RSS feed for tag linux on Raymii.org

Put your SSH keys in your TPM chip!

Fri, 10 Apr 2026 19:37:00 GMT

I've got a [long](/s/articles/Get_Started_With_The_Nitrokey_HSM.html) [history](/s/tags/hsm.html) [with](/s/tags/yubikey.html) [hardware security modules](/s/articles/Nitrokey_HSM_web_cluster.html), both professionally and for fun. For the longest time, my SSH private key has lived inside a hardware token of some sort, be it the Nitrokey, the Smartcard-HSM or a Yubikey. The private key never leaves the device, you yourself can't even extract it, neither can malware. It does not live on your filesystem or in an `ssh-agent` (in memory) and some hardware keys even require a physical touch to use the key. Way more secure than the file `~/.ssh/id_rsa`. I do hope you have a password on your private keys. Most, if not all modern machines come with a comparable hardware solution, a [TPM](https://en.wikipedia.org/wiki/Trusted_Platform_Module) (trusted platform module). It's required for Windows 11 so most hardware has one. Its often used to verify the boot process. You can however, also use it to store your SSH keys and in this guide I'll show you how I recently did just that.

A way to run Ansible 2.19 on old operating systems like Ubuntu 18.04 with working Apt

Sat, 31 Jan 2026 23:08:00 GMT

Ansible recently stopped working on one of my older servers. The playbooks wouldn't execute anymore, with a cryptic python error. With Ansible 2.14 this server worked, after upgrading to 2.19 the playbooks failed. It turned out that the Python version on the server was too old. This server runs Ubuntu 18.04, that ships with Python 3.6. That server still gets updates via Canonicals Ubuntu Pro program, but no more major python version upgrades. I manually installed Python 3.12, after which the Ansible playbook started working again, only failing to do stuff via `apt`. For example the `package`, `apt_key` and `apt_repository` modules. I've found a workaround for package installation by using ansible's `raw` commands. This post shows how to manually install newer Python and the trick I'm using to (idompotently) get package installation working again with a few `when` rules.

Finally, run Docker containers natively in Proxmox 9.1 (OCI images)

Thu, 20 Nov 2025 22:34:00 GMT

Proxmox VE is a virtualization platform, like VMWare, but open source, based on Debian. It can run KVM virtual machines and Linux Containers (LXC). I've been using it for over 10 years, the [first article I wrote mentioning it was in 2012](/s/tags/proxmox.html). At home I have a 2 node Proxmox VE cluster consisting of 2 HP EliteDesk Mini machines, both running with 16 GB RAM and both an NVMe and SATA SSD with ZFS on root (256 GB). It's small enough (physically) and is just enough for my homelab needs specs wise. Proxmox VE 9.1 was released [recently](https://www.proxmox.com/en/about/company-details/press-releases/proxmox-virtual-environment-9-1) and this new version is able to run Docker containers / OCI images natively, no more hacks or VM's required to run docker. This post shows you how to run a simple container from a docker image.

High Available Mosquitto MQTT on Kubernetes

Wed, 14 May 2025 22:11:00 GMT

In this post, we'll walk through a fully declarative, Kubernetes-native setup for running a highly available MQTT broker using Eclipse Mosquitto. This configuration leverages core Kubernetes primitives (`Deployments`, `Services`, `ConfigMaps`, and `RBAC`), alongside Traefik `IngressRouteTCP` to expose MQTT traffic externally. It introduces a lightweight, self-healing failover mechanism that automatically reroutes traffic to a secondary broker if the primary becomes unhealthy. The setup also demonstrates internal MQTT bridging, allowing seamless message propagation between brokers. The big advantage over a single Pod deployment (which, in case of node failure, k8s will restart after 5 minutes) is that this setup has a downtime of only 5 seconds and shared state, so all messages will be available on a failover.

Fast MQTT logger (to syslog)

Tue, 25 Mar 2025 21:33:00 GMT

For almost 5 years I've been using the `mqtt-data-logger` [python script](https://github.com/RaymiiOrg/mqtt-data-logger) to log all MQTT communication. This script works, but is a bit limited in how it stores logs (files per time it's started) and it often can't keep up with the message rate (tens of thousands per second) of my mqtt brokers. So I've written a new tool in C++ to log all MQTT messages to syslog and optionally to the terminal. Then, via syslog, you can send it to where ever you like, be it a file or an ELK (Logstash/Elasticsearch/Kibana) stack. It even compiles without syslog support, if you only want to log to a file or the terminal. There's a docker image and a docker compose file, so you can easily deploy it wherever you have an MQTT broker running.

After 47 years, OpenVMS gets a package manager (VSP)!

Mon, 17 Mar 2025 20:33:00 GMT

As of the 18th of February, OpenVMS, known for its stability and high-availability, 47 years old and ported to 4 different CPU architecture, has a package manager! This article shows you how to use the package manager and talks about a few of its quirks. It's an early beta version, and you do notice that when using it. A small list of things I noticed, coming from a Linux (apt/yum/dnf) background: There seems to be no automatic dependency resolution and the dependencies it does list are incomplete. No update management yet, no removal of packages and no support for your own package repository, only the VSI official one. Service startup or login script changes are not done automatically. Packages with multiple installer files fail and require manual intervention. It does correctly identify the architectures, has search support and makes it way easier to install software. The time saved by downloading, manually copying and starting installation is huge, so even this early beta is a very welcome addition to OpenVMS.

Safely expose the Kubernetes Dashboard in Traefik k3s via a ServersTransport

Tue, 11 Mar 2025 22:11:00 GMT

I'm using the Headlamp dashboard for my [high-available local kubernetes cluster](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html) because I find that to be faster, more clear and useful than the full blown Kubernetes Dashboard. In [my first article](/s/tutorials/My_First_Kubernetes_k3s_cluster_on_3_Orange_Pi_Zero_3s_including_k8s_dashboard_hello-node_and_failover.html#toc_4) I accessed the dashboard via a local port forward. This article documents how to expose the dashboard via an `Ingress` and some `Traefik` specific `annotations`. The dashboard helm chart sets up HTTPS internally, `Traefik` does not like that by default. Most of the time, all internal cluster communication is insecure (I'm not sure why, seems to be a bad idea). A few of the guides online suggest disabling HTTPS for the dashboard internally or, for the k3s specific case, disabling HTTPS validation entirely. Both of those are too broad for my use case, so I decided to figure out how to make `Traefik` talk to the `kubernetes-dashboard-kong-proxy` via `https`, without disabling certificate validation.

The Adventure of the Missing Syscall: Error 38

Thu, 24 Oct 2024 21:33:00 GMT

Sherlock Holmes tackles a modern computing dilemma involving a missing system call. In this case, a frustrated developer attempts to port an embedded device running Yocto to a newer version, only to be met with `Error 38` due to a missing syscall. Holmes and Watson delve into the intricacies of kernel versions, glibc, and system calls to uncover the truth behind the missing `syscall_397` and provide a logical solution.

Create Kubernetes user restricted to one namespace with resource limits

Mon, 29 Jul 2024 04:39:00 GMT

This guide shows you how to use Role-based access control (RBAC) to create a user account that only has rights for one specific namespace. I'll also show you how to limit the resource usage of that `Namespace`. Last but not least, I'll also show you how to create a `kubeconfig` file for that specific user.

nameConstraints on your Self Signed Root CA in Kubernetes with cert-manager

Wed, 17 Jul 2024 23:22:00 GMT

If you have [set up a Self Signed Root CA](/s/tutorials/Self_signed_Root_CA_in_Kubernetes_with_k3s_cert-manager_and_traefik.html) for your local Kubernetes Cluster and have trusted the Root Certificate, you are at risk if the key is compromised. If the key is stolen, it can be used to create trusted certificates for everything. Luckily there is something we can do, using `nameConstraints` to limit the scope of the Root Certificate to, in our case, a single domain (`k3s.homelab.mydomain.org`). This means that if your key would be compromised, it would only be able to issue certificates for anything under that domain, not your bank for example.

Self-signed Root CA in Kubernetes with k3s, cert-manager and traefik. Bonus howto on regular certificates

Wed, 17 Jul 2024 04:22:00 GMT

Now that I'm learning Kubernetes for a few weeks, I'm finally at the point where I was 20 years ago with regular boring old tech, being able to [host multiple domains](/s/tutorials/Kubernetes_k3s_Ingress_for_different_domains_like_virtual_hosts.html), [password protection](/s/tutorials/Password_protect_web_services_in_Kubernetes_k3s_traefik_with_basic_auth.html) and [high available clusters](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html). It seems we have to re-invent the wheel every time but in the end, it's just resume-driven development, the underlying stack costs more, is way more complex but for the user, nothing changes, they see the same website as always. [Not all change is progress](https://luddites.latenightlinux.com/). Enough of being a curmudgeon, time to continue with Kubernetes. In this episode of 'Remy discovers Kubernetes', I'm setting up `cert-manager`, **not with Lets Encrypt**, but with a self-signed certificate authority. I'll also show you how to set up a regular certificate, one you've for example bought somewhere. I'll also cover `nameConstraints` to make the risk of compromise of your trusted root ca lower.

Password protect web services in Kubernetes (k3s/traefik) with basic auth

Mon, 15 Jul 2024 20:11:00 GMT

Now that I have a [high-available local kubernetes cluster](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html) and am [experimenting with deploying apps](/s/snippets/Using_nodeSelector_to_deploy_a_Kubernetes_Helm_chart_only_on_x86_or_amd64_nodes_not_arm64.html), it's also time to look into securing those apps using certificates and passwords. In this case I'm going to set up password authentication, like a `.htaccess` file in `Apache2`, to protect the `Longhorn` dashboad, which by default requires no authentication. This means deploying an `Ingress`, a `Middleware` and a `Secret`.

Using nodeSelector to deploy a Kubernetes Helm chart only on x86/amd64 nodes, not arm64

Thu, 11 Jul 2024 23:39:00 GMT

My [k3s cluster](/s/tutorials/My_First_Kubernetes_k3s_cluster_on_3_Orange_Pi_Zero_3s_including_k8s_dashboard_hello-node_and_failover.html) runs on Orange Pi Zero 3 small board computers, with a 1.5 GHz Allwinner H618 Quad-Core Cortex-A53 ARM64 CPU. Nowadays most popular software has support for `aarch64` due to the popularity of boards like the Raspberry Pi and the Apple M1 series processors, but smaller projects or niche software often can only run on x86/amd64. If you write your own yaml files for deployment you can use a `nodeSelector` combined with the `kubernetes.io/arch=amd64`, but with a Helm Chart this is not that obvious. This small snippets shows you the correct syntax to force deploy a Helm Chart to only amd64 nodes in your cluster. This assumes you have a mixed cluster, I added a small virtual machine to it for testing.

Kubernetes (k3s) Ingress for different domains (virtual hosts)

Wed, 10 Jul 2024 20:39:00 GMT

Now that I have a [high-available local kubernetes cluster](/s/tutorials/High_Available_k3s_kubernetes_cluster_with_keepalived_galera_and_longhorn.html) it's time to learn not just managing the cluster but actually deploying some services on there. Most examples online use a `NodePort` or a `LoadBalancer` to expose a service on a port, but I want to have domains, like, `grafana.homelab.mydomain.org` instead of `192.0.2.50:3000`. Back in the old days this was called [Virtual Host](https://web.archive.org/web/20240515131604/https://httpd.apache.org/docs/2.4/vhosts/), using 1 IP for multiple domains. My k3s cluster uses `traefik` for its incoming traffic and by defining an `Ingress` we can route a domain to a service (like a `ClusterIP`). This page will show you how.

High Available k3s kubernetes cluster with keepalived, galera and longhorn

Tue, 09 Jul 2024 22:30:00 GMT

After my [first adventure with Kubernetes](/s/tutorials/My_First_Kubernetes_k3s_cluster_on_3_Orange_Pi_Zero_3s_including_k8s_dashboard_hello-node_and_failover.html), getting started with k3s on my small 3 node ARM cluster that [boots via PXE / NFS](/s/tutorials/Netboot_PXE_Armbian_on_an_Orange_Pi_Zero_3_from_SPI_with_NFS_root_filesystem.html), I noticed that there is only one k3s node that has the `control-plane,master` role. If that node fails you can no longer manager the cluster. Other nodes can fail and then the workloads (pods) will be restarted eventually after 5 minutes, but this node is special. Time to change that and make it a high available cluster. K3s [supports](https://web.archive.org/web/20240703112841/https://docs.k3s.io/datastore/ha) high-availability with embedded `etcd` and with external databases like `MySQL` and `postgres`. `etcd` will thrash your storage (SD cards) so I decided to go with a `MySQL` cluster using `Galera` for the database and `keepalived` for the High Available Cluster IP. This guide will show you how to configure the HA database and HA-IP and I'll also setup [longhorn](https://web.archive.org/web/20240707025724/https://longhorn.io/) for high-available block storage inside kubernetes. The end result is that I can pull the power from any two of the three nodes without the k3s cluster or workloads going down.

My First Kubernetes: k3s 'cluster' on 3 Orange Pi Zero 3's, including the dashboard, hello-node and failover

Fri, 28 Jun 2024 22:30:00 GMT

I've been working as an embedded C++ developer for over 5 years now so my sysadmin / devops skills are becoming a bit rusty. The odd bit of Ansible here and there but no new stuff. I figured it was time to expore Kubernetes, as it is what all the cool kids do these days. So I [got myself 3 new SBC's] (/s/tutorials/Netboot_PXE_Armbian_on_an_Orange_Pi_Zero_3_from_SPI_with_NFS_root_filesystem.html), the [Orange Pi Zero 3] (https://web.archive.org/web/20240623200133/http://www.orangepi.org/html/hardWare/computerAndMicrocontrollers/details/Orange-Pi-Zero-3.html). I'll be using these to install and setup a basic Kubernetes cluster, getting the Dashboard working, installing a Hello World app and testing how the failover works.

Netboot (PXE) Armbian on an Orange Pi Zero 3 from SPI with NFS root filesystem

Tue, 25 Jun 2024 22:30:00 GMT

Because I wanted to experiment with Kubernetes I bought a few cheap SBC's and a Power over Ethernet switch to run `k3s`. Since Kubernetes is very resource intensive I wanted to try to boot the boards via the network without causing wear on the Micro SD card. The boards have built-in SPI flash from which it can boot `u-boot` and Armbian works quite well with a root filesystem over NFS. This guide will help you with netbooting an Orange Pi Zero 3 running Armbian.

Proxmox VE 7 Corosync QDevice in a Docker container

Sun, 17 Apr 2022 00:00:00 GMT

At home I have a 2 node Proxmox VE cluster consisting of 2 HP EliteDesk Mini machines, both running with 16 GB RAM and both an NVMe and SATA SSD with ZFS on root (256 GB). It's small enough (physically) and is just enough for my homelab needs specs wise. Proxmox VE has support for clustering. For a cluster (in any sense of the word), you need at least 3 nodes, otherwise there is no quorum. Corosync, the cluster software used by Proxmox, supports an external Quorum device. This is a small piece of software running on a third node which provides an extra vote for the quorum. In my case I wanted to run this on my NAS, since (physical) space is a premium. The NAS supports Docker, this guide explains how to run the QDevice for Proxmox VE 7 in a Docker container. There is a qdevice Docker image on the Docker hub but that guide does not work for Proxmox VE 7 and requires a lot of manual setup. Using my method involves a lot less steps, since you're basically running an extra debian VPS (a container with systemd and openssh).

Fixing the hiss on my Atgames Legends Pinball Micro including root access

Tue, 23 Jan 2024 22:00:00 GMT

The [Atgames Legends Pinball Micro](https://web.archive.org/web/20240123213954/https://www.atgames.us/products/legends-pinball-micro) is a small virtual pinball cabinet for around USD 350. I imported one to the Netherlands, Atgames does not ship here. The built in tables are okay and more are for sale via Atgames' webshop. Overall for the price it is a nice device. Build quality is okay, software lacks a bit of quality. One really annoying issue which severely impacts gameplay is a buzz / hiss sound. This post goes over my attempts to fix this hiss and the one that worked was a ground loop isolator.

APT keeps complaining that the HTTPS certificate cannot be validated?

Wed, 11 Jan 2023 05:31:00 GMT

Recently a few of my Ubuntu 20.04 and Debian 11 servers failed to run an `apt update` because it insisted that the HTTPS certificate for a repository could not be validated, while `curl` on the same system had no issues connecting. Join me on a deep dive into certificate validation and troubleshooting `apt`, digging into the C++ source code for `apt` and `GnuTLS` and in the end, it turned out to be my own fault due to permission on a folder. However, the error messages were totally unhelpful resolving the mysterious validation problem. This article was written over the period of a few days, chronologically during troubleshooting.

Expose any Qt5 program via VNC

Mon, 20 Sep 2021 00:00:00 GMT

A few months ago I wrote about [Microsoft Teams running on a coffee machine. That was a fun work experiment where I got a VNC client running on the Linux-based coffee machines that we produce at work. In the comments on hackernews Jean-Michaël Celerier pointed me to the reverse, a way to expose any Qt application over VNC. This article shows you how I use this feature to work on our Qt 5 based coffee machine frontend as well as how you can use this on your machine, for example, to expose Dolphin, the KDE file manager, over VNC.

Using IceWM and a Raspberry Pi as my main PC, sharing my theme, config and some tips and tricks.

Sat, 10 Jul 2021 00:00:00 GMT

KDE is my desktop environment of choice. KDE5 is rock-solid, configurable in any way possible and works great. It treats you like a responsible adult instead of a child like GNOME does these days, and after XFCE switched to GTK3, the RAM usage is on-par, more often than not a bare KDE install (Debian or Arch) uses around 300MB ram. This is with Baloo (search indexer) and Akonadi (PIM database backend) disabled. Great default behaviour, low resource usage and enourmous configurability, so why is this post then titled 'IceWM'? At home I'm using a small ARM device (Raspberry Pi 4 with an SSD) as my main computer, and there resources are limited. KDE runs fine, but you notice that it is a bit slower than on my work computer. IceWM on the other hand, uses less than 30 MB of RAM and even less CPU. The program that gives you a desktop background, icewmbg, uses double the RAM of IceWM itself! IceWM, next to Awesome, is one of my favorite window managers, very configurable and provides all I need. This PC doesn't have multiple screens, which would be a bit more of a hassle than with KDE. After switching, the machine feels a lot faster. It's the small details in which I notice it, like text input, a few seconds of lag here and there. This post shows my IceWM config including some options explained, my IceWM theme and a few tips and tricks to configure the rest of the desktop.

Firefox 89 Proton UI Tab Styling

Sun, 27 Jun 2021 00:00:00 GMT

Firefox 89 recently came out with a 'new' user interface (named proton). I'm not a fan of change because UX/UI people need to make it seem like their job is relevant. Also, the picture they show under the headline '17 billion clicks...' only scares the crap out of me, tracking every move a user makes in their browser seems to me to be a bad idea, but hey, lets see how long Mozilla can continue their war against their own users. Since the `about:config` flag to disable proton will probably be gone in a few releases I thought, why not try to get used to this new interface. It's so enormous and wide, lacking contrast. As you might have guessed, I cannot get used to the tab bar, so in this post I'll show you how to use the `userChrome.css` file to make the new tab bar look a bit more like the old tab bar.

Execute a command and get both output and exit status in C++ (Windows & Linux)

Mon, 07 Jun 2021 00:00:00 GMT

Recently I had to parse some command line output inside a C++ program. Executing a command and getting just the exit status is easy using `std::system`, but also getting output is a bit harder and OS specific. By using `popen`, a POSIX `C` function we can get both the exit status as well as the output of a given command. On Windows I'm using `_popen`, so the code should be cross platform, except for the exit status on Windows is alway 0, that concept does not exist there. This article starts off with a stack overflow example to get just the output of a command and builds on that to a safer version (null-byte handling) that returns both the exit status as well as the command output. It also involves a lot of detail on `fread` vs `fgets` and how to handle binary data.

All packages that were present in Ubuntu 18.04 but absent in Ubuntu 20.04

Wed, 19 May 2021 00:00:00 GMT

Otherwise titled `Figure out the differences between two apt repositories`. Recently I've had a few packages that I often use but were missing from Ubuntu 20.04 LTS. One is [ckermit](/s/blog/Ive_packaged_up_CKermit_as_a_snap_for_Ubuntu_20.04.html) and the other is [gnash](/s/blog/Ive_packaged_up_Gnash_as_a_Snap_for_modern_linux.html), both of which I 'converted' to a snap. (In air quotes because I just converted the 18.04 deb). This made me wonder if I could figure out a list of that are present in Ubuntu 18.04, but absent in Ubuntu 20.04. As `apt` and `dpkg` are standardized tools and and package formats, we can use a few shell tools to parse the package lists and compare them side by side. This post shows you how to do the comparison yourself and I discuss the removed packages a bit. Some are version increments (like `gcc-6` in Ubuntu 18.04 but `gcc-7`in Ubuntu 20.04), and some are packages that were combined into one instead of split up (like `ltsp` in Ubuntu 20.04 but a bunch of seperate `ltsp-$postfix` packages instead in Ubuntu 18.04). Many others are just replaced by newer versions (`python-ceph` vs `python3-ceph`). The list of differences is provided as a download, both ways.

I've packaged up CKermit as a snap, for Ubuntu 20.04

Sun, 16 May 2021 00:00:00 GMT

Last year I packaged up [gnash as a snap](/s/blog/Ive_packaged_up_Gnash_as_a_Snap_for_modern_linux.html) because it was missing from the Ubuntu 20.04 apt repositories. Recently I found out that `ckermit` is also not in Ubuntu 20.04, as far as I can tell because it wasn't in the Debian repositories when the Ubuntu 20.04 initial sync happened. Which is very inconvenient for an LTS release. I often use `ckermit` to connect to our hardware via a script, to automatically boot from NFS (via u-boot). I could do that manually via `screen` or `minicom`, but I have a `kermit` script that does it for me, which is very convenient. Since the snapping of `gnash` was so easy, I decided to do it for `ckermit` as well, since I now know how to convert deb packages to snaps. I also have a few colleagues who also use those kermit scripts and are going to update to 20.04 in the (near) future. The snap packaging is based on work by Phil Roche, he wrote about re-packaging older debian packages with an Ubuntu 18.04/16.04 base layer as a snap. My `ckermit` package is confined (no `--classic` needed), the source code for the snap is on my github and on any snap-enabled distro you can now 'snap install ckermit-raymii' to enjoy CKermit.

I've packaged up Gnash as a snap, for modern linux

Mon, 07 Dec 2020 00:00:00 GMT

I hate snaps just as much as the next guy but last week I did something unexpected. I packaged up Gnash as a snap. Gnash is a GNU flash media player, not updated since 2011, and thus removed from the Ubuntu 20.04 repositories. The snap packaging is based on work by phil roche, he wrote about re-packaging older debian packages with an Ubuntu 18.04/16.04 base layer as a snap. My gnash package is confined (no '--classic' needed), the source code for the snap is on my github and on any snap-enabled distro you can now 'snap install gnash-raymii' to enjoy Gnash again.

Run MS Teams on a coffee machine?!? (Or: Embedded Linux Framebuffer VNC client)

Thu, 08 Apr 2021 00:00:00 GMT

To fill some time [during compiling](https://xkcd.com/303/) I tried to get a VNC client running on a coffee machine, specifically to show MS Teams. At work I develop software for these coffee machines in C++, which allows me to do such fun stuff, because from a software point of view, it's just an ARM PC running linux with a framebuffer for graphics. I compiled a few framebuffer VNC clients, fired up an SSH tunnel and used `x11vnc` to share one specific window and after a few attempts, Teams was up and running on my 'new' second monitor. This post contains my little adventure in framebuffer VNC clients, but it's not a comprehensive guide as most of my other articles. Showing you how to set up an Openembedded server with a VariScite specific toolchain is way too much work to cross-compile a simple C program, but since that's my day job, why not use it for fun. It contains some tips for `x11vnc` and shows you two different framebuffer VNC clients, `fbvnc` and `directvnc`.

Record your Linux Desktop with ffmpeg and slop to any format

Wed, 17 Mar 2021 00:00:00 GMT

This two-line shell script allows you to record a region of your linux desktop to a video file, or a `.gif`, using `slop` and `ffmpeg`. I use it often when a screenshot is not enough, or when you need to explain a sequence of events to someone.

Limit specific process memory on desktop linux with cgroups and earlyoom

Sat, 13 Feb 2021 00:00:00 GMT

On my laptop I recently had trouble with out of memory issues when running `clion`, `firefox`, `thunderbird`, `teams` and a virtualbox VM. To combat this, I've setup cgroups to limit how much RAM specific applications can use and configured `earlyoom`, a very nifty tool that checks available memory and kills the process with the highest `oom_score` if available memory falls below 5%. Otherwise, my laptop would first grind to a halt (even without swap) and only after half an hour of seemingly being stuck would the OOM killer kick in. With `earlyoom` this hanging behavior is gone, although sometimes applications get killed when I don't expect it. I've given firefox, thunderbird and teams a cgroup with memory limit and clion and virtualbox use their own configuration to limit their RAM usage.This post details how to setup `cgroups` to limit memory of specific processes including automatically placing process inside a cgroup.

The Common Desktop Environment (CDE) is still developed and modern in 2021

Thu, 28 Jan 2021 00:00:00 GMT

While playing around with the GUI on OpenVMS I was looking for CDE documentation and I found out CDE is still being developed and can be installed on modern linux. This quick post shows you how to install CDE on Debian 10 and includes a bit on compiling GENERIC TETRIS, the same program I installed on OpenVMS. Really cool to compile and run a game from 1992 on a retro/modern desktop environment.

Get webcam resolution and info on Ubuntu and fix HD

Sun, 23 Aug 2020 00:00:00 GMT

With all the video calling nowdays due to working from home I decided to get a webcam. Since I mostly work at a workstation, I have no microphone or camera built in. A friend gave me a spare webcam, a generic non-brand. It says 'HD Camera' on the box, but by default it records in 640x480. Using a few tools on Ubuntu you can figure out what resolutions are supported for your device. It turned out to be Cheese, the webcam capture program I used, not supporting the 'mjpeg' format, just the 'yuyv' RAW format. Using another webcam program named Webcamoid solved it, that program was able to use mjpeg.

Ubuntu Snap auto updates broke my development setup and there is no way to turn them off

Sat, 01 Aug 2020 00:00:00 GMT

After updating-by-reinstall to Ubuntu 20.04, I installed CLion via snap since that seemed more convinient than manually downloading a java installation. CLion is the best thing since sliced bread, or I mean a C/C++ IDE by JetBrains. Ubuntu snap is a packaging system made by Canonical and pushed hard in Ubuntu. Today I found out the hard way that snap auto-updates and that there is no way to turn that off permanently. CLion was updated, which I noticed because the process was killed. The update broke several key plugins for my workflow and the theme was weird. In this article I'll discuss my disgust, I as the owner of the computer want to be in full control, not some developer that decides I need auto updates. I ended up removing snap completely, and my next install will not be Ubuntu due to this.

Running gnash on Ubuntu 20.04 (in Docker with X11 forwarding)

Sun, 05 Jul 2020 00:00:00 GMT

As you might have noticed, I'm slowly updating servers and workstations to Ubuntu 20.04, and as always with major upgrades, things break or are removed. Earlier this week I fixed up pygopherd and today I'll get gnash running again. Gnash is not updated since 2011 and therefore, finally, removed from the Ubuntu 20.04 repositories. Compiling it from source proved to be a lot of effort due to gstreamer dependencies and after a few hours I thought, why not just spin up a Ubuntu 18.04 Docker container, install gnash and forward X11. That took just about 10 minutes and now I'm happily running gnash again. In this tutorial I'll show you how to setup gnash in a docker container with x11 forwarding and host networking.

Installing PyGopherd on Ubuntu 20.04

Sat, 04 Jul 2020 00:00:00 GMT

Ubuntu 20.04 dropped the Pygopherd package. There is no way to install it from the official repositories. In this guide I'll show you two ways to install the version from Ubuntu 18.04, which still works perfectly on 20.04. Either via just downloading the 2 deb packages, or via `apt pinning` from the previous (18.04) repository.

Personal Wireguard VPN on a Freedombox with Debian

Mon, 03 Feb 2020 00:00:00 GMT

This guide will show you how to set up a personal Wireguard VPN server on Debian or Ubuntu with Freedombox. Freedombox will be used to manage the VPN software, firewall and users. Wireguard is a relatively new VPN built in to the linux kernel. Freedombox is a long running project under the Debian umbrella providing a private server for non experts with focus on user freedom, ease of use and privacy. Combined, those two make a great pair. In the past I've written many articles on how to setup your own personal VPN server, but those all required manual setup and maintenance. With freedombox, the updates are automatic and the management is hidden away behind a convenient web interface.

Installing Freedombox on Armbian on the Olimex Pioneer

Wed, 29 Jan 2020 00:00:00 GMT

FreedomBox is a private server for non-experts: it lets you install and configure server applications with only a few clicks. It runs on cheap hardware of your choice, uses your internet connection and power, and is under your control. Last year the Pioneer became available, officially supported and sanctioned by the Freedombox Foundation. This is a home server you can buy from Olimex, comes in a nice metal case with a proper power supply, network cable, battery and SD card preloaded with Freedombox. Plug in and go. Perfect for users that don't want to tinker but do want their freedom and control. With the Pioneer, both the hardware and software are fully open source. In the default provided distribution for the Pioneer there are a few things I dislike. This guide covers the installation of Freedombox and Debian for the Olimex A20 Lime2 Pioneer with Armbian including reinstalling, Apache SSL certificate and LDAP issues.

Run CLion native on Android, ditch your desktop!

Fri, 27 Dec 2019 00:00:00 GMT

How often do you read articles that state that people have replaced their main computer with an iPad and are fully content? Now, how many of those articles just use a linux server (vps) somewhere with some native apps, but mostly SSH to that server? Well, what if I told you that you can run a full blown IDE, the best IDE for C++ there is, CLion by JetBrains, on Android? Including compiling, just native GCC, CMake, GDB and all the stuff you are used to? Just for fun I've installed CLion on an old Samsung Tab S2 I had lying around, using Ubuntu in a chroot. It works way better than I'd expected, with a Bluetooth keyboard and mouse it's almost as if your on a desktop. I wonder if you could run Android Studio and use the tablet to compile app's for itself. This article shows some photo's, including a mechanical keyboard, different window managers and had instructions to replicate this setup.

and & or are valid in C++ (alternative tokens)

Mon, 16 Dec 2019 00:00:00 GMT

A post on lobste.rs on the C feature trigraphs triggered me to write this piece on the C++ feature, alternative tokens. I've recently suprised a co- worker by using an if statement with 'or' instead of '||', which works fine, but he never saw it before. It's in C++ since C++ 11, but MSVC requires a specific compiler flag ('/Za') or the 'iso646.h' header. This post has a few samples on the usage inclusing other alternative tokens like bitor, xor and or_eq.

C++ project setup with CMake & unit tests (google test)

Tue, 01 Oct 2019 00:00:00 GMT

This guide will show you how to setup a new C++ project with CMake and unit tests via Google's test framework. With this setup you can get started right away with test-driven-development in C++. It is also simple enough to look and figure out how to add gtest to your existing project and start doing TDD on your legacy (existing) codebase.

connman operstate list

Tue, 25 Jun 2019 00:00:00 GMT

Recently I was debugging connection issues with a system that uses connman as it's network management software. In the log it was visible that the connection went away and came back, logged with 'operstate' $number $state. I couldn't easily find an overview of all the possible states, but since it's open source we can take a look at the code to find out. Publishing it here for future reference.

C++ template definitions in a .cpp file (instead of a header file)

Sat, 22 Jun 2019 00:00:00 GMT

In this snippet I'll show you how to place your C++ template definitions in a seperate .cpp file. I'd recommend you to just put template definitions in your header file, or a .hpp file, but if you really want to there is a trick to get them in a seperate .cpp file. The trick is to explicitly instanciate every template you're going to use at the end of the .cpp file. With many different templates and types this becomes cumbersome, but for certain usecases it could be useful.

C++ create and write to a CSV file with a variadic template

Mon, 17 Jun 2019 00:00:00 GMT

In this snippet I'll show you a variadic template to write to a file. In line with my other experiments to get a better grasp at templates, this example improves on my earlier attempt by using a variadic template, thus allowing you to provide an infinite number of columns to the csv file of any type that has the overloaded << operator.

C++ create and write to a CSV file

Fri, 07 Jun 2019 00:00:00 GMT

In this quick snippet I'll show you how to create and write to a csv file. It includes checking if the file is writable, and if it's not there, creates it with a different first row as header. It's a quick example, I've used it to log some test data. It can probably be improved.

Cooking with C++ templates and stronger types

Thu, 13 Jun 2019 00:00:00 GMT

To gain a better understanding of C++ templates I'm playing around with them. Most of the online guides stop at the example of a simple template to, for example, get the max of two inputs, or cover just a bit more (like how to overload operators for your specific template classes to make << and + / - work). Combining templates with a stronger type to pass stuff around led me to a test kitchen. As in, some code with ingredients, amounts and an oven. One small thing kept it from working, after some feedback it turned out I was passing the wrong parameters to the template. Afterwards the error also made sense. This post covers both my learning and a small piece on stronger types.

C++ variadic template recursive example

Sat, 08 Jun 2019 00:00:00 GMT

In this article I'll show you how to use a variadic template in C++. Variadic templates allow you to have a template with a variable number of arguments, also called a parameter pack. Unpacking that pack is more difficult than it should be, so we use a recursive template to iterate over all the parameters one by one. I've also included an example in Python to compare to.

Sparkling Network

Sat, 12 Jan 2019 00:00:00 GMT

This is an overview of all the servers in the Sparkling Network, mostly as an overview for myself, but it might be interesting for others. It also has a status overview of the nodes. Prices are monthly, excluding VAT.

Microsoft Office 2013 and 2010 on Linux

Sat, 02 Jan 2016 00:00:00 GMT

This guide shows you how to run Microsoft Office 2013 and 2010 on Linux using CrossOver. It guides you through the installation and gives a review on what parts of the Office suite work with Linux.

Build a Flexible and Powerful System with Arch Linux

Mon, 09 Mar 2015 00:00:00 GMT

This article covers the basic installation and configuration of Arch Linux, the distro that adheres to the Keep It Simple, Stupid principle. Arch Linux is a rolling release, that means that you always have the latest and greatest software. With Arch, you're on your own. In a world where where technology is taking your personal responsibility and giving it to the cloud, or to an internet search filter or the device manufacturers, getting your hands dirty with an operating system can be a revelation. Not only will you learn a great deal about how Linux works and what holds the whole thing together, you'll get a system you understand from the inside-out, and one that can be instantly upgraded to all the latest packages. You may also learn something about yourself in the process. And despite its reputation, it's not that difficult.

Transmission Web on a Raspberry Pi with Arch Linux

Mon, 28 Apr 2014 00:00:00 GMT

One of my Raspberry Pi's was running a test setup of the Citadel groupware service. The test was sucessfull, so I set up a real world setup. The Raspberry Pi would serve another purpose, namely, a Linux Torrent seedbox. As in, to seed Linux torrents from linuxtracker.org. I choose Transmission for this, because it is simple, fast and stable. Transmission has a good webinterface, plus it allows access from remote clients with the transmission-remote gui packages. This article shows you how to set it up on a Raspberry Pi running Arch Linux.

Exploring /proc/ - tips and tricks for the procfs

Mon, 28 Jan 2013 00:00:00 GMT

This article has a lot of nice tips and trics on using the procfs linux virtual file system.

Small low cost linux pc's, an overview from 11-2012

Wed, 07 Nov 2012 00:00:00 GMT

This is an overview of small linux computers, mostly ARM based.

Small Operating Systems / Linux Distributions

Mon, 09 Jul 2012 00:00:00 GMT

This is an overview of small operating systems and Linux distributions, most of them work well on older hardware (pre-dual core era). It provides screenshots, package information, size and specs and project information on the distro.