Huy Nguyen - I do things and sometimes I blog about it

Favorite Thangs in 2025

Wed, 24 Dec 2025 16:53:17 -0600

Intro #

This year has been absolutely a joke for America and not in a good way. So while this country continues to crash out, there’s been some good things I’ve enjoyed this year. Let’s get started!

Favorite Movies I watched #

Weapons (2025) #

One of my favorite horror movies of this year, not specifically because it was scary, but it played with some interesting ideas and that ending sequence, so good.

Sinners (2025) #

This was a fantastic horror movie staring Michael B. Jordan. I really love the idea of a period piece taking place in the south and dealing with Vampires. It combined a lot of interesting ideas in this one.

M3GAN 2.0 (2025) #

While the first movie was a “horror” movie, this one was anything but that. It was however a ridiculous movie that knew exactly what it was doing playing of the ridiculousness of the first one.

Superman (2025) #

This was an amazing super hero movie, we got a very boy scout Superman in this, which is great. The Justice Gang was amazing, loved the casting there. Oh and we cannot talk enough about how good of a boy Krypto was.

Thunderbolts* (2025) #

In terms of favorite Super Hero movie of the year, it has to be Thunderbolts. This one hit all the notes for me, comedy, action, and real underlying story of depression and grief. This was definitely 🧑🏽‍🍳😘

Beginners (2010) #

I re-watched this movie this year and I’m still enamored about this movie. It’s such a good story about allowing one’s self to open up to the opportunity of something. Ewan McGregor who plays the main character, is depicted as this kinda depressed, quirky, plain human and how he tells the story of the events unfolding is lovely. The subplot about the late stage life of his father is just fantastic. If you’re a quirky kinda romantic, I think this is a good one to watch.

Babyteeth (2020) #

I knew this was gonna be a kinda depressing watch, I’ve had this movie on my list for a while and only this year did I get around to it. I don’t want to give much away about it, but it deals with a young girl’s late stage cancer and how she is dealing with it. As much as it was about Eliza Scanlen’s character, Milla, the story told of the parents dealing with the inevitable loss of their child was so great. The ending scenes in this movie really got me.

The Friend (2024) #

I like a lot of weird little movies that Bill Murray is in, but this one staring Naomi Watts was so good. The main challenge was that Naomi’s character, Iris has to deal with wishes of her dear departed friend and take care of this old Great Dane. Having lost my dog in recent years, it really got to me.

Favorite Shows I watched #

I watched a lot of shows this year, so I’ve tried to keep this list tidy. Here we go!

The Residence #

Staring Uzo Aduba as Cordelia Cupp, this detective murder mystery series was amazing. I loved everything about it, the quirkiness of the characters, the mystery of the murder, it was just great. I really wished people enjoyed it more to get a second season.

Alien: Earth #

First ever Alien franchise television series, yes please. While there was a lot to accept about this story, android children and taking place on Earth being some of the least desirable plot points to me, what they did really well was the inclusion of so many weird extraterrestrial species and I mean eyeball alien is definitely my new favorite.

The Studio #

Seth Rogen’s comedy satire about hollywood was an amazing rollercoaster ride of a show, each episode was absolutely insane.

Normal People (2020) #

I’ve heard high praises about this romance series, so I finally got around to checking it. I have to say that I really enjoyed the long drawn romance taking place over the course of high school to uni to after. I liked the complexity of the 2 main characters, Connell and Marianne, they’re also very Neurodivergent coded.

Star Trek: Discovery #

So I got on a Star Trek kick this year and watched all of Discovery and then later Strange New Worlds. I really really enjoyed the characters and world building they did in Discovery. What’s great about Star Trek as a “space” franchise is that it’s always more so focused on hope and the possibility of adventure as opposed to Star Wars being more focused on battle and attrition. You can’t help but watch an episode and be wowed.

Star Trek: Strange New Worlds #

For as great as Discovery is, I think Strange New Worlds is my particular jam. Seeing a young Spock nail the weirdness/struggle of his character is amazing. As always each character on the series is just fantastic, top notch.

King of the Hill (Old + Revival) #

When I heard that King of the Hill was getting a revival and picking up several years after the series ended. I had to go back and re-watch all of it all. The old series still holds up. The new season was amazing, they really aged the characters in terms of progression and character development really well. The voice actor shuffling wasn’t bad, I understand why the did and don’t have any issues there. I really enjoyed how Bobby went from this kinda unsure of himself and sometimes cocky kid to this stressed out adult trying to build something he can be proud of and living life. I can’t wait to see what they do for another new season and who they can bring back.

Honorable Mentions #

There were some great second and final seasons this year that I had to drop a mention below!

Silo (Season 2)
Severance (Season 2)
Platonic (Season 2)
Peacemakere (Season 2)
Resident Alien (Season 4)

Favorite Video Games I Played #

Death Stranding 2 #

The second and maybe final entry into this crazy game by Kojima. I have to say it’s just as weird and awesome as the first game.

Dispatch #

It’s been a long while since I played a game like the Telltale ones, but this Super Hero one really intrigued me. Loved how quirky, inappropriate and funny this game was. The whole dispatching super hero game mechanic really scratched that resource management itch.

Clair Obscur: Expedition 33 (Currently playing) #

I’m currently still playing this one, but wow the beginning of this game really set the tone. I can’t wait to finish this. The only thing I really dislike, is the whole dodge/parry mechanic during turn based combat.

Favorite Things I read #

This year I read a few different mediums, but only a handful of them I would call my favorite, so I’m combining comics, manga and novels this year.

After God (Manga) #

It’s kinda hard to describe this one, it’s playing around with a lot of interesting concepts about these all powerful god like beings who exist in Japan and have devastated the land.

Hirayasumi (Manga) #

This slice of life manga about a burnt out individual and his cousin living a simple life. It’s got a kind of summer cozy relaxing feel to the story.

Tokyo Alien Bros (Manga) #

This was a lovely combination of weird + slice of life. Super short 3 volume series, totally worth a read.

Sex Criminals (Comic) #

Obviously this comic deals with adult themes, but in terms of a premise it was interesting. While the adults are there to drive a plot, what I really enjoyed was the two main characters and how they grew throughout the series.

Silo Series (Novel) #

The second season of Silo was so good when I found out it was based on a set of books (Wool / Shift / Dust), I knew I had to read them to get my fix. The first and second books are definitely my favorites in the series, the third book that wraps everything up is good, but definitely my least favorite of the 3.

Favorite Anime I watched #

Tojima Wants to Be a Kamen Rider #

This is hands down my favorite Anime of this year. It’s extremely meta crafting a story in a fictional world that grew up with the Kamen Rider franchise, so you have these fanatic who’s main thing is that they aspire to be like their idol Kamen Riders. All while finding out that their world actually has the alien enemies from the show. So now these adults who worshiped Kamen Rider can now live out their power fantasy of becoming a Kamen Rider and defeating evil. The music and power ups and fights goes so hard in this Anime. Also the fact that the main character is in his thirties is also a plus, it’s kinda refreshing to watch anime of age appropriate people to yourself.

Yowamushi Pedal #

I re-watch this anime from time to time and this year, its just one of those wholesome sports anime that makes you want to get out there and do something.

My Hero Academia (Series Finale) #

The manga finished publication last year so the anime was finally wrapping up this year. Seeing the action scenes animated from the manga was something amazing. My Hero gets kinda a bad wrap because of the fanbase or because it’s a typical Shonen, but it hits all the notes for me.

Favorite Items I own #

Pixel Fold #

This year I had an international trip and so digital privacy was top of mind for me leaving the country AND re-entrying the country. I decided to buy a separate phone for travel and wanted to try out these foldables. However, no way was I ever gonna pay retail price for these things, it’s just way too pricey, but a used one on ebay, definitely worth a chance. The OG Pixel Fold is a fantastic device, while I did mostly used it like a regular slab phone, it was nice opening it up to read comics, browse websites or watching youtube. It’s really made me consider getting a Pixel 10 Fold as a daily driver.

Single Speed Bike (Build) #

After Watching Yowamushi Pedal, I got the itch to start riding a bike again this year. I had a old road bike from college that was long in the tooth, so I go the bright idea to build a bike this year. There is just something incredible about building something and using it, the level of satisfactions you get is indescribable. So much so that I have another bike build planed for 2026.

Ikea Donut Lamp #

Orange is my favorite color and this thing is weird and whimsical for me. No notes, 10/10.

Favorite Youtube Channels of the year #

I’ve watched a lot of Youtube this year, but in terms of favorite channels, there weren’t too many that I was really excited to see that was new.

Cut Transform Glue #

I’ve been on a maker kick this year, and I’ve really come to enjoy this particular channel for turning found items/parts into really amazing robots, vehicles, etc.

Awkward Virgo TV #

This channel created a web comedy series this year called The Comic Shop. It was such a fun nerdtastic comedy. Highly recommend checking it out.

Caroline Winkler #

Primarily she makes videos about home decor and this year has been a big journey for her and her betrothed partner as they’ve moved into a 1900 old victorian home and her journey to decorate it. It’s fun and interesting to watch and I’m getting design tips for a home I’ll probably never afford.

Colleen’s Manga Recs #

Colleen makes videos essay about shoujo manga. While I am not the demographic for shoujo manga, it is interesting to learn about and a good way to broaden my horizon in terms of manga. Colleen’s love of Chihayafuru is what prompted me to read it last year.

Rachel Maksy #

She’s a maker of all things whimsy. I’ve really enjoyed watching her make interesting costumes, cosplay, props and even sets. It’s really pulls at the nerdy fun heart strings.

Close out #

I did not do as much blogging as I would have liked this year, but here’s hoping that I’ll be it a new resolution that I can actually stick to… No promises however. While this year has been an absolute nightmare in the US, to the point I don’t think we can really even recover, let’s not end it on a complete failure of a note.

Be kind to your neighbors, be kind to yourself, happy holidays and hope in 2026 we can slowly rebuild.

Setting up a Fresh Worktop

Fri, 19 Sep 2025 18:47:45 -0500

Unlike most people who seem to work in Tech and have Tech blogs and/or a presence online, I work specifically in a Technical Support Role, so I don’t need a lot of fancy things to write code or do my job specifically. But I do have specific workflows and apps that I use on a frequent basis to help me communicate to customers, replicate issues, review configuration and logs as well as knowledge management. Over the years the stuff I’ve added and configured has sort of gotten away from me so I’ve been delaying a work machine replacement for a long time now. But enough is enough and it’s time to get things in order so that I can get going from 0.

Essential Apps #

It’s been a few years since I had to sort of start fresh, so I wanted to see if there’s new apps to swap out for and turns out there was. At work I use a Mac and at home I use Linux, so I’ve tried to mirror as much of my essential apps as I can, but there are just a few apps that are specific to Mac that I need.

I was using Alfred as my App Launcher, Spectacle pretty heavily for window movement and using the default MacOS Workspaces for virtual desktops as I primarily only worked off the single screen on the laptop. I know, I know, that’s probably weird as most people are gonna have at least a 2 monitor setup for work. It helps me to keep things compartmentalize and makes it easier for me to work from the desk, couch or coffee shop if I want to move around.

While I’m still using Workspaces as my main virtual desktop, I’ve moved away from Spectacle and started using Raycast. Raycast is like a Applauncher on crack, it also has Window Management and an awesome plug-able extensions store. There’s also a text expander feature that I’m using for stuff that I type over and over everyday, like greetings, signatures, etc. Raycast is now replacing 2 apps for me and opening a door to new possibilities, I can’t wait to check out what else is in the extensions store.

I’ve been using SublimeText now for reviewing configuration files, small log files and typing scratch notes as I investigate application issues. My favorite feature is the little mini map as I’m a visual person and being able to see the shape of a log file really helps to take notice of things that you can easily miss if you’re only grepping for ERRORs. It also has a pretty sweet plugin system as well, which was extremely useful before I swapped to Obsidian for Knowledge Management.

Of course I’ve been using Obsidian for quite a while now as it’s been the ultimate tool for Knowledge Management, Meeting Notes, Investigation notes, etc. Using Templater has really opened up automating a lot of my workflows here and I can’t imagine going back to simple text editors.

In terms of the Terminal Emulator, I’m still using a Single Alacritty Window with Tmux for multi-terminal spaces and sessions. Sometimes I have to try and replicate a customer issue or bug and Tmux makes it easy to move around.

Dotfiles #

For the most part my dotfiles are nearly identical to my personal dotfiles except for a private sub repo that I’m using to include work specific configurations that differ from my personal ones. There’s also a mac specific initialization script for homebrew apps that I need installed.

Email Challenges

Tue, 04 Mar 2025 14:13:15 -0600

So recently I decided to tackle learning a bit about Email as I needed to troubleshoot why emails from my custom domain were failing to send and why I was getting phishing emails routed through by my custom domain. I’ll admit, I have very little knowledge in the area of Emails. I originally had a setup for years that kinda just worked without issue, this was when G Suite was free. But now I really needed to tackle this.

The Problem #

I started noticing emails arriving in my inbox that tried to look weirdly legitimate. For example the above email which I manually flagged for spam was mailed by my custom domain.

How do I know the email was a phishing attempt? For 1, my name’s not Joel. 2, If you check things like the phone number to customer service there, it shows up as a suspicious Paypal scammer number.

I later found out that emails I was sending was getting flag for spam as well. So I needed to fix my setup and do some research.

The Setup #

So how this works is that my custom domain which is hosted by Cloudflare, is configured to forward emails from my custom domain to a gmail account. That works without issue, because Cloudflare has you verify the destination email address before it’ll send it there. This covered receiving email for my custom domain, which is really what I need it for.

Now sending email as my custom domain is not something I do frequently, but I do have a need to be able to legitimately do so. I had originally configured Gmail to send mail as this custom domain, via the Send mail as configuration under the Accounts and Import settings within Gmail. Originally I was using Gmail’s smtp servers to send mail. Unfortunately when inspecting email sent by my custom domain, it was failing DKIM and DMARC.

Terminology #

Alright let’s go over some terminology so before going any further.

SPF - Sender Policy Framework DKIM - Domain Keys Identified Mail DMARC - Domain Based Message Authentication Reporting and Conformance

SPF #

Sender Policy Framework is a way to list or identify the approved domains/IPs which can send emails from. This is configured as a TXT DNS Record for your custom domain. So this allows mail servers to verify if the email should come from an expected IP(s). This is simple enough to setup through Cloudflare and I’ve included both Cloudflare’s spf records as well as Gmail’s spf records.

Below is what you typically see mentioned online.

v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all

DKIM #

Domain Keys Identified Mail, is a way to use Public Key Cryptography to verify that the email is actually sent from an approved sender. So when email is sent, it’ll contain a header that signs the email using a Private Key, then mail servers receiving the email can look up the public key via another DNS record to validate that the mail is legitimate. The problem here with my setup is that the way that I had configured Send mail as in Gmail doesn’t actually sign my emails with DKIM because the free Gmail Account doesn’t offer this with smtp.gmail.com I believe this worked fine when I had a free G Suite account.

This is configured as a TXT DNS Record who’s key is typically xxxx._domainkey or something like that. Now you unfortunately cannot just add some random thing here, because you need an actual mail server to hold the Private Key, so that you can specify the Public key in this DNS record.

DMARC #

Domain Based Message Authentication Reporting and Conformance, this is basically a rule/policy/instruction for mail servers on how to handle email received by your domain. This is configured as a TXT DNS record with the key _dmarc, which the mail servers can lookup.

For example the contents of a _dmarc record might look like

v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:xxxx@example.com; ruf=mailto:xxxx@example.com

The v specifies the version, the p specifies the policy, which accepts, reject which will reject the email, quarantine which will accept it but send it to Spam, and finally none which will take no action.

The sp is the sub domain policy, which follows the same options. There’s also an additional default configuration here pct which defaults to a value of 100 the pct configuration marks the percentage of failed DMARC email to apply the policy to. 100 being all email vs say 75 would mean 75 percent of failed DMARC emails would have the policy specified applied, so if you set the policy to be rejected, then 75 percentage of failed DMARC email would be rejected.

The email addresses here are used for configuring DMARC reports, the rua which indicates Aggregate reports and the ruf which indicates Forensic reports. These get periodically sent to those mailto:xxx@example.com addresses. This can be helpful for periodic review, but we’ll see if it’s extremely useful or another alert to ignore.

Originally I had my policy set to p=none but unfortunately that was not a solution for passing DMARC with Gmail.

If you want to learn more? Check out Cloudflare’s excellent article on it here

Tools are Cool #

In my research, I stumbled across a pretty cool website tool called www.learndmarc.com This was an interactive way to understand how SPF, DKIM, and DMARC were passing or failing. This was nicer than just looking at the email headers and trying to make sense of the gibberish.

To get started you’d send an email to the email address that the tool tells you to. Once it receives your email, it’ll go through how it identifies it’s legitimacy and even breaks down the DMARC policy you may have configured.

In my testing SPF was succeeding because it was being sent out by Google’s smtp server, but DKIM was failing, which ultimately resulted in DMARC failing. DKIM failed because the sender domain differ from the custom domain. This is due to me sending emails through Gmail’s smtp server, because it doesn’t sign the email with a Private Key for DKIM.

The Solution #

So clearly my main issue here is that while SPF can succeed, DKIM wasn’t configured and my DMARC configuration would essentially fail if the policy I configured told it to quarantine email (e.g. send to spam). So it was pretty clear from the report that I needed to configure DKIM and that out of the box Free gmail didn’t offer this so I couldn’t configure my DNS records for DKIM. I could only configure SPF and DMARC policies.

What I needed was a SMTP server that I could send mail through that would sign it with a Private Key. For my use case I don’t really need to send a ton of emails, nor do I need a bunch of email addresses, so I don’t want to pay $7 USD a month for the lowest tier offering with Google Workspace.

What I ended up finding for a solution was SMTP2GO which provided a Free Plan (without credit card) that would allow up to 1000 emails sent a month and up to 200 emails a day. This was perfect for my low use case needs, cause who doesn’t love free-ninty-free?

Setup was extremely easy, they provided me with all the DNS record configuration that I needed to make on Cloudflare, the only trouble I ran into was that I initially created the DNS records with the proxy status enabled, which did not correctly resolve the specific smtp2go endpoints. Once that was fixed, the verification process succeeded.

I then created my accounts for their smtp server. Went back into gmail and configured my Send mail as with the new smtp server from smtp2go’s documentation. Finally I was ready to re-test with learndmarc.com which now passed DKIM and ultimately passed DMARC, policy. I can now actually configure the DMARC policy to correctly quarantine or reject failed mail.

Not bad for a few hours worth of research, this has certainly been a long time coming and I’m glad I was able to learn something new and fix a problem. Hopefully you’ve learned something new as well.

Ebay Access Denied Issue

Wed, 05 Feb 2025 22:23:29 -0600

For the longest time, I would encounter a strange “Access Denied” message sometimes when browsing Ebay. Which ends up locking me from using the site for a small period of time, sometimes even using a new browser wouldn’t work either.

Access Denied #

You don't have permission to access "http://www.ebay.com/sch/i.html?" on this server.

Reference #18.1c043517.1738815757.f4abf3b1

https://errors.edgesuite.net/18.1c043517.1738815757.f4abf3b1

Eventually I’d get fed up and try searching the internet for an answer only to never find anything from the usual places, Duckduckgo, Google, even Reddit.

That is until tonight when I decided to try my luck again. Low and behold I found this incredible Reddit thread.

Apparently this whole time the issue was due to a browser plugin that I use often, which is HoverZoom+ I’ve been using this handy plugin for years to load images so that I didn’t have to click into a image link or post, but never knew it was the cause of the issue. I had always thought it might have been an ad blocker extension or something related to my pfBlockerNG settings in my Router.

Looking at the HoverZoom+ Github Issues, it indeed looks like someone reported it as an issue as of last year without resolution.

So for now I’m happy enough to just disable the Browser extension when browsing Ebay and making this blog post to hopefully help someone else out there that might be running into this issue.

Case Closed.

Hello 2025!

Wed, 01 Jan 2025 11:46:15 -0600

Starting off 2025 with a small but major update to this blog. I’ve spent the past few days working on some needed maintenance for the theme and how this blog is deployed and figured I’d capture this information in the first blog post of the year.

Updating Blog Post Creation workflow #

How I have this blog structured is that I utilized 3 separate Github repositories to ultimately build the blog with Hugo

This allows for flexibility if I one day decided I wanted to move to a different Static Site Generator or if I want change up the theme without specifically affecting the other repos. Obviously I could keep everything in a single repo, but I really want to utilize git’s changelog to track markdown publicly.

Hugo can generate blog posts via the following command.

hugo new content <content_location>/blog_post.md

This will generate a markdown file using pre-determined frontmatter at the location specified by the path. While this is nice, it requires me to run Hugo to do this and it also requires me to manually update the lastMod frontmatter whenever I make edits. I include this particular frontmatter because I value being transparent when it comes to information edits. This allows readers of my blog, who are observant to then check out the changelog link at the very bottom of this post to see what has been changed and when. This way I can utilize git’s changelog as opposed to keeping track elsewhere. Why is this even important? Well I believe public information can change over time and everyone deserves to understand those changes to better stay informed and formulate their own opinions on that information.

Instead of using Hugo to generate new blog posts, I’ve opted to use an Obsidian vault to really power up my blog post creation flow.

Why use Obsidian? #

I’ve been using Obsidian for note taking in my private and professional life. At it’s base level, it’s just a super neat markdown note taking app, but with a few community plugins it allows me to automate blog post generation as well as lastMod frontmatter update on changes.

In particular I’m using the following 2 Community Plugins

This gives a fairly nice gui experience as I can accomplish a lot of different workflows via the Command Palette. This allows me to automate including specific Hugo shortcodes from a templates folder and/or create a blog post based on a skeleton markdown file.

What’s neat is that the Obsidian configuration itself now lives in this content repo as a dot folder, which is handy because Hugo will ignore this directory in content. However the templates that I use are in a regular folder, which means I also needed to update the Main Build repo to ignore it as non-content otherwise it’ll break when trying to compile the site.

This required a new inclusion of content module in Hugo’s configuration yaml to exclude it from being processed. What’s cool about this is that I could also specify different content directories within the same repo for different environment builds if I wanted. But for now, I only need it as a way to exclude a specific directory.

module:
  mounts:
    - source: content
      target: content
      excludeFiles:
        - "templates/**"

This was all done and completed with the last post I made.

Updating the Theme #

Now let’s talk about what I updated for the theme. In case you’re not aware, my theme is based on a no longer maintained public theme called Hello Friend which I’ve refactored with the Bulma Framework into what I’ve cutely named Hello Bulma. Dragon Ball Z was a big part of my childhood, so I have a soft spot for this CSS framework.

Updated Font Awesome Free 6 to 6.7.2, prior version used was 6.4.2 (so not a major jump)
Updated Bulma CSS Framework to v1
Update local Hugo Container to use version 0.140.1 in Main Build repo

Updating the Dockerfile #

In the main repo, I have a local Dockerfile, which I use to build a local Hugo container to stand up my website for local testing. This allows me to not have to install Hugo locally, because I run Archlinux (by the way), which means that I’m at the mercy of a Rolling Release structure for packages. So if I install Hugo locally via pacman, it’ll be updated whenever there’s a new update. That’s not what I want for anything I push to production, anything that is going to be considered “production” needs to be deterministic and remain on consistent versions.

So let’s go over some of the major changes to my Dockerfile

ENV HUGO_VERSION 0.140.1
...
ENV DART_SASS_VERSION 1.83.0
ENV DART_SASS_FILENAME dart-sass-${DART_SASS_VERSION}-linux-x64.tar.gz
ENV DART_SASS_URL https://github.com/sass/dart-sass/releases/download/${DART_SASS_VERSION}/${DART_SASS_FILENAME}

# download Dart Sass
RUN cd /tmp && \
curl -O -L ${DART_SASS_URL} && \
tar -xf ${DART_SASS_FILENAME} && \
cp -r /tmp/dart-sass/* /usr/local/bin && \
rm -rf /tmp/dart-sass*

First and foremost is setting the HUGO_VERSION to a newer version
I’ve also included Dart Sass installation

The inclusion of Dart Sass is necessary here because by default Hugo uses LibSass to transpile Sass to CSS and LibSass is deprecated by the Sass team in favor of Dart Sass as of 2020. Unfortunately the extended Hugo release packages doesn’t contain this so I’m forced to manually install this for local development. Luckily for Cloudflare Pages (where this blog is hosted), I don’t have to worry about this as Dart Sass is pre-installed in the Cloudflare Workers when generating the static files for Hugo.

So for the most part I just copy-pasted what was in Hugo’s Documentation opting for Dart Sass version 1.83.0

The use of Dart Sass is also crucial here because Bulma V1 is built with it according to their Migration documentation.

Migrating to Bulma v1 #

As with any major software changes, it’s always good to read any official documentation to account for any breaking changes. Luckily Bulma provides us 2 major recommendations/changes.

Tiles are deprecated in favor of Smart Grid (I don’t use either so this is irrelevant to me)
Use of @import is not recommended

Now I’ve been using @import to import specific components from the Bulma sass directory to build the CSS as I have my own modifications and additions. So this means I need to migrate from @import to @forward or @use in the main file that my Theme points to for css compiling.

Unfortunately Font Awesome 6 still uses @import in it’s scss files, so I’ll be keeping this around until it’s change.

But now my bulma.scss file looks like

// bulma.io v1.0.3
@use "../bulma/sass/<component>" (
	//my overrides
);
...
@forward "../bulma/sass/<component>";
...

// CUSTOM
@forward "./<components>";
...

// Font Awesome 6.7.2
@import "../fontawesome/<filename>.scss";
...

Apparently the ordering of @use , @forward , and @import here is important. I ran into some errors when compiling the CSS, so learned a lesson on that ordering. Had to spend a bit of time reading through the Sass documentation on the usage of @forward and doing a bit of back and forth testing to ensure everything compiled and rendered like before.

Finally one more thing to note is how do we tell Hugo to use Dart Sass to compile these Sass files.

<!-- Theme CSS -->
{{ $opts := dict "transpiler" "dartsass" }} {{ $style := resources.Get
"scss/custom/bulma.scss" | toCSS $opts | minify | fingerprint }}
<link
  rel="stylesheet"
  href="{{ $style.RelPermalink }}"
  integrity="{{ $style.Data.Integrity }}"
  crossorigin="anonymous"
/>

This follows Hugo’s Guidance on the use of toCSS with optional flags, unless specified it’ll default to use LibSass.

Pushing to Production #

With the theme update it was time to create a Pull Request to push the changes to master branch, which in turned triggered a commit on the Main Build repo with the new theme changes and is watched by Cloudflare for any changes to my Main Build repo to trigger a new deployment.

So as you can see pretty much everything is intact. One minor change I did decide to do was change the strong text colors for headers and links to a white-ish color instead of the previous dark grey-ish ones, which should help with readability I suppose.

Anyhow, Happy New Years! Here’s to accomplishing more things in 2025!

Favorite thangs in 2024

Thu, 26 Dec 2024 11:44:58 -0600

Intro #

People often do a favorite things to sum up the year, this year marks the first year this blog went live. So to commemorate this occasion, I’ve decided to also do a favorite things in 2024. This is not specifically technology related, but something more personal and fun.

So let’s kick of my first ever Favorite thangs in 2024!

Favorite Movies I watched #

The Iron Claw (2023) #

Last time I cared about wrestling was back in Highschool, I would normally pass up this type of genre, but when I found out what the subject matter was about, I knew I had to immediately watch it. What a beautifully tragic story.

The Fall Guy (2024) #

This movie is just pure enjoyment and an amazing celebration of stunt people in the film industry. I think I’ve watched this many times since it’s released and it’s always such a fun watch.

Late Night with the Devil (2024) #

I love the horror genre, so I’m always on the look out for new and interesting stories and settings. Late Night with the Devil paints an amazing portray of an era piece of late night talk show television with a demonic twist.

Longlegs (2024) #

Some of the magic of movies like Longlegs is that it blends the supernatural and reality together so well. It gives you patterns, clues to how the supernatural works, shows you the impossible and finally gives you a real world explanation for it. And still in the end it leaves a few crucial details out, just enough to make you doubt the facts.

Smile 2 (2024) #

The sequel to Smile, and what a follow up this movie was. With sequels we already know the rules, so we need something more to hook us. Smiling has always felt terrifying to me and this movie really ramps up this horrific feeling to an 11, particularly with one scene in Skye’s apartment.

Exhibiting Forgiveness (2024) #

I really enjoy movies where the character has broken free of their former life only to have to return one day to face unresolved trauma. I’ve been a fan of André Holland as an actor ever since I saw him Moolight and Castle Rock, so I wanted to check this out.

Your Monster (2024) #

This is just a silly premise where your imaginary monster from childhood turns out to be real as your life is falling apart. It’s a fun watch.

Favorite Shows I watched #

Abbot Elementary #

I finally started watching Abbot Elementary and holy heck did I wish I would have watched this sooner! I absolutely love each of the teachers, they’re all so quirky and wholesome in the ways that I remember my teachers growing up.

Ted Lasso #

I also finally got around to watching all of Ted Lasso this year and I totally why this series was so beloved. It’s the kind of story that has an underdog team that you just want to root for, the characters are all great.

The Bear (Season 3) #

It’s good, we all know this. But I just want to really share my favorite episode of this recent season, Napkins. I don’t know what it says about me, but I really empathize with characters who get shitted on in life, but put on a smile and persevere right up to their breaking point and beyond. Liza Colon-Zayas’ performance in this episode was absolutely incredible. Fun fact her husband plays her husband in the show.

X-Men ‘97 #

“The Name’s Gambit, Mon Ami… Remember it.” This shit went so fucking hard and it exhibits everything I love about characters like Gambit. Of course the rest of the season was an amazing nostalgia trip as well and I highly recommend this series to anyone who grew up watching the X-Men cartoon.

Mr. and Mrs. Smith #

I think what I really enjoyed most about this show was the chemistry between Donald and Maya’s character. They’re weird, there’s a bit of romance, there’s spycraft and it all blends together so well. I’m looking forward to what they do for a season 2.

The Brothers Sun #

Being first generation from an immigrant family, this show hits a few of the notes from my childhood, I mean without all the mafia stuff. There’s not too many majority led asian cast television shows in the west and especially ones that tells stories with some level of seriousness. This show had it all, martial arts, comedy, familial expectations, striving to want something for yourself. I loved it and I wish it would get a follow up season.

One Day #

I got sucked into the tiktok hype about this one. I saw all these reaction videos of people crying over this series that I had to give it a watch. I have to say as far as love stories go, I really enjoyed this one. It’s not the typical they fall in love and live happily ever after, no, years goes by as this love is developed and tested. It’s a good watch.

The Queen of Villains #

My second mention of a wrestling related media, which I also thoroughly enjoyed. It follows our lead, Dump Matsumoto, who is portrayed by Yuriyan Retriever and gives one heck of a performance, during the very real rising era of female japanese wrestling. I love non-stereotypical lead characters and you can’t help but want to root for her.

Dead Boy Detectives #

What I’ve come to appreciate about DC in the wake of the Marvel takeover is that they’re no stranger to take chances on characters and stories the typical super hero movie enjoyer may know about. This is like Hardy Boys meets the supernatural, or at least what I imagine the Hardy Boys were like (never read them growing up, too busy reading comics instead).

A Virtuous Business #

I don’t often watch k-dramas, usually because I feel it’s all the same, just a bunch of extremely good looking people with some kind of romance problems. However this one has a really interesting premise in which an unlikely bunch of women start a risque women’s lingerie business. What I really enjoyed about this one is how different of a story it was from the typical ones. I really like the main cast of women and the stories that’s told from their perspectives.

Favorite Video Games I played #

Lies of P #

It’s a soulsborne like game set in a fictitious gothic fairy tale like world. Combat took a while for me to get the hang of because the timing of the blocks/deflect was not what I was used to. But I love the artistic take on a classic fairy tale.

Black Myth Wukong #

I was already familiar with the story of Wukong through an old cartoon from my childhood called Monkey Magic. But to experience more of the tales of Wukong and see just how weird it all was in the game styles of soulsborne mechanics was fantastic. I made sure to fight each and every boss possible. Highly recommend.

Helldivers 2 #

I don’t much play multi-player games outside of Destiny 2. So when some old friends wanted to give it a go, I have to say I was delightfully surprised at how enjoyable the experience was. It may not be so much the game itself, but the combination of good company and fun mechanics is really want made the experience very enjoyable.

Favorite Comics I read #

DIE #

This is probably my favorite read of the year. Out of all the nerd stuff I’m into, Dungeons and Dragons has never been something I’ve personally been interested in. But man this comic’s story and artwork was so cool, I couldn’t pass up giving it a shot. I love the power fantasy for each of the character in the game world and how non-traditional hero like behaviors they had to grapple with.

Saga #

It’s an amazing Space Opera. It’s hard to really hate any characters in this story, even villains become lovable. I can’t wait to read more as they come out.

Favorite Manga I read #

A Man and His Cat #

This is a slice of life manga I suppose. I actually started reading this years ago, but I think I’ve come to appreciate it more in the past year with the absence of my dog. It’s silly, emotional, and very enjoyable.

Chihayafuru #

I knew nothing of what Karuta was but the Japanese just have a way with taking a subject matter that I either know nothing of or have interest in and making it worth reading about. Obviously the story is more than just about the game, but it makes for an interesting vehicle in which to tell a story.

Dandadan #

Pure ridiculousness and the facial expressions of the characters is so funny. They also recently came out with the Anime this year as well.

Hinamatsuri #

This is lowkey comedic gold and I finally finished reading all of it this year. Highly recommend.

Jagaaaaaan #

I love weird shit and Jagaaaaaan is this mixture of weird, violence and ridiculous. It reminds me a lot of Gantz back in the day.

Sakamoto Days #

What if the most notorious assassin wanted to settle down and live a quiet life? Well its not gonna go smoothly for everyone else trying to collect that bounty on his head.

Favorite Anime I watched #

Yuru Camp #

This is just a superb slice of life anime about camping. It doesn’t get deep and it kinda just makes you want to go camping.

Orb: On the Movements of the Earth #

This anime started airing late in the year, but man has it been so interesting. The plot revolves around Heliocentrism and takes place through iterations of characters studying this “taboo” during a time of Geocentrism. There’s a manga to this as well.

Favorite Items I own #

Bambu Lab’s A1 Mini #

I already own a fantastic Prusa MK3S, but wanted to see what the hype was around the Bambulab printers. So on a whim with some spare change, I bought the Bambulab A1 Mini. Man what a printer it is! The speed and accuracy in which it printed a benchy was pretty incredible, and at the price point, I totally understood the hype. It’s pretty great for prototyping small prints and even fairly large ones (well large for it’s build volume)

Steamdeck #

I used to travel back to my home town lugging my PS5 to keep up with my Destiny 2 addiction. But circumstances changed and I was no longer in a position to travel with my PS5. So I sold myself on the practicality of the Steamdeck. Not only could it play games from my Library, I could even play Destiny 2…. if I installed Windows, which I had no plans to do. Instead what it acted great as was a Sony Remote Play and it worked great being able to stream my PS5 from the Steamdeck. Only bottleneck became the network, so unfortunately it did not run well outside of my home network. However it did allow me to start taking a crack at that backlog. I am thoroughly impressed by the device and I really hope this helps bring more attention to Linux gaming. It also makes for the perfect gaming session before bed.

Favorite Youtube Channels of the year #

Adam Savage’s Tested #

I’ve always enjoyed the maker that is Adam Savage, his build videos are always a delight to watch. I love how he approaches organizing his workspace and how he explains his thoughts and process in his videos. Every year the Tested team does a Favorite Things of the year, which is sort of what inspired this among many other things. He has an immense appreciation for tools and I love hearing him talk at length about some of his favorites. Here’s one of my favorite videos of the year, would probably only interest people who are makers who enjoy the workspace they build in.

PossedbyHorror #

Being the big horror fan that I am I of course watch youtubers talk about horror. This is certainly one of my favorite channels on the subject. I find Sarah’s appreciation of the Found Footage horror refreshing considering that most people seem to write of these shaky cam style horror movies as being bad. I personally love that style of horror. Here’s Sarah’s ranking of Found Footage style horror movies.

Kidology #

A youtuber who does analytical eassy type videos about society. I think she has interesting thoughts and ideas that she brings up for discussion and appreciate the data she brings into the discussion. She recently made a video on the discussion of the end of reading, which I found really fascinating.

FLATLANDER TECH #

Here’s a interesting maker / film maker type channel. Watching his custom desk build has been really satisfying.

Diggnation #

After over a decade since Diggnation last aired, Kevin and Alex get together and do a special reboot episode and boy was it everything I remembered. Diggnation has a special place in my heart as being probably the first podcast I ever watched back in my college days. The subject matter was never really special given that they just picked a few digg article to talk about, but what really made it magical was the chemistry they had, this was a real friendship on display, having a good time, drinking some booze and shooting the shit.

AntsCanada #

I don’t know where to begin with this one, but I loved watching this man build this ridiculously giant indoor Vivarium. I couldn’t stop watching every week for a new update.

Mina Le #

Another one of those video essay youtubers who talks about a wide variety of societal topics. She has a background in the fashion world so she often dresses up for her videos and sometimes the topic of discussion does have an overlay into that world.

Gawx Art #

I only just stumbled upon his videos this year, but damn does this guy know how to make cinematic and aesthetically pleasing videos. I think it was this video that got me into his channel.

Some honorable mentions #

Macho Nacho Productions - Retro Game Console Repair and mods
YourCoolUncleMarisa - Sharing her love and story telling of retro consoles
Vuhlandes - Photography, Film Making and story teller
GxAce - Photography story telling with a cyber punk aesthetic.

Close out #

With that, my favorite thangs in 2024 has come to a close. Hope you all have a lovely time spending it with your loved ones and here’s to learning and growing in 2025!

Moving Apartments and Moving the Homelab

Sun, 15 Sep 2024 20:44:14 -0500

Sometimes you just encounter some of the weirdest quirks with your tech and homelab and it only becomes apparent when you power off, dismantle, and move the whole shebang. I’ve recently moved and had to dismantle, box up, and relocate everything. Now let me preface this by saying while I would like to physically clean my servers on a more frequent bases, it’s generally difficult with the limiting space that I often find myself in with apartments. So most maintenance tends to happen during apartment moves or when something goes haywire. Most of my gear has not changed for several years and I often don’t really buy new parts outside of my desktop and hard drives.

So with this move, I ended up encountering 2 major issues and I figured documenting them might be good in case someone else comes across similar issues and just needs some ideas to get the brain motors turning.

Problem #1 #

Let’s start with my main PC. I built this over 2 years ago, so here are the current specs.

Gigabyte X570 Aorus Ultra Motherboard
AMD Ryzen 9 5900X
64GB of RAM
A bunch of SSDs
1x Nvidia GeForce RTX 3080 Ti powering 4 monitors
1x Nvidia Quadro M4000 for passthrough on VMs connected to a Wacom Cintiq 22HD
OS: Archlinux

Maybe some day I’ll go over my main setup in further detail, but for now. Let’s go over the issue. When powering on, the fans come on, but the BIOS doesn’t POST and holding down the power button doesn’t actually turn off the PC. I have to manually switch off the Power Supply. So already something weird is going on.

No clue what could have happened during the move, but my guess is that either something got dislodged or a build up of static charge or something has caused an issue. So let’s go over some of the basic things I’ve tried.

Re-seating the RAM modules, moving the 2 sticks around, starting with 1 stick only. No changes.
Re-seating the 2 Graphics cards, swapping them around, leaving in only one and removing them both. Still no changes.
I took out the CMOS battery, waited 30 seconds to a minute and re-added it back. Again still no changes.

At this point I was starting to think that maybe the motherboard had gone bad and that I would need a whole new board replacement. But out of a final act of desperation I decided to re-seat the CPU itself. Amazingly this worked and my BIOS posted. I still don’t understand why re-seating the CPU did the trick, or perhaps by re-seating the CPU I had allowed some built up static to discharge or maybe the CMOS battery was finally able to dissipate? Either way, I’m glad this was a no-cost fix.

Problem #2 #

My NAS was not detecting any of the harddrives outside of the boot drives. For my setup, I’m running a 20 Hot-swap bay Norco Chassis, that I built well over a decade ago at this point. The only thing recent in this machine is the Hard Drives for the ZFS pools. Now normally I’d be really concern that the hard drives died, but not this time since I manually transported the hard drives myself, only the server was moved via hired movers. So I was 99.9% confident that the hard drives are not the issue here. This means that the possible points of failure can be any device/component between the hard drive to the PCI-E slot. Since the boot drives are directly connect to the Sata ports on the motherboard. Let’s go over how a storage hard drive is connected.

Hard Drive -> Backplane -> Sata to SFF Cable -> SAS Expander Card -> SFF to SFF Cable to HBA Card

So I worked backwards, simply unplugging and replugging in cables and re-seating the HBA and Expander cards. It may seem dumb but sometimes things get loose in a move and just reseating/replugging them back in can solve the issue.

This was not the case for me. So I then tried move the PCIE slots that the HBA and SAS cards were connected in around. Still no dice. So next step was to swap more cables around, still nothing really.

Finally by shear coincidence, I started to really pay attention to the hot swap caddies during boot up as they do contain indicator lights for power and activity. I realized at somepoint that I was not seeing any green activity light during the startup phase when TrueNAS is trying to import the zfs pool. Since the power light shown, I started to suspect that maybe it was a sata/SFF cable issue. I decided to skip the SAS expander entirely and plug Sata/SFF cable directly into the HBA card instead. Plugged in a spare hard drive and I found out it was an issue with the SAS expander not being recognized. I made sure I tested all combination of SFF slots on the SAS expander with the HBA card, but none of it connected.

Luckily the SAS expander was cheap and I was able to buy a used replacement from ebay, which is great because when I first put together this NAS, I also bought this used. So anytime I can used gear for cheap it’s a win in my book.

Intel RES2SV240 24 port 6Gbps Sata SAS controller for around 30 USD

The great thing is that this is just a drop in replacement, once I replaced the card, TureNAS was able to import the zfs pool and I was back in business.

For gear that I bought used 10+ years ago it still works like a champ!

Dotfiles for 2024

Tue, 16 Apr 2024 11:56:51 -0500

Intro #

I’ve been on this kick to update my dotfiles so that I can also revamp my dotfiles that I use for work as well in an effort to optimize my workflow. With this I’m also making the switch from Vim to Neovim as my default text editor in order to really force myself to use and learn vim motions more. I’m not a software engineer, so my typical usage with Vim has just been to edit configuration files, write bash scripts or perform small edits. I’ve been using VSCode a lot for writing configuration yamls and anything remotely close to programming. So I’m going cold turkey and cutting VSCode out of my repertoire.

So let’s go over some goals I have for iterating over my existing dotfiles.

Creating a new branch for the update before merging to master.
Adding new configurations for neovim and tmux.

But before we go all in on what I’m adding, let’s go over a bit on how my dotfiles are structured for modularity.

The basic structure #

It was a few years ago that I learned about GNU stow which allows you to create and manage symlinks. With this we can manage symlinks appearing in a given location following the structured format of another.

To illustrate this, let’s say we have the following directory structure in my home directory

drwx--x---+ 53 sinicide sinicide 4.0K Apr 14 18:37 .
drwxr-xr-x   3 root     root     4.0K Sep 16  2021 ..
drwxr-xr-x   2 sinicide sinicide 4.0K Feb 17 20:41 bin
drwxr-xr-x  72 sinicide sinicide 4.0K Apr 14 15:55 .config
drwxr-xr-x  10 sinicide sinicide 4.0K Apr  5 07:41 .dotfiles
drwxr-xr--+ 30 sinicide sinicide  80K Apr 14 13:37 Downloads
lrwxrwxrwx   1 sinicide sinicide   29 Jan 23  2022 .gitconfig -> .dotfiles/personal/.gitconfig
drwxr-xr-x   3 sinicide sinicide 4.0K Aug 11  2023 Pictures
drwxr-xr-x   2 sinicide sinicide 4.0K Dec  7 16:52 .ssh
lrwxrwxrwx   1 sinicide sinicide   20 Mar 30 00:28 .tmux -> .dotfiles/tmux/.tmux
lrwxrwxrwx   1 sinicide sinicide   25 Mar 30 00:28 .tmux.conf -> .dotfiles/tmux/.tmux.conf
lrwxrwxrwx   1 sinicide sinicide   18 Mar 29 14:42 .vim -> .dotfiles/vim/.vim
-rw-------   1 sinicide sinicide  32K Mar 29 15:39 .viminfo
lrwxrwxrwx   1 sinicide sinicide   20 Mar 29 14:42 .vimrc -> .dotfiles/vim/.vimrc
-rw-------   1 sinicide sinicide  21K Oct 17  2021 .zhistory
-rw-r--r--   1 sinicide sinicide   87 Mar 13 00:26 .zlogin
lrwxrwxrwx   1 sinicide sinicide   21 Mar 29 14:42 .zshenv -> .dotfiles/zsh/.zshenv
-rw-------   1 sinicide sinicide 349K Apr 14 18:37 .zsh_history
lrwxrwxrwx   1 sinicide sinicide   20 Mar 29 14:42 .zshrc -> .dotfiles/zsh/.zshrc

From this you can see how the symlinks are mapped to the files within my .dotfiles directory, I’ve split up configurations into their own specific directories, such as tmux, zsh, and vim So the base of these subdirectories act as the base home directory and how I structure the files and subdirectories within this maps back to the home directory.

/home/sinicide/ = /home/sinicide/.dotfiles/zsh/

This makes it very modular and if I want to add new configs that are specific to an application I can just create a new directory for it. So for example, I’ll be adding Neovim configs which will live in

/home/sinicide/.dotfiles/nvim/

Neovim configs are stored within a user’s .config directory. So we’ll structure them the same way within our sub directory and when we run the stow command it’ll map it accordingly in our home directory.

/home/sinicide/.dotfiles/nvim/.config/nvim/

How stow works is that it can take a target directory, which is where stow should create the symlinks and then it takes a given directory that it maps.

cd ~/.dotfiles
stow -t ~ nvim

So the above command here will take our Home directory as a target and will map our nvim directory. So when I navigate into the ~/.config directory I’ll see the following symlink.

nvim -> ../.dotfiles/nvim/.config/nvim

Neovim #

So one of my biggest undertaking here is switching to Neovim, with this comes a slew of possible plugins and key remaps. I had the following goals in mind to help make my choices.

Keep key remaps to a minimum to start
Choose plugins that are useful instead of just providing a visual cool factor

With that said, let’s take a look at my nvim config directory and how I’ve structure it.

[sinicide        4096]  .
├── [sinicide          42]  init.lua
├── [sinicide        2123]  lazy-lock.json
├── [sinicide        4096]  lua
│   ├── [sinicide        4096]  core
│   │   ├── [sinicide          42]  init.lua
│   │   ├── [sinicide         591]  remap.lua
│   │   └── [sinicide         915]  set.lua
│   ├── [sinicide        4096]  packagemanager
│   │   └── [sinicide         494]  init.lua
│   └── [sinicide        4096]  plugins
│       ├── [sinicide         902]  conform.lua
│       ├── [sinicide        4591]  lsp-config.lua
│       ├── [sinicide         211]  markdown-preview.lua
│       ├── [sinicide         955]  mason.lua
│       ├── [sinicide         281]  monokai-pro.lua
│       ├── [sinicide        1252]  nvim-cmp.lua
│       ├── [sinicide         954]  nvim-lint.lua
│       ├── [sinicide         891]  telescope.lua
│       ├── [sinicide         906]  treesitter.lua
│       ├── [sinicide          91]  undotree.lua
│       ├── [sinicide         111]  vim-paper.lua
│       └── [sinicide         528]  vim-tmux-navigator.lua
└── [sinicide        4096]  undodir

At the core of it, we have the init.lua inside nvim, which starts off all the requirements. This is a pretty simple file that only contains 2 things for my setup

require("core")
require("packagemanager")

The required just points to non-plugin configurations, which are essentially the vim configurations and remaps. The other one just points to lazy.nvim plugin manager. Now I do want to note that the docs recommends structuring the lazy config within the top level init.lua, plugins.lua or plugins/init.lua However I structured mine within a directory I called packagemanager and called it from the init.lua just to help me understand the structure of loading things in neovim.

nvim core configs #

So the core directory here contains 2 main things, vim default configs and key remappings, the init.lua just points to 2 these two files. I won’t go into detail on the vim configs, these are primarily carried over from my original vim dotfiles and are less interesting I think.

As for the key remaps, I do want to touch base on them since I’m trying to use VIM motions more and more so I’ve kept my remaps to a minimum for now to ensure that I learn the remaps as muscle memory.

I’ve taken these remaps from ThePrimeagen I did a little testing here and there to determine their benefits for my workflow. So let’s go over the ones I’ve chosen.

-- page up/down, keeping cursor centered
vim.keymap.set("n", "<C-d>", "<C-d>zz")
vim.keymap.set("n", "<C-u>", "<C-u>zz")

I like the idea of keeping focus towards the center of the screen, so basically this remaps combines the default page up/down and then centers the cursor in the middle of the screen.

-- search, but keep item middle of screen
vim.keymap.set("n", "n", "nzzzv")
vim.keymap.set("n", "N", "Nzzzv")

The following keeps this same thing in mind, which is to keep the search pattern in center focus.

-- yank/paste to/from system clipboard
vim.keymap.set({"n", "v"}, "<leader>y", [["+y]])
vim.keymap.set("n", "<leader>p", [["+p]])
-- delete into blackhole register
vim.keymap.set({"n", "v"}, "<leader>d", [["_d]])

The above here should keep 2 separate copy buffers, one for vim and one for system clipboard.

-- shift highlighted line up/down
vim.keymap.set("v", "J", ":m '>+1<CR>gv=gv")
vim.keymap.set("v", "K", ":m '<-2<CR>gv=gv")

Finally the above remap seems super nice for being able to highlight a block of text and shifting it up or down without having to yank/paste.

The plugins #

Let’s talk plugins, I’m keeping my approach with this to the absolute minimal for now, so you can see that I’m not installing a filemanager like NERDTree and just sticking with the default netrw while it ain’t pretty, it does get the job done. I’m also not doing much in the way of customizing the bottom bar either, no lualine or anything as it’s really just for aesthetics.

I’m using telescope to fuzzy find my way around files, undotree for viewing previous iterations of a file, this is particularly helpful for configuration orientated files which I find myself working with often in my workflow. vim-tmux-navigator is for some nice keybindings for navigating between vim and tmux. Markdown Preview for being able to view what my markdown looks like rendered in a web browser, this is useful in particular for this blog as all content is written in Markdown, previously I’ve been using something similar in VSCode, so this is totally a nice to have.

Finally we have 2 themes, monokai-pro is my default theme, but I have a nice vim-paper one for light mode if I ever need to do screensharing/presenting that way vim in my terminal is actually readable.

The rest are for LSPs, linting and formatting, with the use of treesitter, mason for managing LSPs, and conform for managing Linters/Formatters. Mason is pretty awesome for being able to manage installing LSPs, Linters, and Formatters, however the only thing it can auto install it seems are LSPs. Hence why we have Conform which helps to automating the installation of Linters and Formatters.

With that my Neovim setup is complete.

Tmux Configs #

My tmux configs are split between 2 main components, the .tmux.conf configuration file and a custom theme.

Let’s start by talking about the configuration file as this primarily contains my key bindings. Like most people, I’ve rebind the leader prefix from the default C-b to C-a

Most important rebinds I have are, changing the pane navigation to VIM movements ala hjkl and the splits. I’ve opted to use | for horiztonal splits and - for vertical splits, simply because they look like their respective cuts as opposed to the defaults, which are % and " , while it wouldn’t be difficult to learn them over time, my visual splits are just easier for me to remember.

# rebind navigation to VIM keys
bind -r h select-pane -L # move left
bind -r j select-pane -D # move down
bind -r k select-pane -U # move up
bind -r l select-pane -R # move right

# rebind splits
unbind |
unbind -
unbind %
unbind '"'
bind | split-window -h -c "#{pane_current_path}"
bind - split-window -v -c "#{pane_current_path}"

Like most, I also change the default numbering from starting 0 to 1. The reasoning behind this is that the 1 key is just closer on the left hand, so it’s a bit more optimized for session switching, as opposed to using 2 hands to hit the prefix keys + session number.

I also have the configurations in place for loading the Tmux Plugin Manager, however I’m not currently using any plugins at the moment. I was testing out the vim-tmux-navigator, but have decided against the keybinds that it default for moving windows, which is to not use leader key prefix and only relay on <ctrl> + <key>. Personally I like keeping this leader key prefix style specific for tmux so that I have it separate in my mind. With the keybindings it also removes the clear line key mapping in the terminal, so that was the main motivator for me to remove this plugin. I don’t need to necessarily use tmux all the time, so I don’t need to keep 2 different key bindings in my brain for the same action.

Finally we have my custom theme, I looked at a bunch of the other themes out there for tmux and honestly I didn’t care for what they offered. So of course I had to create my own. So what makes my theme different? Mostly the removal of hostname + time as these are unnecessary give modern desktops generally show a clock somewhere.

So I thought about the type of information that would be important to me with managing multiple terminal windows. This essentially boils down to,

What Session am I on?
What Window am I on?
How many panes are in a given window?
Am I zoomed into a pane?

So I’ve customized the theme with these in mind and have removed the necessary things.

# left status bar
set-option -g status-left-style 'bg=#19181a'
set-option -g status-left ' '

# right status bar
set-option -g status-right-length 40
set-option -g status-right-style 'bg=#19181a,fg=#a9dc76'
set-option -g status-right '#{?client_prefix,#[bg=#fc9868]#[fg=#19184a],} [#{=30:session_name}] '

# windows status
set-option -g window-status-format '#{window_index}#(echo ":")#{=20:#{b:window_name}}#{window_flags}'
# window current/active status
set-option -g window-status-current-format '#{?client_prefix,#[bg=#fc9868]#[fg=#19184a],}#{window_index}:#(echo "#{b:window_name}")#{?window_zoomed_flag,[Z],[#{window_panes}]}#{?mouse,[M],}'

So you can see that this is split into 3 sections, a left side, right side and window-status, gets pushed to the left side. A nice little addition I added was the Z indicator whenever I’m zoomed into a pane.

Conclusion #

With these new changes implemented, I can git pull and update my existing dotfiles and stow the new changes all at once or one at a time. This becomes quite flexible when I want to integrate a personal or work folder given whether I’m using my work computer or my personal computer.

All and all dotfiles are great and no two need be alike. I quite enjoy seeing how people setup their own dotfiles and take inspiration and snippets where it makes sense for my own workflow.

K8S The Number of the Beast Part 3

Mon, 22 Jan 2024 16:37:15 -0600

Deploying in Kubernetes #

Now that we have the container image I can work on deploying this to my Kubernetes Cluster. Now obviously I can deploy this to Docker and just be done with it, but a good chunk of my self hosted applications are deployed to Kubernetes. I don’t have any greater reasons for deploying in Kubernetes other than it’s beneficial for my understanding and helps with my day job. Now with deployments in Kubernetes I don’t have to worry so much if/when I take down a node for upgrade as the container will just move to another node for high up time.

Breaking it Down #

Compared to deploying with docker-compose yaml, there’s quite a bit more needed to deploy in Kubernetes. Containers deployed in Kubernetes are grouped as Pods, which can contain 1 or more containers, but for our use case we will only have 1 container in our pod. What we need to decide on is if our Application is stateful or not, which will help to determine if we should use a Deployment or a Statefulset. For my use case I only need 1 container and the application itself isn’t so state sensitive that I need to use a Statefulset. Next is Storage, we do need a big amount of storage but we need it to persist if the container is terminated, within my Kubernetes Cluster I’m using Longhorn for my Storage Class, this offers a number of useful features such as replicas and NFS/S3 backup solutions. Finally I’ll need a Reverse Proxy/Ingress solution to allow traffic from outside the Kubernetes Cluster to route to my Application, for that I’ll be using Traefik.

So breaking down the yaml files we’ll need are the following…

deployment.yaml (defines our application)
ingressroute.yaml (defines our ingress routing)
pvc.yaml (defines our persistent volume claim)
service.yaml (defines our service/routing)
secrets.yaml (defines our environment variables as a Kubernetes Secret)

deployment.yaml #

The following is an extremely basic Kubernetes deployment yaml that will deploy 1 replica (e.g. 1 pod) that is our anki-syncserver. The pod exposes port 8080 just like our docker-compose example did.

kind: Deployment
apiVersion: apps/v1
metadata:
  name: anki-syncserver
  labels:
    app: anki-syncserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: anki-syncserver
  template:
    metadata:
      labels:
        app: anki-syncserver
    spec:
      containers:
        - name: anki-syncserver
          image: ghcr.io/sinicide/anki-syncserver:v1.0.2
          envFrom:
          - secretRef:
              name: anki-syncserver-secrets
          ports:
            - name: http
              containerPort: 8080
          volumeMounts:
          - name: anki-syncserver-pv
            mountPath: "/data"
      volumes:
        - name: anki-syncserver-pv
          persistentVolumeClaim:
            claimName: anki-syncserver-claim

The volumes section here defines the referenced Persistent Volume Claim, which our Pod will use.

volumes:
	- name: anki-syncserver-pv
	  persistentVolumeClaim:
		claimName: anki-syncserver-claim

Then we mount that Claim via the volumeMounts sections of the Container definition, and in my case we’re mounting the PVC to /data

volumeMounts:
  - name: anki-syncserver-pv
	mountPath: "/data"

Finally we’re taking the key/value pairs from our Kubernetes Secret and using them as Environment Variables within the Container.

envFrom:
  - secretRef:
	  name: anki-syncserver-secrets

pvc.yaml #

The persistent volume claim is fairly straight forward, it simply defines which Storage Class is used and the requested resource values.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: anki-syncserver-claim
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: longhorn-retain
  resources:
    requests:
      storage: 512M

Since I’m not entirely sure how much disk space I’ll truly need to sync, I figured 512M will be a good starting point. The Storage Class itself will allow for volume expansion and my custom Storage Class also enables the persistent volume to be retained when the pod is terminated. I’m also not overtly concerned with backing up this data volume as I don’t consider this data necessarily mission critical, but Longhorn create multiple Replicas of my data and does allow for backing up to an NFS share or an S3 bucket as I mentioned earlier.

service.yaml #

The service resource defines an endpoint and can be of type Load Balancer for requests outside the cluster to route to our application. However we’ll be using Traefik for our Ingress routing instead, meaning we just define a basic service resource, Traefik will have it’s own Load Balancer Service defined which will route traffic on port 80 to our application’s port 8080

apiVersion: v1
kind: Service
metadata:
  name: anki-syncserver
spec:
  selector:
    app: anki-syncserver
  ports:
    - protocol: TCP
      port: 8080
      name: http

inrgressroute.yaml #

Since I’m using Traefik for Ingress, we need to define a Custom Resource called IngressRoute that will match a rule to route the DNS hostname anki-temp.sin.lan on port 80 to our service on port 8080. Traefik has this concept of entryPoints which are typically just http/80 or https/443 which we can then redirect to our application’s specific port. Since there’s no SSL configuration for Anki Sync Server out of the box and it’s not a huge deal for me to use a super crackable password, I don’t have a need to offload SSL handling with my Ingress Controller. I’ve simply opted to just use the http endpoint called web for the time being. I primarily still use Self-Signed Certificates in my home network and these typically will fail validation in most application unless there’s a way to specify a Truststore, so I don’t want to bother with that hassle for now.

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: anki-syncserver-http
spec:
  entryPoints:
    - web
  routes:
  - match: Host(`anki-temp.sin.lan`)
    kind: Rule
    services:
      - name: anki-syncserver
        port: 8080

With this, I can reach my Anki Sync Server at the following address http://anki-temp.sin.lan/

secrets.yaml #

Since I need to provide an Environment Variable with our username+password, I’ve opted to use a Kubernetes Secret to hold this sensitive information as opposed to simply defining it within the Deployment yaml. So in this resource, I’m providing a key/value data, our Environment Variable SYNC_USER1 and it’s associating value which is composed of the username and password separated by a colon anki_username:anki_password

apiVersion: v1
kind: Secret
metadata:
  name: anki-syncserver-secrets
type: Opaque
stringData:
  SYNC_USER1: "anki_username:anki_password"

The CI/CD Way #

I’ve been playing around with around with ArgoCD for my Continuous Deployment solution in my Kubernetes cluster, so of course I had to get my Anki Sync Server Deployment going here. This allows me to update my github repo and ArgoCD will pull down the changes when detected and deploy the changes in my Kubernetes Cluster.

ArgoCD provides a Custom Resource Definition for deploying Applications in Kubernetes, This yaml can reference a github repo or Helm chart that it’ll use to deploy and keep watch on. So the following is what I’m using, which is extremely bare minimum to get my Anki Sync Server deployed in my Kubernetes Cluster.

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: anki-syncserver
  namespace: argocd
  labels:
    name: anki-syncserver
  # remove this for prod
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://github.com/sinicide/sh-repo
    targetRevision: HEAD
    path: yamls/anki-syncserver
    
  destination:
    server: https://kubernetes.default.svc
    namespace: apps

  syncPolicy:
    automated:
      prune: false
    syncOptions:
    - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

  revisionHistoryLimit: 3

Please note, my sh-repo for Anki Sync Server doesn’t provide an example for the Kubernetes Secret yaml, so that’s something that needs to be deployed manually before hand and needs to exist before ArgoCD can successfully deploy the Anki Sync Server Git Repo if you are using my github repo for your own deployment.

Conclusion #

With my Anki Sync Server now deployed, I can point my local Anki Instances to the Sync Server http://anki-temp.sin.lan and will be able to sync progress and decks between my Desktop and Phone. Frankly it’s working really well for all the extra work I went through to do this. Now comes the hard part which is learning Japanese with this Anki System, until next time.

じゃあね

Building and Deploying Anki Sync Server Part 2

Wed, 10 Jan 2024 19:11:27 -0600

Continuing… #

Alright now that we have our Dockerfile fleshed out and we’ve verified that we can start it up without it crashing, let’s move on and figure out how to automate all this so that we don’t need to build locally and/or push a container image locally. Now I’ve only used Github Actions sparingly, this blog uses Github Actions to make a commit on the main repository whenever I update either the Theme or create a new blog post, this way I can keep my blog separated into standalone components should I one day want to move to a brand new theme or move to a different Static Site Generator.

Github Actions #

Github provides a framework to help you build workflows/pipelines for your projects. These actions can be triggered based on specific activities such as a Push to the repository. In fact Github themselves provides an example yaml for Publishing Docker Images which we’ll use as a base for our own workflow.

The following is the workflow I’ll be using

name: Publish Docker image

on:
  workflow_dispatch:

jobs:
  push_to_registries:
    name: Push Docker image to multiple registries
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4
      
      - name: Log in to Docker Hub
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      
      - name: Log in to the Container registry
        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
        with:
          images: |
            ${{ secrets.DOCKER_REPO }}
            ghcr.io/${{ github.repository }}            
      
      - name: Build and push Docker images
        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

For now the trigger is a manual execution, meaning this won’t trigger unless I do so from the Github Actions UI.

on:
  workflow_dispatch:

But let’s break down what this workflow is doing. Here we have our job id push_to_registries and in Github Actions, jobs run parallel with each other by default, so you can have multiple jobs execute at the same time when triggered. You can also specify conditions for each job, so you can build out complex and robust workflows where 1 or more jobs are triggered. This can be useful for automating tests. However for our needs, we’ll just stick to one job.

push_to_registries:
    name: Push Docker image to multiple registries
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read

Jobs contains a list of sequential steps which are executed when ran. Here we’re doing the following.

Check out the repo
Log in to Docker Hub
Log in to the Container registry
Extract metadata (tags, labels) for Docker
Build and push Docker images

In this workflow we’ll be pushing to both the Docker’s Container Registry and Github Container Registry in one single action and we’re doing this by using reusable actions, uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 What are reusable actions? Basically they’re other workflows that perform a set of steps that we’re now referencing. Think of it like a function call, you or others build out a function that does something specific and now you can reuse that function in other parts of your program.

Now an important consideration here is the Tagging, by default if you’re just executing a workflow based on a given branch such as main you’ll end up with an image name + version like sinicide/anki-syncserver:main which is fine if I was never ever going to update this again, but really what I want is that nice sinicide/anki-syncserver:v1.0.0 versioning.

Semantic Versioning #

So we need to take a detour here and figure out what the heck is Semantic Versioning and how can I get that nice Release Tagging. Luckily there is a handy website semver.org that goes over the whole version numbering. But really all we need to know is that the format is MAJOR.MINOR.PATCH and that’s how the version number is formatted. The Major number generally dictates a big change, that is incompatible with the old Major number. The Minor number is for functionality changes that are backwards compatible. And finally the Patch number is generally for bug fixes. If you want to learn more, I highly recommend reading the link I referenced.

Doing some research online I found that a pretty popular Semantic Versioning automation is semantic-release which is an NPM package that uses Angular’s Commit Message Conventions meaning that as we work on our project and commit our changes to Git, we can add little prefixes which semantic-release’s workflow will be able to read and determine if it needs to set the Major, Minor, and Patch version, this combined with Github’s Actions gives us a very powerful automation workflow.

Semantic-Release Setup #

Now I wouldn’t say that this is a typical application development since I’m just repackaging an existing program into a docker container so there’s a lot in the Example workflow that I didn’t need to make use of. So let’s go over how I implemented semantic-release for this docker project.

Configuration File #

Semantic-release uses a configuration file, I initially started trying do this with a .releaserc file but found in my testing that I needed a package.json for some npm stuff, so I just opted to use a package.json solely instead of having both.

{
    "name": "anki-syncserver",
    "private": true,
    "release": {
        "branches": ["main"]
    }
}

Here I’m setting private=true because we are not publishing this to npm, so we have no need of an NPM Token which would be necessary to publish to npm. The important thing here is the branches which can take an array of string objects to determine which branches a release should be applied to. Since I’m only testing locally and publishing only final releases, I’m just gonna stick with the main branch in the Github repo.

Semantic-Release Workflow #

Now semantic-release provides a sample Github workflow yaml example, but we don’t need a bunch of the configuration on there by default because again I’m not publishing this to npm.

So below is what I’ve settled on.

name: Release
on:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "lts/*"
      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release@22.0.12

Here I’ve stripped out id-token for permissions, gotten rid of Install dependencies and Verify the integrity.... and finally removed the NPM_TOKEN as well. These would be used for publishing to npm, which I don’t need.

Finally I’m also specifying a specific version of semantic-release npm package and bumping up the actions/xxxx@v4 since it’s generally good practice to have a consistent experience using the same version until you are ready to upgrade to a newer version. Otherwise you might eventually run into unexpected behaviors as it tries to use the latest.

What’s Next #

So now we have a workflow that generates tags with Semantic Versioning in Github. These Tags can then be used for Publishing Docker containers to the Container Registries. For the moment Pushing Docker images is a manual trigger, at some point I’ll work on getting that automated based on the releases, I just need to learn a bit more on Github Actions.

Next time we’ll go over how I’m deploying the public containers in my Kubernetes setup.

Building and Deploying Anki Sync Server Part 1

Sat, 06 Jan 2024 19:39:23 -0600

Learning Japanese #

I’m really trying to learn how to Read and Speak Japanese this year for a future trip to Japan. Part of this goal is to learn to read Hiragana and Katakana and I was having trouble finding a learning method that would help with this in a way I wanted. I wanted a flash card system for learning the characters, but specially to learn both Hiragana and Katakana at the same time. So instead of learning one writing system’s characters and sound, I’d learn both the character system at the same time since they’re pretty much the same, plus I got it in my head that it’d probably be easier to learn it this way. Now there’s tons of applications/programs/etc to actually learn this. Tons of practice writing charts and what not. However I don’t specifically want to learn how to write (I know, I know, insane 🤯) I mean, when was the last time I actually hand wrote something? It’s all type type type in today’s world. For my use cases, I really only need to understand speech, be able to speak back and then be able to read signs, menus, dialogue, etc. So I want a flash card system that can accommodate this, most learning apps probably aren’t built this way.

For my requirements, I need the following in an application/system

Runs on Linux/Android
Can create my own flashcards that contains images and sound so that I can learn the character and the sound for said character
Regularly maintained

So in comes Anki a flash card application that runs on multiple platforms (Windows, MacOS, Linux, iOS, and Android) and can sync between devices as well. From what I understand, Anki is extremely customizable and easy to get started with. And if youtube is any indication, if it’s good enough for Medical Students, it’s good enough for my basic language learning needs.

AnkiWeb #

You can use AnkiWeb to sync your Flashcards between devices (e.g. desktop and smartphone), however while I have no intentions of doing anything malicious or illegal, it’s very likely that me scrapping the internet for graphics and sound is not exactly within Acceptable Content usage for a Free AnkiWeb sync account. But there is a Self-Hosted option for a Anki Self-Hosted Sync Server so that’s perfect, I can just spin up a docker container and have a local sync server that I can point my devices to.

The Problem #

Doing some research there doesn’t appear to be a regularly maintained Docker Image in English from what I can tell. Now I did find one from AnkiCommunity Github however that doesn’t look to be actively maintained. I would really prefer not to use out of date software, so how hard could it be to build a docker image for the Anki Sync Server?

Challenge Accepted #

Let’s go over the requirements for hosting an Anki Sync Server in my Homelab

Running the Anki Sync Server in a Docker Container
Deploy the Container Image in my Kubernetes Cluster
Automate the Build process for the Docker Image so that I can build new images easily in the future
Push said Docker Image to both Github Container Registry and Docker Hub Registry
Automate Release Version Tagging for the docker images pushed

RTFM #

So let’s start with the Sync Server Documentation Reading this tells me that their Sync Server is part of their Anki application and I can install the application in Linux or install via Python Module. I decided to go with the Python module as I can easily install specific versions via pip so with that in mind, I can build a Dockerfile based on the python:3.9.18 base image.

From the doc, we can see that running the Sync Server really only requires

First User Credentials (requires the environment variable SYNC_USER1=username:password additional users can be added via SYNC_USER2 and so on)
Web Port (defaults to SYNC_PORT=8080)
Sync Directory (where the sync data is stored, this defaults to /.syncserver and can be overriden via environment variable SYNC_BASE)

In case you just want to check out the repository here you go Anki SyncServer Repository

Now below is what I came up with for the Dockerfile

FROM python:3.9.18

ENV SYNC_HOST "0.0.0.0"
ENV SYNC_PORT "8080"
ENV SYNC_BASE "/data"

WORKDIR /

COPY requirements.txt .

RUN python -m pip install --upgrade pip && \
    python -m pip install -r ./requirements.txt

EXPOSE ${SYNC_PORT}

CMD ["python", "-m", "anki.syncserver"]

This is super basic, we’re setting up the necessary Environment Variable (omitting SYNC_USER1 for now). We’re passing a requirements.txt which will be used by pip to install our Anki Python Module and specific version

anki == 23.12.1

At the time of this writing the latest version of Anki is 23.12.1 so that’s what I’m going with.

Now I wrote a Makefile to build the docker image locally for testing just to make sure it all works as expected.

APP_VERSION ?= "23.12.1"
APP_NAME ?= "anki-syncserver"

build:
	docker build --no-cache -t ${APP_NAME}:${APP_VERSION} .

This only has one option build and will run the docker build command to create a docker image called anki-syncserver:23.12.1

So I can just run a simple make build command to get that going.

Testing #

While I can run a docker run command to deploy my container, I’d rather test using a docker-compose yaml file.

version: '3'
services:
  anki-sync:
    image: anki-syncserver:23.12.1
    container_name: anki-sync
    environment:
      SYNC_USER1: "username:password"
    ports:
      - 8080:8080
    volumes:
      - ./data:/data

Here we’re putting it all together, I’m running a single service specifying our local docker image and version. Exposing the web port 8080. Mounting a local directory for the Data volume. By default I’m mapping the Sync Directory to /data in the docker image, but this could also be overwritten by specifying the SYNC_BASE environment variable. Finally I’m setting our 1 and only user, SYNC_USER1=username:password which is by no means secure in any shape of form.

Next a simple docker-compose up will show that our application is running successfully as it’s listening on port 8080

anki-sync  | 2024-01-07T05:13:58.351480Z  INFO listening addr=0.0.0.0:8080

Next Time on Dragon Ball Z #

And that’s it! We now have a simple docker image, next time we’ll cover automating the build process because I really don’t want to manually push the docker image to the container registries.

つづく

Migrating to Unifi Network Application

Sun, 26 Nov 2023 18:23:57 -0600

The Backstory #

In my home network, I use Ubiquiti products for my Wireless Access Points. In particular I have Unifi AP AC Lite deployed in both my Apartment and in my Parent’s home for Wifi. Recently I also bought a used Unifi Standard USW-24 Managed Switch, that I need to migrate to as I’ve been using a Dell PowerConnect 2824 Managed Switch for a several years now.

You might be asking why I use Unifi Wireless Access Points, when most consumer grade Router/Wifi combos already include Wifi. Well I also don’t use Consumer Grade Routers or at least I haven’t for the better part of a decade now.

The entry point into my Home Networking typically follows

Modem -> pfSense (Router) -> Switch -> Unifi AP (wifi)

While pfSense can handle Wifi as well, it was preferred back in the day to have that be handled by something else (not sure if this is still true or not), either a Consumer Grade Wifi/Router acting as a Wifi only Access Point or a Unifi AP.

The Unifi Wifi Access Points can be Powered over Ethernet, so if you have a PoE switch, you can power the Access Points directly with 1 cable instead of having a power dongle to go with the Ethernet, unfortunately I don’t yet have a PoE switch, so I’m still using the power dongle.

With these Ubiquiti products, you’ll need an Application to configure them. For Self-Hosted minded individuals, this is where the Unifi Controller Web Application comes in.

For years now I’ve been using the unifi-controller docker image by linuxserver.io This was/is a relatively painless setup. However in January 1st, 2024, linuxserver.io will be deprecating the unifi-controller image and instead we’ll need to upgrade/migrate to Unifi Network Application.

Since the new year is fast approaching, I went ahead and made the necessary changes. So let’s go over the migration requirements and steps to perform.

Requirements #

In place upgrade does not work (e.g. can’t just swap container image)
Create a backup of existing unifi-controller
Unifi Network Application requires Mongo DB
Create docker-compose file for new deployment

In my existing deployment of unifi-controller I used a docker-compose file, so I’ll need to replace that with a new one.

Backing Up the Config #

This is extremely straight forward, just go to the Unifi Controller Settings > System > Backups and download a copy of the backup file. Yay! now you have a .unf backup file, we’ll need this to restore our Unifi Settings when we’ve deployed the Unifi Network Application since it won’t have any configuration on start essentially being a brand new setup.

Let’s talk docker-compose #

We need to create a new docker-compose file that containers the Unifi Network Application image in addition to the Mongo DB image, since that’s now a requirement.

Below is what I’m using for my deployment.

version: '3'
services:
  unifi-db:
    image: mongo:4.4.25
    container_name: unifi-db
    networks:
      - traefik_proxy
    volumes:
      - "/data/containers/unifi-db/data:/data/db"
      - "/data/containers/unifi-db/initialize/init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js:ro"
    restart: unless-stopped

  unifi-network-application:
    image: lscr.io/linuxserver/unifi-network-application:8.0.7
    container_name: unifi-network-application
    hostname: unifi-app
    depends_on:
      - unifi-db
    networks:
      - traefik_proxy
    ports:
      # Unifi STUN port
      - 3478:3478/udp
      # Required for AP Discovery
      - 10001:10001/udp
      # Required for controller to be discoverable on L2 Network
      - 1900:1900/udp
      # Required for device communication
      - 8080:8080
      # Remote syslog capture
      - 5514:5514/udp
    environment:
      # MongoDB configuration, evaluated on first run
      MONGO_USER: ${MONGO_DB_USERNAME}
      MONGO_PASS: ${MONGO_DB_PASSWORD}
      MONGO_HOST: "unifi-db"
      MONGO_PORT: "27017"
      MONGO_DBNAME: ${MONGO_DBNAME}
    restart: unless-stopped
    volumes:
      - "/data/containers/unifi-network-application:/config"
    labels:
      - "traefik.http.routers.unifi-network-application-http.entrypoints=web"
      - "traefik.http.routers.unifi-network-application-http.middlewares=redirect-to-https@file"
      - "traefik.http.routers.unifi-network-application-http.rule=Host(`unifi-app.sin.lan`)"
      - "traefik.http.routers.unifi-network-application-https.entrypoints=websecure"
      - "traefik.http.routers.unifi-network-application-https.rule=Host(`unifi-app.sin.lan`)"
      - "traefik.http.services.unifi-network-application-https.loadBalancer.server.port=8443"
      - "traefik.http.services.unifi-network-application-https.loadBalancer.server.scheme=https"
      - "traefik.http.routers.unifi-network-application-https.middlewares=unifi-network-application-headers"
      - "traefik.http.middlewares.unifi-network-application-headers.headers.customRequestHeaders.Authorization="
      - "traefik.http.middlewares.unifi-network-application-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
      - "traefik.http.serverstransports.unifi-network-application-st.insecureSkipVerify=true"
networks:
  traefik_proxy:
    external: true

The Mongo Requirement #

So starting off is the MongoDB deployment. Here, I’m following the guidance of linuxserver.io and configuring Mongo with version 4.4.25 as it’s document that Unifi Network Application supporting only Mongo 3.6.x to 4.4.x versions. Here I’m also specifying an initialization file that will create user for the unifi database.

unifi-db:
  image: mongo:4.4.25
  container_name: unifi-db
  networks:
    - traefik_proxy
  volumes:
    - "/data/containers/unifi-db/data:/data/db"
    - "/data/containers/unifi-db/initialize/init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js:ro"
  restart: unless-stopped

The init-mongo.js as referenced by linuxserver.io, this create our unifi-user to connect to the database named unifi

db.getSiblingDB("unifi").createUser({user: "unifi-user", pwd: "unifi-password", roles: [{role: "dbOwner", db: "unifi"}]});
db.getSiblingDB("unifi_stat").createUser({user: "unifi-user", pwd: "unifi-password", roles: [{role: "dbOwner", db: "unifi_stat"}]});

In my setup, I have multiple docker-compose files that use a common Network so that containers can talk to each other and use a common Proxy Manager, otherwise each container deployed via docker-compose is potentially isolated to it’s own network.

No ports are exposed here because we don’t need to directly access anything ourselves.

Unifi Network Application #

unifi-network-application:
  image: lscr.io/linuxserver/unifi-network-application:8.0.7
  container_name: unifi-network-application
  hostname: unifi-app
  depends_on:
    - unifi-db
  networks:
    - traefik_proxy
  ports:
    # Unifi STUN port
    - 3478:3478/udp
    # Required for AP Discovery
    - 10001:10001/udp
    # Required for controller to be discoverable on L2 Network
    - 1900:1900/udp
    # Required for device communication
    - 8080:8080
    # Remote syslog capture
    - 5514:5514/udp
  environment:
    # MongoDB configuration, evaluated on first run
    MONGO_USER: ${MONGO_DB_USERNAME}
    MONGO_PASS: ${MONGO_DB_PASSWORD}
    MONGO_HOST: "unifi-db"
    MONGO_PORT: "27017"
    MONGO_DBNAME: ${MONGO_DBNAME}

At the time of this writing, version 8.0.7 is the latest. Here we’re specifying a dependency on unifi-db

My original unifi-controller deployment exposes the same Ports that are necessary for device communication. However I’m not exposing Unifi Guest Portal ports nor mobile throughput test port and finally I’m not exposing the Unifi Web Admin Ports (http/https) since I’m using Traefik to Proxy the requests so that I don’t have to type in a port value in the browser.

Finally new Docker Environment configurations are included to tell our Unifi Network Application how to connect to the Mongo Database.

Bonus Traefik configuration #

I think most of the Self-Hosted community seems to use Nginx Proxy Manager, but in case you’re using Traefik Proxy here’s what I’m using, my Traefik Proxy looks at docker labels to configure the routing.

labels:
  - "traefik.http.routers.unifi-network-application-http.entrypoints=web"
  - "traefik.http.routers.unifi-network-application-http.middlewares=redirect-to-https@file"
  - "traefik.http.routers.unifi-network-application-http.rule=Host(`unifi-app.sin.lan`)"
  - "traefik.http.routers.unifi-network-application-https.entrypoints=websecure"
  - "traefik.http.routers.unifi-network-application-https.rule=Host(`unifi-app.sin.lan`)"
  - "traefik.http.services.unifi-network-application-https.loadBalancer.server.port=8443"
  - "traefik.http.services.unifi-network-application-https.loadBalancer.server.scheme=https"
  - "traefik.http.routers.unifi-network-application-https.middlewares=unifi-network-application-headers"
  - "traefik.http.middlewares.unifi-network-application-headers.headers.customRequestHeaders.Authorization="
  - "traefik.http.middlewares.unifi-network-application-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
  - "traefik.http.serverstransports.unifi-network-application-st.insecureSkipVerify=true"

The above specifies an http entrypoint, this is port 80that does a redirect to https on port 443

Next we’re specifying the loadBalancer port, which specifies the Unifi Web Admin Port 8443

- "traefik.http.services.unifi-network-application-https.loadBalancer.server.port=8443"
- "traefik.http.services.unifi-network-application-https.loadBalancer.server.scheme=https"

So essentially Web Request goes from 80 -> 443 -> 8443

The Unifi Application handles TLS itself, so we’ll include HTTP headers and ignore the TLS cert presented by the Unifi Application.

- "traefik.http.routers.unifi-network-application-https.middlewares=unifi-network-application-headers"
- "traefik.http.middlewares.unifi-network-application-headers.headers.customRequestHeaders.Authorization="
- "traefik.http.middlewares.unifi-network-application-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
- "traefik.http.serverstransports.unifi-network-application-st.insecureSkipVerify=true"

Deploying Mongo and Unifi Network Application #

A simple docker-compose -f unifi.yaml up -d will start everything.

Check logs to make sure there’s no errors in Mongo

docker logs -f unifi-db

Finally check the new Unifi Network Application

docker logs -f unifi-network-application

If all went well we should see

*** Waiting for MONGO_HOST unifi-db to be reachable. ***

Generating 4,096 bit RSA key pair and self-signed certificate (SHA384withRSA) with a validity of 3,650 days

	for: CN=unifi

[custom-init] No custom files found, skipping...

[ls.io-init] done.

Restoring the old configuration #

Now we can navigate to our application in browser and click on Restore Server from a Backup then click on Upload Backup File and selecting our .unf file. Restoring should take a few minutes at most and we’ll be redirect to the login page when it’s done. Logging in and we can verify that our previous Unifi AP devices are found and connected.

Postmortem #

While migrating to this new deployment is fairly painless, the need for Mongo is an additional overhead that we didn’t need previously and as far as I can tell, Unifi Network Application is still generating backup .unf files in the same autobackup location, so in terms of backing and restoring in the future, we really only need the .unf files and mongo database can be discarded without issue, if this changes in the future, I’ll update this post to note what we’ll be losing without backing up Mongo.

Initial Commit

Sun, 19 Nov 2023 17:23:58 -0600

This blog has been a long time coming. I think I’ve owned this domain for the better part of a decade now. But finally in the year 2023, I think it’s time that the internet gets yet another blog.

For the better part of the last decade, I’ve been working in Technical Support Engineering roles and at home I spend a good chunk of my time moonlighting as some psuedo DevOps Engineer, standing up Self-Hosted applications and services within my home network. My goal with this blog is to document the goals and challenges of Self-Hosting and having a Home Lab. With the occasional fun posts on just things I’m interested in general such as 3d printing, art, design, tech gear, and much more.

So I hope you’ll hit that bookmark and check me out in the next one.