Secluded.Site

Crash Course to LXD

Tue, 19 Sep 2023 14:27:00 -0400

If you’re wondering why I like system containers, see the previous post, LXD: Containers for Human Beings.

Installation

Install snap following Canonical’s tutorial
- LXD is natively packaged for Arch and Alpine, but configuration can be a massive headache.
sudo snap install lxd
lxd init
- Defaults are fine for the most part; you may want to increase the size of the storage pool.
lxc launch images:debian/12 container-name
lxc shell container-name

Usage

As an example of how to use LXD in a real situation, we’ll set up my URL shortener. You’ll need a VPS with LXD installed and a (sub)domain pointed to the VPS.

Run lxc launch images:debian/12 earl followed by lxc shell earl and apt install curl. Also apt install a text editor, like vim or nano depending on what you’re comfortable with. Head to the Installation section of earl’s SourceHut page and expand the List of latest binaries. Copy the link to the binary appropriate for your platform, head back to your terminal, type curl -LO, and paste the link you copied. This will download the binary to your system. Run mv <filename> earl to rename it, chmod +x earl to make it executable, then ./earl to execute it. It will create a file called config.yaml that you need to edit before proceeding. Change the accessToken to something else and replace the listen value, 127.0.0.1, with 0.0.0.0. This exposes the application to the host system so we can reverse proxy it.

The next step is daemonising it so it runs as soon as the system boots. Edit the file located at /etc/systemd/system/earl.service and paste the following code snippet into it.

[Unit]
Description=personal link shortener
After=network.target

[Service]
User=root
Group=root
WorkingDirectory=/root/
ExecStart=/root/earl -c config.yaml

[Install]
WantedBy=multi-user.target

Save, then run systemctl daemon-reload followed by systemctl enable --now earl. You should be able to curl localhost:8275 and see some HTML.

Now we need a reverse proxy on the host. Exit the container with exit or Ctrl+D, and if you have a preferred webserver, install it. If you don’t have a preferred webserver yet, I recommend installing Caddy. All that’s left is running lxc list, making note of the earl container’s IPv4 address, and reverse proxying it. If you’re using Caddy, edit /etc/caddy/Caddyfile and replace everything that’s there with the following.

<(sub)domain> {
	encode zstd gzip
	reverse_proxy <container IP address>:1313
}

Run systemctl restart caddy and head to whatever domain or subdomain you entered. You should see the home page with just the text earl on it. If you go to /login, you’ll be able to enter whatever access token you set earlier and log in.

Further tips

One of the things you might want to do post-installation is mess around with profiles. There’s a default profile in LXD that you can show with lxc profile show default.

$ lxc profile show default
config: {}
description: Default LXD profile
devices:
  eth0:
    name: eth0
    network: lxdbr0
    type: nic
  root:
    path: /
    pool: default
    type: disk
name: default
used_by: []

Not all config options are listed here though; you’ll need to read the documentation for a full enumeration.

I’ve seen some people say that executing a fork bomb from inside a container is equivalent to executing it on the host. The fork bomb will blow up the whole system and render every application and container you’re running inoperable. That’s partially true because LXD by default doesn’t put a limit on how many processes a particular container can spawn. You can limit that number yourself by running

lxc profile set default limits.processes <num-processes>

Any container you create under the default profile will have a total process limit of <num-processes>. I can’t tell you what a good process limit is though; you’ll need to do some testing and experimentation on your own.

As stated in the containers section of the previous post, this doesn’t save you from fork bombs. It just helps prevent a fork bomb from affecting the host OS or other containers.

LXD: Containers for Human Beings

Tue, 19 Sep 2023 14:26:00 -0400

This is a blog post version of a talk I presented at both Ubuntu Summit 2022 and SouthEast LinuxFest 2023. The first was not recorded, but the second was and is on SELF’s PeerTube instance. I apologise for the terrible audio, but there’s unfortunately nothing I can do about that. If you’re already intimately familiar with the core concepts of VMs or containers, I would suggest skipping those respective sections. If you’re vaguely familiar with either, I would recommend reading them because I do go a little bit in-depth.

Questions, comments, and corrections are welcome! Feel free to use the self-hosted comment system at the bottom, send me an email, an IM, reply to the fediverse post, etc. Edits and corrections, if there are any, will be noted just below this paragraph.

The benefits of VMs and containers

Isolation: you don’t want to allow an attacker to infiltrate your email server through your web application; the two should be completely separate from each other and VMs/containers provide strong isolation guarantees.
Flexibility: VMs and containers only use the resources they’ve been given. If you tell the VM it has 200 MBs of RAM, it’s going to make do with 200 MBs of RAM and the kernel’s OOM killer is going to have a fun time 🤠
Portability: once set up and configured, VMs and containers can mostly be treated as closed boxes; as long as the surrounding environment of the new host is similar to the previous in terms of communication (proxies, web servers, etc.), they can just be picked up and dropped between various hosts as necessary.
Density: applications are usually much lighter than the systems they’re running on, so it makes sense to run many applications on one system. VMs and containers facilitate that without sacrificing security.
Cleanliness: VMs and containers are applications in black boxes. When you’re done with the box, you can just throw it away and most everything related to the application is gone.

Virtual machines

As the name suggests, Virtual Machines are all virtual; a hypervisor creates virtual disks for storage, virtual CPUs, virtual NICs, virtual RAM, etc. On top of the virtualised hardware, you have your kernel. This is what facilitates communication between the operating system and the (virtual) hardware. Above that is the operating system and all your applications.

At this point, the stack is quite large; VMs aren’t exactly lightweight, and this impacts how densely you can pack the host.

I mentioned a “hypervisor” a minute ago. I’ve explained what hypervisors in general do, but there are actually two different kinds of hypervisor. They’re creatively named Type 1 and Type 2.

Type 1 hypervisors

These run directly in the host kernel without an intermediary OS. A good example would be KVM, a VM hypervisor than runs in the Kernel. Type 1 hypervisors can communicate directly with the host’s hardware to allocate RAM, issue instructions to the CPU, etc.

Type 2 hypervisors

These run in userspace as an application, like VirtualBox. Type 2 hypervisors have to first go through the operating system, adding an additional layer to the stack.

Containers

VMs use virtualisation to achieve isolation. Containers use namespaces and cgroups, technologies pioneered in the Linux kernel. By now, though, there are equivalents for Windows and possibly other platforms.

Linux namespaces partition kernel resources like process IDs, hostnames, user IDs, directory hierarchies, network access, etc. This prevents one collection of processes from seeing or gaining access to data regarding another collection of processes.

Cgroups limit, track, and isolate the hardware resource use of a collection of processes. If you tell a cgroup that it’s only allowed to spawn 500 child processes and someone executes a fork bomb, the fork bomb will expand until it hits that limit. The kernel will prevent it from spawning further children and you’ll have to resolve the issue the same way you would with VMs: delete and re-create it, restore from a good backup, etc. You can also limit CPU use, the number of CPU cores it can access, RAM, disk use, and so on.

Application containers

The most well-known example of application container tech is probably Docker. The goal here is to run a single application as minimally as possible inside each container. In the case of a single, statically-linked Go binary, a minimal Docker container might contain nothing more than the binary. If it’s a Python application, you’re more likely to use an Alpine Linux image and add your Python dependencies on top of that. If a database is required, that goes in a separate container. If you’ve got a web server to handle TLS termination and proxy your application, that’s a third container. One cohesive system might require many Docker containers to function as intended.

System containers

One of the most well-known examples of system container tech is the subject of this post: LXD! Rather than containing a single application or a very small set of them, system containers are designed to house entire operating systems, like Debian or Rocky Linux, along with everything required for your application. Using our examples from above, a single statically-linked Go binary might run in a full Debian container, just like the Python application might. The database and webserver might go in that same container.

You treat each container more like you would a VM, but you get the performance benefit of not virtualising everything. Containers tend to be much lighter than most VMs.¹

When to use which

These are personal opinions. Please evaluate each technology and determine for yourself whether it’s a suitable fit for your environment.

VMs

As far as I’m aware, VMs are your only option when you want to work with esoteric hardware or hardware you don’t physically have on-hand. You can tell your VM that it’s running with RAM that’s 20 years old, a still-in-development RISC-V CPU, and a 420p monitor. That’s not possible with containers. VMs are also your only option when you want to work with foreign operating systems: running Linux on Windows, Windows on Linux, or OpenBSD on a Mac all require virtualisation. Another reason to stick with VMs is for compliance purposes. Containers are still very new and some regulatory bodies require virtualisation because it’s a decades-old and battle-tested isolation technique.

Application containers

Application containers are particularly popular for microservices and reproducible builds, though I personally think NixOS is a better fit for the latter. App containers are also your only option if you want to use cloud platforms with extreme scaling capabilities like Google Cloud’s App Engine standard environment or AWS’s Fargate.

Application containers also tend to be necessary when the application you want to self-host is only distributed as a Docker image and the maintainers adamantly refuse to support any other deployment method. This is a massive pet peeve of mine; yes, Docker can make running self-hosted applications easier for inexperienced individuals,² but an application orchestration system does not fit in every single environment. By refusing to provide proper “manual” deployment instructions, maintainers of these projects alienate an entire class of potential users and it pisses me off.

Just document your shit.

System containers

Personally, I prefer the workflow of system containers and use them for everything else. Because they contain entire operating systems, you’re able to interact with it in a similar way to VMs or even your PC; you shell into it, apt install whatever you need, set up the application, expose it over the network (for example, on 0.0.0.0:8080), proxy it on the container host, and that’s it! This process can be trivially automated with shell scripts, Ansible roles, Chef, Puppet, whatever you like. Back the system up using tarsnap or rsync.net or Backblaze, Google Drive, and restic. If you use ZFS for your LXD storage pool, maybe go with syncoid and sanoid.

My point is that using system containers doesn’t mean throwing out the last few decades of systems knowledge and wisdom.

I wrote a follow-up post with a crash course to actually using LXD in the real world along with a few configuration tips.

There’s a technical publication indicating that specialised VMs with unikernels can be far lighter and more secure than containers. ↩︎
Until they need to do anything more complex than pull a newer image. Then it’s twice as painful as the “manual” method might have been. ↩︎

I co-host some podcasts

Fri, 11 Aug 2023 11:15:44 -0700

I’ve been co-hosting Linux Lads for a couple years and recently started co-hosting Linux Downtime. I mention them on the home page of this site, but didn’t consider that there are potentially many people subscribed to my RSS feed(s) that never actually look at my home page ^^'

A couple of weeks ago, someone suggested I write an announcement so RSS subscribers can see it. This is that announcement: I co-host some podcasts!

Here are a couple episodes from each that I recommend:

Linux Lads
- Hare under the Willow — Mike and I talk about my project, Willow, and a new programming language called Hare
- Interview with Chris from the Gio Project — Chris Waldon from the Gio project talks about Gio, what makes it unique, and why it’s so awesome
Linux Downtime
- Episode 77 — we discuss how CLAs could actually help open source projects and how not having a CLA has caused serious issues for Pidgin
- Episode 71 — we talk with Molly White from Web3 is Going Just Great about the issues with cryptocurrencies, Bitcoin, the Lightning network, blockchain, NFTs, “web3”, etc.

Linux Downtime is part of the Late Night Linux family and the free feed is ad-supported. If you want to listen, but don’t like ads, you can subscribe to the LNL Patreon. Linux Downtime can be had on its own for $5/mo or you can get all the LNL podcasts ad-free for just $10/mo. That includes…

You must follow my RSS feed :)

Sun, 21 May 2023 01:59:31 -0400

Hello! o/

You must follow my RSS feed :)

I’ve decided to start publicising some posts exclusively over RSS because I quite like the idea. Taking a page out of the creator’s book,

It’s my pledge to use this secret communication channel to share a little more deeply. Maybe it’s something personal, maybe it’s something in progress, maybe it’s a soft launch. Monthly’ish Easter eggs for those of us who still use RSS readers.

Though this new communication channel is “secret”, these posts will still be available on the public website. They simply won’t be linked to on the posts page. I have some good ideas for less formal writing to put here, but we’ll see how long I can keep monthly-ish posts going.

Until next time \o
— Amolith

Pull vs push: intentional notifications

Mon, 20 Mar 2023 12:15:00 -0400

I’ve recently noticed that many of my peers are sometimes overwhelmed by the internet; they feel as if they’re stretched too thin and that their attention is constantly shifting between too many different platforms. I think a portion of that feeling comes from systems that bombard them with push notifications. In games, this introduces a sense of urgency because you want make the most of your time and use your “lives” or “energy” or whatever efficiently. With social media, these reminders tend to incite a fear of missing out (FOMO), making you feel like you need to open the app to connect with friends and avoid missing out. With news apps, the notifications are usually click-bait headlines specifically selected to make you open the app so you can see what’s going on.

But most of that isn’t really necessary. If something on social media is genuinely that urgent, it should be a call or an instant message. Social media can be checked at the end of the day. The same goes for news; if a headline is really that important, it’ll still be there in a couple hours. If a game needs to remind its players that it exists, it’s probably not particularly fun or memorable.

On Android, when users first open an app, they’re often asked to give that app permission to send notifications. They hit Allow without thinking because they just want to use the app, exactly like what happens when asked to agree to a privacy policy and terms of service. Most of these apps would be able to fill their purpose just as well without sending notifications, but we’re more concerned with using the app so we just don’t think about it.

On their phones, my peers usually have a list of notifications a mile long, full of new emails and YouTube videos and Slack messages and “your lives are restored!” messages from mobile games and so much more. I think reducing that barrage — on all systems, not just phones — is a great way to start building a healthier relationship with technology.

Pushed-based

Modern internet services heavily rely on push-based systems. YouTubers used to say “smash like and subscribe!” at the end of videos because they wanted you to get a push notification when they publish a new video. When YouTube stopped sending notifications for subscriptions and added the bell, YouTubers started saying “smash like, subscribe, and hit that bell!” instead. Free Android games often ask for permission to send notifications because they want to periodically remind you that “hey!! you downloaded me! don’t forget about me! come play me, run out of energy, get annoyed, then buy some extra energy with your hard-earned money! also, pay a bit more and remove the ads while you’re at it! 😃”

E-commerce platforms often ask you to subscribe to their newsletter in exchange for a small discount on your next purchase because they want to push their marketing to your inbox. Some news websites serve massive popups asking you to subscribe to their newsletters so they can, again, push their new content in front of your face. In some cases, this tactic may be perfectly benign; there are some individuals and companies with newsletters that might be genuinely interesting and they just want to let you know that the newsletter exists in case you want to subscribe. But they still result in content being pushed in front of their subscriber’s faces.

Similarly, instant messaging is all about push notifications. It’s in the name: instant. When someone sends you a message, you usually want to know immediately; maybe it’s a family emergency, maybe your food delivery person just arrived, maybe the sky is falling, etc. Those are all situations where you genuinely do want notifications pushed in front of your face. But think about while you’re at work. Do you really need to know that there’s no more coffee in the lounge when you’re waist-deep in a big code refactor and having to mentally juggle variables and signatures and business logic and overarching structu— look at this funny meme!

Ah shit. Where was x set again? Does this function duplicate the logic of that other function 83 lines above? You’ve lost your train of thought and it’s going to take you about 30 minutes to get it back.¹

Maybe you’re spending time with your family, but that new hire keeps asking for help with this snippet of code they can’t figure out. You genuinely want to help them, but time with family is incredibly valuable. It can wait until tomorrow.

There’s a time and place for push notifications. Intentionally setting boundaries and being thoughtful with your time is important.

Pull-based

With a push-based system, you receive notifications on others’ schedules, which might not line up well with your own. In a pull-based system, you receive “notifications” on your schedule. You see what happened on social media when you log in, you receive emails when you explicitly fetch them, you see chat messages when you open the app, and so on. This allows you to decide when you’re ready to interact with that system, whether “ready” is every ten minutes, once you’re in the office, or during breakfast.

Some suggestions

Make heavy and extensive use of Do Not Disturb rules on as many platforms as possible. On mobile devices, it’s often possible to automatically enable DND during calendar events as well as enable it while you sleep. Mark yourself as unavailable in Slack (or Teams or XMPP or ____) outside of work hours. On Android, you can sometimes long-press notifications you don’t want to see and completely disable that category; this allows you to continue receiving push notifications from other categories but silences the one(s) you don’t need. Disable push notifications for YouTube, Twitter, Reddit, etc. Maybe consider using alternative clients for those services that are more user-respecting in general.

Religiously unsubscribe from everything that clutters your inbox. If you don’t actively want to see it, unsubscribe from it or write a rule that marks it as read and immediately shoves it in, for example, a Marketing folder. Inboxes are for pertinent, important information; the latest shoe sale at your preferred big-box store is neither.

Get a feed reader! Please!

They allow you to subscribe to multiple sources of information — like news websites, YouTube channels, blogs, etc. — and aggregate that content into one place. You can read what you want when you want without having anything thrust in your face. Depending on which feed reader you select, you can also sort sources into categories or folders that allow you to focus on one thing at a time, rather than being treated to a firehose of the internet.

If you’re looking for a service, check out Feedbin, NewsBlur, Feeder, Feedly, and Inoreader. Changelog, a developer-focused podcast, interviewed the creator of Feedbin and I quite enjoyed the episode. Be thoughtful when enabling push notifications in readers that support it.

vore is another one to look at, but it may be rather off-putting for some. It has a questionable name, but it’s cute, extremely simple, minimal, and, in my opinion, quite pleasant.

If you’re into self-hosting, I highly recommend yarr. At the time of writing, I’ve been using yarr for 6 months and don’t see myself switching any time soon. I only wish it had a maximum content width so reading was more pleasant on wide screens and that the theme would switch based on your system theme. Also worth a look are miniflux and Tiny Tiny RSS.

There are also desktop feed readers. These do come with a disadvantage though; some extremely active feeds, such as Slashdot, only retain the most recent entries. If you open your desktop feed reader once a day, you might end up missing some entries. Most blogs preserve entries for a lot longer, though. It depends on what feeds you’re interested in. If you want to go with a desktop reader, consider GNOME Feeds (Linux, GNOME), Akregator (Linux, KDE), Newsboat (Linux, TUI), and possibly RSS Guard (All). I’ve only named a few options; there are many more across all platforms.

If you do adopt a feed reader, whichever it is, I strongly recommend migrating your important newsletter subscriptions to Kill the Newsletter! This free service generates an email address, you subscribe to the newsletter with that email address, and it appends each email to a unique feed generated just for you. At the time of writing, I receive 7 newsletters as feeds and it’s a wonderful experience.

In a nutshell

Be thoughtful and intentional with your time and attention; they’re incredibly valuable, both to you, to other people, and to companies.

I’ve seen and heard 30 minutes cited many times from sources I remember trusting, but I can’t remember exactly which sources they were. After a quick search, The Muse says It Takes Nearly 30 Minutes to Refocus After You Get Distracted. ↩︎

Privacy-respecting analytics

Mon, 06 Mar 2023 12:23:00 -0500

For a long time, I was so vehemently opposed to analytics on personal websites that I condemned people using privacy-respecting systems like Plausible on their blog, shouting about mUh PrIvAcY and saying that these platforms only boosted the bloggers’ ego and they would end up writing for their readers rather than personal enjoyment. I’m realising that I was kinda dumb 🤔

One of my clients recently asked me to add analytics to the website I created for them. I said yes and asked whether they had a preference as to which analytics system. They said no, they just wanted to see how many people were using the website and whether they were actually looking at the menu and store pages. I decided to set them up with Umami because it has a very simple UI, it’s not affiliated with Big Tech™ companies, it’s GDPR-compliant, and the script is only 2 KBs.

Analytics on a business’s website is a no-brainer. Business websites should be pleasant, ergonomic, and useful for their customers and analytics do assist with that goal. But what about on personal websites? The big reason Google Analytics is so often condemned is because of Google; you bet your ass they’re aggregating all the data they harvest from their collective properties and associating that information with your visitors’ profiles (yes, even if they don’t have a Google account) to improve their advertising engine. Facebook, Reddit, Twitter, etc. do exactly the same thing with all of their like/share buttons. They’re ingesting as much data as they can to feed their ad systems and I don’t want to further their mass surveillance of the internet.

The privacy issues with analytics primarily apply to the big providers that aggregate everything across their customers’ properties in order to surveil as many people as possible. Systems like Umami are different. The minimal data that’s collected is anonymised and stays in-house, on your (preferrably) self-hosted server. When you really give it some thought, there’s nothing inherently wrong with knowing how many visitors your site has, what pages they’re viewing, and what website they came from.

I enabled Umami on my website shortly after coming to this realisation and made the analytics page public.

The referrers section is fascinating when you bump the period from “Today” to “All time”. There are some unusual search engines, a couple onion addresses, another of my own websites (scratchanitch.dev), and even some personal ones. After seeing other individuals link to my website, I had the idea to use GitHub’s Code Search feature to poke around and see where else it was mentioned.

A suprising number of people seem to be referencing my Vim as a Markdown Editor post. I haven’t thought about that post since I wrote it, much less updated it. Taking a look at Umami indicates that it’s by far my most popular one. Maybe I should have another look at it and see if there’s anything that needs to be improved …

Knowing that there are people visiting my site and that some of the things I’ve written are useful is, frankly, quite encouraging. That’s why I’m writing this post. That’s part of what inspired my next one and it’s why I intend to start writing more. I do enjoy writing, but the idea of tossing something I’ve spent hours on into the void of the internet isn’t exactly motivating.

As long as it isn’t causing problems, I don’t believe “boosting the blogger’s ego” is inherently bad. Encouragement can be quite good 🙂

(Ab)using mesh networks for easy remote support

Mon, 01 Nov 2021 02:51:00 -0400

One of the things many of us struggle with when setting friends and family up with Linux is remote support. Commercial solutions like RealVNC and RustDesk do exist and function very well, but are often more expensive than we would like for answering the odd “I can’t get Facebook open!” support call. I’ve been on the lookout for suitable alternatives for a couple years but nothing has been satisfying. Because of this, I have held off on setting others up with any Linux distribution, even the particularly user-friendly options such as Linux Mint and elementary OS; if I’m going drop someone in an unfamiliar environment, I want to be able to help with any issue within a couple hours, not days and certainly not weeks.

Episode 421 of LINUX Unplugged gave me an awesome idea to use Nebula, a networking tool created by Slack, X11vnc, a very minimal VNC server, and Remmina, a libre remote access tool available in pretty much every Linux distribution, to set up a scalable, secure, and simple setup reminiscent of products like RealVNC.

Nebula

The first part of our stack is Nebula, the tool that creates a network between all of our devices. With traditional VPNs, you have a client with a persistent connection to a central VPN server and other clients can communicate with the first by going through that central server. This works wonderfully in most situations, but there are a lot of latency and bandwidth restrictions that would make remote support an unpleasant experience. Instead of this model, what we want is a mesh network, where each client can connect directly to one another without going through a central system and slowing things down. This is where Nebula comes in.

In Nebula’s terminology, clients are referred to as nodes and central servers are referred to as lighthouses, so those are the terms I’ll use going forward.

Mesh networks are usually only possible when dealing with devices that have static IP addresses. Each node has to know how to connect with the other nodes; John can’t meet up with Bob when Bob moves every other day without notifying anyone of his new address. This wouldn’t be a problem if Bob phoned Jill and told her where he was moving; John would call Jill, Jill would tell him where Bob is, and the two would be able to find each other

With Nebula, nodes are Bob and John and Jill is a lighthouse. Each node connects to a lighthouse and the lighthouse tells the nodes how to connect with one another when they ask. It facilitates the P2P connection then backs out of the way so the two nodes can communicate directly with each other.

It allows any node to connect with any other node on any network from anywhere in the world, as long as one lighthouse is accessible that knows the connection details for both peers.

Getting started

The best resource is the official documentation, but I’ll describe the process here as well.

After installing the required packages, make sure you have a VPS with a static IP address to use as a lighthouse. If you want something dirt cheap, I would recommend one of the small plans from BuyVM. I do have a referral link if you want them to kick me a few dollars for your purchase. Hetzner (referral: ckGrk4J45WdN) or netcup (referral: 36nc15758387844) would also be very good options; I’ve used them all and am very comfortable recommending them.

Creating a Certificate Authority

After picking a device with a static IP address, it needs to be set up as a lighthouse. This is done by first creating a Certificate Authority (CA) that will be used for signing keys and certificates that allow our other devices into the network. The .key file produced by the following command is incredibly sensitive; with it, anyone can authorise a new device and give it access to your network. Store it in a safe, preferably encrypted location.

nebula-cert ca -name "nebula.example.com"

I’ll explain why we used a Fully-Qualified Domain Name (FQDN) as the CA’s name in a later section. If you have your own domain, feel free to use that instead; it doesn’t really matter what domain is used as long as the format is valid.

Generating lighthouse credentials

Now that we have the CA’s .crt and .key files, we can create and sign keys and certificates for the lighthouse.

nebula-cert sign -name "buyvm.lh.nebula.example.com" -ip "192.168.100.1/24"

Here, we’re using a FQDN for the same reason as we did in the CA. You can use whatever naming scheme you like, I just prefer <vps-host>.lh.nebula... for my lighthouses. The IP address can be on any of the following private IP ranges, I just happened to use 192.168.100.X for my network.

IP Range	Number of addresses
10.0.0.0 – 10.255.255.255	16 777 216
172.16.0.0 – 172.31.255.255	10 48 576
192.168.0.0 – 192.168.255.255	65 536

Creating a config file

The next step is creating our lighthouse’s config file. The reference config can be found in Nebula’s repo. We only need to change a few of the lines for the lighthouse to work properly. If I don’t mention a specific section here, I’ve left the default values.

The section below is where we’ll define certificates and keys. ca.crt will remain ca.crt when we copy it over but I like to leave the node’s cert and key files named as they were when generated; this makes it easy to identify nodes by their configs. Once we copy everything over to the server, we’ll add the proper paths to the cert and key fields.

pki:
  ca: /etc/nebula/ca.crt
  cert: /etc/nebula/
  key: /etc/nebula/

The next section is for identifying and mapping your lighthouses. This needs to be present in all of the configs on all nodes, otherwise they won’t know how to reach the lighthouses and will never actually join the network. Make sure you replace XX.XX.XX.XX with whatever your VPS’s public IP address is. If you’ve used a different private network range, those changes need to be reflected here as well.

static_host_map:
  "192.168.100.1": ["XX.XX.XX.XX:4242"]

Below, we’re specifying how the node should behave. It is a lighthouse, it should answer DNS requests, the DNS server should listen on all interfaces on port 53, it sends its IP address to lighthouses every 60 seconds (this option doesn’t actually have any effect when am_lighthouse is set to true though), and this lighthouse should not send reports to other lighthouses. The bit about DNS will be discussed later.

lighthouse:
  am_lighthouse: true
  serve_dns: true
  dns:
    host: 0.0.0.0
    port: 53
  interval: 60
  hosts:

The next bit is about hole punching, also called NAT punching, NAT busting, and a few other variations. Make sure you read the comments for better explanations than I’ll give here. punch: true enables hole punching. I also like to enable respond just in case nodes are on particularly troublesome networks; because we’re using this as a support system, we have no idea what networks our nodes will actually be connected to. We want to make sure devices are available no matter where they are.

punchy:
  punch: true
  respond: true
  delay: 1s

cipher is a big one. The value must be identical on all nodes and lighthouses. chachapoly is more compatible so it’s used by default. The devices I want to connect to are all x86 Linux, so I can switch to aes and benefit from a small performance boost. Unless you know for sure that you won’t need to work with anything else, I recommend leaving it set to chachapoly.

cipher: chachapoly

The last bit I modify is the firewall section. I leave most everything default but remove the bits after port: 443. I don’t need the laptop and home groups (groups will be explained later) to access port 443 on this node, so I shouldn’t include the statement. If you have different needs, take a look at the comment explaining how the firewall portion works and make those changes.

Again, I remove the following bit from the config.

- port: 443
  proto: tcp
  groups:
    - laptop
    - home

Setting the lighthouse up

We’ve got the config, the certificates, and the keys. Now we’re ready to actually set it up. After SSHing into the server, grab the latest release of Nebula for your platform, unpack it, make the nebula binary executable, then move it to /usr/local/bin (or some other location fitting for your platform).

wget https://github.com/slackhq/nebula/releases/download/vX.X.X/nebula-PLATFORM-ARCH.tar.gz
tar -xvf nebula-*
chmod +x nebula
mv nebula /usr/local/bin/
rm nebula-*

Now we need a place to store our config file, keys, and certificates.

mkdir /etc/nebula/

The next step is copying the config, keys, and certificates to the server. I use rsync but you can use whatever you’re comfortable with. The following four files need to be uploaded to the server.

config.yml
ca.crt
buyvm.lh.nebula.example.com.crt
buyvm.lh.nebula.example.com.key

With rsync, that would look something like this. Make sure rsync is also installed on the VPS before attempting to run the commands though; you’ll get an error otherwise.

rsync -avmzz ca.crt user@example.com:
rsync -avmzz config.yml user@example.com:
rsync -avmzz buyvm.lh.* user@example.com:

SSH back into the server and move everything to /etc/nebula/.

mv ca.crt /etc/nebula/
mv config.yml /etc/nebula/
mv buyvm.lh* /etc/nebula/

Edit the config file and ensure the pki: section looks something like this, modified to match your hostnames of course.

pki:
  ca: /etc/nebula/ca.crt
  cert: /etc/nebula/buyvm.lh.nebula.example.com.crt
  key: /etc/nebula/buyvm.lh.nebula.example.com.key

Run the following command to make sure everything works properly.

nebula -config /etc/nebula/config.yml

The last step is daemonizing Nebula so it runs every time the server boots. If you’re on a machine using systemd, dropping the following snippet into /etc/systemd/system/nebula.service should be sufficient. If you’re using something else, check the the examples directory for more options.

[Unit]
Description=nebula
Wants=basic.target
After=basic.target network.target
Before=sshd.service

[Service]
SyslogIdentifier=nebula
ExecReload=/bin/kill -HUP $MAINPID
ExecStart=/usr/local/bin/nebula -config /etc/nebula/config.yml
Restart=always

[Install]
WantedBy=multi-user.target

We’re almost done!

Setting individual nodes up

This process is almost exactly the same as setting lighthouses up. All you’ll need to do is generate a couple of certs and keys then tweak the configs a bit.

The following command creates a new cert/key for USER’s node with the IP address 192.168.100.2. The resulting files would go on the remote node not yours. Replace HOST and USER with fitting values.

nebula-cert sign -name "HOST.USER.nebula.example.com" -ip "192.168.100.2/24"

The following command will create a similar cert/key but it will be part of the support group. The files resulting from this should go on your nodes. With the config we’ll create next, nodes in the support group will be able to VNC and SSH into other nodes. Your nodes need to be in the support group so you’ll have access to the others.

nebula-cert sign -name "HOST.USER.nebula.example.com" -ip "192.168.100.2/24" -groups "support"

On to the config now. This tells the node that it is not a lighthouse, it should not resolve DNS requests, it should ping the lighthouses and tell them its IP address every 60 seconds, and the node at 192.168.100.1 is one of the lighthouses it should report to and query from. If you have more than one lighthouse, add them to the list as well.

lighthouse:
  am_lighthouse: false
  #serve_dns: false
  #dns:
  #host: 0.0.0.0
  #port: 53
  interval: 60
  hosts:
    - "192.168.100.1"

The other bit that should be modified is the firewall: section and this is where the groups we created earlier are important. Review its comments and make sure you understand how it works before proceeding.

We want to allow inbound connections on ports 5900, the standard port for VNC, and 22, the standard for SSH. Additionally, we only want to allow connections from nodes in the support group. Any other nodes should be denied access.

Note that including this section is not necessary on your nodes, those in the support group. It’s only necessary on the remote nodes that you’ll be connecting to. As long as the outbound: section in the config on your node allows any outbound connection, you’ll be able to access other nodes.

- port: 5900
  proto: tcp
  groups:
    - support

- port: 22
  proto: tcp
  groups:
    - support

The certs, key, config, binary, and systemd service should all be copied to the same places on all of these nodes as on the lighthouse.

X11vnc

Alright. The hardest part is finished. Now on to setting x11vnc up on the nodes you’ll be supporting.

All you should need to do is install x11vnc using the package manager your distro ships with, generate a 20 character password with pwgen -s 20 1, run the following command, paste the password, wait for x11vnc to start up, make sure it’s running correctly, press Ctrl + C, then add the command to the DE’s startup applications!

x11vnc --loop -usepw -listen <nebula-ip> -display :0

--loop tells x11vnc to restart once you disconnect from the session. -usepw is pretty self-explanatory. -listen <nebula-ip> is important; it tells x11vnc to only listen on the node’s Nebula IP address. This prevents randos in a coffee shop from seeing an open VNC port and trying to brute-force the credentials. -display :0 just defines which X11 server display to connect to.

Some distributions like elementaryOS and those that use KDE and GNOME will surface a dialogue for managing startup applications if you just press the Windows (Super) key and type startup. If that doesn’t work, you’ll have to root around in the settings menus, consult the distribution’s documentation, or ask someone else that might know.

After adding it to the startup application, log out and back in to make sure it’s running in the background.

Remmina

Now that our network is functioning properly and the VNC server is set up, we need something that connects to the VNC server over the fancy mesh network. Enter Remmina. This one goes on your nodes.

Remmina is a multi-protocol remote access tool available in pretty much ever distribution’s package archive as remmina. Install it, launch it, add a new connection profile in the top left, give the profile a friendly name (I like to use the name of the person I’ll be supporting), assign it to a group, such as Family or Friends, set the Protocol to Remmina VNC Plugin, enter the node’s Nebula IP address in the Server field, then enter their username and the 20 character password you generated earlier. I recommend setting the quality to Poor, but Nebula is generally performant enough that any of the options are suitable. I just don’t want to have to disconnect and reconnect with a lower quality if the other person happens to be on a slow network.

Save and test the connection!

If all goes well and you see the other device’s desktop, you’re done with the VNC section! Now on to SSH.

SSH

First off, make sure openssh-server is installed on the remote node; openssh-client would also be good to have, but from what I can tell, it’s not strictly necessary. You will need openssh-client on your node, however. If you already have an SSH key, copy it over to ~/.ssh/authorized_keys on the remote node. If you don’t, generate one with ssh-keygen -t ed25519. This will create an Ed25519 SSH key pair. Ed25519 keys are shorter and faster than RSA and more secure than ECDSA or DSA. If that means nothing to you, don’t worry about it. Just note than this key might not interact well with older SSH servers; you’ll know if you need to stick with the default RSA. Otherwise, Ed25519 is the better option. After key generation has finished, copy ~/.ssh/id_ed25519.pub (note the .pub extension) from your node to ~/.ssh/authorized_keys on the remote node. The file without .pub is your private key. Like the Nebula CA certificate we generated earlier, this is extremely sensitive and should never be shared with anyone else.

Next is configuring SSH to only listen on Nebula’s interface; as with x11vnc, this prevents randos in a coffee shop from seeing an open SSH port and trying to brute-force their way in. Set the ListenAddress option in /etc/ssh/sshd_config to the remote node’s Nebula IP address. If you want to take security a step further, search for PasswordAuthentication and set it to no. This means your SSH key is required for gaining access via SSH. If you mess up Nebula’s firewall rules and accidentally give other Nebula devices access to this machine, they still won’t be able to get in unless they have your SSH key. I personally recommend disabling password authentication, but it’s not absolutely necessary. After making these changes, run systemctl restart sshd to apply them.

Now that the SSH server is listening on Nebula’s interface, it will actually fail to start when the machine (re)boots. The SSH server starts faster than Nebula does, so it will look for the interface before Nebula has even had a chance to connect. We need to make sure systemd waits for Nebula to start up and connect before it tells SSH to start; run systemctl edit --full sshd and add the following line in the [Unit] section, above [Service].

After=nebula.service

Even now, there’s still a bit of a hiccup. Systemd won’t start SSH until Nebula is up and running, which is good. Unfortunately, even after Nebula has started, it still takes a minute to bring the interface up, causing SSH to crash. To fix this, add the following line directly below [Service].

ExecStartPre=/usr/bin/sleep 30

If the sleep executable is stored in a different location, make sure you use that path instead. You can check by running which sleep.

When the SSH service starts up, it will now wait an additional 30 seconds before actually starting the SSH daemon. It’s a bit of a hacky solution but it works™. If you come up with something better, please send it to me and I’ll include it in the post! My contact information is at the bottom of this site’s home page.

After you’ve made these changes, run systemctl daemon-reload to make sure systemd picks up on the modified service file, then run systemctl restart sshd. You should be able to connect to the remote node from your node using the following command.

ssh USER@<nebula-ip>

If you want to make the command a little simpler so you don’t have to remember the IP every time, create ~/.ssh/config on your node and add these lines to it.

Host USER
  Hostname <nebula-ip>
  User USER

Now you can just run ssh USER to get in. If you duplicate the above block for all of the remote nodes you need to support, you’ll only have to remember the person’s username to SSH into their machine.

Going further with Nebula

This section explains why we used FQDNs in the certs and why the DNS resolver is enabled on the lighthouse.

Nebula ships with a built-in resolver meant specifically for mapping Nebula node hostnames to their Nebula IP addresses. Running a public DNS resolver is very much discouraged because it can be abused in terrible ways. However, the Nebula resolver mitigates this risk because it only answers queries for Nebula nodes. It doesn’t forward requests to any other servers nor does it attempt to resolve any domain other than what was defined in its certificate. If you use the example I gave above, that would be nebula.example.com; the lighthouse will attempt to resolve any subdomain of nebula.example.com but it will just ignore example.com, nebula.duckduckgo.com, live.secluded.site, etc.

Taking advantage of this resolver requires setting it as your secondary resolver on any device you want to be able to resolve hostnames from. If you were to add the lighthouse’s IP address as your secondary resolver on your PC, you could enter host.user.nebula.example.com in Remmina’s server settings instead of 192.168.1.2.

But how you do so is beyond the scope of this post!

If you’re up for some more shenanigans later on down the line, you could set up a Pi-Hole instance backed by Unbound and configure Nebula as Unbound’s secondary resolver. With this setup, you’d get DNS-level ad blocking and the ability to resolve Nebula hostname. Pi-Hole would query Unbound for host.user.nebula.example.com, Unbound would receive no answer from the root servers because the domain doesn’t exist outside of your VPN, Unbound would fall back to Nebula, Nebula would give it an answer, Unbound would cache the answer, tell Pi-Hole, Pi-Hole would cache the answer, tell your device, then your device would cache the answer, and you can now resolve any Nebula host!

Exactly how you do that is definitely beyond the scope of this post :P

If you set any of this up, I would be interested to hear how it goes! As stated earlier, my contact information is at the bottom of the site’s home page :)

Running an IRC server

Sat, 05 Dec 2020 16:55:00 -0400

Many people will disagree but I think IRC is still one of the best chat platforms there is for a number of reasons. However, the documentation surrounding it is sometimes lacking, commands are esoteric and can differ from server to server, some networks have stupid requirements/defaults, etc. But who says you have to join them? IRC is very easy to set up, use, and maintain and this post should be a decent guide on doing just that.

Picking an IRCd

First, ircd is short for IRC daemon; it’s just a server running in the background. Second, there are a ton of choices, from charybdis and ngIRCd to UnrealIRCd, InspIRCd, and many others. The ircd this guide will focus on is Oragono because it’s one of the simpler options yet has support for IRCv3 and comes with services out of the box.

Setup

While we could run Oragono as root or under whatever account you use, that’s a stupid idea. We’re going to create an oragono user to make sure things are properly separated.

adduser --disabled-login oragono

Press the enter key a bunch of times and you’re good. After that, run sudo su - oragono to log into that user account then head to the GitHub releases page and download the latest gzipped tarball¹ for your architecture. Decompress it with tar xvf oragono-*.tar.gz. I don’t recommend renaming the folder to something else; having the version name right there will make it easy to figure out when you need to upgrade in the future.

Copy the default config to the production config with cp default.yaml ircd.yaml, open it in your favourite TUI editor, and start exploring the options! The file is commented very well but I’ll list a few specific options and values I recommend.

Configuration

Obtain a TLS cert from Let’s Encrypt and use it if possible. If not, use Oragono’s self-signed certificates. Don’t enable plaintext use.
Consider setting Tor up and allowing users to connect through it.
If you’re using a TLS cert from Let’s Encrypt (like you should be), set sts.enabled and sts.preload to true.
Unless you specifically want IRC cloaks to indicate position, status, or affiliation, set lookup-hostnames: true and forward-confirm-hostnames: false.
Always make a cool MoTD. It’s essential for any IRC server.² I recommend using something like TAAG to come up with it.
You may want to enable email authentication but it’s a pain to set up properly. I haven’t bothered.
I recommend setting channels.default-modes to +nts. The +s flag just indicates that it’s a secret channel and won’t show up in the global list when someone runs /list. After creating a channel, if you want it publicly listed, just run /mode -s.
You may want to uncomment opers.admin.modes but it can get very spammy when there are a lot of people on your server.
If you plan to leave history.enabled: true and store channel message history server-side, I highly recommend setting datastore.mysql.enabled to true and going through that configuration.
Roleplay can be fun so it’s a good idea to look through that section.
If you enabled datastore.mysql, also enable history.persistent
For privacy reasons, I highly recommend setting history.persistent.registered-channels to "opt-out". Message history will not be stored by default but the channel owner can decide to enable it if they wish. Same goes for history.persistent.direct-messages.
I recommend enabling both of the options under history.retention.

Running the server

If you’re using self-signed certs, run ./oragono mkcerts and make sure the paths are correct in your ircd.yaml. Assuming your config is valid, you should be able to run ./oragono run and connect to it. If you can’t, make sure port 6697 is open, your credentials are correct, and nothing is wrong in the config.

You can always run Oragono in tmux or something but it would be much better to do it with systemd, OpenRC, runit, etc. I personally use systemd and this service file should go in /etc/systemd/system/oragono.service or something similar.

[Unit]
Description=oragono
After=network.target
Wants=mysql.service
After=network.target mysql.service

[Service]
Type=simple
User=oragono
WorkingDirectory=/home/oragono/oragono
ExecStart=/home/oragono/oragono/oragono run --conf /home/oragono/oragono/ircd.yaml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
LimitNOFILE=1048576

[Install]
WantedBy=multi-user.target

Run the following commands to ensure Oragono starts when your server boots.

systemctl daemon-reload
systemctl enable --now oragono

Commands

As I said in the first section, IRC has a lot of commands and they can be confusing to work with. I still don’t know everything I should. That said, here are a (very) few of the essentials:

Command	Example	Operation
`/quote`	`/quote helpop`	Send argument as a command to the server
`/join`	`/join #channel`	Join a channel
`/leave`	`/leave`	Leave a channel
`/me`	`/me yawns`	Result will look like `* Amolith yawns`
`/query`	`/query amolith`	Open a direct message buffer with amolith
`/mode`	`/mode -s`	Add/remove flags from a channel³
`/op`	`/op amolith`	Make amolith a channel operator
`/voice`	`/voice amolith`	Let amolith speak when channel set to `+M`

The one command every Oragono oper⁴ should know is /quote helpop index. It will list all the available commands so you can read through them and discover what each does.

You’ve reached the end of the post. You are now disallowed from telling anyone that IRC is too complicated. If you want to test a server you’re setting up, feel free to use my instance of The Lounge; it’s at irc.nixnet.services and any IRCd details can be entered but mine are default. Speaking of my IRC server, you should join #secluded and mention this post :D

A gzipped tarball is just a compressed archive like a zip file ↩︎
You should definitely join mine and look at our awesome MoTD ↩︎
See /quote help cmodes for all the flag options ↩︎
Short for IRC operator ↩︎

Replacing YouTube & Invidious

Mon, 03 Aug 2020 05:43:37 -0400

Omar Roth, the developer of Invidious, recently wrote a blog post about Stepping away from open source. While I never used the official instance, I thought this was a good opportunity to create a tool that downloads videos from YouTubers I’m subscribed to so I can watch them offline in whatever manner I prefer.

To that end, youtube-dl is by far the most reliable and versatile option. Having been around since before 2008¹, I don’t think the project is going anywhere. MPV is my media player of choice and it relies on youtube-dl for watching online content from Twitch to YouTube to PornHub to much more.

Conveniently, youtube-dl comes with all of the tools and flags needed for exactly this purpose so scripting and automating it is incredibly easy. Taking a look at man youtube-dl reveals a plethora of options but only a few are necessary.

Preventing duplicates

The main thing when downloading an entire channel is ensuring the same video isn’t downloaded more than once. --download-archive will save the IDs of all the videos downloaded to prevent them from being downloaded again. All that’s required is a file path at which to store the list.

--download-archive .archives/<channel>.txt

Selecting quality

By default, youtube-dl downloads the single file with the best quality audio and video so it doesn’t need to mux² them together after. However, I prefer to have the highest possibly quality and don’t mind waiting a few seconds longer for FFmpeg to combine audio and video files. --format lets the user decide which format they prefer and whether they want to focus on storage efficiency or quality. The basic options are best, worst, bestvideo, and bestaudio. These will download a single file that is the highest or lowest quality of both video/audio or video-only/audio-only. There are a lot of other options for more fine-grained control over what to look for but, as I mentioned, I want the highest video and the highest quality audio so I use bestvideo+bestaudio. After downloading both of those files, they will be muxed together.

--format bestvideo+bestaudio

Embedding subtitles

I enjoy subtitles but I know many people don’t so this section can certainly be ignored.

There are a few options for fetching and embedding subtitles. To get “real” subtitles that someone transcribed manually, use --write-sub. For YouTube’s auto-generated subtitles that may or may not be horribly inaccurate, use --write-auto-sub. For selecting the language, --sub-lang <language-code>, for embedding them, --embed-subs, and for selecting the format, --sub-format <desired-format>. I like using SRT files so I have that first with best beside it like so: --sub-format srt/best. SRT is preferred but, if unavailable, whatever other highest-quality format will be used and embedded instead.

--write-sub --write-auto-sub --sub-format srt/best --sub-lang en --embed-subs

Limiting downloads

When switching to this method, the initial download will pull all of a channel’s videos. I certainly don’t want this so they should be limited in some way. --dateafter and --playlist-end serve very nicely. The former will only download videos published after a certain date and the latter will only download X number of videos.

--dateafter 20200801 --playlist-end 5

EDIT: A reader sent me an email with this improvement to the archive functionality. Rather than checking the last five days of videos to see if they’ve already been downloaded, this snippet will check when the archive file was last edited and use that as the --dateafter parameter, making the script a bit more efficient.

AFTER=$(date -r .archives/"$1".txt +%Y%m%d 2>/dev/null || date +%Y%m%d)
--dateafter $AFTER --playlist-end 5

Naming format

The final parameter to look at is how to name the files once they’re downloaded. --output provides templating functionality and there are a lot of options. For this use, an acceptable template might be something like Channel/Title.ext. In youtube-dl’s templating format, that’s "%(uploader)s/%(title)s.%(ext)s".

--output "%(uploader)s/%(title)s.%(ext)s"

Getting notifications

I don’t yet have a good method for getting notifications when there are new videos but there is a simple way to get notified when the script is finished running. notify-send is one of the easiest and has pretty simple syntax as well: the first string is the notification summary and the second is a longer description. You can optionally pass an icon name to make it look a little better.

notify-send -i video-x-generic "Downloads finished" "Check the YouTube folder for new videos"

For some reason, I don’t get icons when the generic name is specified but I know the command will work on most systems. On mine, I have to pass the path to the icon file I want: -i /usr/share/icons/Suru++-Dark/apps/64/video.svg

Writing the script

I want to store the videos in ~/Videos/YouTube and I want the archive records stored in .archives so the first line (after the shebang³) creates those directories if they don’t already exist and the second enters the YouTube folder.

mkdir -p "$HOME/Videos/YouTube/.archives"
cd "$HOME/Videos/YouTube"

From here, a way to reuse the youtube-dl command is necessary so parameters can be changed in one place and they’ll apply to all channels. Functions are intended for exactly this purpose and are formatted like so:

functionName () {
    # Code here
}

I’ve named the function dl so mine looks like this:

dl () {
    AFTER=$(date -r .archives/"$1".txt +%Y%m%d 2>/dev/null ||   \
        date +%Y%m%d)

    youtube-dl --download-archive .archives/"$1".txt -f         \
        bestvideo+bestaudio --dateafter 20200801 --write-sub    \
        --write-auto-sub --sub-format srt/best --sub-lang en    \
        --embed-subs -o "%(uploader)s/%(title)s.%(ext)s"        \
        --playlist-end 5 "$2"
    sleep 5
}

Because it’s in a function that’s called repeatedly, the AFTER variable will be reevaluated each time using a different archive file to ensure no videos are missed. The backslashes at the end (\) tell bash that it’s a single command spanning multiple lines. At the bottom, sleep just waits 5 seconds before downloading the next channel. It’s unlikely that YouTube will ratelimit a residential address for this but it is still possible. Waiting a bit before continuing reduces the likelihood further.

Note the use of "$1" and "$2" in the archive path and at the very end of the youtube-dl command. This lets the user define what the archive file should be named and what channel to download videos from. A line using the function would be something like:

dl linustechtips https://www.youtube.com/user/LinusTechTips

The result would be this directory structure:

YouTube
|-- .archives
|   \-- linustechtips.txt
\-- Linus Tech Tips
    \-- They still make MP3 players.mkv

The last line is the notification command:

notify-send -i video-x-generic "Downloads finished" "Check the YouTube folder for new videos"

Finished script

This the script I have in use right now.

#!/bin/bash

mkdir -p "$HOME/Videos/YouTube/.archives"
cd "$HOME/Videos/YouTube"


dl () {
    AFTER=$(date -r .archives/"$1".txt +%Y%m%d 2>/dev/null ||   \
        date +%Y%m%d)

    youtube-dl --download-archive .archives/"$1".txt -f         \
        bestvideo+bestaudio --dateafter $AFTER --write-sub      \
        --write-auto-sub --sub-format srt/best --sub-lang en    \
        --embed-subs -o "%(uploader)s/%(title)s.%(ext)s"        \
        --playlist-end 5 "$2"
    sleep 5
}

dl vsauce               https://www.youtube.com/user/Vsauce
dl avikaplan            https://www.youtube.com/user/AviKaplanMusic
dl robscallon           https://www.youtube.com/user/robs70986987
dl logosbynick          https://www.youtube.com/channel/UCEQXp_fcqwPcqrzNtWJ1w9w
dl andrewhuang          https://www.youtube.com/user/songstowearpantsto
dl brandonacker         https://www.youtube.com/user/brandonacker
dl lastweektonight      https://www.youtube.com/user/LastWeekTonight
dl bingingwithbabish    https://www.youtube.com/user/bgfilms

notify-send --icon /usr/share/icons/Suru++-Dark/apps/64/video.svg "Downloads finished" "Check the YouTube folder for new videos"

Automation

This is a very simple process.

Store your script wherever you want but take note of the directory.
Run crontab -e
- If you don’t already have a cron utility installed, try cronie. It should be in most repos.
Paste and edit: 0 */6 * * * /home/user/path/to/script.sh
Save
Exit
???
Profit

The pasted line runs the script every 6th hour of every day, every week, every month, and every year. To change the frequency just run crontab -e, edit the line, and save. Crontab Generator or Crontab Guru might be useful if the syntax is confusing.

Have fun!

Edits

Synchronised --dateafter parameter with last modified timestamp of the archive file — thank you Dominic!

The first commit for the current youtube-dl repository was made on 21 July 2008 and it references “the new youtube-dl”, which suggests versions prior. ↩︎
In the digital media world, muxing is process of combining two or more files into one. This might be a video track, multiple audio tracks, and/or subtitle tracks. ↩︎
A shebang is a sequence of characters that tell your program loader what interpreter to use. #!/bin/bash is what you would use if it’s a bash script. To use a Python interpreter, #!/usr/bin/env python will use the program search path to find the appropriate executable. ↩︎

100 Days To Read

Thu, 23 Jul 2020 00:48:16 -0400

The idea

I’ve found it very difficult to stick to a regular schedule for #100DaysToOffload for various reasons. Chief among them is simply that I don’t have enough time with everything else I have going on; what I want to write and the ideas I’ve had take longer to get on paper (or screen) than I’m able to dedicate at the moment.¹ However, I love the intent behind it and want to continue in a somewhat less involved manner. Enter #100DaysToRead (dead link to hashtag on fedi instance).

The “rules”

Quotes are used because they’re not solid rules; it can be hard to learn something significant from fiction, you might miss a day here and there, what you learned could be a bit personal and not really suitable for social media, any number of things might result in “breaking” one or all of them. Just do your best. :simple_smile:

Read for an hour a day

I recommend using some kind of timer or stopwatch to track how long you’ve been reading. A stopwatch would be best as it allows you to get sucked in without ringing and making you feel as if you need to stop; the pull of real life is great and audible reminders only serve to exacerbate the urgency of rejoining the rest of the world. Part of the idea behind this is not only to learn something but to enjoy it and that’s difficult when you’re anxiously waiting for a timer to ding so you can get back to watching a show. I spent a lot of time with books when I was younger then fell completely out of the practise once I got more involved with school and want to make it a habit once more.

Take notes

The main goal of this challenge is to learn things and the effects of this rule are twofold; you’ll certainly be learning a lot but it will also provide material to write about in the future.² Take notes in whatever manner you prefer, from writing in the margins³ to writing on the wall, though the latter might not be the greatest idea. I personally plan to put my notes in a Zettelkasten created with vimwiki along with the rest of my notes.⁴ I will first write down whatever thoughts I have in my pocket notebook (these will likely just be a short summary with the page/paragraph as reference⁵) then, directly after I’ve finished the session or later that day—the same day!—I’ll go through the notes and expand them a bit. I want the full thought stored in my Zettelkasten for use in the future; whenever I read another book and have a related thought, I’ll return to this note and add links between them.

Post a short summary

Whatever you’ve learned that day, post a condensed version along with the book/page/paragraph on social media using the #100DaysToRead tag! Expanding a short summary then condensing it again with different wording helps to ensure you understand the material and will aid in recollection. Posting about it will give others the same information and might even pique their interest about what you’re reading.

Thoughts

Inspiration for this comes partly from episode 112 of The Social-Engineer Podcast, partly from me wanting to learn more, and partly from me wanting more material to write about. There is so much knowledge in books but it takes a great deal of discipline to sit down every day and read for an hour when there are upgrades to perform, emails waiting for replies, games to play, shows to watch, and so much else. Another small aspect of this is partly to alleviate those concerns and stresses; it’s a time to sit down, lose yourself in a book, and forget about the outside world.

What I’m starting with

Fittingly, I plan to begin with How to Read a Book by Mortimer J. Adler. It provides an in-depth discussion on reading critically and learning as much as possible from a given book. Adler doesn’t push a “one-strategy-fits-all” method either. He goes through a variety of approaches for different genres and encourages a deep level of thinking for all, fiction included. I’m looking forward to starting it tomorrow!

With finding links, proofreading, revising, expanding, and shortening various sections, this short post took me over two hours to write. ↩︎
Maybe a #100DaysToOffload Take 2! ↩︎
I physically can’t bring myself to do this but some people love marginalia and actively seek books with them. However, it’s a very effective technique and might be fun to follow your thought trail when re-reading a book. ↩︎
I am currently evaluating Anytype as a tool for creating and maintaining a Zettelkasten as well as storing other types on information. At the moment, I can only use it on Windows so it’s inaccessible when I really need it but the developers say a Linux build will be ready soon™ ↩︎
I plan to format these like p20 ¶2. The second symbol is a pilcrow or, more commonly, a paragraph mark. Usage of that and the section mark (§) are detailed in Matthew Butterick’s Practical Typography. ↩︎

New fonts & site changes

Sun, 19 Jul 2020 01:43:11 -0400

I just got a couple of new (and rather expensive) fonts. So far, I’m incredibly happy with them and think it was money well-spent for a few reasons. Created by Matthew Butterick, Valkyrie and Concourse are simply beautiful. I don’t know which I like more but they both have their places on this website and will find their way onto others in the future. Because Concourse is a sans-serif, it will be the default used all across Secluded.Site. Valkyrie is a serif font and, though the type seems to be losing its place on the web, I think it adds a lot when reading content that’s focused on a narrative rather than simply being informative. Because of that, it will be used for my posts about pipe smoking and Dungeons & Dragons. I might come up with other categories where Valkyrie fits as well but it will likely remain limited to those two.

In addition to simply changing the fonts, I’ve also modified some styles on the site. Headers (such as the title of this post) are now in proper small caps¹ and I did some work to improve font size relative to the content width. Previously, the text was smaller than I would have liked which meant longer lines; there are some studies² indicating that lines with a lower character count, while decreasing reading speed,³ are generally more comfortable and hold the reader’s attention more effectively. The width hasn’t changed but the size has increased and thus decreased the number of characters per line.

One of the reasons I decided to buy the fonts was simply that I love the way they look and they have a lot of features I wanted. In addition to that, however, I also wanted to support Matthew. His book, Practical Typography is an amazing resource for anyone that does anything with text. He has put a massive amount of work into it and simply asks readers to pay. There is no paywall and no ads either; it’s completely supported by readers. There are a few ways to contribute and one of them is buying his fonts. Interestingly enough, if you read his first, second, and third year summaries, more people bought his fonts for a higher price than simply paid him directly:

What’s most interesting to me, however, is that so many more readers were willing to buy a font license (at $59–299) than to make a direct payment (at $5–10). Don’t get me wrong—I’m utterly grateful. But it’s counterintuitive: I never expected that the cheaper option would be so much less popular. Economists, I invite your explanations.

— The Economics of a Web-based Book: Year One

I won’t speculate as to why but it is thought-provoking. Regardless, his approach is very similar to that of any developer who creates open source software. They pour their time and energy into projects they might get no compensation for and rely on the community to fund their efforts. I have a great deal of respect for these people and try to support them whenever I’m able. $200 is a small price for two incredible fonts in addition to Practical Typography!

Small caps are a font style where the letters that would otherwise be lower case are a shorter version of the upper case form. Many people simulate small caps by reducing the font size of regular capital letters to that of lower case characters but the results are too tall and their vertical lines too thin; they’ve only been scaled down. Proper small caps are an additional set of letters added to a font file as OpenType features. For a comparison, see the related page on Practical Typography. ↩︎
I took mental note when reading an article about it but have since forgotten what it was and can’t find it again. There are, however, various other sources, such as The Elements of Typographic Style Applied to the Web and Readability: the Optimal Line Length. ↩︎
A rather short study from Wichita State University found that increased line length resulted in greater reading efficiency. However, there were no significant effects on comprehension and the preference for longer or shorter lines was fairly evenly distributed. ↩︎

LWN Theming

Fri, 19 Jun 2020 16:41:16 -0400

After a poll by @karan, I started thinking about where I get my news and decided to subscribe to LWN. Their content is really good, they’ve been running for a long time, and I want to support their work. However, I think the default theme is quite terrible. I spent about an hour last night messing with it and I think I improved it significantly; it’s based on the theme of this site.

Screenshot of my LWN theme

After subscribing, navigate to your account page then click the link under Customization. The following tables are the options and values I’ve set for my theme but note that I have not changed the Old (seen) comment background color as I haven’t had an opportunity to experience what that looks like yet. Once I do, I’ll update my theme and this post accordingly.

Display preferences

Option	Value
Page background colour	`#292a2d`
Left column background	`#292a2d`
Middle column background	`#292a2d`
Headline background	`#3b3d42`
Form/byline background	`#292a2d`
Sidebar background	`#292a2d`
Text colour	`#f5f4f7`
Link colour	`#fe5186`
Visited link colour	`#d0738f`
Quoted text (in email) colour	`#7ec699`
Old (seen) comment background colour	`#cccccc`
Navigation box on printable page	✅
Minimum width of main text column (em)	`40`
Maximum width of main text column (em)	`50`
Display old parent in unread comments screen	:large-green-square: (unchecked)

New page engine preferences

Option	Value
Use the new page engine	✅
Left column color	`#292a2d`
Maximum width for handset presentation (em)	`48`
Fixed navigation menu on small screens	✅
Font family to use	`:white_check_mark: sans-serif`

Quoted text preferences

Option	Value
Quoted text style	`:white_check_mark: normal`
Quoted text weight	`:white_check_mark: bolder`
Quoted text colour	`#a9a9b3`
Quoted text background	`#292a2d`

After applying the changes, this is what comments look like:

Screenshot of LWN comments

Conclusion

I’m already happy with my LWN subscription and plan to remain subscribed for a long time. The recent post about Tools to improve English text looks especially interesting and something I’m already looking into for Arbor’s documentation (big blog post about the project coming soon™). If you have an extra $3.50/mo, I really encourage you to subscribe to LWN. News is important and high-quality news especially so. Blinding though the default theme may be, LWN is, bar none, the best news site I’ve ever seen and I want to ensure they stick around.

This was day 12 of #100DaysToOffload, an awesome idea (dead link to fedi post) from Kev Quirk. If you want to participate, just write something every day for 100 days and post a link on social media with the hashtag!

Documenting With MediaWiki

Thu, 04 Jun 2020 12:23:34 -0400

Much to my chagrin, I’ve hardly posted anything at all the past couple of weeks. This is partly due to university summer classes starting and partly due to me putting some work into NixNet’s documentation. After listening to Episode 4 of 2.5 Admins, I decided to change some things up with my infrastructure planning and, instead of automating all the things, document it first. Only after writing extensive documentation will I look into automating portions my setup, like hardening a server directly following installation. To that end, I’ve decided to use MediaWiki.

After downloading and installing MediaWiki, a very straightforward process,¹ the next step is configuring it. There is of course a guide but I think it can be useful to see someone else’s configuration to get ideas from as well, especially considering how many extensions there are. I won’t go through all of the settings, just the maybe less obvious ones.

URLs

The first thing in LocalSettings.php is $wgScriptPath. Different wikis take vastly different approaches for this. Some fill that variable with "/w" (default), some with "/view", and some with something entirely different. Wikipedia and all of its children use "/wiki". While well and good, the default configuration will have your URLs appearing as example.com/wiki/index.php?title=<page> and this is bad practise for SEO; if you want your pages easily discoverable, the URLs need to be a bit shorter. The easiest way I’ve found to do this is add all of six lines to my NGINX config and set $wgScriptPath to "" (an empty string).

location / {
    try_files $uri $uri/ @rewrite;
}
location @rewrite {
    rewrite ^/(.*)$ /index.php?title=$1&$args;
}

The snippet above tells NGINX to rewrite all of your site’s base URLs and remove index.php?title= from them. This is a similar approach to what Mozilla has done. The result is cleaner URLs that comply with SEO best practises and a setup that avoids moving MediaWiki to the site’s root.

Mobile view

I see a lot of MediaWiki instances without a good mobile version and, other than keeping the number of extensions down, I don’t really understand why. Setting it up is incredibly easy and gives everyone a much better experience. The Minerva Neue skin is designed specifically for use on mobile devices and is also much more aggressive about optimisation. Though editing is a terrible experience, it also looks great on desktop. The MobileFrontend extension is used to detect the reader’s device and serve them either the configured desktop skin or Minerva Neue. You could serve a different skin on mobile but I’ve found that Minerva Neue looks the best by far.

To set them up, you’ll need to download the skin and the extension. From there, you’ll need to add a few lines to your config file. On a side note, I love how dynamic MediaWiki can be, especially with downloads; providing a copy/paste extraction command that doesn’t use wildcards and puts it in the correct directory is awesome.

# I recommend putting this with the rest of your extensions
wfLoadExtension( 'MobileFrontend' );

# These can go wherever you want but together is better
$wgMFDefaultSkinClass = 'SkinMinerva';
$wgMFAutodetectMobileView = true;

With the skin and extension in place and those lines in your config, save and reload and there should be a link at the bottom of your wiki called Mobile view. Click it and you’ll see Minerva! On a phone, MobileFrontend will automatically serve it but you can force your default theme by clicking Desktop view in the same location.

Discussion pages

The default discussion page for MediaWiki works but, unless you’re already used to it, it can be quite odd for new people. That’s where the StructuredDiscussions extension comes in. Here’s a comparison of before and after enabling it.

As I said, the left works but most people wouldn’t know what to do when given the default MediaWiki editor and it raises the barrier for entry. The right is much more user-friendly and works exactly how one would expect. StructuredDiscussions does have a few dependencies but they’re easy to add. Echo is for notifications and the others are included by default. After installing it, and StructuredDiscussions, add the following lines to your LocalSettings.php.

# With the rest of your extensions
wfLoadExtension( 'Echo' );
wfLoadExtension( 'Flow' );

Running the following commands is necessary because MediaWiki’s database needs modification to support the extension. General talk pages are --ns=1 and User:Talk pages are --ns=3. If you only want Structured Discussions enabled for one of them, only run that one. I personally recommend doing it for all.

php maintenance/populateContentModel.php --wiki=somewiki --ns=1 --table=revision
php maintenance/populateContentModel.php --wiki=somewiki --ns=1 --table=archive
php maintenance/populateContentModel.php --wiki=somewiki --ns=1 --table=page

php maintenance/populateContentModel.php --wiki=somewiki --ns=3 --table=revision
php maintenance/populateContentModel.php --wiki=somewiki --ns=3 --table=archive
php maintenance/populateContentModel.php --wiki=somewiki --ns=3 --table=page

After that, add these to actually enable the extension. To temporarily disable it, you can comment them out but I don’t know how that will affect talk pages that already exist.

# Flow (discussions) configuration
$wgNamespaceContentModels[NS_TALK] = 'flow-board';
$wgNamespaceContentModels[NS_USER_TALK] = 'flow-board';

Subpages

One of the features I’ll be making heavy use of for my Privacy Policies and Terms of Service pages is Subpages. This allows you to create pages entitled Parent/Child and the child automatically links back to the parent at the top. This can be seen in Mozilla and Arch Linux’s wikis right under the header and in mine as well. Enabling it is quite simple; just add the following line to your config.

## Enable subpages for all namespaces
$wgNamespacesWithSubpages[NS_MAIN] = true;

Syntax highlighting

The final configuration change I’ve made (so far) has been to enable syntax highlighting in the default editor with CodeMirror. After installing it, add these lines to your config and you’re done!

# Place with the other extensions as always
wfLoadExtension( 'CodeMirror' );
# Enables it by default but allows users to disable it
$wgDefaultUserOptions['usecodemirror'] = 1;

Editing in Vim

The final tip I have is that you can edit pretty much any MediaWiki instance in Vim, including Wikipedia itself, with a simple plugin. The only drawback I’ve found is that, unless you store your password in your config, you’ll have to enter it every time you close and reopen Vim. You can also give Vim Wikitext syntax highlighting for creating MediaWiki pages when offline. A few days ago, my wiki was completely offline while taking a disk image backup but I still wrote the majority of the libvirt and Debian pages while I waited and the highlighting was really nice.

This was posted as part of #100DaysToOffload, an awesome idea (dead link to fedi post) from Kev Quirk. If you want to participate, just write something every day for 100 days and post a link on social media with the hashtag!

If you’re having issues, feel free to contact me and I’ll help where I can. ↩︎

A (Mostly) Google-Free Android

Mon, 18 May 2020 15:28:02 -0400

Let me put a little disclaimer right here at the beginning: I don’t use my mobile phone how a lot of people do so your mileage will vary. I also say “Mostly” in the title because it’s incredibly difficult to completely remove Google from Android though some projects have done a very good job of it.

My motivation

In short, I value my privacy and Google is about as far from privacy-friendly as you can get. What information algorithms are capable of extrapolating given enough data is downright scary and that is Google’s entire business model. In addition, the company itself is really quite terrible, from launching a censored search engine in China and selling AI tech to the US military to mishandling sexual assault cases and forcing people onto Google services with sheer market dominance.

I do not like Google and I do not want it on my phone.

What I’m using

I have the Redmi Note 5 Pro and love it. Specifically, one of the things I like is Xiaomi’s business model. It’s exactly the same as Google’s—data collection and advertising—but it’s incredibly easy to circumvent. Xiaomi not only uses its MIUI (me-you-eye) for user tracking and profiling but it also displays ads on the lock screen and elsewhere. Because of all that, they’re able to seriously drop the price on their phones and almost sell them at no more than the hardware and manufacturing cost.

Circumventing the data collection is as easy as flashing your own ROM; I prefer AospExtended though LineageOS is a much simpler and “cleaner” Android experience. Many of the installation guide will tell you to flash some Open GApps package but I don’t. Others will say to use microG, which is much better but I decided to even omit that the last time I flashed my phone. Thus, I have absolutely no compatibility with Google Services and apps that break without it, well, break.

I also have the Mi Band 4 which does give Xiaomi the ability to collect a plethora of biometric data as well … if I use their app. Instead, I like Gadgetbridge from F-Droid. I do occasionally want proprietary apps such as Linguee for English/German translation and I get those through Aurora rather than Google Play.

What it’s like

I mentioned that some apps will break without Google Services, however, I find that they are solidly in the minority; most proprietary applications will work perfectly fine without Google Services or microG though you won’t get push notifications. That’s really not a big deal for me because I’ve been moving to a more minimal mobile experience and do most things on my desktop anyway. This is closely related to the disclaimer at the top. I rarely use my phone for anything other than communication through open source apps and listening to podcasts; I don’t even have an email client installed (but if I did, it would be K-9 Mail.) In all, it’s perfectly useable but don’t expect your banking application to work.¹

Why would you bank on mobile anyway? Mobile platforms are some of the most insecure and something that sensitive should be kept far away. ↩︎

The House of San Balay

Thu, 14 May 2020 16:04:05 -0400

Today, our primary purpose was to gather information. We rose, ate a quick breakfast, and then headed into the city. Saltmarsh is a very busy, bustling little town. Ships were loading and unloading at the docks, there were taverns, historical centres, statues, restaurants, people going about their day and hurrying off in this direction or that, etc. In the distance and to the right, we noticed a little house on a cliff overlooking the ocean. That was the house we were to inspect.

As a sage, I’m generally knowledgeable about academic locations. That includes museums and there was just such a place in Saltmarsh. It’s run by a few of the more … experienced village elders who have been around for some time. I headed in that direction with Iliris and Doctor Reed following further behind. However, Doctor Reed focused more on finding other villagers he could glean some information from. As we ventured closer to the Historical Society, he did find one and asked about the “fancy house on the hill”. The man’s response was that it would soon be torn down; the council spent quite a lot of money to commission some warships and that cliff was where they planned to provision them with weaponry. After cautioning us to avoid it, he bade us farewell and continued on his way.

At the historical society, I inquired about the house on the hill as well. One of the elders said that the former owner of the residence, San Balay, was haunting it and most people wouldn’t go near the house anyway; there were monsters living in the garden who attacked anyone that attempted entry. Another said that it was a relatively small troll and that she had seen it with her own eyes. Yet another said it was not a troll, just a rather large rodent. The last elder dismissed the others with a wave of his hand saying it was just the town bum rummaging in the trash and he didn’t even live near the house. The conflicting reports in mind, I turned to Iliris to see if he had anything further to add.

He walked up to the oldest man and asked if he could point him to someone able to sell him an estate in town. The old man said that Iliris wanted the Dock Master, Anders Solnar, as he was in charge of most things. At that, Iliris simply left and waited by the building entry.

I was unsatisfied with the information we had been given so I stayed and asked a few more questions about San Balay himself. He came into the town and took up residence in an apartment for a long time. No one knew anything about him, he never talked to anyone, and no one could figure out what he did for a living. One day, he plopped down a ton of money to buy the house in the hill, moved in, and no one ever heard from him after. He occasionally came into town for food but nothing else. He hadn’t been seen in five years so everyone assumes he is dead. Thanking the old ones for their help Dr. Reed and I join Iliris outside the building.

By that time, it was midday and the town was still busy. Iliris suggested that Dr Reed hide his armour and I hide my quarterstaff. After doing so, he cryptically bade us follow him, fluffing up his coat and donning an air of importance. He took off in the direction of the dock where we were directed to a fancy, very ornamental ship that looked as if it had been repurposed for an office.

Remaining puffed up, Iliris approached Solnar saying that he wanted to buy property here and he already owned estates in Neverwinter, Waterdeep, and a number of other cities. The Dockmaster stroked his beard, eyed Iliris’s gilded coat, and said that they had previously planned to demolish it but they were open for negotiation. Iliris replied by saying that his company was looking to expand their business to the city, to which said that things can be negotiated and that the house is available for a price; they could part with it for 30,000 gold pieces. Iliris asked if there was anything he should know about it before making his counteroffer. Solnar replied saying that there were local children’s stories about it but brushed the question off. Negotiations continued as they discussed prices, local opinion, what would be required for it to be liveable, and so on. Iliris concluded the discussion by saying that he and his two associates (Dr. Reed and I) would go by the estate to determine its value for themselves. In the ensuing discussion, the dock master said that there was a back door and that we should be wary of the garden; a group of weasels had taken up residence in the vicinity. Thanking him for his time, we took our leave.

We set off for the residence and, on the way, came upon another house inhabited by a Minotaur. Dr. Reed and I entered, intending to inquire a bit more about the house; he lived closer than anyone else so he surely must have had some good information. As we went to walk through the doorway, an old friend of mine, Arrod the Silent, appeared beside me. There was no sound so, having already turned back inside, the Minotaur didn’t notice. The rest of us, however, were startled but we didn’t want to alarm our host and acted as if he had been with us the whole time. The whole encounter was rather awkward and we didn’t learn much. After leaving, Iliris roughly confronted Arrod and demanded to know who he was. I hadn’t seen him for many years and wasn’t sure myself so I did my best to explain.

Arrod hailed from the Town of Old Host, a hub for adventurers in the Kingdom of Dugall. He and his friends grew up seeing brave men and women set out on their journeys and witnessed them returning to a comfortable life of wealth and fame. Fuelled by these tales of renown, they made a pact to do the same once they came of age. As the oldest, Arrod set off as soon as he turned 16, promising to return with enough experience to show the rest how things were done and keep them same. It was during these early adventures that he and I met and we quickly formed a bond. The others slowly joined Arrod and I as they grew and, on the day the youngest turned 16, we parted ways. I continued on my way and Arrod and his friends on theirs. The rest of what I know is simply hearsay; Arrod hasn’t spoken a word in many years.

The party now complete, he was unanimously appointed leader. Confident in his own skill and that of his companions, they set out to slay a strange beast. Rumours were that is was either a giant with dwarf-ism or a dwarf with giant-ism and that it was terrorizing a village to the north. They travelled several days until they came to said village. As they were making camp, the creature came back into the village and, immediately seeing them, charged. They thought it would be an easy fight but it turned out to be exactly the opposite; the beast was a towering goliath. Arrod was forced to watch as it slaughtered every member of the party. Before it had the chance to turn its attention to him, the young man fled. He spent the next few years seeking a way to bring them back and ended up finding a necromancer that agreed to assist him. Unfortunately, that assistance took a malicious form; at random times, Arrod was teleported to the Underworld where he would sift through the dead, searching for his friends. The necromancer also took his voice and that’s when he became known as Arrod the Silent.

That’s all I have time to write this evening. Hopefully, tomorrow will be a bit more calm and I’ll be able to finish recording everything that has transpired.

Calcurse Notifications

Wed, 13 May 2020 22:23:25 -0400

I recently started using calcurse for my calendar and one of its limitations is good notification support in the generally accepted meaning of the word. The developer has a different opinion and that’s perfectly alright but traditional notifications are a feature I heavily rely on and calcurse doesn’t handle handle them very well; it leaves the user to figure something out on their own. Inspired by one individual’s issue, I did just that.

A quick glance at man calcurse reveals this section:

-n, --next
    Print the first appointment within the next 24 hours. The
    printed time is the number of hours and minutes left before
    this appointment.

The output of running calcurse -n, for me and at the moment, looks like this:

$ calcurse -n
next appointment:
   [17:25] DnD on Mumble

It’s all well and good but not really something you’d want in a notification; it needs to be filtered down so it only shows the name of the event, DnD on Mumble. To do this, I turned to the man pages of standard CLI utilities tail and cut. tail allows us to filter the output to only the last line¹ with tail -1. cut is a little more complicated but will allow us to remove the first few columns of text. cut -d ' ' -f 5- is the next snippet in this one-liner. -d ' ' tells cut to use a single space as the delimiter, -f specifies the fields to keep, and -5 says to use all fields starting with the 5th because there are a few spaces preceding the content we want. Chain all of this mess together with pipes and we get:

calcurse -n | tail -1 | cut -d ' ' -f 5-

Great. Now we need to actually get a notification containing the resulting string. This can be achieved by storing it in a variable then using it with notify-send. You likely already have notify-send installed if you’re using Linux but, if you don’t, I would recommend looking around to see what’s default and using that instead.

CONT="$(calcurse -n | tail -1 | cut -d ' ' -f 5- -)" && notify-send "Calcurse Event" "$CONT"

Now we’re actually getting somewhere. With my setup, the notification looks like this:

It’s certainly passable and sufficient for some but I’d like an icon so I can see what the notification is for out of the corner of my eye and decide whether or not to glance over. Thankfully, notify-send has this built in with the -i flag.

-i, --icon=ICON[,ICON...]
    Specifies an icon filename or stock icon to display.

Now it’s just a matter of figuring out what icon to use. You can certainly pass the path of whatever image you want to it, such as ~/Pictures/calendar-icon.png, but I want something that fits in with the rest of my icons. These are found in:

/usr/share/icons/<theme>/it/depends/on/theme

I use Suru++ Dark and the icon I’m using can be found at:

/usr/share/icons/Suru++-Dark/apps/32@2x/calendar.svg

It’s different for Adwaita and all the rest though; you’ll have to do some digging. It’s also worth noting that, if you don’t have this theme installed on another device, the icon won’t show up.

After all that, here’s my notification command and a screenshot.

CONT="$(calcurse -n | tail -1 | cut -d ' ' -f 5-)" && notify-send -i /usr/share/icons/Suru++-Dark/apps/32@2x/calendar.svg "Calcurse Event" "$CONT"

The opposite of tail is head and allows for exactly the same thing in reverse: head -1 will return the first line of whatever input it’s given. ↩︎

Adding A (Better) Scroll To Top Button Without JavaScript

Mon, 11 May 2020 20:39:00 -0400

I’m a fan of using as little JavaScript as feasible on a website and implementing a scroll-to-top button in JS is just ridiculous. Nevertheless, there seems to be a plethora of copypasta for it so I thought I would write about implementing one in pure HTML and CSS. The title is just a playful poke at Kev Quirk who recently posted about exactly the same thing but with different styling 😉

HTML

There’s only one attribute to add to an existing HTML tag near the top of your page and a single line for the button itself.

For the attribute, you’ll need to use an ID. When the button is clicked, the user will be taken to whatever element has this attribute. For my site, I simply added it to the header at the very top.

<header class="header" id="top">

All that’s required for the button is:

<a href="#top"><button class="top">Top</button></a>

CSS

The basic HTML above is exactly the same as what Kev’s article has. The CSS is where ours will diverge. Having a button at the very bottom of the page is perfectly fine but I use my site as more than a blog; it’s reasonable to expect visitors to simply search for a link or whatever else and move on. Having a floating button that stays in the same place as the user scrolls is a good way to facilitate this.

.top {
  position: fixed;
  bottom: 10px;
  right: 10px;
  max-width: 50px;
  max-height: 50px;
  width: 100%;
  height: 100%;
  padding: .5px;
  border-radius: 8px;
  justify-content: center;
  background: #3b3d42;
  font-size: 1rem;
  font-weight: 800;
  text-decoration: none;
  cursor: pointer;
}

The position, bottom, and right lines are what tell your browser to render the item in the bottom right. The position is fixed so that means we can put it wherever on the page we want and it will stay there as the user scrolls. right and bottom say that the element is to be positioned 10 pixels above the bottom of the page and 10 pixels from the right. It’s rather hidden on desktop but I’m not expecting desktop users to click it very often; that’s what the Home key is for, after all, and it works across every website. I’m expecting mobile users to make use of it the most.

Pausing 100 Days to Offload

Mon, 04 May 2020 21:57:27 -0400

I’m only 8 days into 100 Days To Offload and I’ve already missed two. The biggest reason is that this is finals week and all my time right now is taken up by studying for exams. As I said on the Fediverse (dead link to post), I have been exhausted the past little while and I’m not getting nearly as much sleep as I really need. I’ve enjoyed it so far but I’m going to take a break until finals are over; I’ll still be coming up with post ideas, however, I just won’t actually write or publish them.

Day 6 Updates

Sun, 03 May 2020 01:57:03 -0400

I haven’t been able to come up with a specific topic for today so this is just a kind of generic update about me.

Zettelkasten

In my previous post about Vim, I briefly mentioned being inspired to create a Zettelkasten by Daryl Sun in his fourth 100 Days To Offload post. A Zettelkasten is a personal knowledge management tool that allows one to quickly retrieve useful information about a subject, relearn forgotten concepts, and discover connections between those concepts to form entirely new ideas. There are different processes recommended by different people but I think it’s a very personal choice and depends on what your workflow will look like. Mine will be as follows.

Take very concise notes on something I learned in a physical notebook
When I’m able, go through those notes and add them to my digital Zettelkasten, expanding them a little and fleshing the thought out more

The last step is the most important as this is the one where you sit down and think about what you’re adding and try to draw connections between it and what you already know. The goal is not to make the longest and most complete notes in the world but to add value to each concise thought by linking it with others and build a web for you to explore later. You might not see immediate benefits but a mature Zettelkasten with hundreds of entries will constantly surprise you as you tumble into your own store of knowledge and rediscover things. That surprise is actually one of the greatest benefits to this kind of knowledge management system; when something is surprising, we tend to remember it better.

Doom Emacs

A friend of mine convinced my to try Doom Emacs and, so far, I am very impressed. Emacs itself is very powerful but, from what I can tell, this configuration adds a lot of value. The main one being Vim keybindings 😉 I’m looking forward to learning org-mode and seeing what it can do for my productivity. As a text editor and programming tool, I plan to stick with Neovim on desktop/laptop, Vim on Debian-based systems, vi wherever else.

NixNet plans

Today, I fleshed out some of my thoughts on reprovisioning all of my over the summer. I’m going to have Ansible or Salt build and deploy LXC containers to a baremetal server from Hetzner running a very minimal Alpine Linux installation. Whatever setup I have for those will of course be available on Gitea. From there, my local NAS will use something like borgmatic to back up files and databases from all of my servers and LXD to create container snapshots¹. All of that will be mirrored to BackBlaze likely using their B2 model as paying per GB per month is generally the most reliable option. Under one of the others, there’s always the possibility that I might upload more than they think is reasonable and start limiting me in some way.

Short-term, I’m going to consolidate some of my servers to a single baremetal machine from Hetzner. Long-term, I’m going to look into building and racking my own servers in a datacenter in Germany, likely one of Hetzner’s. This comes with a plethora of benefits but a pretty major detriment: the up-front cost will be absolutely massive. Building a rack server worth putting in a datacenter will be incredibly expensive at the start. Following that, all I have to pay is a monthly fee for however much space it uses in the rack and it won’t be too much. Before any of that is even considered, I’m going to be spending a lot of time discussing things with my father; he did a lot of racking before he got his current sysadmin job and has a ton of advice to give, from using VoIP to powercycle the server to what networking gear to look at and how to organise everything within the rack.

I have a lot of really big plans.

This one isn’t really necessary as building the containers with Ansible/Salt is automated and it’s a simple process to rebuild them. Snapshots might just take less time to redeploy should something go wrong. ↩︎

Vim as a Markdown Editor

Thu, 30 Apr 2020 23:06:59 -0400

I’ve recently decided to attempt to keep all of my notes and everything I’ve learned in a Zettelkasten. After reading Daryl Sun’s blog post, I started looking more into the method and found it incredibly intriguing. I’ve tried the “Evernote way” of throwing everything I come across in a single place but it inevitable gets lost. I don’t remember what it was called but I tried another app that actually tags your files and organises them in a nice manner. This worked well for the most part but the graphical client was badly optimised Electron and very heavy. I’ve also tried keeping notes in books but I was never really able to keep up with any of it. The thing that is especially compelling about a Zettelkasten is that I put everything I learn in a single text file but link around to as many different ideas as I can, drawing my own connections for me to rediscover later on.

Because it’s all in a simple text file, I’m also able to create a keybinding in Sway that will open it in Vim, jump to the bottom, and have a nice markdown environment ready for me to write in. It did take a bit of configuration and looking around for different plugins but I’m very happy with what I have so far.

The first thing is telling Vim to treat all .md files as Markdown

" Treat all .md files as markdown
autocmd BufNewFile,BufRead *.md set filetype=markdown

Visuals

In a long text file with a great many lines, it can be useful to find your cursor quickly without having to search around the screen for it.

" Highlight the line the cursor is on
autocmd FileType markdown set cursorline

It can also be nice to not see a ton of [links](https://example.com) and **bold** or *italic* text everywhere. Sure, my eye has gotten used to it but still. I’d rather have my terminal actually render bold text as bold.

" Hide and format markdown elements like **bold**
autocmd FileType markdown set conceallevel=2

If you use the vim-markdown plugin mentioned further on, I recommend using its option for concealing rather than Vim’s.

Spell check

One of the things every good editor needs is spell check and Vim is no exception. This line enables spell check with British English for all markdown files.

" Set spell check to British English
autocmd FileType markdown setlocal spell spelllang=en_gb

Here’s a short crash course in Vim spelling commands:

[s to search for misspelled words above the cursor
]s to search for misspelled words below the cursor
z= to see replacement suggestions
zg to add the word to your dictionary

Goyo

The very first component is something I use across all markdown files. Goyo is one of the first plugins I install on any machine I’ll be writing with. It enables a “distraction-free writing environment” and I absolutely love it. It disables pretty much all visual elements in Vim except for what mode you’re in: visual, command, insert, etc. I have a keybinding set to quickly open/close Goyo because there is an odd issue when I switch workspaces to and away from Vim. With two taps of Ctrl+g, it’s back to normal.

nnoremap <C-g> :Goyo<CR>

Another line in my Vim config automatically opens Goyo for all markdown files:

autocmd FileType markdown Goyo

vim-markdown

That latest plugin I installed is vim-markdown and it is wonderful. I really recommend reading about all of the options but here’s what I have set.

" Configuration for vim-markdown
let g:vim_markdown_conceal = 2
let g:vim_markdown_conceal_code_blocks = 0
let g:vim_markdown_math = 1
let g:vim_markdown_toml_frontmatter = 1
let g:vim_markdown_frontmatter = 1
let g:vim_markdown_strikethrough = 1
let g:vim_markdown_autowrite = 1
let g:vim_markdown_edit_url_in = 'tab'
let g:vim_markdown_follow_anchor = 1

In addition to the rest of the awesome features, the main one I wanted is the last: follow_anchor. With this, I can create internal links within the same markdown document and jump between them with ge. It also lets me open both files and URLs from within Vim and without ever having to reach for the mouse.

General Vim things

Other, more general Vim settings that I use globally but might also be nice for editing markdown

" Have lines wrap instead of continue off-screen
set linebreak

" Gives Vim access to a broader range of colours
set termguicolors

" Converts tabs to spaces
set expandtab

" Use two spaces instead of tabs
set tabstop=2

" The same but for indents
set shiftwidth=2

" Keep cursor in approximately the middle of the screen
set scrolloff=12

" Disable mouse support
set mouse=

In all, I’m hoping that the work I’ve done today for improving my markdown workflow will help me create a more effective Zettelkasten. The big thing was really being able to follow internal links around because that’s the main thing with keeping a Zettelkasten: following your ideas to see where they lead and discovering what connections you can make to form entirely new ideas. Mine will be stored in Gitea for now but I’m thinking about putting it here at some point. It would be cool to have a map of my own mind very easily accessible from anywhere.

Edit

Time stamps

" Insert timestamp at the end of the line in this format: 20200527T113245
nnoremap <C-t><C-s> m'A<C-R>=strftime('%Y%m%dT%H%M%S')<CR>

Portable `autocmd`s

Put all the autocmd lines in the if statement so they don’t throw errors when the config is added to a version of vim without autocmd support

" Only enable autocommands when Vim supports them
if has("autocmd")
	""
	" Markdown Configuration
	""
	" Spellcheck in British English
	autocmd FileType markdown setlocal spell spelllang=en_gb
	" Automatically open Goyo
	autocmd FileType markdown Goyo
	" Hide plaintext formatting and use color instead
	autocmd FileType markdown set conceallevel=3
	" Disable cursor line and column highlight
	autocmd FileType markdown set nocursorline
	autocmd FileType markdown set nocursorcolumn
endif

I won’t keep editing this post to provide updates on my config. Instead, I recommend looking at my “production” version on Gitea.

Bluegrass Music

Tue, 28 Apr 2020 02:13:16 -0400

When I was younger, I prided myself on being a classical musician. I played piano and organ, I was in a nearby fine arts university’s choir (singing soprano of course), and, quite honestly, I was rather stuck up about it. I didn’t know any bluegrass musicians so I had never really interacted with them or gotten “into” the genre but, whenever my mother would show me a group of people with a double bass, a banjo, a mandolin, and a fiddle, I would listen for a few seconds and write it off as “boring country”. It wasn’t until I started taking lessons that I grew fond of genre.

One of the things I had always wanted to play was double bass. However, lessons were extremely expensive and the instrument was even more so. Coming from a rather poor family of just me and my mother, classical lessons were completely out of the question. She did end up finding a way for me to take bluegrass lessons at an incredibly cheap rate; I won’t say what the program is called because my name is plastered all over the internet for the branch in this area but it allows student to take lessons at a greatly reduced cost. Pricing was based on school lunch status and, with this particular branch, I was able to take free lessons and rent a bass for something like $30/semester. I picked it up quickly and started to really enjoy it, learning some classical pieces on the side and playing with a violin bow rather than the expensive bass bows. Throughout the lessons, my main goal was not to get “roped into” doing bluegrass for the rest of my life because I was entirely uninterested in that; I wanted to keep bluegrass in the back and classical in front.

Because I picked it up so quickly, the style is very common in this area, and bass players in something of a shortage, I ended up playing for a number of different groups at different levels. In one of them, the youngest member was 12 and, in another, I was the youngest with the next being 30 years older. With all of these groups, I ended up meeting many amazing and wonderful people, playing so much music, and getting to travel quite a lot. It was very slow but, about three years after first picking up a bass, I’m actively seeking out more bluegrass to learn, recently picking up fingerstyle guitar, banjo, and maybe mandolin in the future.

In opening my mind to the genre, I also discovered a lot of beautiful music that’s…not quite bluegrass but…not quite anything else I’ve heard either. I absolutely love the style and can’t wait to meet up with a friend of mine and put some pieces together. The main band I’ve been following is The Punch Brothers. Chris Thile, the leader…holy shit he’s a musician. From classical to bluegrass to jazz, he’s an absolute madman. A couple of my favourite songs that The Punch Brothers do are written by him: My Oh My, Julep, Patchwork Girlfriend, and Between 1st and A. The style is just so unique and different yet has those evident bluegrass roots underpinning it all.

Day 3

Mon, 27 Apr 2020 23:15:04 -0400

Well I had planned to write a post about music this evening but I just spend two hours making the post’s cover image, a guitar. Lately, I’ve been basing my images on Feather Icons or Font Awesome. I might download one to use as a reference, download and modify, etc. but I’ve stopped using the icons as they are. This guitar, however, is an exception; I used the Bezier Pen and created it completely from scratch. It’s still just a silhouette but I’ve always avoided this tool because it’s so hard to use. You can view it on my Gitea instance.

Anyway, this is my anti-climactic third day out of 100! Prepare for some music tomorrow 😉

Custom Streaming Setup

Sun, 26 Apr 2020 20:24:38 -0400

The other day, I decided that I wanted to start streaming. I’ll definitely be playing some games but I might also stream some other things like me playing music. We’ll see where that goes. In any case, I don’t like relying on third parties for things and didn’t want to use Twitch so I started figuring out how to build my own open source and privacy-friendly “platform” (which is really just a page.)

The search for a platform

Before settling on my own custom thing, I did some digging into ready-made platforms I could just throw on one of my servers and run. Two of the ones I found were OpenStreamingPlatform and Restreamer. The latter isn’t exactly what I was looking for but it could have worked quite well. The former, at first glance, was absolutely perfect. On a functional level, it still is. However, take a look at the installation guide.

<rant>

Steps 3 and 7 are unnecessary unless you feel like manually compiling your web server; it’s already available in the Debian repos and, by extension, Ubuntu’s. It’s even been backported to Stretch. In step 4, he has sed -i 's/appendfsync everysec/appendfsync no/'. Like so many application developers, he’s assuming that this is the only project that will be installed on the system. If someone is already using redis in production and they have a different value there, that command will fail. In step 9, the commands are copying the SystemD service files to /lib/systemd/ but this is where the package manager, apt, stores its services. When you have your own that you’re writing or copying from somewhere else, best practise is to put them in /etc/systemd/system. In addition, all of this is scripted for the “standard” install. Yes, you’re always supposed to review scripts before running them but who really does that? When I see a project whose only supported installation method is a script, I nope right on out of there for exactly this reason. I know how my system is set up and I know how I want it set up. I can’t stand it when they assume they know what’s best. Just tell me what you recommend and I’ll make decisions from there.

</rant>

NGINX & RTMP

RTMP stands for Real-Time Messaging Protocol and facilitates streaming audio, video, and other data over the internet in real-time. The NGINX module mentioned above adds functionality to NGINX that allows it to handle RTMP streams and turn them into something a browser or media streaming client can use. Connecting directly via rtmp://example.com/live/stream is not very widely supported so protocols such as MPEG-DASH and HLS are used instead.

On Debian-based systems, adding RTMP functionality to NGINX is as simple as apt install libnginx-mod-rtmp. After that, you’ll need to add some things to your nginx.conf and whatever host file you’re using for your website.

rtmp {
  server {
    listen 1935;
    application live {
      deny publish all;
      allow publish 127.0.0.1;
      live on;
      interleave on;
      hls on;
      hls_path /tmp/hls;
      hls_fragment 15s;
      dash on;
      dash_path /tmp/dash;
      dash_fragment 15s;
    }
  }
}

1935 is the default RTMP port. deny publish all means you are denying anyone from publishing a stream (that includes you. allow publish 127.0.0.1 allows local connections to publish content. I’m using this as a form of authentication—before streaming anything, I have to tunnel my connection to my server via SSH or a VPN. At the moment, I’m using SSH:

ssh -L 1935:localhost:1935 user@example.com

The other options are just the basics needed to get DASH and HLS to work. The only other thing to do is use NGINX as a reverse proxy (sort of) to serve the streams. Add this to your site’s virtual host.

location /dash {
  root /tmp;
}
location /hls {
  root /tmp;
}

That’s it! Now you’ll need to test your stream and verify that it actually works.

ffmpeg -re -i video.mp4 -vcodec copy -loop -1 -c:a aac -b:a 160k -ar 44100 -strict -2 -f flv rtmp://example.com/live/stream

This command has FFmpeg play the video and stream it to the server. You should then be able to open the stream in something like VLC or MPV and watch it from anywhere.

mpv https://example.com/dash/stream.mpd

However, I also wanted to embed it in a website and this is where it gets a little unstable.

Browser playback

dash.js is currently one of the best ways to play a live stream in a browser plus it’s pretty easy to work with. The code can be found on GitHub. Using the setup with NGINX I detailed above, this should work perfectly fine out of the box.

<div>
    <video id="videoPlayer" poster="/assets/jpgs/stream.jpg" controls></video>
</div>
<script src="/assets/js/dash.all.min.js"></script>
<script>
(function(){
    var url = "/dash/stream.mpd";
    var player = dashjs.MediaPlayer().create();
    player.initialize(document.querySelector("#videoPlayer"), url, true);
})();
</script>

Web chat

The last thing every stream needs is something for web chat. I tried a few different solutions and had mixed results. The first was KiwiIRC but the iframe wouldn’t even finish loading because it connected to so many third parties with a lot of tracking. It functions very well and I might set it up on my own site eventually but it was a bit much to go through at the time. As an intermediate solution, I embedded my instance of The Lounge, a fully-functional web-based IRC client. This loaded perfectly right out of the box but it wasn’t quite what I wanted; there were too many options and the friends of mine who tested it got frustrated because some of the essential UI elements were hidden due to the small viewport. It’s just not quite suitable for embedded webchat.

Finally, I landed on qwebirc and it was pretty much exactly what I wanted. When the iframe loads, you’re prompted to enter a nick, you click connect, wait a minute, and done! My one complaint is that the theme is very bright but I’ll work on that later on. It’s good enough for now 😉

EDIT: Since the time of writing, I have switched to self-hosting KiwiIRC so all of the trackers and third parties aren’t in use. My configs are below but I recommend going through the wiki and making your own decisions.

/etc/kiwiirc/config.conf

logLevel = 3
identd = false
gateway_name = "webircgateway"
secret = "changeme"

[verify]
recaptcha_secret = ""
recaptcha_key = ""

[clients]
username = "%i"
realname = "KiwiIRC on secluded.site"

[server.1]
bind = "0.0.0.0"
port = 7264

[fileserving]
enabled = true
webroot = /usr/share/kiwiirc/

[transports]
websocket
sockjs
kiwiirc

[reverse_proxies]
127.0.0.0/8
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
"::1/128"
"fd00::/8"

[upstream.1]
hostname = "irc.nixnet.services"
port = 6697
tls = true
timeout = 5
throttle = 2
webirc = ""

/etc/kiwiirc/client.json

{
	"windowTitle": "Secluded.Site Chat",
	"startupScreen": "welcome",
	"kiwiServer": "/webirc/kiwiirc/",
	"restricted": true,
	"hideAdvanced": true,
	"showAutoComplete": true,
	"showSendButton": true,
	"sidebarDefault": "nicklist",
	"theme": "dark",
	"themes": [
		{ "name": "Default", "url": "static/themes/default" },
		{ "name": "Dark", "url": "static/themes/dark" },
		{ "name": "Coffee", "url": "static/themes/coffee" },
		{ "name": "GrayFox", "url": "static/themes/grayfox" },
		{ "name": "Nightswatch", "url": "static/themes/nightswatch" },
		{ "name": "Osprey", "url": "static/themes/osprey" },
		{ "name": "Radioactive", "url": "static/themes/radioactive" },
		{ "name": "Sky", "url": "static/themes/sky" }
	],
  "buffers" : {
    "messageLayout": "compact",
    "show_timestamps": false,
    "show_hostnames": false,
    "show_joinparts": false,
    "show_topics": true,
    "show_nick_changes": true,
    "show_mode_changes": false,
    "traffic_as_activity": false,
    "coloured_nicklist": true,
    "colour_nicknames_in_messages": true,
    "block_pms": true,
    "show_emoticons": true,
    "extra_formatting": true,
    "mute_sound": false,
    "hide_message_counts": false,
    "show_realnames": false,
    "default_kick_reason": "Your behaviour is not conducive to this environment.",
    "shared_input": false,
    "show_message_info": true,
    "share_typing": true,
    "flash_title": "off",
    "nicklist_avatars": true,
    "show_link_previews": true,
    "inline_link_previews": true,
    "inline_link_auto_preview_whitelist": "secluded.site|nixnet.services",
    "channel": "#secluded"
  },
	"startupOptions" : {
		"server": "irc.nixnet.services",
		"port": 6697,
		"tls": true,
		"direct": false,
		"channel": "#secluded",
		"nick": "viewer?",
		"greetingText": "Welcome!",
		"infoBackground": "",
		"infoContent": ""
	}
}

Actually streaming

Once you’re ready to start streaming content, I recommend using OBS Studio. If you’re noticing issues with stream performance, play around with your output resolution and FPS—those are the biggest factors. To use OBS with NGINX, you’ll need to go to Settings, Stream, and set Server to rtmp://localhost/live/. If you’re using my configs as they are, the key will need to be stream. Literally every component requires specific paths so, unless you’re careful, things will break and you’ll spend hours trying figure it out like I did. Also don’t forget that the connection has to be tunnelled if you want authentication as I mentioned above. If you don’t have localhost:1935 on your streaming machine tunnelled to port 1935 on your server, OBS is going to throw errors about not being able to connect.

Summary

I’m pretty proud of the set up I have now but it could still do with some improvements. For example, I plan to mess with the CSS and make both the video and chat panes much wider as well as side-by-side rather than on top of each other. Everything is crammed together and it’s not a very good experience.

References

This post has pieces taken from a few other articles and sites that also deserve a mention as well as a read. NGINX actually has an official blog post on setting up RTMP streaming (though they compile NGINX from source as well) that was a massive help. I also found another post that is very similar to this one about HTML5 Live Streaming with MPEG-DASH. A good number of the parts are the same but I used the NGINX module in Debian repos and they used a fork of it with additional features. My NGINX setup was mostly from the NGINX blog post and the embedded stream was primarily from Inanity’s. I figured out some of the components I could use for all of this from Drew DeVault.

School...

Sat, 25 Apr 2020 22:12:40 -0400

A fedizen, Kev Quirk, issued a challenge (dead link to fedi post) yesterday and I decided to take him up on it. In the time between then and now, he’s actually set up a website for participants to submit their posts; it’s called (quite fittingly) 100 Days To Offload (dead link to website). I’m going to attempt to keep up with it for the next 100 days and see where it takes me. Because I’ll be using this blog every day, expect a lot of changes and improvements. With that out of the way, here goes!

Part of this challenge is “offloading” and one of the ways that word can be meant is to lay out everything that’s on your mind. Today, that’s school. I’m generally an incredibly laid-back person; I don’t really ever get stressed about anything. That is simultaneously a good thing and a very bad thing. Because I don’t really get stressed, I don’t feel the urgency of getting homework done, communicating with professors about late assignments, studying, the works. In the past, I’ve enjoyed the content I was learning so the fear of making a bad grade was never a motivator—it was interest in the subject and a natural curiosity. Right now, I’m not interested in any of my subjects except for German. It’s very unlikely that I will be dealing with Java in the workforce, Discrete Math is boring, and Calculus II is killing me.¹ I don’t even know if I’ll pass it this semester.

And yet…I’m still not stressed. My university implemented an optional pass-fail grading system in light of the pandemic and the physical campus shutting down. If a student is making an A, they will definitely opt out. If a student is making a C, the minimum required to move on, they will opt in. This mean the C will remain on their transcript but it won’t affect their GPA. For those wanting to get into grad school (me), it is a god send. I have been so lax this semester about doing anything for my classes that I will very likely end up opting in for all of courses except German. As I said above, I don’t even know if I’ll make a C in Calculus though that isn’t just because I haven’t done all of the work; I have one of the most difficult professors in the math department.I am worried but I’m very good at keeping that in the back of my mind under many many layers of keeping myself busy. It’s a bit like that meme of the dog saying “this is fine” while the house burns around him except I’m not looking at the fire. My head is craned towards my monitor, my fingers on the keyboard, and my mind is somewhere in a server in Germany ignoring every bit of it.

This is very much a badly-written ramble and I’m not even going to read through it before posting. I don’t like talking about this kind of thing but it feels good to get it off my chest, even if it is garbled and likely hard to read. I will try to only have a single “downer” post like this in the series; I have a few ideas for much better content.

This is published as part of 100 Days To Offload and is not indicative of the rest of the content there; most of it is much more positive. To join in, simply write a post, submit it here (dead link), and use #100DaysToOffload somewhere on your social media.

I actually took the course last semester and ended up dropping it because my grade was so bad right out of the gate. ↩︎

Part of my cellar

Fri, 17 Apr 2020 20:18:01 -0400

Continuing with my journey into the world of pipe smoking, I thought I would show what my cellar¹ looks like. It’s not much—just some jars and a pipe stand on my dresser—but it’s more than what I’ve seen some other people have². I’ll talk about tobacco in another post; this one is just about what’s on the left of the picture below. The paper is something I saw in a YouTube video and I thought it was a really cool idea; rather than pinching your tobacco out of the jar, sprinkling it into the bowl, and inevitably spilling some, simply dump it onto a sheet of paper. From there, you can pull apart any clumps that may have formed, fill the bowl, then fold the paper in half lengthwise and pour what’s left back into to the jar.

The small stand to the right of the big one is the Single Pipe Stand from SmokingPipes. I do like it but it’s really only suitable for pipes with straight³ stems; with bent stems, the mouthpiece ends up resting on the table. I haven’t tried it but I would recommend going with the solid version if you’re wanting a stand for a single pipe because it’s more versatile. The larger one, below, is the Woodmere 6 Pipe Stand from the same website. It has the same problem as the first but it’s not as pronounced; pipes with bent stems need to be pushed forward in the divot in the base so they can lean back against the bar. Otherwise, the weight of the stem and shank⁴ will cause them to fall forward.

Pipes will be described further down so the next thing is the metal object that looks like a sink drain. It’s a wind cap from The Country Squire (which also has a great podcast). I’ve found it to be very handy at my university when it’s windy. The next item is just a simple “Czech pipe tool” that can be purchased from pretty much any store that sells pipes, both brick-and-mortar and online retailers. The last thing is a Zippo pipe lighter. These are entirely different from normal Zippo lighters because they’re meant to be held sideways over the bowl of a pipe. This design lets you put the flame directly to the tobacco rather than drawing it over the side of the bowl and scorching the rim. I ordered mine from Amazon a year or so ago but have since stopped using Amazon due to ethical and privacy concerns. I can’t find the same product on Zippo’s website so here’s a link to it from Wal-mart. I also dislike using Wal-mart but it’s marginally better than Amazon.

Now the fun part 😉 The first pipe I got was the Missouri Pride from Missouri Meerschaum. An excellent starter pipe, I ended up giving it to my room mate after he showed an interest in the hobby. However, a close friend of mine had given me one of his old pipes and I fell in love with it. Unfortunately, I know absolutely nothing about it other than it was made by Mauro Armellini, an Italian craftsman who died several years ago. I’m considering sending an email to the company and seeing if they can tell me anything about it. On one side of the shank is the name Mauro Armellini, the bottom has the number 705, and the other side says Verona with the word ARCOBALENO below it. If anyone reading this knows something about the pipe, please let me know.

The first “real” pipe I bought myself was a churchwarden⁵ from Nørding Pipes. If you’re curious about the company or the founder, Erik Nørding, listen to this episode of the Country Squire Radio. After I heard it, I decided to make one of their pipes my first purchase. What I ended up getting was a Partially Rusticated⁶ Churchwarden from SmokingPipes. I’ve been using it for a month or so now and absolutely love it, especially when I’m sitting on the porch reading or going lunting⁷.

My latest acquisition is The Emerald from Missouri Meerschaum. It is a corn cob pipe but not like the Missouri Pride; this model has very obviously been sanded smooth and sealed so that it almost feels like finished wood. The stem is a higher quality acrylic than their other models and much more pleasant to look at as well. This is the model they released for Saint Patrick’s Day in 2019 but, due to popular demand, they started producing it again. I’m hoping to purchase this year’s as well and start building a collection.

This last picture is of me sitting on my porch with a book, my churchwarden, my lighter, and my pipe tool. It was a warm and peaceful afternoon and I had a strong urge to capture the moment because this is one of the big reasons I enjoy smoking a pipe. In the rigorous life of a university student, musician, and systems administrator, this is my rare chance to just slow down and simply be in the moment without worrying over anything else.

In this context, a cellar is simply a place to store pipes and pipe tobacco. When someone says they’re going to cellar their tobacco, they mean they’re going to prepare it for long-term storage. ↩︎
One was literally just a cardboard box with some jars inside and a few pipes laying on top. There’s nothing wrong with that but I prefer to have a little more space. ↩︎
The stem is the part of the pipe where the mouthpiece is. In these pictures, it’s opalescent for the first, marbled for the second, and solid black for the third. ↩︎
The shank is where the stem is inserted; it’s in between that and the bowl and made from the same material as the bowl. ↩︎
Churchwarden refers to the length of the pipe. There are many theories about why it’s named so but one I find interesting is that it’s after real churchwardens. They would have to stay up all night guarding the church and couldn’t be expected to go that long without smoking. However, the smoke from a traditional pipe would often obscure their vision because it was so close to their face. The churchwarden was invented so the bowl was significantly further away and wouldn’t get in their line of sight. ↩︎
Rustication is the process of adding texture to the bowl (or shank) of a pipe. Generally, this is done to hide imperfections in the briar so the pipe still looks good. Personally, I stay away from fully rusticated pipes not just because I don’t like the aesthetics but because the wood is likely poor quality. This is certainly not always the case, however. ↩︎
Lunting is the act of taking a leisurely stroll whilst smoking a tobacco pipe (Lunting.org). When I go hiking, I’ll often take my pipe with me; it’s a calm and contemplative time to simply think and enjoy a good tobacco. ↩︎

Site changes

Mon, 13 Apr 2020 19:50:25 -0400

I just created a new category called Meta and it’ll be used for updates about this website and about me. The first thing is that I didn’t realise until a few minutes ago that the RSS feeds only had summaries of my posts; that issue has been fixed and the full content is available in each one now. The second thing is some of my plans for this site. Until now, NixNet has been my online “home”. I’m in the process of making this my home instead. As NixNet grows, it needs to become less personal and more . . . “official” I guess. Sometime tomorrow, I plan to move all of the blog posts from there to here and make the Blog menu item lead to secluded.site. I’ll also put redirect in place so links to the old posts will lead to their new home over here.

Another one of my plans is the make the READ OTHER POSTS section at the bottom a bit more intuitive. Right now, clicking on the right arrow opens the chronologically previous post and the left arrow opens the next one out of the global list. That’s fine for now but it will be an annoyance when some of my D&D campaigns get longer or when I do a series of posts on some topic. It might end up being next week or something but I’m going to set up some better logic for determining what’s “next” and what’s “previous” as well as better visual indicators of which is which.

I don’t have any idea how I would set it up but it would also be nice to let readers pick combinations of feeds rather than having separate feeds for each one or a single feed for everything. The reason why I set up individual feeds is the same as why I’m wanting to give the option for combining them; I know the Pipe Smoking category is something few people will want to read but it’s a passion of mine and I plan to write about it anyway. The reading experience of the site as a whole shouldn’t be lessened because of it though.

Typing International Characters

Wed, 08 Apr 2020 13:21:39 -0400

My first computer was an Acer C710 Chromebook. There were a lot of problems with it but one thing I always appreciated were its dead keys. Until a few days ago, I had completely forgotten what the feature was called. Once I figured it out, however, I was able to do some digging and find the answer fairly quickly.

Dead keys

Dead keys¹ are actually a type of modifier, like Ctrl or Shift. They allow people to type accented characters that don’t appear on their keyboard. For example, I have a US keyboard and there is no enye (the diactric² mark over the ñ) as can be found on Spanish and Latin American layouts.

I’m not exactly sure why but dead keys don’t have to be held down when you want to use them but they don’t; simply strike the dead key then the character you intend to modify and the resulting accented character will be rendered properly.

Dead keys allow writers to use far more characters that just the accented ones found in various alphabets. Indeed, one can type a very wide variety of symbols:

™ © ® § ¶ ∵ € ¢ ¥ ⅞ x³ ∞ ¬ ÷ ± × ≠ ♪ ♬ ♭ ♮ ♯ → ⇒ ☭ ㉔ ⓐ ß æ ø Œ

The full list of all possible combinations (on Linux) can be found in the documentation from David Monniaux. For a shorter but easier-to-read list, refer to the GtkComposeTable from Ubuntu.

Compose key

If you write code at all, enabling dead keys alone would be an absolute nightmare. To get double quotes, you would have type " then Space every single time. The same goes for ', :, ;, ~, etc. The compose key³ makes this much less of an issue. When struck, it indicates that the next few keys (2 or more) are to function as dead keys. With this enabled, you can write code without abusing your space bar but also type résumé⁴ correctly.

I have found this absolutely invaluable in my German course. I am able to type something like Linux ist großartig without searching “eszet” and copying it from Wikipedia⁵.

Usage

How you enable dead keys or the compose key depends entirely on your operating system. I’m sure most Linux distributions that ship with a DE⁶ like GNOME, KDE, XFCE, etc. will have a GUI option in the settings. I use Arch Linux with i3-gaps and thus don’t have a GUI to manage these kinds of things. That’s where the Arch Wiki comes in.

Depending on whether you want dead keys or a compose key, there are different commands to run. I’m not sure how to enable the former—you’ll need to read the page for that yourself—but mapping an existing key to compose is really easy.

List what your options are

grep "compose:" /usr/share/X11/xkb/rules/base.lst

Copy which first column you want and paste it into this command

setxkbmap -option <option-goes-here>

I mapped mine to the right Alt key as I never use it and it’s near the space bar. The command for that would simply be:

setxkbmap -option compose:ralt

For other interesting things you can do with your keyboard, check that whole section of the Arch Wiki. It’s really one of the best resources there is for this kind of thing.

Edit

Since the time of publication, I’ve started using Wayland and configuring your keyboard with setxkbmap doesn’t work. Instead, assuming you’re running sway, add something along this vein to your config. If you want to use something other than your right Alt key, make sure you change that.

input type:keyboard xkb_options compose:ralt

They’re called dead keys because, with most keyboards and operating systems, there is no visual indication that it’s been struck; the key appears to be dead. ↩︎
Dictionary.com: “a mark, point, or sign added or attached to a letter or character to distinguish it from another of similar form, to give it a particular phonetic value, to indicate stress, etc.” ↩︎ ↩︎
Also known as a multi key ↩︎
Yes, résumé is the correct spelling. Resume is accepted but it’s more correct with the diacritical² marks. ↩︎
I also had to do the same when I wanted to add an umlaut to anything, as in über ↩︎
DE is short for Desktop Environment. If you’re not familiar with the term, a DE is basically a suite of applications and programs that make up the interface a computer user interacts with. The dock on macOS, the start menu on Windows, your file manager, these are all examples of tightly integrated applications that provide the core functionality of whatever operating system you use. ↩︎

The Guilded Mouse

Tue, 07 Apr 2020 12:53:05 -0400

A few days ago, @klaatu asked if anyone was up for a game of D&D 5e. I didn’t notice it until I saw @ShellOwl’s reply (dead link to reply on fedi) in my local timeline and simply had to join in; my last D&D campaign has been put on hold for the foreseeable future but of course I still want to play. We met up last Thursday, had our first session, and I thoroughly enjoyed myself; I’m looking forward to the next few weeks!

My companions and I have been adventuring together for some time but, until now, I never thought to record our journeys. As I had the strange feeling I should do so now, on our way to the Guilded Mouse, I picked up a spare book and additional ink. Today has been largely uneventful, however I’ll document it regardless.

A few days ago, we were invited to meet with a man named Sarus at a tavern known as The Guilded Mouse. Upon arriving in the city, we found that it was a small hole-in-the-wall place and didn’t look like much at all. Its slight appearance gave the impression of being wedged between the two much larger buildings on either side. I led the way with Doctor Reed following a few paces behind and Iliris trailing further back, not wanting to be seen as our companion quite yet.

On entering the tavern, we found two men that could have been Sarus; one with a silver cloak on the left and one clad in grey on the right. The fellow in silver looked rather out of place and uncomfortable, as if he had never hired mercenaries before. However, his garb implied a great deal of wealth and I was rather intrigued. Doctor Reed and I crossed the tavern to speak with the man as Iliris leaned against the bar and ordered a mug of ale. A roguish character, I assumed he had some plan to eavesdrop on our conversation and join in when he felt the time was right.

We walked up to the man and, peering at us amiably, he asked if there was anything he could do for us. I replied asking him if he went by the name of Sarus. He said he did not but he was looking for a band of adventurers who might help with a problem his organisation was facing. Based on his garb, I assumed he could pay well so I was certainly interested, however we had already arranged to meet with someone else. I explained this and offered to return and hear him out once we concluded our other business and he, with a very relieved expression, accepted. I turned to Doctor Reed, gave a questioning look, and received a nod in confirmation.

I crossed to the man with the grey cloak and asked if he went by the name Sarus. He replied with a question of his own and asked if we were the adventurers he was waiting for and, sitting down, I said yes. From this vantage point, I was able to get a closer look at the man; from head to toe, his garb was quite the opposite of the man in silver, favouring function over form. He wore sturdy, leather boots instead of cloth shoes, breeches with bulging pockets, a nondescript vest, and that thick, grey cloak. He introduced himself as Something Sarus—I’ve forgotten his forename—and said he was a tenured professor of History at the University of Subtleties. He went on to explain that, in his research, he had discovered what might be a very notable temple not far away, approximately two days journey, and he would like to hire some adventurers to retrieve some artefacts. Specifically, he wanted items of importance to the civilisation he was studying, the Jaundools.

Pausing for a moment, Sarus fumbled around in his pack and retrieved what appeared to be a very intricate and complex magnifying glass. He held it up and said that it would detect the kind of artefacts he wanted us to collect. Being rather scholarly, I was curious how it worked on a more fundamental level. Hesitating as if gauging my intelligence and whether or not I would actually understand him, he said that it was a device of his own creation and tuned to a very specific god. He never had the chance to actually test it in the field so he requested that we monitor it carefully and apprise him of its behaviour when we returned. Satisfied that I could be trusted with it, Sarus handed the device to me and said to turn the knob on the handle left or right to adjust it; it was rather finicky and I would have to play with it. When looking at something related to the Jaundools, the band should emit a faint green glow. As Sarus sat back, indicating he had nothing further to say, Doctor Reed leaned forward and asked a few questions of his own.

The first thing on his mind was whether or not the temple was inhabited; he wanted to know if we would be stealing from anyone. Sarus said that, as far as he knew, the temple was completely abandoned and had been for centuries. He expected that the only creatures we would encounter would be on the road there. He would go himself but the way was too dangerous and he had students to instruct. The university had graciously offered to finance the expedition and he would be able to pay us 200 gold pieces each. This was a meagre sum and, seeing both of us hesitate, Sarus quickly added that we would be able to keep any artefacts we found that were not related to the Jaundools.

At this point, Iliris came over from the bar, pulled up a chair, sat down, and got right to business. He asked what exactly we could expect at the temple and on the way there: would there just be a few small creatures easily taken care of, was there something larger awaiting us, what? A little taken aback at this blunt intruder, Sarus said that, based on the research he had conducted, the temple was completely empty. It had been lost for centuries and no one but he and the university knew it existed. Iliris peered suspiciously at the man and said, considering that he didn’t actually know for sure what was awaiting them at the temple, they should really be paid 250 gold pieces each. Uncertainty about the dangers would increase the price. Sarus quickly agreed and said that the university had a small amount set aside and he would be able to draw from it to pay us; 250 each would be fine.

Iliris then asked if there was a minimum number of artefacts we should bring back and Sarus said there was no hard minimum but he would be extremely disappointed if we returned with fewer than six small items or something of equivalent value: one large statue, a few medium-size pieces, something like that. He also said that there was no urgency in completing the expedition. He wanted us to take our time and examine everything thoroughly so we could make the most of the journey. Satisfied, Iliris rose and stepped back to the bar to finish his drink. With a covert gesture to Doctor Reed, he indicated that we had yet to decide on a meeting place once the job was completed. The Doctor asked and Sarus suggested simply seeking his office at the university.

After draining his glass, Iliris walked to the wealthy man we first met with. I was not within earshot but, from what I could see, it looked as if he took on the same attitude as with Sarus; incredibly blunt and business-like. Doctor Reed and I were content to stay where we were so we both got a drink and I ordered some food. After a short period of time, Iliris got up and simply left without so much as a nod us. We finished our food and strode outside after him. Summing up the conversation, Iliris said that the man would pay each of us 300 gold pieces if we would investigate a manor in a neighbouring town. The locals say it’s haunted by its previous owner but the city council he represents believes it to be nothing more than superstition. Regardless, they still need to put on a show for the townspeople’s benefit so he wants us to take a look and rid the place of any creatures or ghosts that may be there, however unlikely that may be.

Iliris took out a slip of paper he said the man gave him; it had a name and address on it where we could reach him once the job was complete. When I saw it, I felt a slight gust of cold air on the nape of my neck. I motioned for him to give it to me and, as soon as my fingers touched the rough scrap of paper, I got the odd feeling that whoever wrote the words was not from Baldur’s Gate—indeed, was not even from the Forgotten Realms. My mind whirled with the implication as I passed it back to Iliris and commented on the impression. Unable to investigate further, we simply let it go for now.

After a few minutes of discussion, it was decided that we would venture to the house. We travelled cautiously and chose to rest for the night by a river. Rather unfortunately, some crocodiles happened to live there. I was nearest to the water and so was attacked first and promptly knocked unconscious. I woke a few seconds later as Doctor Reed cast Healing Word and revived me. Iliris had jumped from his position further away to a tree branch and then onto the beast attacking me. Rising, I drew my crossbow and fired a bolt at the one Doctor Reed was charging; it thudded into the crocodile’s flesh and sank in. Nonetheless, when he met the animal, it snapped at him and he quickly went down, as well. Neither Iliris nor I had anything that could revive him so we focused first on slaying the beasts.

Just as I loosed another bolt at the crocodile chewing on Doctor Reed, I heard a groan and saw Iliris sink to the ground, slammed into unconsciousness by the beast he had been riding. Still determined to minimise the damage done to Doctor Reed, I took a third shot in his direction and that crocodile let out a sharp hiss just before it slunk off toward the river and died halfway there. As I made ready to cast Misty Step, Doctor Reed rose and—still reeling—tried to regain his bearings. A moment later, I appeared approximately 15 feet away from the remaining crocodile and quickly fired. The bolt sailed past and into the water. Fortunately, Doctor Reed had recovered enough to loose a bolt of his own and slay the creature.

We dragged the bodies away from the camp, returned, bandaged our wounds, ate a hearty dinner, and decided who would take first watch. Doctor Reed volunteered so I’m using a portion of this time to write. He should wake me in about an hour. In the morning, we’ll be off to Saltmarsh.

On smoking a pipe

Sun, 05 Apr 2020 21:38:07 -0400

The Lord of the Rings is one the greatest book series I have ever read as well as one of my favourite movie trilogies; when I was younger, I watched them so often that I knew almost exactly where all the scenes were in the timeline and could quote a fair few of the lines verbatim 😉 Pipe smoking was very prominent throughout, from the hobbits to the humans to the dwarves, and I was always intrigued by it. In my second year of high school/college,¹ I took a public speaking course and decided to do my persuasive speech on the topic; my purpose was not to convince people to smoke a pipe, rather that they shouldn’t judge pipe smokers as harshly. In conducting my research, I ended up wanting to try it for myself.

Another influence was likely my grandfather. I don’t remember it particularly well other than a few scattered images here and there but I do know he smoked everything from cigarettes to cigars, cigarillos, and pipes. A few days ago, my grandmother commented on my pipe stand and said he had had one very similar before his stroke.²

Shortly after my 18th birthday, I ordered my first corn cob pipe from Missouri Meerschaum and ended up falling in love. I went to my local tobacconist and asked what he recommended for someone who was just getting into it. He suggested two blends I think they created in-house; one was an aromatic³ called Indian Summer and the other was an English³ which I’ve forgotten the name of.

The first one I tried was Indian Summer as people typically start with an aromatic. It’s sort of like drinking beer before brandy (I’ve never had brandy so I don’t know what it actually tastes like); the former is palatable to most while the latter is an acquired taste. The flavour was a little odd but I enjoyed it nonetheless. The English on the other hand . . . suffice it to say⁴ that my palate hadn’t (and still hasn’t) developed that far. When I open the jar, my nose is assaulted with a smell reminiscent of burning rubber; it’s very sharp and acrid. Other than smelling it and promptly deciding to leave it for another day, that blend has stayed in the same jar since I made the purchase.

The pipe I started with, the Missouri Pride, is one that pretty much every podcast, blog post, and tutorial recommends. There’s no reason to pay over $100 for an artisan pipe when you can get a feel for the hobby spending less than $15 including tobacco, tamper, and pipe cleaners. It wasn’t a stellar experience but I would certainly recommend it to anyone that’s curious; corn cob pipes are the best way to see if you’ll enjoy the activity. In addition, many pipe smokers still buy cobs because of their low price. You can take one out with you and, if you drop and break it, you’re really not out that much. My Emerald is supposed to get here sometime tomorrow (I know that website is down at the moment; I’ll edit this and add a picture or two once the pipe arrives).

One of my favourite aspects of smoking a pipe is the “ritual” associated with it. You pick which pipe you’re in the mood for, select the tobacco, go through the stages of packing the bowl, striking the “false light”,⁵ letting it go out, tamping it down again, striking the “true light”, and then, finally, sitting back to enjoy the flavour whilst reading a good book. It’s one of the most relaxing hobbies I’ve ever had. Another aspect I appreciate is the rich history and tradition associated with pipe smoking. I may discuss this further in another post but, for now, I’ll say that tradition and history are incredibly important to me.⁶

I attended an Early College; I was taking college courses instead of some high school courses yet getting credit for both. I ended up going to high school for five years and coming out with three Associate Degrees. ↩︎
When I was 7 or 8, he had a severe stroke due to a blood clot likely caused by how often he smoked. He spent the next 9 years paralysed on his left side and wheelchair-bound. ↩︎
You can read about the different styles and flavours of pipe tobacco at the Pipedia, a fantastic resource on pipe smoking. ↩︎ ↩︎
Dictionary.com: “It is enough to say this and no more, as in Suffice it to say that the judge was furious when the invitation was withdrawn.” ↩︎
When you’re lighting a pipe, you first put the flame to the tobacco and move it around the bowl trying to evenly “toast” it, all the while drawing the flame down further by sucking as you would on a straw (not inhaling). After doing this for 15-20 seconds, you stop and let the flame die. The tobacco will fluff up from the heat (like when lighting any other fire with tinder) so you tamp it back down. The next time you light it, it will stay lit. This is the “true light”. ↩︎
Because this is my blog and I don’t have to conform to any academic standards, I’m ending it here. Goodbye and thanks for reading 😁 ↩︎

(Temporary?) Death of the Campaign

Fri, 03 Apr 2020 09:13:20 -0400

With the emergence of COVID-19, our university shutting down, and everything going remote, this campaign has ended. Our DM and a few of the other guys don’t like playing without face-to-face interaction. It’s unfortunate but I do understand; half of our sessions consisted of us being complete dumbasses and dying laughing at something stupid one of us did. I did have half-finished notes that were going to be made into stories like the first but I don’t remember enough of what else happened to complete them.

We might pick things up in the Fall once the university opens and we can move back in or we might just start a new one; it remains to be seen. Whatever happens, there will be a new post in the category.

Consuming News

Tue, 31 Mar 2020 14:08:14 -0400

I recently posted about getting through 487 feed items in less than half an hour and I thought I would write about my setup here. There are three primary applications that require some configuration:

Tiny Tiny RSS

My feed reader of choice is TT-RSS. It’s one of the most advanced readers I’ve ever used and can be tailored for any workflow. My basic preferences are below:

✅ Enable categories
✅ Combined mode
✅ Always expand articles¹
✅ Show content preview in headlines

Making use of the categories is very important; if you have a lot of feeds, getting through them is much easier when you can go topic by topic and leave some for when you have more time.

In addition to categories, the big feature I make use of is keyboard shortcuts. You can view those from the hamburger menu² in the top right at Keyboard shortcuts help. n and o is what I make use of more than any other; n goes to the next article (or scrolls in particularly long ones) and o opens the source in a new tab. This would be great except that most browsers automatically switch to that new tab. If you’re just wanting to get it up there to deal with later as I do, this diversion is incredibly annoying. Thankfully, it can be disabled in Firefox 😏

Firefox

This setting is pretty damn easy; open about:config, search for loadDivertedInBackground, and set it to true.

When you right-click something and open it in a new tab, you’re automatically diverted to it. In some cases, this is convenient but I’ve always found it annoying and worked around it by middle clicking links. Changing this setting in about:config will make it so all tabs open in the background leaving your current tab focused.

wallabag

My read-it-later application is wallabag, a libre alternative to Mozilla’s Pocket (which they still haven’t made open source 👀) I use the Firefox Add-on so simply clicking the icon will send the URL to my server for download. I also have an application on my eReader called Wallabako. It downloads articles from wallabag as ePubs so I can read online articles while I’m offline as if they were books. A dream come true 😉

Entire workflow

With all that out of the way, here’s my entire workflow.

Select topic of interest (category)
Start at the top and use n to quickly view the next headline and maybe a short preview of the content
If you want to read more, open it in the background
Continue pressing n and/or o until you get to the bottom
If you have time, move to the next category
Use CTRL+Tab to cycle through all the links you opened and send them to wallabag for consuming later

Depending on what feeds you add, you might want to disable this. Slashdot makes up the bulk of my feed items and they generally fit on one page. ↩︎
A hamburger menu is three parallel horizontal lines typically styled as a button that expands to show a menu of some kind. ↩︎

Reading Methods & RSVP

Thu, 13 Feb 2020 21:57:28 -0500

Reading methods

Today, I learned that there are three primary ways people read. The first and most common is mental reading and this is when you “say” the words in your head as if you were speaking them.¹ I find this useful when writing because it’s as if I’m actually speaking them; picking out sentences and phrases that don’t sound quite right is easier. In writing courses, the instructor’s advice is often to read your work aloud and see how it sounds as mistakes, word choices, and grammatical errors are typically much more prominent. Personally, I find doing it in my head sufficient though. Mental reading is the slowest method but also where your comprehension is at its peak; you are forced to slow down and that gives your brain more time to process the information it’s being fed. The average speed is 250 WPM.²

The second method is called auditory reading and it’s just listening to words spoken by a person or a TTS³ engine. Because listening is generally more passive, it’s much easier to completely miss individual words while still understanding the meaning of the phrase or passage. This is significantly faster than mental reading at an average of around 450 WPM. However, comprehension takes a hit because you have less time to process the information.

Visual reading is the last and fastest. The concept may be kind of hard to grasp at first but the next paragraph about Stutter will hopefully make it clearer. Visual reading is understanding the meaning of the word without having to hear it or say it in your head, recognising it based on its shape and the letters it’s comprised of. Comprehension is at its lowest here but speed peaks. The average reader who uses this method can consume 700 words per minute. To put that in perspective, it’s 2.8x faster than mental reading. While comprehension is low, it is not nonexistent. The best way to understand what I mean is to try it for yourself.

Note: Some sources say that, with practise and when done correctly, there is no difference in comprehension, rather the opposite; you retain information significantly better when speed reading properly. This is where I would recommend actually doing it and deciding for yourself.

Stutter

Stutter is a Firefox and Chrome extension that brings RSVP⁴ to your browser and lets you develop visual reading skills. It specifically makes use of peripheral reading and displays a single word at time but moves through them at rapid pace. It highlights a single character of the current word just to the left of the centre. This is because a word can usually be recognised by its first few characters; the rest aren’t as important. The highlight remains in a fixed position so you never have to move your eyes. Because of that, Stutter is able to display new words much more quickly; the average reader can usually comfortably start at 500 WPM but it is possible to reach speeds of over 1200 WPM with regular practise. I haven’t gotten that far yet 😉

For more information on speed reading, the Wikipedia page (where I got most of my information) is really interesting and well-worth a read.

Edits

@caltlgin (dead link to fedi profile) recommended flrdr, a TUI tool for reading with RSVP

The technical term is subvocalisation ↩︎
Words per minute ↩︎
Text-to-speech ↩︎
Rapid serial visual presentation ↩︎

Krozn'ik

Sun, 09 Feb 2020 01:03:03 -0500

Today was, quite honestly, average for this band. Before I get into what happened, however, I had better introduce myself. I am Krozn’ik, a half-orc. I know not where I was born save that the entirety of my village was slaughtered and I was raised by one of the knights party to the massacre. I was incredibly young at the time so he is the only father I have ever really known. We never had much but it was enough: a modest house near the centre of a small town, clothes without holes, enough food that we didn’t starve, and so on. Though Father tried to teach me the ways of the sword, shield, and spear, it wasn’t until I picked up a greataxe that he felt I had “found it”. Within a couple short years, I was wielding the weapon as an extension of my body, able to make it sing as it sliced through the air, turned on a dime, and darted through the wooden poles we set up for practice.

Once I grew to be 17 or so, father started sending me to deal with minor issues in the neighbouring villages in his stead, fending off small groups of bandits, protecting towns from parties of goblins, things like that. Eventually, our lord sent me a few hundred kilometres West to care for another village. While there, a large band of orcs raided my father’s city and slew him along with every one else. I left my people in the care of another knight and began a quest for vengeance. That is a story for another time, however.

This tale follows Angus, a dwarvish giant, a human ranger, Ryu, a barbarian called Tyler2, Valthos the Fighter, and, of course, me. It’s an odd story, taking place in the caverns of Purgatorus, but one well worth reading. I didn’t think to record our journey until the third encounter so I will do my best to recap it in the following entries. For now, this brief and inadequate introduction will have to suffice; we have just made camp and are resting for our journey back to Byron in the Cathedral of Thyatira.

Downloading courses from Linux Academy

Sat, 19 Oct 2019 01:35:00 -0400

Forward

Every month, Linux Academy releases courses for free. I’m a very busy college student and don’t have time to whirl through everything I want to before it goes behind their paywall again so I figured out how to download a course or two every month using youtube-dl.

Setup

Install youtube-dl
Make sure you have a browser handy
Create a community account on Linux Academy
Get some food
Maybe a drink
Sit back down in your chair
Spin around a bit
Read on

Downloading

Log into your account
Pick the course you want
Open the developer console and go to Network (Ctrl+Shift+E in Firefox)
You’ll want to select Media as shown in the screenshot below

In moving my posts around, this screenshot has disappeared 🤷

Click the video you want to start with
Watch the network logs
You’ll see an entry that starts with playlist (screenshot below)

In moving my posts around, this screenshot has disappeared 🤷

Right click it
Copy the URL
Paste it after youtube-dl in a terminal:

amolith@poseidon:~ $ youtube-dl https://video-cdn.linuxacademy.com/vods3/_definst_/smil:box/cdnstore/modules/lots-of-stuff-in-here

Press enter
Watch the magic unfold

At a high level, youtube-dl is acting like your browser and following the m3u playlist to download chunks of the file. After it fetches them all, it runs them through ffmpeg to stitch them together into a single video!

I found it useful to open a text editor and script downloading a whole course at a time. All you have to do is type youtube-dl -o and copy/paste it however many times there are videos. Then, copy and paste the video title in quotes after -o and add .mp4 to the end (command example below). After that, paste the URL. Do that with every video in the series, save the script, run chmod +x <script>, then ./<script> and (after a bit) you’ll have an entire course you can watch at your leasure!

amolith@poseidon:~ $ youtube-dl -o "04 - Conclusion and Next Steps.mp4" https://video-cdn.linuxacademy.com/vods3/_definst_/smil:box/cdnstore/modules/lots-of-stuff-here

NOTE: You may want to set up your directory structure beforehand so it’s easier to script the process. Here’s an example of one of mine:

amolith@poseidon:~/Videos/Courses/Ansible - Playbooks Deep Dive $ tree
.
+-- 01 - Course Overview
|   +-- 01 - About the Course.mp4
|   +-- 02 - About the Training Architect.mp4
|   +-- 03 - Course Features and Tools.mp4
|   +-- 04 - About Ansible Playbooks.mp4
|   \-- 05 - Advanced Inventory Configuration.mp4
+-- 02 - Playbook Basics
|   +-- 01 - Using YAML for Ansible Playbooks.mp4
|   +-- 02 - Creating an Ansible Play.mp4
|   +-- 03 - The ansible-playbook Command.mp4
|   \-- 04 - Understanding Playbook Tasks.mp4
+-- 03 - Essential Playbook Syntax
|   +-- 01 - Using Variables in Playbooks.mp4
|   +-- 02 - Working with Templates.mp4
|   +-- 03 - Using Ansible Facts.mp4
|   +-- 04 - Conditional Execution in Playbooks.mp4
|   +-- 05 - Using Loops in Ansible.mp4
|   \-- 06 - Working with Handlers in Ansible.mp4
+-- 04 - Advanced Playbook Syntax
|   +-- 01 - Executing Selective Parts of a Playbook.mp4
|   +-- 02 - Working with Sensitive Data Using Ansible Vault.mp4
|   +-- 03 - Error Handling in a Playbook: limit, ignore_errors, changed_when, and failed_when.mp4
|   +-- 04 - Error Handling in a Playbook: Block Groups and The Debug Module.mp4
|   +-- 05 - Asynchronous Tasks within a Playbook.mp4
|   +-- 06 - Delegating Playbook Execution with delegate_to and local_action.mp4
|   +-- 07 - Parallelism in Playbooks.mp4
|   +-- 08 - Using run_once.mp4
|   +-- 09 - Overview of Ansible Roles.mp4
|   \-- 10 - Ansible Role Demo.mp4
\-- 05 - Conclusion and Next Steps.mp4

4 directories, 26 files
amolith@poseidon:~/Videos/Courses/Ansible - Playbooks Deep Dive $

Removing your site from the Wayback Machine (GPG)

Tue, 04 Jun 2019 21:57:00 -0400

Preface

If you simply want to remove your website and nothing else, read through the setup and verifying identities sections then continue from the For domains you own section of the previous post. If you’re wanting to address accounts/profiles on websites you don’t own, read on.

In addition to dealing with the Wayback Machine, this article is also supposed to help you get started using GPG in every-day life for general security and privacy.

Getting set up

Installation & Generating Keys

First of all, you’ll want to install GPG. The package on most distributions should be just be gnupg.

Debian: sudo apt install gnupg
Arch: sudo pacman -S gnupg
Fedora: sudo dnf install gnupg

The next step is generating your key. While it will take a bit longer to generate, a stronger key will be more secure. Also make sure you read this excerpt from the man page as it contains a useful warning.

WARNINGS

Use a good password for your user account and a good passphrase to protect your secret key. This passphrase is the weakest part of the whole system. Programs to do dictionary attacks on your secret keyring are very easy to write and so you should protect your ~/.gnupg/ directory very well.

With that said, use gpg --full-gen-key to get started. Keep in mind that you don’t actually have to use your real name or personal email address. If you want a personal key, go ahead and create one but you can also use a pseudonym and fake address if you’d like.

I would use the default (1) of “RSA and RSA”.
Again, you can use default but I would recommend 4096 bits because it’s much more secure. This does mean, however, that it will take longer to generate the key.
An expiry date is recommended but you don’t necessarily have to set one.
You don’t have to use your real name. You can use a pseudonym if you wish.
You don’t have to use your personal email. You can use a pseudonymous one if you wish.
You don’t need a comment
Confirm
Come up with a secure password or, even better, a passphrase.
Move your mouse around a bit, type, something like that while it’s generating the key.

Email

I use Thunderbird for email and there is a great addon for it called Enigmail. It’s quite easy to set up and use but there is a really annoying bug that you’ll experience when replying in threaded mode. If you want to encrypt a reply, simply open the editor in a new window.

Verifying Identities

In general, all you’ll have to do is type something along the lines of:

I am <your-name-here> and I own the following accounts:

Account 1 - <link>

Account 2 - <link>

Etc.

You’ll save that in a text file, run gpg --clearsign file.txt, copy the output, then paste it wherever it needs to go, whether that’s a blog, a GitHub gist, etc. With Twitter/Mastodon and their character limit, this won’t quite work. The best solution there is probably to post a link to a gpg-signed message on your website that links back to the post.

Really, all you have to do is tie all of your accounts together in as close-knit a web as you can and sign with your GPG key wherever possible. Linking everything to everything else would definitely work but it should also be enough to link everything to a single document on your website (or a gist in GitHub etc.) that links back to all of those.

I’m probably not explaining very well so here’s a diagram showing it.

Note that the email links to everything else but nothing links back to the email. It’s the main document that’s at the centre of it all. Make sure both it and the email are signed. If you toot, link to the toot in the main document. If you make a gist, link to the gist in the main document.

Sending the email

Once you have all the groundwork laid out, you’ll be ready to send the email; the address is info@archive.org. Explain what you would like done and link to the document requesting your domain exclusion first as that’s the easiest to verify. In the next paragraph, I would explain a little bit about what you’ve set up with signing messages and creating the “Web of Verification” (lol). Under that, I would link to the posts asking for the accounts to be removed. Make sure those posts also link back to the main document. Be polite, say thank you, then send the email!

Removing your site from the Wayback Machine (Keybase)

Mon, 03 Jun 2019 12:08:00 -0400

Preface

There may be a myriad of reasons you want to do this, from removing sensitive information to regaining a measure of control over your content. Whatever your purpose, below should be a quick and easy way to achieve it.

For domains you own

The easiest way to verify you own a domain is to put a text file in an easily accessible location and email info@archive.org asking for removal and link to it. Mine is at removal-request.txt. It would be better if you didn’t copy mine word-for-word and wrote your own instead though 😉

If that’s all you intend to do, this should be sufficient and there’s no need to read any further. If you want to exclude your profiles as well (for example, all your GitHub repos, Twitter, Mastodon, etc.) read on.

For domains you don’t own

There are a few things I used that worked in harmony to verify my other accounts. Keybase was the most useful for this purpose. It is a proprietary service but I deem the level of proof it facilitates worth compromising for.

The other tool I used was GPG. For the sake of keeping it simple, this guide will just deal with GPG from within Keybase. I really recommend actually learning to use GPG on its own; it’s wonderful for protecting your privacy and verifying your identity in a multitude of situations. The next post will be on using GPG outside of Keybase for this so stay tuned.

Generating your key

After creating your Keybase account, click “add a PGP key”, “I need a public key”, then enter the requisite information. You should use whatever name is associated with the account you’ll be emailing Archive.org from as well as that address. Wait a bit while it generates the key…

Verifying some accounts

This is where you verify whatever accounts you want removed. Just click the option and go through the steps! Aside from personal websites, Twitter, GitHub, Reddit, etc., you can also prove accounts on a lot of other services (including Mastodon). More are being added every day so check back if there’s something specific you want to address.

Once this is done, you’ll be ready to contact Archive.org about getting your stuff removed.

Signing some messages

In the top right of Keybase, you’ll see a pencil. Click it and you’ll be taken to a page with a text box. This is where you’ll type your email and the text file for your website proof. For the text file, copy the signed message and paste it into your text editor, save, and put it at the root of your website. For example, mine is at removal-request.txt. It would be better if you didn’t copy mine word for word and wrote your own 😉 For the email, you’ll do the same thing but paste the signed message into your email client, whether that’s Thunderbird, ProtonMail, Tutanota, etc. The text file only needs to contain the request for the (sub)domain removal. The email needs to contain the request for everything along with links to the text file, you Keybase account, and whatever you want removed.

Before sending it, you should also go back to your profile, click your key, and copy everything in the text box that starts with -----BEGIN PGP PUBLIC KEY BLOCK-----. Paste that into another text file but save it with the .asc extension. For example, key.asc. Attach this to the email, send it to info@archive.org, wait a couple days, and you’re done!

Forecasting with a command

Fri, 14 Dec 2018 21:41:00 -0400

We all love the CLI (and if we don’t, we should) so wouldn’t it be great if there was a tool to see your weather forecast with a single command? Ceda EI at webionite.com has written a tool that uses the Dark Sky API to give you the forecast for a day or week, at your location, and in Celsius or Fahrenheit.

Celsius

Weather for one week - $ curl sky.webionite.com/location
Weather for today - $ curl sky.webionite.com/location/t

Fahrenheit

Weather for one week - $ curl sky.webionite.com/f/location
Weather for today - $ curl sky.webionite.com/f/location/t

A great way to make this faster and simpler is to put an alias in your shell’s rc file. For bash, you can do that with:

echo "alias weather='curl sky.webionite.com/f/location'" >> ~/.bashrc

If you ever forget how to use the tool, just run curl sky.webionite.com and you’ll be given instructions.

Arch Spin pt. 3 - packages.x86_64

Sat, 18 Aug 2018 16:52:42 -0400

Package configuration

As I said in the last post, this is the file in which you list the applications you wish to install. I won’t list the defaults because there a lot. However, this basic setup only builds to a total of ~440 MB so you can add many more applications.

I want the setup on this bootable to be exactly the same as what I currently have on my system. I did not want to manually enter every single package though. Thankfully, pacman is a feature-complete tool and it lets you get a lot of information about installed packages. pacman -Qne lists all the currently installed packages that you explicitly installed. It does not list dependencies of those applications. What I did was run pacman -Qne >> ~/liveiso/packages.x86_64 to add all the apps I have installed from the official Arch repos to the end of the file so nothing was overwritten.

After, I ran pacman -Qni >> official.txt so I could get information about all those packages and decide whether or not I wanted to keep them. For example, I removed some stuff from deepin that I no longer used, SuperTuxKart, and a lot of other stuff. This shrunk my iso from 3.6 GB to 2.5. Now I have a lot of space to use for installing my applications from the AUR. This includes making a custom repo for the packages and building them in a chroot so you make sure you have all the needed dependencies while keeping your system from being messed up while building.

All of this will be discussed in the next blog post (when I get to it).

Arch Spin pt. 2 — Initial setup

Fri, 17 Aug 2018 14:11:07 -0400

I think I’m going to call it a spin . . .

Install the package archiso from the official repos or archiso-git from the AUR
$ mkdir ~/<build-directory>
- Replace <build-directory> with wherever you want the iso build to be stored. This is where we’ll be spending all of our time configuring. Mine is at ~/liveiso/ and that’s the path I’ll be using in this and future posts
$ sudo cp -r /usr/share/archiso/configs/releng/ ~/liveiso
Edit ~/liveiso/packages.x86_64 to install desired software
- This will be addressed in the next post, packages.x86_64, where I also give some quick ways to install everything you might want.

Arch Spin pt. 1 — The perfect bootable

Wed, 15 Aug 2018 10:38:00 -0400

Today I had an orthodontist appointment and a voice lesson. The appointment was at 15:00 and the voice lesson at 16:00. I got to the orthodontist’s office 10 minutes early, was told to right to the back (like always), I sat down in the seat, and the orthodontist came over after a few minutes with another patient. He looked at my teeth, had me put my retainers in, checked how they fit, then said I don’t ever need to come back (unless I do need to). That all took about 7 or 8 minutes. My voice lesson was ~5 minutes away so I had an hour to kill. I drove to the college (where the lesson was), went into the computer lab, and booted my multibootable bootable.

I went through the distros I had and chose the i3 spin of Manjaro, forgetting that it hadn’t written correctly and was corrupt. I went through a couple of other distros that were as well and settled on Parrot Home. While I love Parrot Home for security reasons, it wasn’t what I was looking for. I started trying to think of a distro that fit all my daily needs that I could take on a flash drive with me wherever I went and . . . I couldn’t.

I would boot it, try to install some app I’m missing (Telegram, for instance), find that I need to first update everything then upgrade some packages then have no space left to install Telegram. There isn’t one distro I can think of that I wouldn’t have to do that with. So I thought I’d try my hand at installing Arch on a flash drive.

As I was reading, I decided I would rather make a live system. This way, I can log into whatever I need to and, as soon as I turn it off, whatever I did disappears. I asked around in the Arch Telegram channel and was given a few pages to read up on the wiki as well as a youtube video. First is building the arch iso, making a custom repo for installing AUR packages, building them in a chroot so you don’t mess with your current setup, and the YouTube videos that help tie it all together:

Summary

That’ll be it for this post. It was originally a lot longer but I think I want to keep them to a quick read so it’s easier to pick up where you left off. I’m not sure what the next post will contain but I am sure that it talks about setting up your dev environment 😉

Lossless screen recording

Sun, 12 Aug 2018 17:15:20 -0400

I’ve been trying off and on for the past few weeks to figure out how to record my 1920x1080 monitor. The recording is going to be some music videos for a friend. Originally, it was just going to be a single background image for the whole video then I had the idea of using cava in a transparent terminal on top of the background. This didn’t work at all because it actually kept freezing when I tried to record it. So I tried switching to ncmpcpp’s visualiser. This still had horrible lag so I’ve been puzzling over how to use ffmpeg to losslessly record my second monitor. The reason OBS and similar screen recorders are so slow is because, most of the time, they encode to the end format while recording and that uses a lot of system resources. I finally figured it out and have pasted the command below.

ffmpeg -video_size 1920x1080 -framerate 30 -f x11grab -draw_mouse 0 -i :0.0+1366,0 -c:v libx264 -crf 0 -preset ultrafast output.mkv

Above is exactly what I used for my 1080p monitor with 768p laptop screen. I’ve modified the command so you can see what you need to edit for your use-case.

ffmpeg -video_size <target-resolution> -framerate 30 -f x11grab -i :0.0+<width-of-unused-monitor>,0 -c:v libx264 -crf 0 -preset ultrafast <filename>.mkv

If you do not want the cursor recorded, add -draw_mouse 0 directly after x11grab like I did in the first command.

My video was 470mb for a ~13 minute video. If you’re going to archive the recording or are concerned about file size, re-encode it with a slower preset. This will be a lot slower and take a lot of CPU but the resulting file is significantly smaller than the original and still lossless. I this as a general purpose screen recorder. Previously, I was using OBS and the lag in the video was incredible but with ffmpeg, it’s smooth as butter. The command for re-encoding is below:

ffmpeg -i output.mkv -c:v libx264 -crf 0 -preset veryslow output-smaller.mkv

Note

This command only works with X, not Wayland. Skimming ffmpeg’s man page, I see that video4linux2 is another option for capturing video so you may be able to replace x11grab with it for the same result. I have not tested this so I don’t know if it’ll work or not.