	446	#+end_src
436	447
437		When visiting the protected domain, you will now be redirected to your
	448	** Results
	449	:PROPERTIES:
	450	:CUSTOM_ID: results
	451	:END:
	452	When visiting the protected domain, you will now be redirected to your
438	453	authentication domain and presented with the Authelia login portal.
439	454
440		![Authelia Portal](https://img.cleberg.net/blog/20231010-authelia/authelia_portal.png "Authelia Portal")
	455	#+caption: Authelia Portal
	456	[[https://img.cleberg.net/blog/20231010-authelia/authelia_portal.png]]
441	457
442		Once you've successfully authenticated, you can visit your authentication domain
443		directly and see that you're currently authenticated to any domain protected by
	458	Once you've successfully authenticated, you can visit your authentication domain
	459	directly and see that you're currently authenticated to any domain protected by
444	460	Authelia.
445	461
446		![Authelia Success](https://img.cleberg.net/blog/20231010-authelia/authelia_success.png "Authelia Success")
	462	#+caption: Authelia Success
	463	[[https://img.cleberg.net/blog/20231010-authelia/authelia_success.png]]

blog/2023-10-15-alpine-ssh-hardening.org +54 −40

		@@ -1,60 +1,74 @@
1		+++
2		date = 2023-10-16T00:20:45+00:00
3		title = "SSH Hardening for Alpine Linux"
4		description = "A quick guide to hardening SSH on Alpine Linux."
5		+++
6
7		## Overview
	1	#+title: SSH Hardening for Alpine Linux
	2	#+date: 2023-10-16
8	3
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
9	8	This guide follows the standard
10		[ssh-audit](https://www.ssh-audit.com/hardening_guides.html) hardening guide,
11		tweaked for Alpine Linux.
12
13		## Hardening Guide
	9	[[https://www.ssh-audit.com/hardening_guides.html][ssh-audit]] hardening
	10	guide, tweaked for Alpine Linux.
14	11
15		These steps must be performed as root. You can try to use `doas` or `sudo`,
16		but there may be issues.
	12	** Hardening Guide
	13	:PROPERTIES:
	14	:CUSTOM_ID: hardening-guide
	15	:END:
	16	These steps must be performed as root. You can try to use =doas= or
	17	=sudo=, but there may be issues.
17	18
18	19	1. Re-generate the RSA and ED25519 keys
19		```sh
	20
	21	#+begin_src sh
20	22	rm /etc/ssh/ssh_host_*
21	23	ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
22	24	ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
23		```
24		2. Remove small Diffie-Hellman moduli
25		```sh
	25	#+end_src
	26
	27	2. [@2] Remove small Diffie-Hellman moduli
	28
	29	#+begin_src sh
26	30	awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
27	31	mv /etc/ssh/moduli.safe /etc/ssh/moduli
28		```
29		3. Enable the RSA and ED25519 HostKey directives in the /etc/ssh/sshd_config
30		file
31		```sh
	32	#+end_src
	33
	34	3. [@3] Enable the RSA and ED25519 HostKey directives in the
	35	/etc/ssh/sshd_config file
	36
	37	#+begin_src sh
32	38	sed -i 's/^\#HostKey \/etc\/ssh\/ssh_host_$rsa\\|ed25519$_key$/HostKey \/etc\/ssh\/ssh_host_\1_key/g' /etc/ssh/sshd_config
33		```
34		4. Restrict supported key exchange, cipher, and MAC algorithms
35		```sh
	39	#+end_src
	40
	41	4. [@4] Restrict supported key exchange, cipher, and MAC algorithms
	42
	43	#+begin_src sh
36	44	echo -e "\n# Restrict key exchange, cipher, and MAC algorithms, as per sshaudit.com\n# hardening guide.\nKexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha256\nCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\nMACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,umac-128-etm@openssh.com\nHostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com" > /etc/ssh/sshd_config.d/ssh-audit_hardening.conf
37		```
38		5. Include the /etc/ssh/sshd_config.d directory
39		```sh
	45	#+end_src
	46
	47	5. [@5] Include the /etc/ssh/sshd_config.d directory
	48
	49	#+begin_src sh
40	50	echo -e "Include /etc/ssh/sshd_config.d/*.conf" > /etc/ssh/sshd_config
41		```
42		6. Restart OpenSSH server
43		```sh
44		rc-service sshd restart
45		```
	51	#+end_src
	52
	53	6. [@6] Restart OpenSSH server
46	54
47		## Testing SSH
	55	#+begin_src sh
	56	rc-service sshd restart
	57	#+end_src
48	58
49		You can test the results with the `ssh-audit` python script.
	59	** Testing SSH
	60	:PROPERTIES:
	61	:CUSTOM_ID: testing-ssh
	62	:END:
	63	You can test the results with the =ssh-audit= python script.
50	64
51		```sh
	65	#+begin_src sh
52	66	pip3 install ssh-audit
53	67	ssh-audit localhost
54		```
	68	#+end_src
55	69
56		If everything succeeded, the results will show as all green. If anything is
57		yellow, orange, or red, you may need to tweak additional settings.
	70	If everything succeeded, the results will show as all green. If anything
	71	is yellow, orange, or red, you may need to tweak additional settings.
58	72
59		![ssh audit](https://img.cleberg.net/blog/20231015-ssh-hardening/ssh-audit.png
60		"ssh-audit")
	73	#+caption: ssh audit
	74	[[https://img.cleberg.net/blog/20231015-ssh-hardening/ssh-audit.png%20%22ssh-audit%22]]

blog/2023-10-17-self-hosting-anonymousoverflow.org +98 −93

		@@ -1,33 +1,37 @@
1		+++
2		date = 2023-10-17T15:44:45.601627917+00:00
3		title = "Self-Hosting AnonymousOverflow"
4		description = "A quick guide to self-hosting AnonymousOverflow."
5		+++
6
7		## Overview
8
9		I recently launched an instance of AnonymousOverflow at
10		[ao.cleberg.net](https://ao.cleberg.net) and wanted to write a brief post on how
11		easy it is to install with Docker Compose and Nginx.
12
13		This guide uses Ubuntu server, Docker Compose, and Nginx as a reverse proxy.
14
15		## Installation
16
17		### Docker Compose
18
19		To install AnonymousOverflow, start by creating a directory for the application
20		and create its `docker-compose.yml` file.
21
22		```sh
	1	#+title: Self-Hosting AnonymousOverflow
	2	#+date: 2023-10-17
	3
	4	** Overview
	5	:PROPERTIES:
	6	:CUSTOM_ID: overview
	7	:END:
	8	I recently launched an instance of AnonymousOverflow at [[https://ao.cleberg.net][ao.cleberg.net]] and
	9	wanted to write a brief post on how easy it is to install with Docker Compose
	10	and Nginx.
	11
	12	This guide uses Ubuntu server, Docker Compose, and Nginx as a reverse
	13	proxy.
	14
	15	** Installation
	16	:PROPERTIES:
	17	:CUSTOM_ID: installation
	18	:END:
	19	*** Docker Compose
	20	:PROPERTIES:
	21	:CUSTOM_ID: docker-compose
	22	:END:
	23	To install AnonymousOverflow, start by creating a directory for the
	24	application and create its =docker-compose.yml= file.
	25
	26	#+begin_src sh
23	27	mkdir ~/anonymousoverflow && cd ~/anonymousoverflow
24	28	nano docker-compose.yml
25		```
	29	#+end_src
26	30
27	31	Within this file, paste the following information. Be sure to change the
28		`APP_URL`, `JWT_SIGNING_SECRET`, and `ports` to match your needs.
	32	=APP_URL=, =JWT_SIGNING_SECRET=, and =ports= to match your needs.
29	33
30		```yaml
	34	#+begin_src yaml
31	35	version: '3'
32	36
33	37	services:
		@@ -40,92 +44,93 @@ services:
40	44	ports:
41	45	- '9380:8080'
42	46	restart: 'always'
43		```
	47	#+end_src
44	48
45		Save and exit the file when complete. You can now launch the container and
46		access it via your local network.
	49	Save and exit the file when complete. You can now launch the container
	50	and access it via your local network.
47	51
48		```sh
	52	#+begin_src sh
49	53	sudo docker-compose up -d
50		```
51
52		### Nginx Reverse Proxy
	54	#+end_src
53	55
54		If you want to access this service outside the local network, I recommend using
55		Nginx as a reverse proxy.
	56	*** Nginx Reverse Proxy
	57	:PROPERTIES:
	58	:CUSTOM_ID: nginx-reverse-proxy
	59	:END:
	60	If you want to access this service outside the local network, I
	61	recommend using Nginx as a reverse proxy.
56	62
57	63	Let's start by creating a configuration file.
58	64
59		```sh
	65	#+begin_src sh
60	66	sudo nano /etc/nginx/sites-available/ao
61		```
	67	#+end_src
62	68
63		Within this file, paste the following content and repace `ao.example.com` with
64		your URL. You may need to update the SSL certificate statements if your
65		certificates are in a different location.
	69	Within this file, paste the following content and repace
	70	=ao.example.com= with your URL. You may need to update the SSL
	71	certificate statements if your certificates are in a different location.
66	72
67		```conf
	73	#+begin_src conf
68	74	server {
69		if ($host ~ ^[^.]+\.cleberg\.net$) {
70		return 301 https://$host$request_uri;
71		}
72
73		listen [::]:80;
74		listen 80;
75		server_name ao.example.com;
76		return 404;
	75	if ($host ~ ^[^.]+\.cleberg\.net$) {
	76	return 301 https://$host$request_uri;
	77	}
	78
	79	listen [::]:80;
	80	listen 80;
	81	server_name ao.example.com;
	82	return 404;
77	83	}
78	84
79	85	server {
80		listen [::]:443 ssl http2;
81		listen 443 ssl http2;
82		server_name ao.example.com;
83		access_log /var/log/nginx/ao.access.log;
84		error_log /var/log/nginx/ao.error.log;
85
86		add_header X-Content-Type-Options "nosniff";
87		add_header X-XSS-Protection "1; mode=block";
88		add_header X-Frame-Options "DENY";
89		add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
90		add_header Referrer-Policy "no-referrer";
91
92		ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
93		ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
94		include /etc/letsencrypt/options-ssl-nginx.conf;
95		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
96
97		location / {
98		set $upstream_ao http://127.0.0.1:9380;
99		proxy_pass $upstream_ao;
100
101		proxy_set_header Host $host;
102		proxy_set_header Upgrade $http_upgrade;
103		proxy_set_header Connection upgrade;
104		proxy_set_header Accept-Encoding gzip;
105		proxy_set_header X-Real-IP $remote_addr;
106		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
107		proxy_set_header X-Forwarded-Proto $scheme;
108		proxy_set_header X-Forwarded-Host $http_host;
109		proxy_set_header X-Forwarded-Uri $request_uri;
110		proxy_set_header X-Forwarded-Ssl on;
111		proxy_redirect http:// $scheme://;
112		proxy_http_version 1.1;
113		proxy_set_header Connection "";
114		proxy_cache_bypass $cookie_session;
115		proxy_no_cache $cookie_session;
116		proxy_buffers 64 256k;
117		}
	86	listen [::]:443 ssl http2;
	87	listen 443 ssl http2;
	88	server_name ao.example.com;
	89	access_log /var/log/nginx/ao.access.log;
	90	error_log /var/log/nginx/ao.error.log;
	91
	92	add_header X-Content-Type-Options "nosniff";
	93	add_header X-XSS-Protection "1; mode=block";
	94	add_header X-Frame-Options "DENY";
	95	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
	96	add_header Referrer-Policy "no-referrer";
	97
	98	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
	99	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
	100	include /etc/letsencrypt/options-ssl-nginx.conf;
	101	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
	102
	103	location / {
	104	set $upstream_ao http://127.0.0.1:9380;
	105	proxy_pass $upstream_ao;
	106
	107	proxy_set_header Host $host;
	108	proxy_set_header Upgrade $http_upgrade;
	109	proxy_set_header Connection upgrade;
	110	proxy_set_header Accept-Encoding gzip;
	111	proxy_set_header X-Real-IP $remote_addr;
	112	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	113	proxy_set_header X-Forwarded-Proto $scheme;
	114	proxy_set_header X-Forwarded-Host $http_host;
	115	proxy_set_header X-Forwarded-Uri $request_uri;
	116	proxy_set_header X-Forwarded-Ssl on;
	117	proxy_redirect http:// $scheme://;
	118	proxy_http_version 1.1;
	119	proxy_set_header Connection "";
	120	proxy_cache_bypass $cookie_session;
	121	proxy_no_cache $cookie_session;
	122	proxy_buffers 64 256k;
	123	}
118	124	}
119		```
	125	#+end_src
120	126
121	127	Save and exit the file when complete. On Ubuntu, you will need to symlink the
122		configuration file before it will be recognized by Nginx. Once complete,
123		simply restart the web server.
	128	configuration file before it will be recognized by Nginx. Once complete, simply
	129	restart the web server.
124	130
125		```sh
	131	#+begin_src sh
126	132	sudo ln -s /etc/nginx/sites-available/ao /etc/nginx/sites-enabled/ao
127	133	sudo systemctl restart nginx.service
128		```
	134	#+end_src
129	135
130		The website will now be available publicly. Visit
131		[my instance](https://ao.cleberg.net) for an example.
	136	The website will now be available publicly. Visit [[https://ao.cleberg.net][my instance]] for an example.

blog/2023-11-08-scli.org +100 −93

		@@ -1,146 +1,153 @@
1		+++
2		date = 2023-11-08T21:37:00.307616604+00:00
3		title = "Installing scli on Alpine Linux (musl)"
4		description = ""
5		+++
6
7		[scli](https://github.com/isamert/scli) is a command-line tool that allows you
8		to connect to your Signal messenger account. This program utilizes a two-pane
9		display that shows you chats on the left and the focused conversation on the
10		right.
11
12		This guide will show you how to install `scli` and its dependencies on Alpine
13		Linux, which requires some extra work due to musl.
14
15		If you're using a non-musl system, you can likely following the `scli` README
16		and download the packaged binaries for an easier installation process.
	1	#+title: Installing scli on Alpine Linux (musl)
	2	#+date: 2023-11-08
17	3
18		## Dependencies
	4	[[https://github.com/isamert/scli][scli]] is a command-line tool that allows you to connect to your Signal messenger
	5	account. This program utilizes a two-pane display that shows you chats on the
	6	left and the focused conversation on the right.
19	7
20		In order to use `scli`, you need a few dependencies:
21
22		- `openjdk17-jre` - Used as a dependency for the `signal-cli` tool. Version may
23		vary.
24		- `signal-cli` - Used as the backbone of the `scli` tool.
25		- `findutils` - Replaces the standard Busybox version of `xargs`.
26		- `urwid` - A console user interface library for Python.
27		- `urwid-readline` - For GNU emacs-like keybinds on the input line.
28		- `qrencode` - Displays a QR code in the terminal to link the device using your
29		phone. Not necessary if you're only linking on desktop and can copy/paste the
30		connection URL.
	8	This guide will show you how to install =scli= and its dependencies on Alpine
	9	Linux, which requires some extra work due to musl.
31	10
32		Let's start by installing the packages available via Alpine's repositories. Be
33		sure to install the latest version of `openjdk`. If you run into Java-related
34		issues, uninstall `openjdk` and install an older version.
	11	If you're using a non-musl system, you can likely following the =scli= README
	12	and download the packaged binaries for an easier installation process.
35	13
36		```sh
	14	** Dependencies
	15	:PROPERTIES:
	16	:CUSTOM_ID: dependencies
	17	:END:
	18	In order to use =scli=, you need a few dependencies:
	19
	20	- =openjdk17-jre= - Used as a dependency for the =signal-cli= tool.
	21	Version may vary.
	22	- =signal-cli= - Used as the backbone of the =scli= tool.
	23	- =findutils= - Replaces the standard Busybox version of =xargs=.
	24	- =urwid= - A console user interface library for Python.
	25	- =urwid-readline= - For GNU emacs-like keybinds on the input line.
	26	- =qrencode= - Displays a QR code in the terminal to link the device
	27	using your phone. Not necessary if you're only linking on desktop and
	28	can copy/paste the connection URL.
	29
	30	Let's start by installing the packages available via Alpine's
	31	repositories. Be sure to install the latest version of =openjdk=. If you
	32	run into Java-related issues, uninstall =openjdk= and install an older
	33	version.
	34
	35	#+begin_src sh
37	36	doas apk add openjdk17-jre findutils qrencode
38		```
	37	#+end_src
39	38
40		Next, let's install `signal-cli`. Be sure to export the version of `signal-cli`
41		that you want. I use version `0.12.4` below, but that may be outdated by the
42		time you're reading this.
	39	Next, let's install =signal-cli=. Be sure to export the version of
	40	=signal-cli= that you want. I use version =0.12.4= below, but that may
	41	be outdated by the time you're reading this.
43	42
44		```sh
	43	#+begin_src sh
45	44	export VERSION="0.12.4"
46	45	wget https://github.com/AsamK/signal-cli/releases/download/v"${VERSION}"/signal-cli-"${VERSION}".tar.gz
47	46	doas tar xf signal-cli-"${VERSION}".tar.gz -C /opt
48	47	doas ln -sf /opt/signal-cli-${VERSION}"/bin/signal/cli /usr/local/bin
49		```
	48	#+end_src
50	49
51		Finally, install the `urwid` packages using the Python packaging utility.
	50	Finally, install the =urwid= packages using the Python packaging
	51	utility.
52	52
53		```sh
	53	#+begin_src sh
54	54	pip3 install urwid urwid-readline
55		```
56
57		## Installation
	55	#+end_src
58	56
59		Now that we have all of the dependencies we need, we can install `scli`. Start
60		by simply cloning the repository.
	57	** Installation
	58	:PROPERTIES:
	59	:CUSTOM_ID: installation
	60	:END:
	61	Now that we have all of the dependencies we need, we can install =scli=.
	62	Start by simply cloning the repository.
61	63
62		```sh
	64	#+begin_src sh
63	65	git clone https://github.com/isamert/scli
64		```
	66	#+end_src
65	67
66		When I cloned this repository on 2023-11-08, I found a bug in the logic that
67		required a fix. You must edit the `scli` file and replace the one instance of
68		`RLIMIT_OFILE` with `RLIMIT_NOFILE`.
	68	When I cloned this repository on 2023-11-08, I found a bug in the logic
	69	that required a fix. You must edit the =scli= file and replace the one
	70	instance of =RLIMIT_OFILE= with =RLIMIT_NOFILE=.
69	71
70		```sh
	72	#+begin_src sh
71	73	cd scli
72	74	nano scli
73		```
	75	#+end_src
74	76
75		Once complete, you can move this program to anywhere on your `$PATH`. I chose
76		the following directory.
	77	Once complete, you can move this program to anywhere on your =$PATH=. I
	78	chose the following directory.
77	79
78		```sh
	80	#+begin_src sh
79	81	doas mv scli /usr/local/bin/scli
80		```
	82	#+end_src
81	83
82		## Initial Setup
	84	** Initial Setup
	85	:PROPERTIES:
	86	:CUSTOM_ID: initial-setup
	87	:END:
	88	Now that everything is installed, we can login and configure the client.
	89	Start by generating a connection link.
83	90
84		Now that everything is installed, we can login and configure the client. Start
85		by generating a connection link.
86
87		```sh
	91	#+begin_src sh
88	92	signal-cli link -n "YOUR-DEVICE-NICKNAME" \| tee >(xargs -L 1 qrencode -t utf8)
89		```
	93	#+end_src
90	94
91		This will generate a connection link and related QR code for you to use to link
92		the devices together. Once complete, wait patiently for the connection
93		process to finish.
	95	This will generate a connection link and related QR code for you to use
	96	to link the devices together. Once complete, wait patiently for the
	97	connection process to finish.
94	98
95		Once it completes, it will exit and return you to the prompt. From here, you
96		need to perform an initial `receive` command to start things off. The `USERNAME`
97		variable should be your phone number, such as `+15551237890`.
	99	Once it completes, it will exit and return you to the prompt. From here,
	100	you need to perform an initial =receive= command to start things off.
	101	The =USERNAME= variable should be your phone number, such as
	102	=+15551237890=.
98	103
99		```sh
	104	#+begin_src sh
100	105	signal-cli -u USERNAME receive
101		```
	106	#+end_src
102	107
103		Also be sure to test the daemon to ensure it works properly. If no errors occur,
104		it's working. If you run into errors because you're not running a DBUS session,
105		see my notes below.
	108	Also be sure to test the daemon to ensure it works properly. If no
	109	errors occur, it's working. If you run into errors because you're not
	110	running a DBUS session, see my notes below.
106	111
107		```sh
	112	#+begin_src sh
108	113	signal-cli -u USERNAME daemon
109		```
	114	#+end_src
110	115
111		Once the initial reception is complete, you are ready to use `scli`.
	116	Once the initial reception is complete, you are ready to use =scli=.
112	117
113		This process will differ depending on your desktop environment (DE). If you are
114		running a DE, you likely have a DBUS session running already and can simply
115		launch the program.
	118	This process will differ depending on your desktop environment (DE). If
	119	you are running a DE, you likely have a DBUS session running already and
	120	can simply launch the program.
116	121
117		However, if you're like me and running your computer straight on the TTY without
118		a DE, you'll need to start a DBUS session for this program.
	122	However, if you're like me and running your computer straight on the TTY
	123	without a DE, you'll need to start a DBUS session for this program.
119	124
120		```sh
	125	#+begin_src sh
121	126	# If you're not running a DBUS session yet, you need to start one for scli
122	127	dbus-run-session -- scli
123	128
124	129	# OR - If you're already running a DBUS session, simply run scli
125	130	scli
126		```
127
128		## Configuration
	131	#+end_src
129	132
130		Lastly, there are a number of configuration options that you can pass via the
131		command or in the `~/.config/sclirc` file. See the Github README for more
132		information on configuration options.
	133	** Configuration
	134	:PROPERTIES:
	135	:CUSTOM_ID: configuration
	136	:END:
	137	Lastly, there are a number of configuration options that you can pass
	138	via the command or in the =~/.config/sclirc= file. See the Github README
	139	for more information on configuration options.
133	140
134		```sh
	141	#+begin_src sh
135	142	nano ~/.config/sclirc
136		```
	143	#+end_src
137	144
138		```conf
	145	#+begin_src conf
139	146	# ~/.config/sclirc
140	147
141	148	wrap-at = 80
142	149	enable-notifications = true
143		```
	150	#+end_src
144	151
145		That's it! Following this guide, I have a functional `scli` program that
	152	That's it! Following this guide, I have a functional =scli= program that
146	153	successfully sends messages to my contacts and myself!

Commit 3d4da5ac60

Commit `3d4da5ac60`