Paul's Site of Stuff

What's the Deal with Calendar Categories?

2026-01-16T15:57:13+00:00
What's the deal with Calendar Categories?
Why do all services and applications seem to handle them differently?
This is a general vent of me, working through all these things and trying to find a reasonable solution!</p> </span>
Situation</a></h2>
A bit of set up: I run my own B2B IT business. It's a small business, with just me as a full-time employee, but I have a business administrator (who just so happens to be my amazing wife) who handles some of the more admin-heavy workload i.e. Invoicing, general organisation, and some business communications.</p>
Since the start of business operations back in 2015 (it's been nearly 11 years?! WOW) we've always been Open Source First, but due to the requirements of reliable email deliverability we [reluctantly] have been using Microsoft 365 as our primary Email and Calendar service.</p>
Naturally, recent events with the dawn of "AI" and Microsoft's Copilot being shoehorned into absolutely everything that Microsoft have their hands on, we've made the very exciting decision to remove Microsoft 365 products from our business (Yay!).</p>
The story of moving to another provider is one for another time, but suffice to say we are in the process of moving to a Open Source platform that utilises CalDAV for calendars.</p>
Calendar Categories</a></h2>
We use categories to highlight different workloads... (well, my lovely administrator wife does anyway)... and previously, this was managed in Outlook (I'd like to make it clear I do not use Outlook myself).
For those that don't know, Outlook displays categorised calendar events by changing the colour of the entire event block in the calendar display, instead of placing a coloured strip/dot/line onto or alongside the event block like other products do.
And, of course Outlook does not work with CalDAV calendars so it's out. Fine, brilliant in fact. We'll use one of the birds (Thunder or Better).</p>
"No big deal, right? It just looks diffent."
Sure, and we can use `userChrome.css</code> to make Thunderbird or Betterbird fill in the entire calendar entry with the category colour.</p>`
`Anyway, it got me thinking...</p>`
How do other people actually use categories in their calendars?</a></h3> You only need to look up a screenshot of any calendar application and you will see pictures of calendars with multiple coloured events spotted all over it, but, trust me, I've tried A LOT of these apps, and none of them get the colours from the categories. In most cases, the colours from the colour the calendar itself is set to.</p> So...</p> Are people using different calendars for different types of event?!</p> </blockquote> In which case...</p> What's the point in the categories?! Are categories just relegated to a life of being a barely visible line or dot on an event?</p> </blockquote> They're serious questions - I'd love answers! Please, let me know. Honestly.</p> Android</a></h2> Thunderbird/Betterbird works well enough for our use on PCs, and that's fine, but don't even get me started on Android calendars... I have not found any (except Outlook, but no CalDAV in Outlook) that can colour an event based on its category. Some allow you to colour a specific event a different colour, but this isn't category based, it's single-event only. I've not even seen a category field in an Android Calendar event, even though I know it's synchronised with DAVx⁵</a>.</p> Questions</a></h2> So, to offer this up to the world for responses to help me understand and plan a reasonable replacement system:</p> How do you set up and manage your calendars where multiple colours for different event types are required? Categories or different calendars?</p> </blockquote> Please add comments to this post on the Fediverse</a>.</p> Thanks,</p>



Don't Connect Contact Forms to Email Accounts!
2025-09-19T14:40:00+00:00
Often, when I'm consulting with a client and a third-party service provider, I may have the need to bring up a security concern which should be considered, or eliminated, surrounding what the third-party service provider aims to implement. This can be met with a defense of "We have always done it this way and not had a problem yet." which drives me insane!</p>
</span>Example</a></h3>
This particular example is one I have fought a LOT over the last couple of decades but for some reason I'm still having to fight it - Contact Forms on Websites.

I'm a System Administrator ("SysAdmin"), and even though I do a little website work here and there I am not a web designer nor developer. However, I do deal with web servers, email servers, networks and all devices and security in between, so when I'm asked by a third-party web company to set up an email account and provide them the credentials for it to handle the emails sent from a contact form on a website I get very, VERY, angry.</p>
I may get an email like the this:</p>
Hello,</span></span>
Could you please set up the email account `submissions@$(client_domain_name)` and send us the SMTP username and password so the contact form on the website can send emails to $(client) please?</span></span>
Thanks,</span></span></code></pre>
Looks fairly harmless. Right?

Wrong.</p>
Why is this bad?</a></h3>

Why do we want to use an internal email address to send emails from an external service (the website) to internal staff members... Why!? Why does it need to be an internal address?</li>
If, for some reason, we do want the email to go to the public then I appreciate it would be good to come from the business address but... why is the website doing this?</li>
Why are we giving a web server - possibly the most front-facing and vulnerable server a business can have - knowledge of sensitive business credentials.</li>
Basic SMTP authentication is mostly considered insecure in general these days. Large email operators such as Google and Microsoft have, or are, removing it as an option because of this.</li>
</ol>
What do we do?</a></h4>
To tackle point [1.]</em> above, as a website operator you could set up a reasonable email service, or use a paid service, which you can configure to use SMTP as you desire. Just send the emails from a domain you set up appropriately (SPF, DKIM, DMARC, etc.) to the client, like "$(clientname)-website@contactforms.ourwebcompany.com". Assuming you've set email security up appropriately, the emails will be delivered to the client successfully and deal with as you need.</p>
Tackling point [2.]</em>, if we want to send the contact form to the business and send a confirmation of receipt to the customer, this is not a job for the web server. The web server has zero knowledge of if the email to the business arrived, so sending a "Thanks for your email, we have it" email to the customer at this point is stupid. This whole concept is a task for a CRM system - it receives the email, logs it into the appropriate queue, then confirms to the customer itself that it has been received.</p>
Point [3.]</em>: Please, please, please don't put sensitive business credentials on your front-facing web server. If that server is compromised you've just given the attacker access to that email account (and potentially access to internal systems too). With that email account an attacker can send spam messages, or worse, to whomever they want and because they're authenticated, the emails are coming from a legitimate server, as your brand. Just don't do it. that's how you solve this one.</p>
Point [4.]</em>: If the email service doesn't support it, then you can't do it anyway. In my most recent experience of this the web company involved said they had 350 clients set up with SMTP authentication and it's normally easy. Which may well be true - but Microsoft are removing support for SMTP by April 2026 as far as I understand. Imagine if those 350 clients all used 365 and in April suddenly all their contact forms stopped working. Bit of an issue, right? Fix it now, problem solved.</p>
Other Options</a></h3>
Personally, I have no idea why businesses are so adament they want their contact forms to arrive via email. It's silly. Website services don't help as they just say "what email account do you want this form to go to?" and be done with it. Typically a web site platform (such as WordPress) when sending these emails just uses an SMTP tool to fire the email off and have nothing else to do with it, it's gone. So how do we ensure an email has been received? Who wants to trawel back though their mailbox to find previous contact forms? Nobody, that's who.</p>
A form on a website is not linked to email, it just sends data to an endpoint which itself can handle the data as it is built to do so. This could be an email, sure, but also it could save a file, or send an API request to a service. Or to put it a simpler way:</p>
WE DO NOT NEED TO CONNECT CONTACT FORMS TO EMAIL ACCOUNTS!!!</p>
With this tiny bit of knowledge comes great power. We can make our contact form interface directly with another system i.e. a basic form handling service or CRM system. I'll leave the use of a CRM system as an exercise for those that need it, but a form handling service is a great option for those who just need contact forms.</p>
Form Handling Solutions</a></h3>
I try not to make recommendations so I'm not going to link right here but two options I have used in the past are Formspree ([dot]io) and Basin (usebasin[dot]com).</p>
I'm sure there's some open source and self-hostable solutions too - if you know of one, let me know and I'll list them here! (Ability to adequately secure self-run email services required - why don't you Run Your Own Mail Server</a>?)</p>
A brief overview is with these services you just change the action</code> url in your form to a "Form Endpoint" url they will provide to you and you're done! Your contact form, when submitted, simply sends the data to this endpoint where it is stored (for 30 days on the free tier) and it notifies you of the submission receipt.</p>
No messing around setting up email accounts and securing them appropriately, just plumb that url in and that's it.</p>
Minor issues</a></h4>
The only potential issue with these services is with the free tiers they just accept forms from anywhere, so a submission to it doesn't have to come from your website. If somebody knows the endpoint url, they can submit to it.

To counter this you would need to use the paid tier and middleware to accept the form submission then authenticate and send the form to the handling service.

Regardless, I think the payoff of not risking your entire business email service is worth it, so this problem is minimal.</p>
Wrap Up</a></h3>
So that's my rant about contact forms on websites. A problem that still exists in 2025 even though numerous options are available to eliminate it completely.

Far be it from me to compliment Microsoft, but I am very much looking forward to April 2026 when I suspect quite a large chunk of contact forms are just going to stop working. I bet I'll get some panicked calls, and I'll be happily wearing my "I told you so" hat.</p>


XMPP <-> WhatsApp with eJabberD and Slidge
2025-06-16T13:00:00+00:00
How I learned to stop worrying and love WhatsApp... not really. This is how I've set up my own XMPP service to be able to talk to WhatsApp using the
slidge-whatsapp</code> transport module.</p>
</span>WhatsApp Pain</a></h3>
I wish I didn't have to use WhatsApp, I really do, I wish people would switch to
more freedom giving services.

But that isn't the case... "everyone uses WhatsApp", so, long story short,
if I want to stay in touch with people, I need some way of communicating with
WhatsApp, at least for now.</p>
Luckily, there are ways...</p>
History</a></h3>
For a long time I've had a Matrix (synapse</code>) server that it set up to use
the mautrix-whatsApp</code></a> bridge.
This has worked well for many years, and I don't really have any complaints
with it specifically. However, Matrix are making some...
questionable choices</a>,
and honestly, I only use Matrix for the WhatsApp bridge -
running an entire server just for this purpose feels a little... wasteful.</p>
However, I do also run my own XMPP service, and I use this service for
communicating with a handful of people. So, if I could get a WhatsApp "bridge"
working with XMPP, I will have one app to communicate with almost everyone I know!</p>
Hosting an XMPP server</a></h3>
I run my own ejabberd</code> server, and I'll have another article about how I do this at
some point. But for the purposes of this article the choice of XMPP service is not
massively important. The WhatsApp transport module is known to work with
both Prosody</a> and eJabberD</a>, so chosing one of those will be best.</p>
Installing a WhatsApp Transport Module</a></h3>
There's a handful of WhatsApp transport modules available for XMPP, but some have
seen little maintenance over the last few years. One that still appears to be in
active development is slidge-whatsapp</a>,
part of a suite of modules based upon the slidge gateway library</a>.</p>
Typically, we should just need to install slidge-whatapp</code> via the command</p>
pipx install slidge-whatsapp</code></p>
However, at the time of writing, this does not build on FreeBSD.</p>
If you're using Linux, or have otherwise managed to install slidge-whatsapp</code>
with pipx</code>, then you can probably skip on to the Configuration</a></p>
First Error - puccinialin</a></h4>
We'll first be given the error:</p>
$</span> pipx install slidge-whatsapp</span></span>
Fatal</span> error from pip prevented installation. Full pip output in file:</span></span>
    /path/to/pipx/logs/cmd_2025-06-16_10.02.59_pip_errors.log</span></span>
</span>
pip</span> seemed to fail to build package:</span></span>
    slixmpp</span><2,>=1.10.0</span></span>
</span>
Some</span> possibly relevant errors from pip install:</span></span>
    error:</span> subprocess-exited-with-error</span></span>
    ModuleNotFoundError:</span> No module named</span> '</span>puccinialin</span>'</span></span></code></pre>
You may think installing puccinialin</code> will solve this, but unfortunately it's
not really that causing the issue. Puccinialin is a Rust bootstrapper, so the problem is we don't have rust</code> installed. We do a pkg install rust</code> and try again.</p>
Second Error - Go</a></h4>
We also have some GoLang dependencies, so if go</code> isn't installed we'll hit this error:</p>
$</span> pipx install slidge-whatsapp</span></span>
...</span></span>
pip</span> failed to build package:</span></span>
    slidge-whatsapp</span></span>
</span>
Some</span> possibly relevant errors from pip install:</span></span>
    error:</span> subprocess-exited-with-error</span></span>
    RuntimeError:</span> Cannot find the go executable in</span> $PATH</span>. Make you sure install golang, via your package manager or https://go.dev/dl/</span></span>
    subprocess.CalledProcessError:</span> Command</span> '</span>[</span>'</span>/root/.local/pipx/venvs/slidge-whatsapp/bin/python</span>'</span>, </span>'</span>build.py</span>'</span>]</span>'</span> returned non-zero exit status 1.</span></span>
    ERROR:</span> Failed to build installable wheels for some pyproject.toml based projects</span> (slidge-whatsapp)</span></span>
</span></code></pre>
We pkg install go</code> and carry on...</p>
Third Error - GoPy fails to build</a></h4>

The pull request mentioned below has now been accepted, meaning you can probably
now just run pipx install slidge-whatsapp</code> and move on to Running Slidge-WhatsApp</a>.</p>
</div>
`slidge-whatsapp` has a dependency on go-python's gopy module. At the time of writing, 
gopy will not build on FreeBSD, so `pipx install slidge-whatsapp` will fail.  
$</span> pipx install slidge-whatsapp</span></span>
...</span></span>
pip</span> failed to build package:</span></span>
    slidge-whatsapp</span></span>
</span>
Some</span> possibly relevant errors from pip install:</span></span>
    error:</span> subprocess-exited-with-error</span></span>
    subprocess.CalledProcessError:</span> Command</span> '</span>[</span>'</span>go</span>'</span>, </span>'</span>install</span>'</span>, </span>'</span>github.com/go-python/gopy@master</span>'</span>]</span>'</span> returned non-zero exit status 1.</span></span>
    subprocess.CalledProcessError:</span> Command</span> '</span>[</span>'</span>/root/.local/pipx/venvs/slidge-whatsapp/bin/python</span>'</span>, </span>'</span>build.py</span>'</span>]</span>'</span> returned non-zero exit status 1.</span></span>
    ERROR:</span> Failed to build installable wheels for some pyproject.toml based projects</span> (slidge-whatsapp)</span></span></code></pre>
However, the reason it doesn't build is quite simple - there's no defined process
for in GoPy's main*.go</code> files for FreeBSD that sets some basic variables up.

We can fix this by editing one file in the gopy</code> repo, then build and install it
manually.</p>
$</span> git clone https://github.com/go-python/gopy</span></span>
$</span> cd gopy</span></span></code></pre>
Find and edit 2 lines in ./main_unix.go</code> so they change from this</p>
//go:build (linux && !android) || dragonfly || openbsd</span></span>
// +build linux,!android dragonfly openbsd</span></span></code></pre>
to this</p>
//go:build (linux && !android) || dragonfly || openbsd || freebsd </span></span>
// +build linux,!android dragonfly openbsd freebsd</span></span></code></pre>
I have made a pull request</a> on the gopy</code> repo which will change this upstream.
In time, this step should no longer be necessary.</p>
</div>
You can then build and install gopy with the following command (you will of course need the go language installed too)</p>
$</span> go install .</span></span></code></pre>Installing Slidge-WhatsApp from Source</a></h4>
We now have gopy installed as a go library, but we cannot use pipx</code> any more as
the slidge-whatsapp</code> build script has a hard link to install gopy from their repo,
and does not look at our local version.

Another simple fix, we clone the slidge-whatsapp</code> repo, make a change to the
build script, and build it locally.</p>
$</span> git clone https://codeberg.org/slidge/slidge-whatsapp</span></span>
$</span> cd slidge-whatsapp</span></span></code></pre>
In ./build.py</code>, find this line:</p>
subprocess</span>.</span>run</span>(["</span>go</span>", "</span>install</span>", "</span>github.com/go-python/gopy@master</span>"],</span> check</span>=True</span>)</span></span></code></pre>
and comment it out so it doesn't run.</p>
#subprocess.run(["go", "install", "github.com/go-python/gopy@master"], check=True)</span></span></code></pre>
As with the change to gopy</code> previously, this should only be a temporary requirement until
the aforementioned pull request gets accepted.</p>
</div>
Running Slidge-WhatApp</a></h4>
Slidge recommend (if not using docker containers) that slidge-whatsapp</code> builds and runs in
a python venv</code> - which is a very sensible recommendation. There's a number of ways of doing this, but using uv</code> is a single command way of doing it.</p>
# Install uv</span></span>
# As root</span></span>
(</span>root</span>)</span># pkg install uv</span></span>
</span>
# Non root</span></span>
# Try to build slidge-whatsapp</span></span>
$</span> uv sync --frozen --all-groups --all-extras</span></span></code></pre>More Errors...</a></h4>
We're nearly there! But, uv</code> is failing with some more errors. The error messages
are long, and require a bit of scrolling to find the issue, but you may see
something like this if you look:</p>
...</span></span>
not</span> found</span></span>
          6</span> |</span> #include <mupdf/fitz.h></span></span>
            |</span>          ^~~~~~~~~~~~~~</span></span>
      1</span> error generated.</span></span>
...</span></span></code></pre>
or</p>
...</span></span>
      ld:</span> error: unable to find library -lgumbo</span></span>
      ld:</span> error: unable to find library -lmujs</span></span>
      clang:</span> error: linker command failed with exit code</span> 1</span> (use</span> -v to see invocation</span>)</span></span>
...</span></span></code></pre>
and many others. I've gone through them so you don't have to...</p>
We need some dependencies, so let's install them.

Also, I've found some souce code has trouble compiling with clang</code>;
there's probably a way to solve it but as a shortcut let's just install
gcc</code> and build using that, setting the CC</code> envvar when running the uv</code> command.</p>
(</span>root</span>)</span># pkg install gcc gmake mupdf gumbo mujs</span></span>
$</span> CC=gcc uv sync --frozen --all-groups --all-extras</span></span></code></pre>Built!</a></h4>
slidge-whatsapp</code> should now be available in $BUILD_DIR/.venv/bin/slidge-whatsapp</code>, ready for use.

A couple of other runtime dependencies will be required though, so let's install them now.</p>
(</span>root</span>)</span># pkg install py311-sqlite3 ffmpeg nginx</span></span></code></pre>
sqlite3</code> for database connectivity, ffmpeg</code> for media handling and nginx</code> for
media publishing.</p>
Finally, configuration!</a></h3>
The slidge</a> website has some decent documentation, and setting
things up boils down to a handful of steps:</p>

Configure slidge-whatsapp</code> to communicate with eJabberD</code>.</li>
Configure eJabberD</code> to allow slidge-whatsapp</code>, and set privileges.</li>
Set up nginx</code> for publishing the sent media.</li>
</ol>
Configure slidge-whatsapp</code></a></h4>
A simple slidge-whatsapp</code> configuration will look like this.</p>
# /usr/local/etc/slidge-whatsapp.ini</span></span>
server</span>=</span>localhost  </span># you can use your xmpp address here, but communication </span></span>
                  # is unencrypted so make sure it's either on the same host,</span></span>
                  # or you can encrypt the transmissions between the services</span></span>
                  </span></span>
secret</span>=</span>v3rYSecur3 </span># secret to authenticate the slidge service to ejabberd</span></span>
                  # you can just run `openssl rand -base64 32` to get something decent</span></span>
              </span></span>
jid</span>=</span>slidge-whatsapp.my.xmpp.host </span># should be a subdomain of the ejabberd address</span></span>
</span>
no-upload-path</span>=</span>/var/lib/slidge/attachments </span># where media will be stored</span></span>
</span>
no-upload-url-prefix</span>=</span>https://my.xmpp.host/slidge/ </span># the address where an XMPP client</span></span>
                                                  # can find the media</span></span></code></pre>Configure eJabberD</code></a></h4>
In the ejabberd</code> configuration, we add a new listener, set up an acl, rules and some module privileges.</p>
# /usr/local/ejabberd/ejabber.yml</span></span>
#...</span></span>
listen</span>:</span></span>
  #...</span></span>
  -</span></span>
    port</span>:</span> 5347</span></span>
    module</span>:</span> ejabberd_service</span></span>
    hosts</span>:</span></span>
      slidge-whatsapp.my.xmpp.host</span>:</span></span>
        password</span>:</span> v3rYSecur3</span> # Same as the secret in slidge-whatsapp.ini</span></span>
        </span></span>
#...</span></span>
</span>
acl</span>:</span></span>
  #...</span></span>
  slidge_acl</span>:</span></span>
    server</span>:</span></span>
      -</span> `</span>slidge-whatsapp.my.xmpp.host`</span></span>
</span>
#...</span></span>
</span>
access_rules</span>:</span></span>
  #...</span></span>
  slidge_rule</span>:</span></span>
    allow</span>:</span> slidge_acl</span></span>
    </span></span>
#...</span></span>
</span>
modules</span>:</span></span>
  #...</span></span>
  mod_roster</span>:</span></span>
    versioning</span>:</span> true</span></span>
  #...</span></span>
  mod_privilege</span>:</span></span>
    roster</span>:</span></span>
      bost</span>:</span> slidge_rule</span></span>
    message</span>:</span></span>
      outgoing</span>:</span> slidge_rule</span></span>
</span></code></pre>Configure nginx</code></a></h4>
The reason we need nginx</code> is documented here</a>.</p>
I will put a basic nginx</code> configuration server block below. If you have many sites
in the same nginx configuration, you should adjust this to your needs.

Please also configure certificates for your site here, you should already have
them available for use with ejabberd</code> anyway.</p>
# /usr/local/etc/nginx/nginx.conf</span></span>
#...</span></span>
    server {</span></span>
                listen 80;</span></span>
                root /var/www/html;  # if you already have nginx serving files…</span></span>
</span>
                # the section below is for slidge</span></span>
                location /slidge {</span></span>
                        #  Must be the same value as slidge's no-upload-path</span></span>
                        alias /var/lib/slidge/attachments/;</span></span>
                }</span></span>
           }</span></span>
#...</span></span>
</span>
</span></code></pre>Run!</a></h3>
And there we have it. We can restart ejabberd</code> and run slidge-whatsapp</code> with
command parameter to use the config file:</p>
$</span> slidge-whatsapp -c /usr/local/etc/slidge-whatsapp.ini</span></span></code></pre>
You can also use an init script to run this as a daemon. My init script is in my rc.d scripts repo</a></p>
We should then start to ejabberd</code> and slidge-whatsapp</code> communicate with each other in their respective log files.</p>
Connect clients</a></h3>
All that's left is to connect up our XMPP client, and we'll be good to go.
The Documentation on Slidge's website</a> talks through this, but to summarise, you can either send a
message saying "register" to the slidge-whatsapp.my.xmpp.host</code> account, or
in something like gajim</code>, go to Accounts > $Account > Discover Services</code>,
select "WhatsApp (slidge)" and click "Register". Then just follow the standard
WhatsApp "Linked Devices" process.</p>
Done!</a></h3>
And that's that. If things aren't working, we can just check the output of the slidge-whatsapp</code> command (or the log file if you're using daemon</code>) and solve what's going wrong.</p>

Step-by-Step. Commands only</a></h3>
The whole thing, narrowed down to a handful of commands:</p>

Install Dependencies</li>
</ol>
# Adjust your python version accordingly - i.e. `py311` may become `py312` in the future.</span></span>
(</span>root</span>)</span># pkg install rust go gcc gmake git py311-pipx py311-sqlite3 ffmpeg nginx mupdf mujs gumbo uv</span></span></code></pre>

pipx install slidge-whatsapp</code></li>
(No Longer Required) Build gopy</code></li>
</ol>
$</span> git clone https://github.com/go-python/gopy</span></span>
$</span> cd gopy</span></span>
$</span> sed -i</span> '' '</span>s/|| openbsd/|| openbsd || freebsd/</span>'</span> main_unix.go</span></span>
$</span> sed -i</span> '' '</span>s/dragonfly openbsd/dragonfly openbsd freebsd/</span>'</span> main_unix.go</span></span>
$</span> go install .</span></span></code></pre>

(No Longer Required) Build slidge-whatsapp</code></li>
</ol>
$</span> git clone https://codeberg.org/slidge/slidge-whatsapp</span></span>
$</span> cd slidge-whatsapp</span></span>
$</span> grep -v -E</span> "</span>subprocess.+gopy</span>"</span> build.py</span> ></span> build.py.patched</span></span>
$</span> cp build.py.patched build.py</span></span></code></pre>

Run slidge-whatsapp</code></li>
</ol>
# In `slidge-whatsapp` git dir</span></span>
$</span> CC=gcc uv sync --frozen --all-groups --all-extras</span></span></code></pre>

Configure slidge-whatsapp</code></a></li>
Configure ejabberd</code></a></li>
Configure nginx</code></a></li>
[Re]Start Services</li>
Connect Clients</a></li>
</ol>


Making an Automated, Operational Hydro-Electric Dam in Luanti
2025-05-13T11:20:00+00:00
Here are some notes and pictures of how I made a working, automated hydro-electric
dam in Luanti</a>. The dam gates can be opened and closed manually to generate more
or less power, or, if the power demand becomes too high or too low, the dam will automatically open or close gates to adjust the power accordingly.</p>
</span>




Luanti Mods in Use</a></h3>
I use a bunch on Luanti mods, but some key ones in use for this build are listed below:</p>

Technic Plus</a> - For power generation</li>
Digilines</a> - for programmable signals</li>
Digistuff</a> - For some control interfaces</li>
Mesecons</a> - For circuitry and programmable controllers</li>
</ul>
And many others that are dependencies of the above, and generally decent looking blocks.</p>
Building the Dam Structure</a></h3>
I will leave the general design of the dam as a exercise for the reader, but in basic terms what you need is:</p>

A large body of water</li>
A big wall to hold the water back, holes cut into the wall at certain intervals where water will flow through.</li>
Another big wall a reasonable distance from the other one to create a large building, within which all the dam mechanics will be. Holes in the same-but-lower position as the back wall's holes to let the water out.</li>
Within the dam, sections built around where the water will run from the back to the front of the dam. More info on this next.</li>
</ul>
Nice to have:</p>

A control tower, away from the main dam, but in a location where you can see the dam

This is where you can control the gates, and where some of the programming happens.</li>
</ul>
</li>
Per-section control areas, for emergency cut off switches and per-section controls.</li>
</ul>
Intake Gates</a></h3>





Of course, we need to control if water is allowed to flow into these generator areas, and we can do this using blocks and Mesecons Sticky Pistons. This is just a simple row of upward facing sticky pistons, with a block of your choosing on top, all connected to a mesecons wire - and a NOT gate (so no signal means the pistons are extended). More on this later.

I've put my intake gate around one block lower than the water level as I've found if it's any lower, the water just flows downwards, instead of into the intake gate.</p>
The Generators and Generator Area</a></h3>
For simplicity, I'll be using Low-Voltage Hydro Generators from the Technic/Technic Plus mod, but you could easily switch these out with Mid-Voltage Hydro Generators if you wish. Or run both in parallel.</p>
These Hydro LV Generators generate power based on water flowing past any of their 4 sides, and their efficiency changes depending on that flow. I've found an ideal efficiency build is to ensure water can flow from at least above, to at least one block below the sides of the generator. This basically means the generator will be sat on it's own wire, which acts as a pedestal to hold it up.</p>





I have an array of 17 generators, in rows of 4, 4, 5 and 4, with concrete blocks in places to maximise water flow.</p>





You should ensure the water flow by allowing it to drop down every couple of blocks, so each generator block would be 1 block lower and 2 blocks forward of the previous generator.</p>
I have this duplicated 3 more times for a total of 4 different generating sections.</p>
Switching Station</a></h3>
The Technic mod requires all power networks are connected to one (and ony one) switching station. My 4 hydro generator arrays all have cables coming back to a Switching Station building I have built inside the dam, which then supplies power to the rest of the world.</p>
Programming</a></h3>
Where the control tower, intake gate section controls are and wiring to them is up to you. You will need a digiline wire from each intake gate control section back to the main control tower, and a bunch of luacontrollers.</p>
Intake Gate Section</a></h4>





My intake gate sections consist of a luacontroller, an AND gate</del>, a NOT gate, the sticky pistons for the gate, and a switch to act as an emergency override switch to turn that section off fully.</p>
The setup looks something like this:</p>





EDIT: I've removed the AND gate from my set up, as the luacontroller can handle
this and also allows us to report back if the emergency switch has been triggered
("locked"). So ignore the AND gate from the image above.</p>
Programming-wise, the luacontroller will run the below code.</p>
gate</span> =</span> 1</span> -- ID of the Gate</span></span>
</span>
-- The Control Tower luacontroller interfaces with a touch screen control.</span></span>
-- When the touch screen button is pressed, the luacontroller sends a </span></span>
-- "Gate {ID} Open" or "Gate {ID} Close" signal, which we use here to </span></span>
-- switch port.d of this luacontroller on or off</span></span>
-- If pin.d (our override switch) is off, then don't do anything here</span></span>
if</span> event.channel</span> ==</span> "</span>Gate </span>"</span>..</span>gate</span>..</span>"</span> Open</span>" </span>and</span> pin.d</span> then</span></span>
  mem.status</span> =</span> "</span>open</span>"</span></span>
  digiline_send</span>(</span>"</span>gate_status</span>"</span>, {gate</span> =</span> gate, status</span> =</span> mem.status})</span></span>
  port.c</span> = true</span></span>
elseif</span> (event.channel</span> ==</span> "</span>Gate </span>"</span>..</span>gate</span>..</span>"</span> Close</span>" </span>and</span> pin.d) </span>then</span></span>
  mem.status</span> =</span> "</span>closed</span>"</span></span>
  port.c</span> = false</span></span>
  digiline_send</span>(</span>"</span>gate_status</span>"</span>, {gate</span> =</span> gate, status</span> =</span> mem.status})</span></span>
end</span></span>
</span>
-- WHen our override switch on pin.d is triggered, set the status to locked</span></span>
if</span> event.type</span> ==</span> "</span>off</span>" </span>and</span> event.pin.name</span> ==</span> "</span>D</span>" </span>then</span></span>
  mem.status</span> =</span> "</span>locked</span>"</span></span>
  port.c</span> = false</span></span>
  digiline_send</span>(</span>"</span>gate_status</span>"</span>, {gate</span> =</span> gate, status</span> =</span> mem.status})</span></span>
elseif</span> event.type</span> ==</span> "</span>on</span>" </span>and</span> event.pin.name</span> ==</span> "</span>D</span>" </span>then</span></span>
  mem.status</span> =</span> "</span>closed</span>"</span></span>
  port.c</span> = false</span></span>
  digiline_send</span>(</span>"</span>gate_status</span>"</span>, {gate</span> =</span> gate, status</span> =</span> mem.status})</span></span>
end</span></span>
</span>
-- Start an interrupt cycle to run after 5 seconds</span></span>
if</span> event.type</span> ==</span> "</span>program</span>" </span>then</span></span>
  mem.status</span> =</span> "</span>closed</span>"</span></span>
  if not</span> pin.d</span> then</span></span>
    mem.status</span> =</span> "</span>locked</span>"</span></span>
  end</span></span>
  interrupt</span>(</span>5</span>,</span>"</span>send_status</span>"</span>..</span>gate)</span></span>
end</span></span>
</span>
-- When the interrupt signal is received, send the current gate status to </span></span>
-- the control tower.</span></span>
if</span> event.iid</span> ==</span> "</span>send_status</span>"</span>..</span>gate</span> then</span></span>
  digiline_send</span>(</span>"</span>gate_status</span>"</span>, {gate</span> =</span> gate, status</span> =</span> mem.status})</span></span>
  if</span> event.iid</span> then</span></span>
    interrupt</span>(</span>15</span>,</span>"</span>send_status</span>"</span>..</span>gate)</span></span>
  end</span></span>
end</span></span>
</span></code></pre>Control Tower</a></h4>






This is where the control really happens. Here we have a touchscreen with
Open/Close buttons for each gate, pressing them sends a signal to that gate's
luacontroller and the gate opens or shuts. I have an LCD screen nearby to
display the current status.

I also have the switching station connected to the digilines network, allowing for feedback of power usage, which allows for automation of opening/closing the gates.</p>
</span>
-- If we get a gate_status signal, update the memory of that gate and </span></span>
-- refresh the screen</span></span>
if</span> event.channel</span> ==</span> "</span>gate_status</span>" </span>then</span></span>
  mem.gates[event.msg.gate] </span>=</span> { gate</span> =</span> event.msg.gate, status</span> =</span> event.msg.status}</span></span>
  content</span> =</span> "</span>\n\n\n\n\n\n</span>"</span></span>
  for</span> i, gate</span> in</span> ipairs</span>(mem.gates) </span>do</span></span>
    if</span> gate.status</span> ~= nil then</span></span>
      content</span> =</span> content</span>..</span>"</span>G </span>"</span>..</span>gate.gate</span>..</span>"</span>:</span>"</span>..</span>gate.status</span>..</span>"</span>\n</span>"</span></span>
      digiline_send</span>(</span>"</span>gates_screen</span>"</span>,</span>"</span>G </span>"</span>..</span>gate.gate</span>..</span>"</span>:</span>"</span>..</span>gate.status)</span></span>
    end</span></span>
  end</span></span>
  digiline_send</span>(</span>"</span>gates_screen</span>"</span>,content</span>..</span>"</span>\n</span>"</span>)</span></span>
end</span></span>
</span>
-- When programming, set Unknown status to all gates</span></span>
-- and configure touch screen buttons.</span></span>
if</span> event.type</span> ==</span> "</span>program</span>" </span>then</span></span>
  -- Arbitrary order of gate opening I'd like. For automation.</span></span>
  mem.gateorder</span> =</span> { </span>2</span>,</span>4</span>,</span>5</span>,</span>3</span>,</span>1</span> }</span></span>
  -- Reverse over of above, for closing.</span></span>
  mem.revorder</span> =</span> { </span>1</span>,</span>3</span>,</span>5</span>,</span>4</span>,</span>2</span> }</span></span>
  digiline_send</span>(</span>"</span>gates_screen</span>"</span>,</span>"</span>Loading...</span>"</span>)</span></span>
  mem.gates</span> =</span> {}</span></span>
  mem.gates[</span>1</span>] </span>=</span> {gate</span>=</span>1</span>,status</span>=</span>"</span>Unknown</span>"</span>}</span></span>
  mem.gates[</span>2</span>] </span>=</span> {gate</span>=</span>2</span>,status</span>=</span>"</span>Unknown</span>"</span>}</span></span>
  mem.gates[</span>3</span>] </span>=</span> {gate</span>=</span>3</span>,status</span>=</span>"</span>Unknown</span>"</span>}</span></span>
  mem.gates[</span>4</span>] </span>=</span> {gate</span>=</span>4</span>,status</span>=</span>"</span>Unknown</span>"</span>}</span></span>
  mem.gates[</span>5</span>] </span>=</span> {gate</span>=</span>5</span>,status</span>=</span>"</span>Unknown</span>"</span>}</span></span>
</span>
  ts</span> =</span> { { command</span> =</span> "</span>clear</span>" </span>},</span></span>
         { command</span> =</span> "</span>set</span>"</span>, width</span> =</span> 6</span> , height</span> =</span> 5</span> },</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 0.0</span>, Y</span> =</span> 0</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 1 Open</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 3.0</span>, Y</span> =</span> 0</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 1 Close</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 0.0</span>, Y</span> =</span> 1</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 2 Open</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 3.0</span>, Y</span> =</span> 1</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 2 Close</span>"</span>} ,</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 0.0</span>, Y</span> =</span> 2</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 3 Open</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 3.0</span>, Y</span> =</span> 2</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 3 Close</span>"</span>} ,</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 0.0</span>, Y</span> =</span> 3</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 4 Open</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 3.0</span>, Y</span> =</span> 3</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 4 Close</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 0.0</span>, Y</span> =</span> 4</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 5 Open</span>"</span>},</span></span>
         { command</span> =</span> "</span>add</span>"</span>, element</span> =</span> "</span>button_exit</span>"</span>, X</span> =</span> 3.0</span>, Y</span> =</span> 4</span>, name</span> =</span> "</span>button</span>" </span>, label</span> =</span> "</span>Gate 5 Close</span>"</span>}</span></span>
       }</span></span>
  digiline_send</span>(</span>"</span>gates_touchscreen</span>"</span>,ts)</span></span>
  </span></span>
  -- get the power status from the switching station too</span></span>
  digiline_send</span>(</span>"</span>lv_switch_station</span>"</span>,</span>"</span>get</span>"</span>)</span></span>
</span>
end</span></span>
</span>
-- When a touch screen button is pressed, send a</span></span>
-- "Gate {ID} Open" or "Gate {ID} Close" signal to the</span></span>
-- digilines network.</span></span>
if</span> event.channel</span> ==</span> "</span>gates_touchscreen</span>" </span>then</span></span>
  digiline_send</span>(event.msg.button,</span>""</span>)</span></span>
end</span></span>
</span>
-- When we get a signal back from the switching station, handle it </span></span>
-- and update the screen.</span></span>
if</span> event.channel</span> ==</span> "</span>lv_switch_station</span>" </span>then</span></span>
  content</span> =</span> "</span>\n\n</span>"</span>..</span>"</span>LV Supply: </span>\n</span>"</span>..</span>event.msg.supply</span>..</span>"</span>\n</span>"</span></span>
  content</span> =</span> content</span>..</span>"</span>LV Demand: </span>\n</span>"</span>..</span>event.msg.demand</span>..</span>"</span>\n</span>"</span></span>
  </span></span>
  -- This is the high threshold, i.e. the level we want to watch for to </span></span>
  -- open another gate</span></span>
  h_threshold</span> =</span> (event.msg.supply</span> /</span> 10</span>) </span>*</span> 9.5</span></span>
  content</span> =</span> content</span>..</span>"</span>HL:</span>"</span>..</span>h_threshold</span>..</span>"</span>\n</span>"</span></span>
  </span></span>
  -- Same as h_threshold, but the low threshold, i.e. when we want to close a gate</span></span>
  l_threshold</span> =</span> (event.msg.supply</span> /</span> 10</span>) </span>*</span> 2.7</span></span>
  content</span> =</span> content</span>..</span>"</span>LL:</span>"</span>..</span>l_threshold</span></span>
  -- it's a bit of a balancing act, as you could end up repeatedly opening and</span></span>
  -- closing a gate if you're not careful.</span></span>
  </span></span>
  -- Show those numbers on screen.</span></span>
  digiline_send</span>(</span>"</span>power_screen</span>"</span>,content)</span></span>
  </span></span>
  -- Here's the automation:</span></span>
  -- If the power supply is 0 or power demand is higher than our higher threshold</span></span>
  -- check each gate from our order above, and open the next available one</span></span>
  -- Likewise, if demand is lower than the lower threshold,</span></span>
  -- cycle through our gates in reverse and close one.</span></span>
  -- Pin D is where our Automaton On/Off Switch is connected.</span></span>
  if</span> pin.d</span> then</span></span>
    if</span> (event.msg.supply</span> ==</span> 0</span> and</span> event.msg.demand</span> ></span> 0</span>) </span></span>
    or</span> event.msg.demand</span> ></span> h_threshold</span> then</span></span>
    for</span> i, v</span> in</span> ipairs</span>(mem.gateorder) </span>do</span></span>
      g</span> =</span> mem.gates[v]</span></span>
      status</span> =</span> g.status</span></span>
      if</span> status</span> ==</span> "</span>closed</span>" </span>then</span></span>
        digiline_send</span>(</span>"</span>Gate </span>"</span>..</span>v</span>..</span>"</span> Open</span>"</span>,</span>""</span>)</span></span>
        break</span></span>
      end</span>    </span></span>
    end</span></span>
  elseif</span> event.msg.demand</span> <</span> l_threshold</span> then</span></span>
    for</span> i, v</span> in</span> ipairs</span>(mem.revorder) </span>do</span></span>
      g</span> =</span> mem.gates[v]</span></span>
      status</span> =</span> g.status</span></span>
      if</span> status</span> ==</span> "</span>open</span>" </span>then</span></span>
        digiline_send</span>(</span>"</span>Gate </span>"</span>..</span>v</span>..</span>"</span> Close</span>"</span>,</span>""</span>)</span></span>
        break</span></span>
      end</span>     </span></span>
    end</span></span>
  end</span></span>
</span>
  -- Finally, set an interrupt for 10 seconds to get the power usage </span></span>
  -- from the switching station again, continually.</span></span>
  interrupt</span>(</span>10</span>,</span>"</span>get_power_status</span>"</span>)</span></span>
end</span></span>
</span>
-- Send a signal to the switching station to get its power usage.</span></span>
if</span> event.iid</span> ==</span> "</span>get_power_status</span>" </span>then</span></span>
  digiline_send</span>(</span>"</span>lv_switch_station</span>"</span>,</span>"</span>get</span>"</span>)</span></span>
end</span></span>
</span></code></pre>My 5th Gate</a></h3>
You'll probably notice in the code blocks above I have a 5th gate, there's not a lot different with this one; it's controlled the same way, except the power generation is a little different.

Instead of water flowing through the dam across hydrogenerators, when the gate
opens water is free to flow past the dam to a pool. In this pool
is a checkerboard pattern of hydrogenerators that the water can just about
flow over and drop between the gaps in between each generator. The efficiency isn't as good as the main dam generators (60% rather than 100%), but you could in theory use multiple layers of generators in series down one big hole to generate massive amount of power without the limitation of horizontal space.</p>





Let it Run!</a></h3>
With all that in place, our dam should be operational! Run some wires,
stick some Technic Lamps up, connect some LV machines, open up a gate and
use the power and see everything (hopefully) work as desired.

You'll find if you switch all your gates off (and you don't use automation),
as the power supply gets to 0 all your lights will go out! Open a gate back up,
and power will return!</p>
Woohoo!</p>
If you need to run maintenance on a gate, use
the emergency override to stop the water, and prevent it from being switch back on, and go in and fix what you need.</p>
Although it is fun to watch the lights go out when the water stops flowing,
you probably should put some batteries on the LV network as well, to cover you
for those times no water is flowing!</p>
Just like real life (almost)!</p>
Block Exchange</a></h3>
This build is available on Block Exchange</a> on the following link:</p>
blockexchange.minetest.ch/schema/pswilde/hydroelectric_dam</a></p>


Setting Up Anubis on FreeBSD
2025-04-15T15:13:00+00:00
I've noticed a few times recently my Forgejo</a> server has been triggering alerts
on my monitoring systems that is isn't responding as fast as it normally should be.
Low and behold - it's due to AI crawlers causing it to grind to a halt as the scrape every
little section of the service for their own needs.

This is how I implemented Anubis</a> to help mitigate this problem.</p>
</span>

Anubis Now in FreeBSD Ports!</a></h2>
Since writing this I have learned Anubis is in the ports tree for FreeBSD, which,
in my opinion, should be considered the de-facto method for installing Anubis on FreeBSD.

It can be achieved by running the following:</p>
# Sync the ports tree</span></span>
git</span> clone --depth</span> 1</span> https://git.FreeBSD.org/ports.git /usr/ports</span></span>
# change to the Anubis port directory</span></span>
cd</span> /usr/ports/www/go-anubis</span></span>
# make anubis</span></span>
make</span> install</span></span>
</span>
# Configure and enable anubis in rc.conf</span></span>
sysrc</span> anubis_args=</span>"</span>-target http://localhost:3000 -bind :8923</span>"</span> # ... add arguments as required"</span></span>
sysrc</span> anubis_enable=YES</span></span>
</span></code></pre>
If, however, you wish to compile it yourself and/or, like me, you prefer to configure things
using configuration files, and/or would like a bit more information on configuration and policies to set, read on.</p>
</div>

Server Setup</a></h3>
For those that don't know, Forgejo is a software forge; Think of it as a git... hub, that you can host yourself.
I run my Forgejo Instance on a FreeBSD server in a jail, and it sits behind a HAProxy</a> reverse proxy which is also a jail.</p>
I monitor the uptime of this service, and many others, using Gatus</a>,
which is a brilliantly simple infrastructure monitoring system that can send you alerts dependant on various factors
i.e. connectivity loss, certificate expiration, and, crucially, response time.</p>
The Problem</a></h3>
Over the last few months, I have noticed a significant increase in alerts due to poor response times. A quick check of the HAProxy logs shows a huge amount of traffic from AI crawlers. Something like the below:</p>
..</span>.thousands of lines before...</span></span>
Feb</span> 19</span> 21:47:39</span> 192.168.200.5</span> haproxy[2334]: 20.171.207.150:41308</span> [19/Feb/2025:21:47:39.115] ft_in_https~ be_forgejo/forgejo 0/0/1/273/279 200 17290 - - ---- 6/6/0/0/0 0/0 </span>"</span>GET https://forge.notnull.space/psw/web/commit/078833d79049280fcc13bfc790b2835d9819de28.patch HTTP/2.0</span>"</span> hdrs:</span>"</span>host: forge.notnull.space^M x-openai-host-hash: 132087407^M accept: */*^M from: gptbot(at)openai.com^M user-agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.2; +https://openai.com/gptbot)^M accept-encoding: gzip, br, deflate^M ^M </span>"</span></span>
..</span>.thousands of lines after...</span></span></code></pre>
Each of these thousands of requests is scraping data from my code forge causing increased load on the server, making is respond slower and slower.</p>
Basic Defense</a></h3>
My immediate goal of course was to stop the current AI slopbucket in its tracks to minimise the load on the server
so it can get on with what it is supposed to be doing.</p>
A robots.txt</code> file helps to some extent, but as it turns out, some AI crawlers either do not honour it, or if they are not Disallowed explicitly (i.e. they don't follow *</code> wildcard) they say they're allowed and get on with it.</p>
As a further defense I set up a basic RegEx based blocklist in HAProxy to return a 403</code> HTTP response for any traffic coming from
somewhere that matched certain patterns</p>
# /etc/haproxy.conf</span></span>
frontend ft_in_https</span></span>
    # Block badbots</span></span>
    acl is-blockedagent hdr_sub(user-agent) -m reg -i -f /opt/haproxy-blocklist-agent.txt</span></span>
    http-request deny if is-blockedagent</span></span>
    ... rest of config</span></span></code></pre>
and a bunch of RegEx patterns to block - be it old browser versions or names of AI crawlers.</p>
# /opt/haproxy-blocklist-agent.txt</span></span>
\WImagesiftBot\W</span></span>
\WBytespider\W</span></span>
\WPetalBot\W</span></span>
\WAmazonBot\W</span></span>
\WAndroid [0-8].0\W</span></span>
\WChrome\/[0-7][0-8]\W</span></span>
\WChrome\/11[0-9]\W</span></span>
\WFirefox\/[0-7][0-8]\W</span></span>
\W47\.82\W</span></span>
\Wx-openai-host-hash\W</span></span>
\Wgptbot</span></span>
\Wgptbot\(at\)openai\.com</span></span>
\WGPTBot\/1\.2;\W</span></span>
...etc...</span></span></code></pre>
This works... sort of. It removes the demand on the Forgejo server so that's a lot better, but these bots
still continuously send requests - it's just HAProxy denys them. HAProxy can deal with this with ease, but still it's not nice to see it all in the logs.</p>
Enter Anubis</a></h3>
Anubis is a fantastic, recently developed Anti-AI software product by Techaro</a>. It works by giving the connecting computer a proof-of-work challenge which it must solve before being granted access to the requested content. It is a project that has started to pop up everywhere, including the United Nations</a>.</p>
For a visitor like you or I, we will see a brief screen displayed saying "Making sure you're not a bot" before the site loads, then after that we can use the site as normal.

For an AI, however, we can configure Anubis to give a harder to solve challenge, which takes much longer, and significantly impacts how quickly that bot can send requests to our service.

This has a massive impact on how many connections HAProxy has to deal with, reducing the overall load immensely.</p>
Building Anubis</a></h3>
Anubis doesn't (yet) have any native FreeBSD binaries, but that's OK, it's a Go and NPM product so we can easily build it ourselves.</p>
First we install Go on our system:</p>
# At the time of writing Go 1.24.2 was the lastest version - adjust as required.</span></span>
$</span> wget https://go.dev./dl/go1.24.2.freebsd-amd64.tar.gz</span></span>
</span>
# Extract it</span></span>
$</span> tar xf go1.24.2.freebsd-amd64.tar.gz</span></span>
</span>
# Copy the downloaded go folder to /usr/local/ (for GOROOT reasons used later)</span></span>
$</span> cp go /usr/local/</span></span>
</span>
# Set your PATH and GOROOT environment variables as required</span></span>
$</span> export GOROOT=/usr/local/go</span></span>
$</span> export PATH=</span>$PATH</span>;</span>$GOROOT/bin</span></span></code></pre>
Now, we can save ourselves a lot of trouble by downloading the Prebaked Tarball</a>
of Anubis, which means the Go modules dependencies are included, and the static JS, CSS, etc. assets are already compiled.</p>
We can build Anubis by the following.</p>
# At the time of writing, v1.16.0 of Anubus was the latest</span></span>
$</span> wget https://github.com/TecharoHQ/anubis/releases/download/v1.16.0/anubis-src-vendor-npm-1.16.0.tar.gz</span></span>
</span>
# Extract it</span></span>
$</span> tar xf anubis-src-vendor-npm-1.16.0.tar.gz</span></span>
</span>
$</span> cd anubis-src-vendor-npm-1.16.0</span></span>
</span>
# And build</span></span>
$</span> make prebaked-build</span></span></code></pre>
All going well, you should have a ready to go binary ./var/anubis</code> which we can use.</p>
Running Anubis as a Daemon</a></h3>
I have written a basic rc.d script</a> for FreeBSD.
This script runs anubis using [daemon](https://man.freebsd.org/cgi/man.cgi?daemon(8) so it restarts if it crashes, and outputs to a log in /var/log.</p>
If you want to use it, you can copy it from the archive into rc.d</p>
$</span> cp anubis.freebsd /usr/local/etc/rc.d/anubis</span></span>
$</span> chmod +x /usr/local/etc/rc.d/anubis</span></span></code></pre>
Then, enable it and set it's configuration path</p>
$</span> sysrc</span> "</span>anubis_enable=YES</span>"</span></span>
$</span> sysrc</span> "</span>anubis_environment_file=/etc/anubis.env</span>"</span></span></code></pre>
You will need to have an anubis</code> user account (i.e. adduser anubis</code>) or set the anubis_user</code> variable appropriately.</p>
Configuring Anubis</a></h3>
Now we have the software ready to run, we need to set up a bit of configuration so it works as we need.

First, we should set some basic environment variables - a full list is available on the Anubis website</a>.
i.e. vim /etc/anubis.env</code></p>
# The port Anubis listens on</span></span>
BIND</span>=</span>:8923</span></span>
</span>
# your service endpoint, forgejo runs on port 3000 by default on this local server</span></span>
TARGET</span>=</span>http://localhost:3000</span> </span></span>
</span>
# Cookie Domain: IMPORTANT: this should be just the root domain of your service, so if your service</span></span>
# runs on forgejo.example.com, just put example.com</span></span>
COOKIE_DOMAIN</span>=</span>example.com</span> </span></span>
</span>
# A Custom Policy File Location - mnore on this later</span></span>
POLICY_FNAME</span>=</span>/etc/forgejo.json</span></span>
</span>
# A hex encoded private key. Without setting this a new one will be generated each time Anubis restarts</span></span>
ED25519_PRIVATE_KEY_HEX</span>=</span>############################### - run </span>`</span>openssl</span> rand -hex</span> 32</span>`</span> to</span> generate one</span></span></code></pre>Creating A Custom Policy</a></h4>
Anubis by default will aggressively challenge everything that might be a browser, which may be fine for some uses,
but, often it won't be. So we can create a custom policy file that makes it nicer for nice things, and bas for bad things.</p>
The examples in Anubis' Documentation</a> are a pretty good fit here:</p>
{"</span>bots</span>":</span></span>
        [</span></span>
        {</span></span>
                "</span>name</span>": "</span>generic-bot-catchall</span>",</span></span>
                "</span>user_agent_regex</span>": "</span>(?i:bot|crawler|gpt)</span>",</span></span>
                "</span>action</span>": "</span>CHALLENGE</span>",</span></span>
                "</span>challenge</span>": {</span></span>
                        "</span>difficulty</span>":</span> 16</span>,</span></span>
                        "</span>report_as</span>":</span> 4</span>,</span></span>
                        "</span>algorithm</span>": "</span>slow</span>"</span></span>
                }</span></span>
        },</span></span>
        {</span></span>
                "</span>name</span>": "</span>well-known</span>",</span></span>
                "</span>path_regex</span>": "</span>^/.well-known/.*$</span>",</span></span>
                "</span>action</span>": "</span>ALLOW</span>"</span></span>
        },</span></span>
        {</span></span>
                "</span>name</span>": "</span>favicon</span>",</span></span>
                "</span>path_regex</span>": "</span>^/favicon.ico$</span>",</span></span>
                "</span>action</span>": "</span>ALLOW</span>"</span></span>
        },</span></span>
        {</span></span>
                "</span>name</span>": "</span>robots-txt</span>",</span></span>
                "</span>path_regex</span>": "</span>^/robots.txt$</span>",</span></span>
                "</span>action</span>": "</span>ALLOW</span>"</span></span>
        },</span></span>
        {</span></span>
                "</span>name</span>": "</span>generic-browser</span>",</span></span>
                "</span>user_agent_regex</span>": "</span>Mozilla</span>",</span></span>
                "</span>action</span>": "</span>CHALLENGE</span>"</span></span>
        }</span></span>
        ]</span></span>
}</span></span></code></pre>
The first definition makes everything connecting with a user-agent string containing "bot","crawler", or "gpt" have to take a high difficulty slow challenge.

The next 3 say that things trying to access the .well-known</code> folder, favicon</code>, or robots.txt</code> files are just allowed. We don't want to challenge those. i.e. certbot/letsencrypt will need access to .well-known/acme-challenge</code> to verify the certificate - we don't want to break this.

Finally, the "generic-browser" definition shows a basic challenge for everything else. This is what casual visitors will briefly see when they visit for the first time to confirm they are not a bot.</p>
Ready to Go</a></h3>
There we go. With all that in place, we can now run Anubis and change HAProxy to Anubis' listening port and put it to work!</p>
Run Anubis</p>
$</span> service anubis start</span></span></code></pre>
Configure HAProxy</p>
... rest of config</span></span>
backend be_forgejo</span></span>
    mode http</span></span>
    # server forgejo 192.168.200.10:3000 # old direct to forgejo route. disabled</span></span>
    server forgejo 192.168.200.10:8923 </span># new route to anubis</span></span></code></pre>Monitoring and extra bits</a></h3>
The rc.d script</a> provided will log stdout and stderr to /var/log/anubis.log</code> so you can see the status of things and any errors.</p>
At this time, Anubis must be run once per endpoint. That is to say if you want to run anubis for Forgejo, and a website, etc. you will need to run at least two instances of anubis.

I am only running a single instance at the moment, but I have a jail that updates and builds Anubis. This jail outputs the anubis binary to a shared location other jails can use and run independantly of each other. This allows me to run numerous instances of it, but I only have to update the Anubis binary in once place.</p>
Final Note</a></h2>
If you use Anubis, and are able to do so, I strongly encourage you to donate what you can</a> to the project so they can continue to maintain it into the future.</p>
HAPPY AI STOPPING!</a></h2>


My Battle with Netcup, IPv6 and FreeBSD combination
2025-01-20T13:59:00+00:00
Recently I've started to migrate some of my VPS's to Netcup</a>
as I have found their offerings more performant, and less expensive, than other
VPS providers.

However, it seems due to the way Netup's IPv6 network is set up causes some issues
with FreeBSD, and allegedly other BSDs leading to loss of connectivity via IPv6.</p>
</span>
TL;DR:</a></h3>
Using Netcup's IPv6 gateway fe80::1</code> with FreeBSD results in eventual lost connectivity with IPv6.

Instead of using the link-local address for a gateway, using IPv6 addresses in the same /48 range as your provided IPv6 range, and setting your IPv6 address prefix to /48 instead of /64 seems to work fairly reliably.

For example if Netcup provide you with IPv6 range: 2a03:4000:AAAA:BBBB::/64</code>, you would set this statically in your rc.conf</code> but as a /48, and set 2a03:4000:AAAA::2</code> and/or 2a03:4000:AAAA::3</code> as your gateway.</p>
# /etc/rc.conf</span></span>
#ifconfig_vtnet0_ipv6="inet6 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff/64"</span></span>
ifconfig_vtnet0_ipv6="inet6 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff/48"</span></span>
#ipv6_defaultrouter="fe80::1%vtnet0"</span></span>
ipv6_defaultrouter="2a03:4000:AAAA::2"</span></span></code></pre>
add other routes with</p>
route</span> -6 add default 2a03:4000:AAAA:3</span></span></code></pre>
I've had most reliability setting both</em> ::2</code> and ::3</code> gateways, YMMV.

It appears in each Netcup /48 subnet ::2</code> and ::3</code> are gateways.</p>

On with the full story...</p>
Netcup</a></h3>
I have moved to Netcup for a few reasons: 1. expense, 2. experienced better performance than my previous provider, and 3. ability to provide my own ISOs for OS install.

Netcup in my experience are great, I have a few Debian systems with them that have been super reliable.

But, I want to use FreeBSD for my projects, so my new VPSs run FreeBSD.</p>
The Issue</a></h3>
All is well on the IPv4 front, the DHCP client picks up my provided IPv4 address and connectivity is there, great. I still manually set it statically for consistency, but either way it works great.

IPv6 however, different story. FreeBSD doesn't seem to get it's provided IPv6 address via
SLAAC, so no address gets associated. That's OK though, I can set it statically in
rc.conf</code>. Netcup provide a /64 IPv6 subnet for each VPS, so I can pick any IPv6 in the range
they have provided, but they also sent one via email, so I'll just use that for now.</p>
...</span></span>
ifconfig_vtnet0_ipv6="inet6 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff/64"</span></span>
...</span></span></code></pre>
2a03:4000</code> is Netcup's network I believe with AAAA</code> defining a certain part of that network.

BBBB</code> is the subnet provided to me with cccc:dddd:eeee:ffff</code> being the range of address I can use in that subnet.</p>
Netcup's IPv6 network is switched, not routed, I'm sure there's a reason for this, and I'm sure it's sensible, but for now the important bit is that the IPv6 gateway should always be fe80::1%vtnet0</code> (where vtnet0</code> is the external interface name) rather than another 2a03:4000:AAAA:BBBB</code> IPv6 address. I pop that into my rc.conf</code> as well.</p>
...</span></span>
ipv6_defaultrouter="fe80::1%vtnet0"</span></span>
...</span></span></code></pre>
Reboot the VPS, and all works well. ping6</code>s work, curl</code>s to IPv6 addresses work, incoming IPv6 connections work. Great! Done...</p>
Not Done.</p>
After about 10 minutes of connectivity, IPv6 just drops out. ping6</code>s fail, curl</code>s fail, no connectivity on IPv6 from the outside world. Drat.

Reboot the VPS again... oh, it's back. Great. Wait a few minutes, it goes again. Reboot, back, wait, gone. And so on.</p>
Tests and Research</a></h3>
Obviously the first thing I'm thinking is firewall. So I disable pf</code> and reboot and wait again - no difference, IPv6 just stops working after a few minutes.</p>
In my fairly inexperienced IPv6 knowledge (it's not big in the UK... yet), using fe80::1</code> as a gateway feels weird, so I try a traceroute6 anyaddress.com</code> to see what the first hop on the route is (it must be my actual gateway, right?) and pop that address into my ipv6_defaultrouter=</code> config in rc.conf</code>.

Reboot... no joy, no IPv6 connectivity at all. OK, I set that back.</p>
I browse the netcup forums a bit, find a handful of posts of people experiencing the same issue. Some refer to people leasing an additional IPv6 lease from Netcup and using that instead which allegedly works for them. I did this, it did not work for me - the IPv6 worked, for about 10 minutes again, then dropped off as before.

FreeBSD forums is the same sort of thing, articles from a few years ago.</p>
Both forums seem to have posts saying the issue lies in the fact the IPv6 address and [actual] gateway exist in different subnets.
My simple understanding of this is: the gateway may have address 2a03:4000:AAAA::2</code> which is in a /48 subnet, and my VPS may have IPv6 address 2a03:4000:AAAA:BBBB::1234</code> which is a /64 subnet. Because they do not exist on the same subnet, something</em> happens at some point to stop them being able to communicate. I believe this "something</em>" is to do with Netcup's switching (rather than routing).</p>
Of the people experiencing this, some have had the IPv6 Connectivity come back and drop off again on its own. I haven't experienced this, but perhaps I'm just impatient.</p>
So, I write a post on the FreeBSD forums</a> with a bit of information of things I've tried asking for help. I link this to a Fediverse post</a> and wait for responses. It doesn't take long.</p>
Switching the subnet</a></h3>
@fab</code> responds with the idea of using a /48 prefix instead of /64.
Given what I have learned up to this point, this could make sense - the gateway is in a /48 of the same first 48 bits of my /64 subnet (2a03:4000:AAAA</code>)
after all, so why not put my IPv6 in that same subnet. It could</em> cause issues with communication with other servers in different /64 subnets within the same /48 subnet, but let's risk it for now.</p>
Unfortunately, I experience the same issues again here. After about 10 minutes the connectivity drops off. Reboot, OK, wait, gone.</p>
Learn German</a></h3>
Maybe it's because I'm a native English speaker that I didn't do this before, but I
thought I'd look more in depth at the Netcup forums and found this thread by a German speaker having the same issues</a>. Fortunately, in browser translate was able to translate it for me and I was able to get the gist of what was going on.

This post in particular</a> was interesting, along with this post by the same author</a> - they suggest two things I've tried before - using a /48 prefix instead of /64, and setting a route for the actual gateway address (not the fe80::1</code> address), but I didn't try them both at the same time!</p>
Let's try those together!</a></h2>
I'll get my default gateway via traceroute6</code> again</p>
></span> traceroute6 netcup.de</span></span>
traceroute6</span> to netcup.de</span> (2a03:4000::e01e) from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff, 64 hops max, 28 byte packets</span></span>
 1</span>  2a03:4000:AAAA::2</span>  0.472</span> ms</span>  1.058</span> ms</span>  0.604</span> ms</span></span></code></pre>
Pop that in my rc.conf</code> and also change my prefix to /48 while I'm there.</p>
...</span></span>
ifconfig_vtnet0_ipv6="inet6 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff/48"</span></span>
ipv6_defaultrouter="2a03:4000:AAAA::2"</span></span>
...</span></span></code></pre>
Reboot. It's working. Wait. It's still working! Wait a little longer. Still working!

This is progress! ping6</code>s and curl</code>s are working great!

Oh, incoming connections aren't so good...</p>
# From another host</span></span>
></span> ping6 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff</span></span>
...</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>4</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>5</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>6</span> Destination unreachable: Address unreachable</span></span></code></pre>
So ping6</code>s go out OK, but nothing is coming in.</p>
Switching, not routing</a></h3>
As previously mentioned, Netcup switches their IPv6 addresses, they don't route them.
I'm not going to pretend I know exactly what this means, but it feels to me that it's
likely the gateway could "switch" periodically, and in normal circumstances the fe80::1</code> can be aware of this and cater for it, just not for the BSDs.</p>
I wonder...</a></h4>
Maybe... I could try switching my default route to another gateway IP? This Post on the Netcup thread</a> seems to suggest there could be a number of 2a03:4000:AAAA::X</code> gateways that could be routers...</p>
route</span> -6 add default 2a03:4000:AAAA::3</span></span></code></pre>
Meanwhile on another host...</p>
...</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>4</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>5</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>6</span> Destination unreachable: Address unreachable</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>1308</span> ttl=</span>48</span> time=</span>5.62</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>1309</span> ttl=</span>48</span> time=</span>4.81</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>1310</span> ttl=</span>48</span> time=</span>5.04</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>1311</span> ttl=</span>48</span> time=</span>4.80</span> ms</span></span>
...</span></span></code></pre>
PROGRESS!</p>
All Good things...</a></h3>
At this point I'm excited. I switch my rc.conf</code> to use that different gateway. I haven't rebooted yet but I see no reason to just yet. Right now I'm at about icmp_seq=5000</code> on my outgoing ping6</code>s and incoming are still successful. But... on my remote server...</p>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>4504</span> ttl=</span>48</span> time=</span>4.86</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>4505</span> ttl=</span>48</span> time=</span>4.93</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>4506</span> ttl=</span>48</span> time=</span>4.81</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>4507</span> ttl=</span>48</span> time=</span>4.87</span> ms</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>508</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>509</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>510</span> Destination unreachable: Address unreachable</span></span></code></pre>
Drat!

Outgoing ping6</code>s still seem OK though... let's switch that default route again</p>
route</span> -6 add default 2a03:4000:AAAA::2</span></span></code></pre>
and on the other server:</p>
...</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>4</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>5</span> Destination unreachable: Address unreachable</span></span>
From</span> 2a00:11c0:AA:B::fff icmp_seq=</span>6</span> Destination unreachable: Address unreachable</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>6323</span> ttl=</span>48</span> time=</span>5.42</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>6324</span> ttl=</span>48</span> time=</span>4.72</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>6325</span> ttl=</span>48</span> time=</span>5.14</span> ms</span></span>
64</span> bytes from 2a03:4000:AAAA:BBBB:cccc:dddd:eeee:ffff: icmp_seq=</span>6326</span> ttl=</span>48</span> time=</span>4.94</span> ms</span></span>
...</span></span></code></pre>
OK, so I can dynamically bring connectivity back if/when it drops. I can probably script this in some way to happen automatically too. Is it perfect? No, but it's something.</p>
Request for Comments</a></h3>
This is where I am right now. I have a sort-of almost stable IPv6 connection that works most of the time, but it's nowhere near ideal. I am continuing my research and I will update this post if/when I discover anything that stablises it completely.

In the meantime, I welcome any comments about things that I could do further to help, or, indeed, comments for reasons why I should not have done any of the above. I'm familiar with networks, but with IPv6 being ignored in the UK my knowledge of it is a little lacking.</p>
If you want to send any comments, please do so either on this FreeBSD Forum thread</a> or on this Fediverse thread</a>.</p>
EDIT: I guess I should have found this post on the FreeBSD forums</a> earlier, which alludes to the same thing.</p>
Updates</a></h3>
After a while of the above, ndp -a</code> is showing something like the below:</p>
Neighbor</span>                             Linklayer Address  Netif Expire    S Flags</span></span>
fe80::1%vtnet0</span>                       **</span>:</span>**</span>:</span>**</span>:</span>**</span>:</span>**</span>:</span>**</span> vtnet0 20h12m4s  S R</span></span>
2a03:4000:AAAA::2</span>                    **</span>:</span>**</span>:</span>**</span>:</span>**</span>:</span>**</span>:</span>**</span> vtnet0 23h59m52s S R</span></span>
2a03:4000:AAAA::3</span>                    **</span>:</span>**</span>:</span>**</span>:</span>**</span>:</span>**</span>:</span>**</span> vtnet0 12s       R R</span></span></code></pre>
So perhaps both gateways are in use? That's good I guess.

I've seen, a few times but rarely, my remote ping6</code>s to my Netcup VPS become unreachable
but after a shortwhile it starts working again without any interactions. I'm hoping</em> this
"self-repair" is something to do with having both routes set up,
meaning I don't have to worry about it any more - I just need to set the second gateway
up in my rc.conf</code> as well.</p>
Results</a></h2>
I've had the above in place for a number of hours now and I have to say the stability has been reasonable. A handful of timeouts, but they seem to self-heal.</p>


Joining Debian Linux (Desktop) to an Active Directory Domain
2025-01-09T15:29:42+00:00
I've come across many articles about how to join a linux system to a Microsoft
Active Directory domain and they all work more or less with some tweaking. This is
my article, here describing my own processes for doing it, trying to explain each
bit as it comes.</p>
Part of a "Using Linux in a Windows Domain"</a> group of posts.

This article is for desktop Debian Linux - for setting up a PC so it can be used by a standard user of the PC.</p>
</span>
Basics</a></h2>
I'll be running through the process I use for joining Debian Linux as a desktop to Active Directory. The steps should be fairly generic as they use packages available in most distributions, so adapt to your distro as required.

This follows this article</a> quite closely, with some changes.</p>
I use neovim</code> as an editor, aliases to vim</code>. If you use another editor then replace vim</code> with your editor i.e. nano</code> in all cases.</p>
Required Packages</a></h2>
First things first we need the right packages installed. This can be done by the following command:</p>
# apt install realmd sssd samba-common krb5-user adcli libsss-sudo sssd-tools libsasl2-modules-ldap packagekit libpam-mount</span></span></code></pre>

sssd</code> is a set of services and tools to manage the connection to the domain.</li>
pam</code> handles general user authentication, and creation of mounts for network shares etc.</li>
realmd</code> is a tool providing a simple way to discover and join domains.</li>
krb5</code> is a kerberos (authentication token) handler amongst other things.</li>
The other packages like *-ldap</code>, adcli</code> are further tools use for domain administration.</li>
</ul>
For the most part, when we say realm</code> we mean your windows "domain name". We'll be using YOURDOMAIN.LOCAL</strong> as an example.</p>
Joining the Domain</a></h2>
This is at its simplest a case of configuring basic krb5</code> and using realm join</code> to actually join the domain.</p>
Configuring krb5</a></h3>
Edit the krb5.conf</code> file to set the default realm:</p>
vim</span> /etc/krb5.conf</span></span></code></pre>[libdefaults]</span></span>
default_realm = YOURDOMAIN.LOCAL # Should be in CAPS</span></span></code></pre>
This will allow the krb5 client to identified the default realm. If you don't set this, then a realm will need to be specified with every kerberos request i.e. with kinit</code>.</p>
Realm Join</a></h3>
Realmd handles a massive amount of the work here. It used to be we had to manage a lot of this configuration ourselves, but realm now does a lot of it for us.</p>
You can discover information about the local domain by issuing the below command</p>
realm</span> discover</span></span>
# or</span></span>
realm</span> discover YOURDOMAIN.LOCAL</span></span></code></pre>
If all looks good you can join it</p>
realm</span> join --user=</span>{</span>your</span> administrator account} YOURDOMAIN.LOCAL</span></span></code></pre>
And to check everything is OK</p>
realm</span> list</span></span></code></pre>
which should output something like</p>
yourdomain.local</span></span>
  type</span>: kerberos</span></span>
  realm-name:</span> YOURDOMAIN.LOCAL</span></span>
  domain-name:</span> yourdomain.local</span></span>
  configured:</span> kerberos-member</span></span>
  server-software:</span> active-directory</span></span>
  client-software:</span> sssd</span></span>
  required-package:</span> sssd-tools</span></span>
  required-package:</span> sssd</span></span>
  required-package:</span> libnss-sss</span></span>
  required-package:</span> libpam-sss</span></span>
  required-package:</span> adcli</span></span>
  required-package:</span> samba-common-bin</span></span>
  login-formats:</span> %U@yourdomain.local</span></span>
  login-policy:</span> allow-realm-logins</span></span></code></pre>Testing Connection</a></h3>
Technically now the computer is joined to the domain and can authenticate. You can test with:</p>
kinit</span> {domain user}</span> # will authenticate as that user</span></span>
klist</span> # to show the kerberos token validity</span></span>
kdestroy</span> # deauthenticate as that user</span></span></code></pre>
Or, of course, log out and back in as a domain user account.</p>
Tuning SSSD</a></h3>
Open up your /etc/sssd/sssd.conf</code> file and make a few tweaks</p>
vim</span> /etc/sssd/sssd.conf</span></span></code></pre>
Most of this will already be completed in your file as realmd handled it. But check over
it anyway.</p>
[sssd]</span></span>
domains = yourdomain.local</span></span>
config_file_version = 2</span></span>
#services = nss, pam # commented out as these are socket units which are dynamically handled by systemd</span></span>
implicit_pac_responder = false # having set to true allegedly crashed some SSSD services. It's not essential.</span></span>
</span>
[domain/yourdomain.local]</span></span>
access_provider = ad</span></span>
id_provider = ad</span></span>
default_shell = /bin/bash</span></span>
krb5_store_password_if_offline = True</span></span>
cache_credentials = True</span></span>
krb5_realm = YOURDOMAIN.LOCAL</span></span>
krb5_ccachedir = /tmp</span></span>
krb5_ccname_template = FILE:%d/.krb5cc_%U</span></span>
full_name_format = %1$s</span></span>
realmd_tags = manages-system joined-with-adcli</span></span>
fallback_homedir = /home/%u@%d</span></span>
override_homedir = /home/%u@%d</span></span>
ad_domain = yourdomain.local</span></span>
use_fully_qualified_names = False</span></span>
ldap_id_mapping = True</span></span>
dydns_update = False</span></span>
</span>
# This next one was a real fix for me. I had some issues where a Group Policy was unreadable which crashed SSSD and prevented the user from logging in. Windows would silently ignore it, so never an issue. I like the fact it was highlighted to me, but is not ideal for a production machine where people need to log in. So we ignore unreadable GPOs.</span></span>
ad_gpo_ignore_unreadable = True</span></span></code></pre>
Now update the PAM modules</p>
pam-auth-update</span></span></code></pre>
and make sure to check [*] Create home directory on login</code> is enabled.

This will allow the system to validate the user again the domain, create the user's home directory and mount the user's network shares if set.</p>
Sudo</a></h3>
There's a chance you may want domain administrators to have sudo privileges. This can be done by adding the following line to /etc/sudoers</code></p>
%domainadmins   ALL=(ALL:ALL) ALL</span></span></code></pre>Samba</a></h3>
Having Samba configured also helps streamline connectivity to network shares.</p>
vim</span> /etc/samba/smb.conf</span></span></code></pre>[global]</span></span>
  workgroup = yourdomain.local</span></span>
  realm = YOURDOMAIN.LOCAL</span></span>
  encrypt passwords = yes</span></span>
  client protection = encrypt</span></span></code></pre>
There are a couple of further notes regarding GVFS and automatically mounting network shares in the article mentioned at the start</a>, if you need those things in place I recommend checking through that article as well.</p>
Testing.</a></h2>
We should be good to go. Let's run some tests.</p>
Are services running?</a></h3>
systemctl</span> status</span></span>
# If the state is `degraded` you can see failed services by running this command</span></span>
systemctl</span> list-units --failed</span></span></code></pre>
I experienced some issues with SSSD failing due to unreadable GPOs mentioned above. I discovered SSSD crashed when trying to log in, and adding the SSSD option to ignore unreadable GPOs fixed it.</p>
Login</a></h2>
Great! We're here. Now we can log in.
Either log in using the desktop login screen, or from a terminal enter:</p>
login</span> {user name}</span></span></code></pre>
to log in as that user. The home directory should be created during login and everything is ready to go.</p>
Automatically Mounting Shared Folders</a></h2>
You can edit /etc/security/pam_mount.conf.xml</code> to enable automatic mounting of shared folders at login. I have had mixed success with this, but I'll put it here anyway:</p>
...prefilled content...</span></span>
<!-- this should go somewhere before the `<mkmountpoint ... >` block.</span></span>
                <volume</span></span>
                        fstype="cifs"</span></span>
                        sgrp="domain users"</span></span>
                        server="yourserver.yourdomain.local"</span></span>
                        path="share"</span></span>
                        mountpoint="~/Network Drives/Share"</span></span>
                        options="vers=3.0,sec=krb5i,cruid=%(USERUID),nodev,nosuid,noexec,rw"</span></span>
                /></span></span>
...prefilled content...</span></span></code></pre>


Accused of Hacking
2025-01-06T18:45:00+00:00
About 5 years years ago, during a security sweep of a new "app" a
client had started using, I discovered the hosting company's website
had a robots.txt giving the paths of many pages on their website containing
sensitive information.

The whole thing is starting to snowball, so this is my statement.</p>
</span> 
Update: 22/07/2025 - Finally, some actions are being taken. More information
at the bottom of the page</a></p>
</div>
The "App"</a></h3>
For those that don't know me, I am an IT Professional, providing IT consultancy
services to businesses around my local area of Devon, UK.

I'm generally met with people who are happy to see me and trust my advice.
Sometimes though that is not the case.</p>
My client in question is a medium sized business in Devon. They employ
approximately 70-100 staffmembers and have been in operation for over 60 years.

They are a well known local business.

Due to running a business this size, they naturally have outsourced some
workloads to third-parties, specifically for this case, Health and Safety. They
use the services of a Chartered Health and Safety Consultancy used by many other local businesses.

For whatever reason, this H&S company had decided they could make "apps" for their
clients to assist with entering H&S information amongst other things. Seems like a good idea, sure... but...</p>
...These "apps" are not apps at all, they are in fact simple html index pages linking to various Jotform Forms, Google Sheets, etc. These html index pages are, for the most part, unauthenticated</em>. This means anybody who knows the link to that page can access those forms and spreadsheets.</p>
As an example, if a random passer by on the internet was to go to a URL like https://thecompanyswebsite.com/someothercompany_portal.html</code> they would be shown a list of links
to various Health and Safety, Vehicle checks, holiday request forms, etc. All of which could be filled out without having to prove who they are.</p>
Why is this bad?</a></h3>
OK, well maybe that doesn't look so bad. I mean, you'd have to know what the path of the page is (the someothercompany_portal.html</code> bit) right? Well, yes, you would but that
should never be a defense, ever. Even if a URL is difficult to guess (it's not), it does not mean it's impossible.</p>
Robots.txt</a></h3>
Yep, the portal URL may be difficult to guess (they're not), and if it was just that alone things may be OK.

But...

This Health and Safety Company also had to good sense not to let search engines index
those portal pages. We don't want people's sensitive information being indexed by Google do we! Very Good.</p>
Ah...</p>
The robots.txt looks something like this:


There's about 510 lines like that.

(You'll notice I have taken the care to pixelise out the paths. I appreciate
pixalisation can be undone, but due to the fact you'd need to know the base URL
for this to work, and if you had the base URL, you'd have the full robots.txt file
anyway, I feel no further actions on my part need to be taken here.)</p>
For the uninitiated, this robots.txt means that Google, Bing, DuckDuckGo, etc. will never try to index any content on any of those paths. However, this does absolutely nothing</em> to stop
a badly behaved or malicious webcrawler/bot - In fact, this file will act as a lovely index to tell that webcrawler/bot exactly what pages you don't</em> want it to see.</p>
Privacy</a></h3>
Once again, on face value this just looks like someone will gain access to fill out forms and be a nuisance to the client business. However, on further investigation I
have discovered that some of these URLs contain plaintext information such as
names, email addresses, and telephone numbers of staff members.
In one particularely negligent case (which I only found today), names of parents and their children, including dates of birth, telephone numbers, email addresses of the parent plus</em> their signatures and</em> names, email addresses, telephones numbers and signatures of that child's sporting coach.</p>
That last case is extreme, but it's there, in plain sight, for anyone who happens
to find the right base URL and path of that particular case.</p>
In short, This. Is. Negligent.</p>
What I have done so far</a></h3>
As I say, I first noticed this about 5 years ago, and immediately informed my client, and
the Health and Safety company involved about it. I ended up being invited to a meeting with them all, and explained my findings and told them these pages should, at the very least, be behind some kind of authentication. From this they decided they would put in
some authentication - but only as groups, i.e. office@clientem.ail, warehouse@clientem.ail etc. and not per user.

Shocking. But at least it was something.

Although... it isn't something... they only did it for my client, so perhaps they just
wanted to shut me up. I don't know. But other paths remained without authentication.

As time went on, new "apps" for my client appeared (once again without authentication) and so I warned my client about it again, and again, and again.

Over the last week this has reared it's ugly head again. I once again provided warning to my client with reasons why.

Humourously, my client forwarded my email to the Health and Safety company and their response to it went like the below:</p>
We are in the process of modifying our own internal app and it is not normally </span></span>
publicly available, and has now been returned to password protection. To of </span></span>
found the URL for our own internal app would of taken more than bad acting, </span></span>
and probably more aligned with IT guru / junior hacker.</span></span></code></pre>
"Not normally publicy available"?! Well, I've seen it publicly available for 5 years.
"To have found the URL for our own interal app ... hacker"!? Erm... no. I've proved already this can be found by anyone just looking around, no hacking required (well, no authentication required, so nothing to hack).</p>
My Actions</a></h3>
OK, they haven't "accused" me of hacking, but it's close.</p>
I have not dignified that email with a response. But, I have reported the Health and Safety company to the ICO</a>, providing links to the robots.txt page
and the direct URL of the page containing parents and child information mentioned above. I'll let them deal with it from here.

However, as the term "hacker" has been used, and I am very</em> aware of court cases that have happened</a> where a good samaritan trying to help protect people, has instead been victimised and made out to be the "malcious hacker"
because people simply do not understand how the internet works.</p>
So, in the fear something like that could happen to me, this article is my statement.
I ask anyone actively involved in System Administration, Cyber Security, Data Protection, etc. to please get involved and share this article.

If you like, you can join in on this Fediverse/Mastodon thread</a> too.</p>
Thank you for reading. I'm a bad writer and I don't write much, but I really needed to vent this, and put it somewhere for all to see.</p>
Someone Finally Understands!</a></h3>
I'm tired of this situation, but on the 21/07/2025 it all came up again.
The same things happened: I make my concerns known, the system provider says
the same "would take bad acting" comments, but this time a few extra things happened:</p>

I lose my rag a bit, and ultimately say what I've been needing the confidence
to say to them for ages - "If their security is 'Only hackers can get in',
that isn't security. Not in the slightest."</li>
I point out it's not just personal information on the site, it also
includes the business internal price lists and other business sensitive information.</li>
I provide my client a link to another client's "portal" on the same system
to demonstrate how this affects another client. (I took care to find a client
with little to no sensitive information so as to not trouble them too much.
I apologise to this other company, but I needed to prove my point.)</li>
Somebody actually understood!</li>
</ol>
The fact the business price lists were involved hit a note, definitely, but...
Someone understood! This person within the company, new to this situation,
was able to actively use the link I sent them for the other company's "portal",
look back at the robots.txt</code> file, then proceed to access anything and
everything they wished to. Ultimately, proving beyond a shadow of a doubt
that no hacking is required!

Thank you to this person! You have just saved me!</p>
Things, for my client at least, are now being taken down (at least, I'm told
they are). Still a bit of a sticking point due to "inconvenience" of losing
access to the documents and forms, but you, dear reader, and I both know this
is moot. If we have to make a choice between convenience and security, security wins.</p>


Norg Backup Utility
2024-08-18T16:08:00+00:00
Norg</a></h1>
A simple, portable, wrapper for the borg backup</a> and restic</a> utilities written in Nim.</p>
</span>
Inspired by Borgmatic</a></p>
Usage</a></h2>
Norg uses a toml</code> based config file for configuration. An example configuration would look like this:</p>
source_directories</span> = [</span></span>
    "</span>/home/me/Music</span>",</span></span>
    "</span>/home/me/Pictures</span>"</span></span>
]</span></span>
[[</span>repositories</span>]]</span></span>
label</span> = "</span>MyBorgRepo</span>"</span></span>
path</span> = "</span>/my/backup/location</span>"</span></span>
</span>
[[</span>repositories</span>]]</span></span>
label</span> = "</span>Another Respository at BorgBase</span>"</span></span>
path</span> = "</span>ssh://1234abcd@1234abcd.repo.borgbase.com/./repo</span>"</span></span>
</span>
[</span>encryption</span>]</span></span>
encryption_passphrase</span> = "</span>MyReallySecurePassword</span>"</span></span>
</span>
[</span>actions</span>]</span></span>
before_actions</span> = ["</span>echo before actions</span>"]</span></span>
after_actions</span> = ["</span>echo after actions</span>", "</span>echo actions completed</span>"]</span></span>
before_backup</span> = ["</span>echo before backup</span>", "</span>date</span>"]</span></span>
after_backup</span> = ["</span>echo after backup</span>","</span>echo backup completed</span>"]</span></span>
</span>
[</span>uptimekuma</span>]</span></span>
base_url</span> = "</span>https://uptime.kuma.url/api/push/1234abcd</span>"</span></span>
states</span> = ["</span>Success</span>","</span>Failure</span>", "</span>Running</span>"]</span></span></code></pre>
You can then run the equivalent borg</code> or restic</code> command to init, create, list, mount and extract your backups.</p>
Using BorgBackup</strong></p>
# Init your repository</span></span>
norg</span> -c myconfig.toml init</span></span>
</span>
# Backup your data</span></span>
norg</span> -c myconfig.toml create</span></span>
</span>
# List Archives</span></span>
norg</span> -c myconfig.toml list</span></span>
</span>
# Mount an Archive</span></span>
norg</span> -c myconfig.toml mount -r MyBorgRepo -a pcname-2024-08-18T15:20:17773204 /home/me/mnt</span></span>
# Unmount an Archive</span></span>
norg</span> -c myconfig.toml umount -r MyBorgRepo /home/me/mnt</span></span>
</span>
# Extract an Archive</span></span>
# You must be in an empty folder for this to work</span></span>
norg</span> -c myconfig.toml extract -r MyBorgRepo -a pcname-2024-08-18T15:20:17773204</span></span>
</span>
# Or You must set the destination to an empty folder</span></span>
norg</span> -c myconfig.toml extract -r MyBorgRepo -a pcname-2024-08-18T15:20:17773204 --destination /tmp/my_extracted_archive</span></span>
</span>
# Prune all repos</span></span>
norg</span> -c myconfig.toml prune</span></span>
# Or specify a particula repo</span></span>
norg</span> -c myconfig.toml prune -r MyBorgRepo</span></span>
</span>
# Delete an Archive</span></span>
norg</span> -c myconfig.toml delete -r MyBorgRepo -a pcname-2024-08-18T15:20:17773204</span></span></code></pre>
Using Restic</strong> New in v0.1.6</em>
Add a repository with a tool = "restic"</code> option.</p>
[[</span>repositories</span>]]</span></span>
label</span> = "</span>MyResticRepo</span>"</span></span>
path</span> = "</span>/my/restic/backup/location</span>"</span></span>
tool</span> = "</span>restic</span>"</span></span></code></pre>
Then run the appropriate commands</p>
# Init your repository</span></span>
norg</span> -c myconfig.toml init</span></span>
</span>
# Backup your data</span></span>
norg</span> -c myconfig.toml backup</span></span>
</span>
# List Snapshots</span></span>
norg</span> -c myconfig.toml snapshots</span></span>
</span>
# Mount a Repo</span></span>
norg</span> -c myconfig.toml mount -r MyResticRepo /home/me/mnt</span></span>
</span>
# Restore an Archive (restore destination must be empty)</span></span>
norg</span> -c myconfig.toml restore -a latest --destination /my/restore/location</span></span>
</span>
# Prune a repo</span></span>
norg</span> -c myconfig.toml prune</span></span>
</span>
# Forget a Snapshot</span></span>
norg</span> -c myconfig.toml forget -r MyBorgRepo -a a1b2c3d4</span></span></code></pre>Command line parameters</a></h3>

-c</code>, --config</code>: The configuration file to use</li>
-r</code>, --repository</code>: The repository to work on</li>
-a</code>, --archive</code>: The Archive to operate on (snapshots for restic)</li>
-d</code>, --destination</code>: When extracting/restoring, the destination for the extracted files</li>
</ul>
Build from Source</a></h2>
Download and build from source</p>
git</span> clone https://codeberg.org/pswilde/norgbackup</span></span>
cd</span> norgbackup</span></span>
nimble</span> install</span></span></code></pre>
or just install directly with nimble</code></p>
nimble</span> install https://codeberg.org/pswilde/norgbackup</span></span></code></pre>System Support</a></h2>
Norg should work on any system that can compile nim</code> code with nimble</code>.
Tested on:</p>

Arch Linux</li>
Debian Linux</li>
AlmaLinux</li>
FreeBSD</li>
</ul>
But in general all Linux distributions and BSDs should work if borg and/or restic is installed.
Windows support (Restic only until Borg support in Windows is available) is planned with the only real issue being finding the restic executable. Should be an easy fix.</p>
Naming. Why "Norg"?</a></h2>
Well, I don't know. I'm a Star Trek fan so obviously I wanted to keep something
in line with the Borg pseudo-species</a> as the borg backup utility does.
Also, sometimes I feel my code has elements of inexperience but loads of potential... which reminded me of Nog</a>.
So, simply put, Norg</code> is an portmanteau of "Borg" and "Nog".</p>
Borg and Restic Notes</a></h2>
I love both Borg and Restic tools, they are both great and both have their pros and cons. As BorgBase</a> has repos for both, I felt it only sensible to
provide a tool that can use both.
Providing implementation for both means you could have duplicate backups using
different tools which should provide a certain amount of protection over failures in
a particular tool.
Caution should be taken when using additional flags when you have repositories of
both types in the same configuration file. I have tried to cater for some common flags
that will be converted to the correct type for a particular tool, but this may not always be the case. If in any doubt, it is advised to use the --repository</code> flag for any borg/restic specific flags so as not to cause one the other tool to fail.</p>
Some different yet similar commands should be converted to the correct type. A table below shows some of these:
| Borg Command | Restic Command             | Result                                     |
| create       | backup                     | creates a backup                           |
| list         | snapshots                  | lists archives/snapshots                   |
| extract      | restore                    | restores/extracts a backup                 |
| delete       | forget                     | removes a archive/snapshot                 |
| prune        | forget (with --prune flag) | removes snapshots as per --keep-*</code> config |</p>
You may specify either command and it will work with both except the forget</code> command. This will only forget a single snapshot in restic.</p>
Why create this when Borgmatic exists?</a></h2>
Borgmatic</code> is absolutely fantastic, and I love it dearly. I even implemented
the Uptime Kuma</code> hook that is in it. However, I got a little impatient waiting
for the version that included the Uptime Kuma hook to arrive in various distributions
package repositories so ended up building borgmatic from source on all computers.
This was a lengthy process, and borgmatic isn't very portable; it requires installation of numerous python packages (and the entire rust language in FreeBSD).
I wanted to make something that had to features I needed, in a single binary I
could move around to whatever computer I needed it on.
Norg was the outcome of this.</p>
Work in Progress</a></h2>
Norg is still very much a work in progress, so there will be bugs. Please raise
and issue, or create a pull request for any issues and resolutions you may have.</p>
Contact</a></h2>
For any issues, please raise an issue here. Otherwise, I can be contacted via
the fediverse at @paul@notnull.space</a>.</p>


BatMon
2024-07-29T21:16:00+00:00
A simple battery monitor tool that can notify you on battery status changes for FreeBSD.

Inspired by but in no way similar to batsignal</a> - inspiring the basic function only.
Written in pure Nim</a>.</p>
</span>
Requirements</a></h2>
Run Requirements</a></h3>

apm</code></li>
notify-send</code></li>
</ul>
Build Requirements</a></h3>

nim</code></li>
nimble</code></li>
</ul>
Installation</a></h2>
To install into your .nimble/bin</code> directory</p>
git</span> clone https://codeberg.org/pswilde/batmon</span> &&</span> cd</span> batmon</span></span>
nimble</span> install</span></span></code></pre>Running</a></h2>
# To run the daemon server notifier, just run:</span></span>
batmon</span> -d</span></span>
</span>
# To run once and just show battery level, run:</span></span>
batmon</span> -o</span></span></code></pre>Using</a></h2>
When importing Batmon as a module you have access to the get_battery_status()</code>
procedure which will return a Battery</code> object you can use elsewhere.</p>
Battery Type</a></h3>
type</span> </span></span>
  Battery</span>* = object</span></span>
    status</span>*:</span> Status</span></span>
    charge</span>*: float</span></span>
  Status</span>* = enum</span></span>
    High</span>,</span></span>
    Low</span>,</span></span>
    Critical</span>,</span></span>
    Charging</span>,</span></span>
    Unknown</span></span></code></pre>
Also, you have access to the notification handler module, where you can build
and send your own notifications:</p>
var</span> n </span>=</span> newNotification</span>(</span>"</span>Title</span>"</span>, </span>"</span>Body</span>"</span>, urgency </span>=</span> Normal</span> , timeout </span>=</span> 5000</span>)</span></span>
discard</span> n</span>.</span>send</span>()</span></span></code></pre>


TootInstall
2024-07-29T14:18:00+00:00
TootInstall Concept</a></h2>
Status of this Memo</a></h3>
This memo defines a conceptual protocol for software build and install scripts
for varying platforms published via Fediverse (ActivityPub i.e Mastodon, et al) posts.</p>
</span>Overview</a></h3>
These days, the options for software build and install processes are many,
and jumping through the hoops required for some operating systems can be
troublesome and sometimes impossible.

Additionally, having to maintain many published packages for varying platforms
is laborious, and sometimes means packages in some platforms become out of date
and unmaintained.

The TootInstall concept aims to bypass many of these requirements in an effort
to have build and install scripts available for any application available on a
decentralized, federated, all-accessible platform.</p>
Usage - by Developers</a></h4>
A software developer or package maintainer would post their script using their
preferred federated ActivityPub service, and mention a tootinstall bot</code>
(i.e. @tootinstall_bot@tootinstall.example</code>). The tootinstall bot</code> would then
parse the script and re-post it, giving attribution to the original poster.</p>
It would be in everyone's best interests if all package requirements are listed
to ensure all dependencies are satisfied before attempting the install.</p>
For example, a simple tootinstall</code> script may look like the following:</p>
@tootinstall_bot@tootinstall.example </span></span>
+++</span></span>
name</span> = "</span>my_package</span>"</span></span>
targets</span> =</span> [</span>"</span>linux+amd64</span>"</span>, </span>"</span>linux+arm</span>"</span>, </span>"</span>freebsd+amd64</span>"</span>]</span></span>
dependencies</span> =</span> [</span>"</span>bash</span>"</span>,</span>"</span>git</span>"</span>]</span></span>
+++</span></span>
#!/usr/bin/env bash</span></span>
git clone https://gitrepo.example/me/my_package /tmp/my_package</span></span>
cd /tmp/my_package</span></span>
cp ./my_package /usr/local/bin/my_package</span></span></code></pre>
which the bot would receive, and re-post like so:</p>
+++</span></span>
name</span> = "</span>my_package</span>"</span></span>
targets</span> =</span> [</span>"</span>linux+amd64</span>"</span>, </span>"</span>linux+arm</span>"</span>, </span>"</span>freebsd+amd64</span>"</span>]</span></span>
dependencies</span> =</span> [</span>"</span>bash</span>"</span>,</span>"</span>git</span>"</span>]</span></span>
author</span> = "</span>@you@a_mastodon_instance.example</span>"</span></span>
date</span> = "</span>2024-29-07T14:48:00</span>"</span></span>
status</span> = "</span>pending approval</span>"</span></span>
tootinstall_host</span> = "</span>packages.tootinstall.example</span>"</span></span>
+++</span></span>
#!/usr/bin/env bash</span></span>
git clone https://gitrepo.example/me/my_package /tmp/my_package</span></span>
cd /tmp/my_package</span></span>
cp ./my_package.bash /usr/local/bin/my_package</span></span></code></pre>
The tootinstall bot</code> should have RSS enabled for their posts, which is then
parsed by a tootinstall helper</code> and collated into a tootinstall database</code> and
published on a tootinstall host</code>.</p>
Usage - by End Users</a></h4>
An end user only requires a simple portable tootinstall</code> binary which can be
used as follows:</p>
tootinstall</span> install my_package @packages.tootinstall.example</span></span></code></pre>TootInstall Bot</a></h3>
A tootinstall bot</code> is a ActivityPub account that is able to read posts it is
mentioned in, adapt incoming information and create new posts with correctly
formatted tootinstall script</code> text.</p>
It must:</p>

be able to publish their ActivityPub feed via RSS so a
tootinstall helper</code> is able to easily read posts it sends for new
tootinstall scripts</code>.</li>
post a tootinstall script</code> as a new post,
not a reply, nor a boost, nor a quote boost, nor anything similar,
to simplify RSS feed handling.</li>
create 'author', 'date', 'status', and
'tootinstall_host' tags in the tootinstall script</code> and ignore those in the
original post to prevent information poisoning.</li>
be able to operate a blacklist of accounts/instances to prevent spamming</li>
</ul>
It may also be useful if it could:</p>

receive boosts/favourites and forward these on to a tootinstall helper</code>
for approval and scoring purposes (see Approvals and Scoring).</li>
</ul>
TootInstall Helper</a></h3>
A tootinstall helper</code> is a background service that can read RSS feeds provided
by configured tootinstall bots</code> collating all new tootinstall scripts</code> it
has posted, store them in a database, and be able to search and return
information about them as requested by a tootinstall</code> user binary.</p>
It must:</p>

be able to be configured to check multiple tootinstall bot</code> RSS feeds to
allow for a more federated and decentralised service.</li>
be able to write to a persistent database</li>
be able to return a script by name</li>
NOT allow anyone other than the original author or maintainers to update a script</li>
be able to operate a blacklist of accounts/instances to prevent spamming</li>
</ul>
It would also be useful if it could:</p>

increment a version number of a tootinstall script</code> automatically. Incoming version numbers
should be ignored.</li>
</ul>
TootInstall Host</a></h3>
A tootinstall host</code> is a web frontend used by tootinstall</code> user binary
that is able to utilise the tootinstall helper</code> to return tootinstall scripts</code>.</p>
It must:</p>

be accessible on the internet</li>
be able to search and return a list of packages in json</code> format</li>
be able to return a specific package script by name in toml</code> format</li>
</ul>
Endpoint URLs should be as follows:</p>

/search?q=package_name</li>
/install?p=package_name</li>
</ul>
The TootInstall Bot, Helper and Host can all be the same system and do not necessarily need to be separate services</a></h4>
TootInstall Script</a></h3>
A tootinstall script</code> is a toml</code> document describing the dependencies and
build/install process of a package.

It has the following parameters:</p>

Editable:</li>
</ul>
name</span>         : string : the package name</span> (not</span> editable after the first post</span>)</span></span>
targets</span>      : array[string] : a list of os+arch targets</span></span>
dependencies</span> : array[string] : a list of software dependencies required</span> </span></span>
maintainers</span>  : array[string] : a list of ActivityPub accounts who can update a script</span></span></code></pre>

Non-Editable:</li>
</ul>
author</span>           : string : the original author of the script</span></span>
date</span>             : datetime : the date and time the script was last updated</span> (RFC3339)</span></span>
status</span>           : string : the status of the script</span> (pending</span> approval, approved, archived</span>)</span></span>
tootinstall_host</span> : string : the host on which this package has been published</span></span></code></pre>
The Editable parameters are enclosed in +++</code>'s to define separation between the
parameters and the main script.

A tootinstall script</code> should also include a shebang</code> to ensure the script runs
as expected.</p>
TootInstall Binary</a></h3>
A tootinstall binary</code> is a simple portable binary that anyone can download and
run to get TootInstall</code> functionality.</p>
A guideline for usage is as below:</p>
tootinstall</span> [mode] package_name @</span>[</span>tootinstall_host</span>]</span> </span></span>
  modes:</span></span>
    install</span>    -    builds and installs the package as per the script</span></span>
    download</span>   -    downloads a script but does not run it</span></span>
    search</span>     -    searches the tootinstall url for a package name</span></span>
    inspect</span>    -    finds and displays the tootinstall script</span></span>
    </span></span>
  parameters:</span>  </span></span>
    package_name</span>          - Required. the package name to install or</span> </span></span>
                            search</span> or inspect</span></span>
    @[tootinstall</span> host]   - Required. the host on which a tootinstall</span> </span></span>
                            database</span> is running</span></span></code></pre>
It must:</p>

be able to access the internet</li>
be able to search and download tootinstall scripts</code> from multiple tootinstall hosts</code></li>
be able to run the downloaded script</li>
allow the user to inspect the script</li>
</ul>
Verification</a></h3>
The various tootinstall</code> bots and helpers should be configured to do some
basic verification of the script poster.</p>
Good examples of some basic checks are:</p>

does the poster have a bio?</li>
does the poster have an image?</li>
has the poster been active on the fediverse for a reasonable amount of time</li>
has the poster been interacting with people of the fediverse for a reasonable
amount of time?</li>
does the poster have some other people following them?</li>
has the poster ever been boosted and/or favourited by somebody else a few times?</li>
</ul>
Scoring</a></h3>
As a popularity/rating service, we can utilise ActivityPub boosts and favourites
as a scoring platform for tootinstall scripts</code>.</p>

favourite</code> = "I like this" = 1 point</li>
boost</code> = "I want other people to see this" = 1 point</li>
</ul>
A favourite and a boost from one account can give a script 2 points.</p>
Approvals</a></h3>
It would not</strong> be sensible to publish a script immediately after posting as
doing so massively increases the risk of distributing malware.

Instead, it would be wise to implement an approval concept whereby authorised
accounts could authorise a script by replying to the tootinstall bot</code>'s post
with an approval state i.e. "approved" or "denied". A tootinstall bot</code> could
also actively seek out approval from a list of configured accounts, and post the
script privately to them before actually posting the published script.

Secondary to this, we could implement a form of crowdsourced approval whereby if
a script score reaches a certain level, it is automatically approved.</p>
Written by Paul Wilde - 29th July 2024</a></h1>
@paul@notnull.space</a></a></h2>
Final Notes</a></h2>
OK… let's address the elephant in the room. I am very</strong></em> aware this is incredibly
dangerous and you</em> should be very aware this is a parody concept.
Please, everyone, PLEASE, do not implement any of this!! It is just meant as a
humorous thought experiment and is in no way intended to make it to production.</p>


Wholesome Errors
2024-02-02T00:00:00+00:00
Your Friendly Error Code Index
Inspirational instructions for dealing with unhelpful error codes</p>
ERROR</span> -41: Failure!</span></span></code></pre>
Wouldn’t it be great if there was something to tell you what to do about this error?!
Wouldn’t it be great if it said</p>
ERROR</span> -41: Sit by a lake</span></span></code></pre>
instead?</p>


Microsoft Exchange 365 Room Calendar - Subject Replaced by Organizer
2024-01-16T11:09:00+00:00
I recently had a issue logged by a client where a room calendar in Microsoft Exchange 365,
when invited to a meeting, shows the organizer's name in the subject instead of the actual subject.

This may well be a desirable feature, but in the case it isn't, this is how it can be resolved.</p>
</span>
Room calendars are useful for booking meetings which will take place in a room in an office. Normally, the process would be for somebody to have delegate permissions on this calendar, allowing them to enter a calendar entry into this calendar and invite the required attendees. In this case, everything works well - the room shows the event, including subject and content and invited parties can accept to reject the event depending on their availability.</p>
However, sometimes somebody wishes to create an event in their own calendar, and invite the room calendar to that event. In this case, it appears the default option is for the event in the room calendar to have its subject and content replaced by the organisers details. I'm sure this makes sense in some cases, but my client in this case does not find this desirable. Luckily, there is a solution.</p>
Powershell to the rescue!</a></h3>
A single Powershell command can be used to set some options on a calendar to change the way that calendars processing works.

First, connect to Exchange Online:</p>
Connect-ExchangeOnline</span></span></code></pre>
Once connected, you can issue the following command to show the current options for a particular calendar's processing:</p>
Get-CalendarProcessing</span> -</span> Identity </span>"</span>{The Calendar Name}</span>"</span> |</span> fl</span></span></code></pre>
Which should show something like the below:</p>
AutomateProcessing                   : AutoAccept</span></span>
AllowConflicts                       : False</span></span>
AllowDistributionGroup               : True</span></span>
AllowMultipleResources               : True</span></span>
BookingType                          : Standard</span></span>
BookingWindowInDays                  : </span>180</span></span>
MaximumDurationInMinutes             : </span>1440</span></span>
MinimumDurationInMinutes             : </span>0</span></span>
AllowRecurringMeetings               : True</span></span>
EnforceAdjacencyAsOverlap            : False</span></span>
EnforceCapacity                      : False</span></span>
EnforceSchedulingHorizon             : True</span></span>
ScheduleOnlyDuringWorkHours          : False</span></span>
ConflictPercentageAllowed            : </span>0</span></span>
MaximumConflictInstances             : </span>0</span></span>
ForwardRequestsToDelegates           : True</span></span>
DeleteAttachments                    : True</span></span>
DeleteComments                       : True</span></span>
RemovePrivateProperty                : True</span></span>
DeleteSubject                        : True</span></span>
AddOrganizerToSubject                : True</span></span>
DeleteNonCalendarItems               : True</span></span>
TentativePendingApproval             : True</span></span>
EnableResponseDetails                : True</span></span>
OrganizerInfo                        : True</span></span>
ResourceDelegates                    : </span>{</span>**</span>Names of delegates are here</span>**</span>}</span></span>
RequestOutOfPolicy                   : </span>{}</span></span>
AllRequestOutOfPolicy                : False</span></span>
BookInPolicy                         : </span>{}</span></span>
AllBookInPolicy                      : False</span></span>
RequestInPolicy                      : </span>{}</span></span>
AllRequestInPolicy                   : True</span></span>
AddAdditionalResponse                : False</span></span>
AdditionalResponse                   :</span></span>
RemoveOldMeetingMessages             : True</span></span>
AddNewRequestsTentatively            : True</span></span>
ProcessExternalMeetingMessages       : False</span></span>
RemoveForwardedMeetingNotifications  : False</span></span>
AutoRSVPConfiguration                : Microsoft.Exchange.Data.Storage.AutoRSVPConfiguration</span></span>
RemoveCanceledMeetings               : False</span></span>
EnableAutoRelease                    : False</span></span>
PostReservationMaxClaimTimeInMinutes : </span>10</span></span>
MailboxOwnerId                       : Room Calendar Name</span></span>
Identity                             : Room Calendar Name</span></span>
IsValid                              : True</span></span>
ObjectState                          : Changed</span></span></code></pre>
You'll see there are a few options set to "True" which could be toggled - Delete Subject</code>, Delete Comments</code> and Delete Attachments</code> - they should be fairly self explanitory.
You can toggle these options by issuing the following command:</p>
Set-CalendarProcessing</span> -</span>Identity </span>"</span>Room Calendar Name</span>"</span> -</span>DeleteComments </span>$false -</span>DeleteSubject </span>$false -</span>DeleteAttachments </span>$false</span></span></code></pre>
This simply disables those options, so now the subject, comments and attachments will not be deleted when the calendar processes the event.

There is one further options which may, or may not, be helpful to disable - AddOrganizerToSubject</code>. This option adds the organizer's name to the start of the Subject. This may be useful, but my client also wanted this switched off which can be done with the following command (or, indeed, adding the flag to the previous command).</p>
Set-CalendarProcessing</span> -</span>Identity </span>"</span>Room Calendar Name</span>"</span> -</span>AddOrganizerToSubject </span>$false</span></span></code></pre>
And there we are, new events now will appear in the calendar as desired - with full Subject, Comments and Attachments.

Previous entries will not update automatically, the organizer must go into each one and re-send it (no need to change anything, just re-send it and press "Send Anyway") which will update the event in the room calendar as desired.</p>


Gemini.css
2023-02-22T20:57:13+00:00
Gemini.css is an almost</em> classless CSS style for making Gemini-like HTML pages.</p>
For a Gemini.css demonstration, go to geminicss.paulwilde.uk</a>.</p>


Nemini
2023-02-20T12:57:13+00:00
'/nɛmɪnaɪ/' Nem-in-eye</p>
A simple Gemini server</a></h3>
Nemini is a simple Gemini server with static file serving, virtual host and alias support.
"Simple" in the way it is, hopefully, simple to configure and use with minimal knowledge of web servers in general.</p>
</span>
You probably need to be familiar with TOML configuration files, but other than that the server should run fairly easily.</p>
See this page on Nemini : gemini://paulwilde.uk/dev/nemini</a></p>
The source code</a> is hosted at Codeberg.</p>
Features</a></h3>

Will serve static files</li>
Virtual host and alias capability</li>
Headers and Footers can be applied to each page</li>
</ul>
How to run</a></h3>

Copy the config/nemini.sample.toml</code> file to /etc/nemini/nemini.toml</code> nd edit to your liking</li>
Certificates are required</em> so make sure you have those set. They will be automatically created via openssl if they don't exist.</li>
Host your files in your root_dir</code> director/y|ies/</li>
Run the nemini</code> binary</li>
</ul>
Parameters</a></h3>
Passing the --config</code> parameter with a file location will allow the use of a custom config file saved wherever you wish.</p>
Build from source</a></h3>
Install nim and nimble and run the following command:</p>

nimble build</p>
</blockquote>
All nim dependencies will be installed.</p>
Links</a></h3>
Source Code</a>

TOML Config file reference</a></p>


AI Search
2023-02-16T14:40:00+00:00
This is a story all about how

Your query got twist-turned upside down

And I'd like to show an answer just sit right there

It might not be fully accurate but I don't care</p>


Why I have turned off my BirdsiteLIVE instance
2022-12-21T11:36:00+00:00
Hello. How are you? I am fine.



You may know me from a few places, but likely on the Fediverse as the person that
maintains a BirdsiteLIVE instance with the url birdsite.wilde.cloud</a>.</p>
</span>
Why?</a></h2>
Due to the recent influx of people from the corporately owned microblogging platform</em>,
the use of many BirdsiteLIVE instances has become massive.
Added to this, I have received many requests from users to block access to block
their posts from the other place</em> via BirdsiteLIVE - which I have happily done
for them, but some people</em> are do not ask nicely and instead resort to claims
of attacks on their privacy (I know, right‽ it's a clear misunderstanding of
how the internet works...). I've also been witness to some pretty brutal comments made towards BirdsiteLIVE's creator.

I simply don't feel comfortable with this.



Added to this, the instance has become so saturated (over 1000%) that posts
from the other place</em> only turn up sporadically and normally in a flurry that
clutters home timelines.

This really isn't nice to see when you're trying to interact with many other people on the fediverse, only to have a huge block on nonsense posts in the middle of it all.</p>
Offline</a></h2>
So, I've been considering doing this for some time, but as from today, December 21st 2022, my BirdsiteLIVE instance is offline. I may start a new one up at some point in the future but with a new database, no old follows will remain.

I will continue to run my BirdsiteLIVE Instance List</a> which appears to be fairly web search-able to help people out - my original BSL instance URL will now redirect to this site.</p>
What else can I do?</a></h2>
Well, to put it bluntly, forget about the other place</em>. Use of the Fediverse has skyrocketed since the other place</em>'s recent ownership changed. You'll find most of the people you want to see postsby are on the Fediverse already! Who needs content from the other place?</p>
If you do need content from the other place, why not try using something like Nitter</a> or one of it's many instances. You can even put /rss</code> at the end of the URL to get that content as a lovely RSS feed to put into your favorite RSS reader (you are</em> using RSS, right‽).</p>
Sign off</a></h2>
Anyway, if you managed to get this far, thank you. I don't blog normally, but I felt I needed to put some kind of statement up, even if it is poorly written and slightly opinionated. Thanks for reading anyway.</p>


Keyoxide Verification
2022-11-17T11:44:27+00:00
[Verifying my keyoxide cryptographic key: 85633E30514CC1932E4268460ED12CF710BC42CA]</p>


SQL Haiku
2022-10-26T22:40:00+00:00
SELECT</span> haiku </span>FROM</span></span>
tableHaikus </span>WHERE</span> LEFT</span>(</span>name</span>,</span></span>
3</span>) </span>LIKE</span> '</span>SQL</span>'</span>;</span></span></code></pre>


Fortieth
2022-09-24T15:45:22+00:00
'Twas the morning after the fortieth

And all through the house

Not a creature was stirring

Except the one making the coffee and Alkaseltzer</p>
'Twas the morning after the morning after the fortieth

And all through the house

The creatures were starting to stir but generally still uncomfortable and underperforming</p>
'Twas the morning after the morning after the morning after the fortieth

And all through the house

The creatures were stirring

Even the mouse!

It scurried up the staircase

Squeaking the old well known phrase

"Warning! Duration of hangover is proportionate to age!"</p>


wm_tools
2022-05-08T16:25:13+01:00
A selection of information output tools for dmenu</a></h1>
These are a selection of independant tools for displaying various information
about system status in dmenu. Some of them i.e. volume</code> have options (up, down, mute...)
which are selectable options in dmenu.</p>
</span>Tools</a></h2>

pingclock</code>        performs a single ping</code> to a server and returns the response time</li>
battery</code>          shows the current battery level</li>
brightness</code>       shows the current backlight level and gives options to adjust it</li>
volume</code>           shows the current volume level and gives options to adjust and manage it</li>
date</code>             shows the date</li>
fuzzytime</code>        shows the fuzzytime clock</li>
wlan</code>             shows the state of the wireless network interface. SSID connected to and signal level.</li>
nic</code>              shows the status and/or the ip address of the network interface card</li>
temperature</code>      shows the current CPU temperature</li>
notes</code>            a simple one liner note taking tool, displaying notes in dmenu</code>/rofi</code></li>
</ul>
The next two do not work with rofi</code> unless you have alias dmenu=rofi</code> set, but they're pretty nice tools</p>

passmenu_wrapper</code> a wrapper for passmenu. It basically just styles passmenu</code> with no other features</li>
command_wrapper</code>  inspired by passmenu_wrapper, a basic tool to run other dmenu</code> related tools with uniform styling.

For example: dmenu_run</code>, clipmenu</code>, passmenu</code> etc.</li>
</ul>
</li>
</ul>
Example in dmenu</code>:</a></h3>
</p>
Example of command_wrapper</code> with clipmenu</code></a></h3>
</p>
How to compile</a></h2>
There are some configuration variables explicit to me, you'll need to change them for you for them to be useful I imagine.

Configuration variables are compile - there are no config files or runtime parameters (except for "rofi")</p>
Each tool is compiled separately, for example:</p>
nim</span> c pingclock</span></span></code></pre>
and then run with</p>
./pingclock</span> </span></span>
# or</span></span>
./pingclock</span> rofi</span></span></code></pre>How to use</a></h2>
Personally, I have these bound to key combinations in i3.
In fact, I have a seperate bindsym</code> mode in which all these
tools are accessible i.e. $mod+i</code> to get to "info" mode then p</code> to show pingclock.

It's completely up to you how to run them, they're just simple CLI tools really.</p>
You can also set the volume and brightness levels by typing a numeric figure into the dmenu/rofi input box</a></h3>
Dependencies</a></h2>

dmenu</code> or rofi</code></li>
yad</code> for calendar</li>
passmenu</code> for passmenu_wrapper</li>
basically any tool that's used to gather the information.</li>
"tools" for audio etc. (pamixer</code>, ncpamixer</code>, etc.) can be set in the source</li>
</ul>


thisisnotmy.email
2021-11-13T16:17:59+00:00
I run the thisisnotmy.email</a> email service.</p>
What's it all about?</a></h2>
Don’t you hate it when people, businesses, random telephone callers, etc. ask you for your email address out of the blue under the ruse of “providing you a better service”?
It's early days but I'm hoping to be able to offer something</em> for people to
use eventually.</p>
</span>
Wouldn’t it be great to confidently give them your email address, but with a slight passive aggressiveness to make the situation more awkward for them, and less awkward for you‽</p>
Enter thisisnotmy.email. thisisnotmy.email is a fully functional email service. When someone asks you for your email address, just say:</p>

“Sure, it’s my name at this is not my, all one word, dot email”</p>
</blockquote>
And let them decide whether it’s worth continuing on with this worthless data collecting routine.</p>


Peanut Butter Recipe
2021-11-13T14:15:22+00:00
This is the easiest thing in the world.</p>

Dry-fry (no oil etc.) the peanuts in the large frying pan for about 10 mins or for as long as it takes for the peanuts to become golden brown.

This will encourage the oils in the peanuts to release - which is exactly what we want!</li>
</ul>
</li>
Put the now-roasted peanuts into the blender and blend.

Blend, blend, blend and blend some more.</li>
There will be a point when you think nothing's happening and the small bits of peanut are just moving around the blender, or just stuck in place. Give the stuck pieces a nudge with a spatula and get back to blending.</li>
Blend, blend, blend even more until, eventually, the mixture starts to bind together and turn into a thick solid mass.</li>
Keep blending and the mixture will loosen up become a lovely, smooth, peanut butter.</li>
</ul>
</li>
Spoon out into a suitable container and allow to cool (or just eat it there and then, I won't judge you).</li>
</ol>
Top Tips  =</p>

If you prefer a chunky peanut butter, save some of the roasted peanuts back and only put them into the blended mixture at the end with a bit of a stir - lovely!</li>
</ul>


I Use …
2021-08-17T11:04:14+01:00
In the interest of sharing interesting information, I thought I'd create this page to list some of my favourite software packages and tools.

This list is by no means complete as, if you're like me you'll understand, I use hundreds of software packages.</p>
For PC/Laptop :</p>

Operating System

Arch Linux</a></li>
FreeBSD</a></li>
river</a> (Wayland)</li>
bspwm</a> (Xorg)</li>
</ul>
</span>

sxhkd</a> (Xorg)</li>
rofi</a></li>
dunst</a></li>
alacritty</a></li>
zsh</a></li>
some of my own WM tools</a></li>
</ul>
</li>
Web browsers

LibreWolf</a></li>
qutebrowser</a></li>
Vivaldi Browser</a></li>
</ul>
</li>
Productivity

Thunderbird</a></li>
LibreOffice</a></li>
Cryptpad</a></li>
Neovim</a></li>
</ul>
</li>
Chat Software

XMPP</a></li>
ejabberd</a></li>
Slidge</a></li>
Gajim</a></li>
</ul>
</li>
Programming Languages

Nim</a></li>
GoLang</a></li>
Python</a></li>
Rust</a></li>
</ul>
</li>
Theming/Colourschemes

Gruvbox</a></li>
Catppuccin</a></li>
</ul>
</li>
</ul>
For Servers :</p>

Operating Systems

FreeBSD</a></li>
Debian</a></li>
</ul>
</li>
Services

BastilleBSD</a></li>
Podman</a></li>
eFA</a></li>
Zola</a></li>
MailScanner</a></li>
MailWatch</a></li>
Dovecot</a></li>
Postfix</a></li>
WildDuck</a></li>
HAProxy</a></li>
nginx</a></li>
MailAutoConf</a></li>
</ul>
</li>
</ul>
If I have missed anyone out, I apologise!</p>


Mailautoconf
2021-08-17T10:49:13+01:00
A simple, configurable autodiscover/autoconfig service for distributed and self-hosted services.</a></h3>
What is MailAutoConf?</a></h3>
MailAutoConf is autodiscover/autoconfig web server for self-hosted mail services
which do not have their own autodiscover service.</p>
</span>What does MailAutoConf do?</a></h3>
MailAutoConf is currently in very</em> early stages, but it does generate valid
autoconfig XML files (/mail/config-v1.1.xml</code>) compatible with many mail clients
i.e. Thunderbird</code>, Evolution</code>, etc.

Theoretically, anything that can read the standard autoconfig XML file -
https://wiki.mozilla.org/Thunderbird:Autoconfiguration:ConfigFileFormat</code>, should
be able to auto-configure using this service.</p>
Installation</a></h3>
MailAutoConf runs its own webserver on port 8010</code>.
You will need to supply a volume for the configuration file and port forwarding.</p>
podman</span> run -dt</span> \</span></span>
  --name mailautoconf</span> \</span></span>
  -v ./config:/mailautoconf/config</span> \</span></span>
  -p 8010:8010</span> \</span></span>
  pswilde/mailautoconf</span></span></code></pre>
You will need a reverse proxy server to publish to the outside world and handle SSL encryption.

For example, in nginx:</p>
server {</span></span>
  listen                443 ssl;</span></span>
  server_name           autoconfig.example.com;</span></span>
  ssl_certificate       /path/to/certificate.file;</span></span>
  ssl_certificate_key   /path/to/certificate.key</span></span>
  location / {</span></span>
    proxy_set_header    X-Forwarded-Host $host:$server_port;</span></span>
    proxy_set_header    X-Forwarded-Server $host;</span></span>
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;</span></span>
    proxy_pass          http://localhost:8010/;</span></span>
    proxy_redirect      http://localhsot:8010/ /;</span></span>
    proxy_read_timeout  60s;</span></span>
  }</span></span>
}</span></span></code></pre>
First run will create sample.yaml</code> files in the config directory. Copy these to config.yaml</code> and services.yaml</code> and configure them to your needs.</p>
MailAutoConf will handle all the URLs it's able to deal with, i.e. /mail/config-v1.1.xml</code>, /Autodiscover/Autodiscover.xml</code> automatically.</p>
DNS config</a></h3>
You will need to configure DNS records for your domain.

I would recommend setting up an A record for autoconfig.your.domain</code> to point
directly to your MailAutoConf's instance which will work for Thunderbird and
Evolution clients.
Then, if Outlook Autodiscover is required (currently not implemented), configure
a SRV</code> record to redirect to the autoconfig.your.domain</code> A</code> record. i.e.</p>
Type                                TTL  P  M  Port Target</span></span>
SRV _autodiscover._tcp.your.domain  3600 10 10 443  autoconfig.your.domain</span></span></code></pre>Compatibility</a></h3>
MailAutoConf has been tested and confirmed working with the following software packages</p>


Thunderbird (v78 and probably earlier versions too)</li>

Evolution Mail (v3.40.3 and probably earlier versions too)</li>

Nextcloud Mail app</li>

Other Mail Clients are likely supported if they support /mail/config-v1.1.xml</li>
</ul>
Future plans</a></h3>
MailAutoConf is currently in very</em> early stages, with a very</em> limited set of features.
My hope for MailAutoConf is to run as an autoconfig service which provides Calendar and AddressBook locations as well.
Calendar and AddressBook is in the autoconfig XML documentation, but currently not implemented. MailAutoConf can generate the correct information for Calendar and AddressBook into the autoconfig XML file, though no clients currently use it.</p>
TODO:</a></h3>


/mail/config-v1.1.xml file for Thunderbird and Evolution mail clients.</li>

Add more code commenting, it's pretty terrible right now.</li>

Refactor the autoconfig and autodiscover XML files, they've been copied and bodged together and could look so much better.</li>

Autodiscover.xml for Outlook clients - currently does generate, but untested.</li>

Autodiscover.json for more modern Outlook clients - this is currently undocumented. I have implemented some features of it but it is currently not working.</li>

Calendars and Address Book - does generate into mail/config-v1.1.xml, but no actual clients support it yet.</li>

Additional, custom services. For example, Nextcloud - instead of having to type in your Nextcloud instance URL, you can just enter your email address associated with you Nextcloud account and it looks up the URL from autoconfig - wouldn't that be nice?</li>

Probably loads of stuff I haven't thought of yet.</li>
</ul>
When will it be ready for production?</a></h3>
Well, not yet. Though it does sort of work already.

I'm working on this ultimately for my own use for my own small business. I'm hoping once it's good enough I could deploy the set up to my businesses customers and ultimately get them away from a Microsoft Exchange based environment. There's a long way to go for that right now though.</p>
If you feel you may be able to help, or ideas on features and their implementation, notice any bugs, or just want to say hi. Please do so and submit a pull request if required.</p>
Thanks for reading!</p>


St Skeletor's Day
2021-08-03T16:53:20+01:00
St Skeletor's Day

February 15th

Every Year</p>


Ross Rates
2021-04-06T21:12:57+01:00
Rate Stuff with Ross, quite simple.</p>


Basic Dough Recipe
2021-04-01T11:41:38+01:00
If you have a bread maker:</p>

add the water, salt, sugar, herbs, oil, flour and yeast/sourdough starter
IN THAT ORDER</strong> to the bread maker's container.

You must</em> add them in that order, or at least water first else the
mixture will not mix correctly.</li>
</ul>
</li>
set the bread maker to its "dough" setting and set it going - job done!

(P.S. you can just use this same recipe as a regular bread too - just set the
bread maker to the regular "bread" mode)</li>
At this point I normally transfer the dough to a suitable container and
cover it to let it rise.</li>
</ol>
Without a bread maker:</p>

add the flour, salt, sugar, herbs and yeast/sourdough starter to the
large mixing bowl and dry mix them all together.</li>
form a well in the middle of the flour mixture and slowly pour in the
water bit by bit, mixing the flour mixture into the water as you go</li>
continue to mix the flour and water mixture, you're going to need to use
your hands, but give it a good mix until everything is mixed together well.

you want the dough to still be a bit wet, so if it's dry, add a bit more
water</li>
</ul>
</li>
dust the large chopping board with flour and turn out the wet-ish dough
ball onto the board.</li>
Knead the dough, a lot!</em> Just keep kneading, adding more flour if
necessary.

As you knead you'll noticed the dough ball become more smooth and
springy, but it will also feel "stronger"</li>
</ul>
</li>
Once the ball is nice and firm, but still springy, place it into a suitable
container and cover to let it rise.</li>
</ol>
After a few hours of rising time (longer if you're using sourdough starter)
your dough will, hopefully, have risen enormously. You can now use it.
I'll be adding recipes for pizzas</a>, naans</a> and other
things that use this dough here, eventually.</p>


Unphonetic ABC
2021-04-01T11:05:46+01:00
A website directory of all words that can be associated with their letters by not</em>
sounding as their corresponding letter should do.</p>


Bedford & Co
2021-04-01T10:54:15+01:00
Simple single page website for a local accountancy business.
Has additional Vue.js implementation for news and exchange rates updates.</p>


Wilde IT
2021-04-01T10:47:49+01:00
A local IT business website detailing available services.
Our business website.</p>


The Lost Tin Opener Society
2021-03-31T22:20:31+01:00
A spoof single page animation website of a secret society dedicated to finding all
lost tin openers.</p>


Noisy Faces
2021-03-31T17:22:16+01:00
Just a very silly website with an animated face making sounds.

Yeah, just that really. (The image is not</em> me)</p>


The Geese Webpage
2021-03-31T10:05:31+01:00
Starting life as a (sort of inappropriate) parody of a certain popular dating website
the geese website was made as a bit of fun and to please minor obsession with geese.</p>


About Me
2021-03-29T10:19:20+01:00
Hello,

This is my website which will contain my general thoughts, utterings,
maybe my opinions, possibly some tech stuff I find interesting, some of the
recipes I cook and want to remember the ingredients of and a bit of artwork I
draw for fun and I in no way claim to be a good artist in any way.</p>
Some things about me. I :</a></h3>

am an IT Professional.

I run my own IT Business</a> that provides IT consulting, assistance and procurement services to local businesses (Devon, South West UK).</li>
</ul>
</li>
am an Open Source advocate/evangelist.

I try to use Open Source products in my personal and working life as often as possible.</li>
</ul>
</li>
am data privacy conscious.

I believe we shouldn't pay for products or services with our personal data and "marketability"</li>
I don't use the mainstream social media services. You shouldn't either.</li>
</ul>
</li>
use Arch Linux</a> btw …</li>
</ul>
Some information about this site. It :</a></h3>

was created using Zola</a></li>
is built with efficiency in mind; It's small and light and quick to view.</li>
uses no JavaScript (except a little bit for Plausible Analytics</a>, forgive me).</li>
runs on an Caddy</a> server on top of a Rocky Linux</a> VPS provided by OVH</a>.</li>
was written using the Neovim</a> text editor on a PC Specialist</a> laptop running Arch Linux</a></li>
</ul>
Paul's Site of Stuff

What's the Deal with Calendar Categories?

Questions</a></h2> So, to offer this up to the world for responses to help me understand and plan a reasonable replacement system:</p> How do you set up and manage your calendars where multiple colours for different event types are required? Categories or different calendars?</p> </blockquote>

Don't Connect Contact Forms to Email Accounts!

XMPP <-> WhatsApp with eJabberD and Slidge

Making an Automated, Operational Hydro-Electric Dam in Luanti

Setting Up Anubis on FreeBSD

My Battle with Netcup, IPv6 and FreeBSD combination

Joining Debian Linux (Desktop) to an Active Directory Domain

Accused of Hacking

Norg Backup Utility

Command line parameters</a></h3> -c</code>, --config</code>: The configuration file to use</li> -r</code>, --repository</code>: The repository to work on</li> -a</code>, --archive</code>: The Archive to operate on (snapshots for restic)</li>

BatMon

Requirements</a></h2> Run Requirements</a></h3> apm</code></li>

Run Requirements</a></h3> apm</code></li>

Build Requirements</a></h3> nim</code></li>

TootInstall

Wholesome Errors

Microsoft Exchange 365 Room Calendar - Subject Replaced by Organizer

Gemini.css

Nemini

Features</a></h3> Will serve static files</li> Virtual host and alias capability</li>

Build from source</a></h3> Install nim and nimble and run the following command:</p> nimble build</p> </blockquote> All nim dependencies will be installed.</p>

AI Search

Why I have turned off my BirdsiteLIVE instance

`Build from source</a></h3> Install nim and nimble and run the following command:</p> nimble build</p> </blockquote> All nim dependencies will be installed.</p> Links</a></h3> Source Code</a> TOML Config file reference</a></p>`
