3D Printing: Incremental Improvement

Good Morning from my Robotics Lab! This is Shadow_8472 and today, I am on my 3D printer again for round 2 of printing a model of Twilight Sparkle. Let’s get started!

Preparation

I began with a fresh download into a clean project directory I designated. The “fixed” version from last time simply fused all the little details I wanted to delete/paint on later into one single model. I instead continued work with the unfixed version [1].

Like before, I used Blender to digitally clear out Twilight’s eyelashes and stitch her mouth shut. I really wanted to try printing her mane pieces separately so I could glue them on later, but I can’t Blender well enough to make that happen.

Over in Slic3r, I scaled the model up by half an inch from front to back. This made her feel a lot bigger, but not so big I was in too much danger of running out.

I played with paint on support blockers a bunch, but I found they weren’t as versatile as I would have liked. I found myself working more with the more geometrically themed blocks. Of note, I added one to the tight space between her mane and neck and a cylindrical one between her mane and forehead. As I finalized each block, I made sure to inspect the individual overhang layers to make sure they would bridge properly.

With the bigger model, I had to override the program into using solid infill for those fragile legs. The selection box was the same as the support blocker. I also told it to make Twilight’s unicorn horn solid at the base, even though it would have been fine with her mane intersecting it (another reason not to print head pieces separately).

As one final touch, I moved Twilight off to the side and removed her raft so the scratch in the build plate would only affect the support material.

Printing and Cleanup

Printing went smoothly. I checked in once an hour until she was done. The PVC pipe I’m using to extend the filament rack fell out again, but fortunately it didn’t cause any issues as I observed during a calibration print. This print used most of the rest of my spool of red PLA filament; it’s just starting on the second to last layer. I have a smaller print or two left, but that’s it.

Removal of the support material took about as long as last time – a full day plus a bit. This time, I tried to be more careful about her mane, and it paid off. Twilight did not suffer any ill effects for missing a few supports here and there. I even caught myself laying fingers on fragile bits while trying to get leverage on stuck bits elsewhere before I broke anything.

Despite the model being scaled up a little, cleanup wasn’t much easier overall. The cutters/needle nose pliers couldn’t reach as far between her legs, but I can get both those parts with sandpaper. The mane was as obtuse with me as before, but after a while, I managed to use a repurposed sewing needle and a bit of tie wire to leverage a corner to where I could get in there with the pliers. It felt so good getting that bit out, but I cracked the lock of her mane hanging off to the right. I want to print up some test pieces and practice repair techniques before continuing work on the real one.

Notes for Future Prints

If I make another attempt after this one, I may follow the fixed version’s cue and fuse all disjoint model pieces before exporting from Blender to Slic3r (over a .stl file). My hope is that Slic3r won’t get as confused with intersecting geometries as found in her mane.

In all reality, I should be thankful these prints are cleaning up as well as they are. The proper tool for the job is either a resin 3D printer –which can manage finer details– or an FDM (Fused Deposition Modeling) printer with an extra head dedicated to a dissolvable support material so I can be done with cleanup in minutes instead of hours. For now, the tool I have has a single printhead for a single filament, and that means tricky supports.

But tricky supports can stick. Both Twilight prints had issues with stuck bits under their manes, bellies, and to a lesser extent: their tails. The bottom layer of those respective regions appears to be peeling away with the interface material, so it takes a bit extra force – exactly the thing you don’t want around delicate parts like legs. While I was discussing this on the Sweetie Bot Project Discord server, user Equestria_dynamics suggested “increasing the contact layers between the print and the actual support material [2].”

Side Project

What fun is it to make all sorts of fun stuff if you can’t share it? You’d be surprised how hard that can be without access to a smartphone you’re willing to use (more on that in a future post when I install AOSP). Special thanks to my sister for loaning me her Nikon S3000 digital camera from around the time she got a smartphone. It’s mostly unused, but the charger was missing. I tracked one down and we ordered it up.

This camera is good for beginners and begging brothers. My impression is that it was aimed at people who understand the concept of point and shoot, but prioritize pictures fitting on a card over lossless compression methods. Read: I want .png and spent hours confirming it only does .jpg.

To get the best quality pictures I can of my prints, I’ve decided to get myself a photo booth. For an early prototype, my father laid some large sheets over his workbench and topped that with some parchment paper so the content on the other side wouldn’t show through. Presently, we’re making a second, more permanent version out of a cardboard box with some creative cutting.

Takeaway

As with any piece of software, Slic3r is taking time to learn. Having to learn a whole segment of the workflow all at once makes it take a bit longer, but I look forward to being able to show my stuff off in a more controlled manor than snapshots with random bits of house in the background.

Final Question

Have you ever glued delicate parts back together on a 3D print? What glue worked out for you?

Works Cited

[1] dragonator, “Mane 6 models MLP:FIM,” Thingverse.com, April 09, 2012. [Online]. https://www.thingiverse.com/thing:21076. [Accessed Jan. 17, 2022].

[2] E. dynamics, Sweetie Bot Project. [Discord] #3d-printing, (Jan. 14, 2022).

Installing NUT UPS Driver on Rocky Linux 8

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am installing the Network UPS Tool on my Rocky Linux 8 Button Mash server. Let’s get started!

A Package Exists

In a previous push on my Button Mash server, I talked about getting an Uninterruptible Power Supply (UPS) so ButtonMash could shut itself down in case of a power failure. If memory serves, I also talked about an open source driver called Network UPS Tools (NUT). At the time, I was under the impression it was exclusively available via source code and I would have to compile it to make it work.

I’ve recently suffered no fewer than four power outages since installing the UPS. A couple long ones while everyone in bed would have outlasted the UPS’s endurance had someone not noticed been aware each time to gracefully shut things down manually. I want the process automated.

And so I started the grind. The first thing the installation instructions tell me is to check for a package. Sign me up!

dnf search nut

I got several results, but with such a simple package name, the letters n-u-t turned up many false positives. NUT’s companion packages come with names of the form: ‘nut-*’, so I often filtered with ‘nut-’. My refined searches remained empty.

Installing EPEL and NUT

If the backbone of a distribution is its package manager, repositories would be its ribs. Not every piece of software gets compiled and packaged for every architecture/package manager. I get that. It was a lesson I had to learn last time I played with optimizing MicroCore Linux and why I’m going with Arch if there ever is a next time.

When I learned NUT was widely available in package form, I went looking again on Rocky Linus dnf: still nothing. Debian has a nice package viewer[1], so I looked for something similar for Red Hat distos. I wanted to be sure I wasn’t missing something before concluding the nonexistence of a package for me. One exists, but I’d need to make an account. However, I found something even better for my purposes.

pkgs.org[2] is a website that lists packages organized by several different major distributions. I was quickly able to find NUT in the CentOS 8 section for the Intel CPU architecture, but not anywhere under Rocky Linux.

A closer look after hours of confusion introduced me to the EPEL repository (Extra Packages for Enterprise Linux). Apparently, it’s held in high regard among the Red Hat branch. Many enterprise Linux users consider it almost mandatory to offset the smaller offering by default repositories. I was uneasy about it at first because it showed up for the now depreciated CentOS RHEL downstream, but EPEL is maintained by the Fedora community, which isn’t going anywhere for the foreseeable future: I’m calling it safe to use.

sudo dnf install epel-release
dnf search nut

NUT was then as simple to install as any other program from a repository.

Side Project

Podman pranks again! While testing my Bitwarden login from my laptop, I got myself permanently logged out. I traced the problem back to my Podman container on ButtonMash corrupting during one of those power outages from earlier. I sent a discouraging error off to the search engine and I found my exact issue on the Podman GitHub (see Works Cited) [3]. I wasn’t happy with the explanation, but it was the best one I found: systemd didn’t like an under-privileged user doing things without at least a recent login, so it messed with Vaultwarden’s Podman container. The messed up container had to be forcefully deleted and remade. I also needed to remember to specify https:// when looking for the server via browser. To make sure it doesn’t happen again, I followed a piece of advice found later in the discussion and permitted the login to linger.

Takeaway

I honestly expected this week’s progress to take at least a month. When I first looked into NUT, all I saw was source code ready to download and compile and honestly, I’m having trouble getting excited about mastering the art of compiling other peoples’ code. If there’s a way to install via a compatible repository, I’m all for it.

I am especially thankful for pkgs.org [2]. They helped me reduce my problem to one I’ve at least blindly followed a tutorial for. You typically won’t find the full, non-free version of Chrome on Linux, so when I was setting up Mint for my father, I had to explicitly add a repository.

While NUT may be installed, configuration is not happening this week if I expect to understand my system when I’m done. I blitzed the first expected month of work and only stopped because the next bit is so intimidating. Here’s to a quick understanding within the next month.

Final Question

NUT has proved difficult to locate assistance for, as I haven’t figured out how use their internal system. Do you have any idea where I can find support for when I need it?

Works Cited

[1] Debian, “Packages”Debian, July, 2019,Available: https://packages.debian.org [Accessed: Jan. 10, 2022].

[2] M. Ulianytskyi, “Packages for Linux and Unix”pkgs.org, 2009-2022, Available:https://pkgs.org/ [Accessed: Jan. 10, 2022].

[3] balamuruganravi “rootless podman ERRO[0000] error joining network namespace for container #6800” github.com, Jun 2020. Available:https://github.com/containers/podman/issues/6800 [Accessed: Jan. 10, 2022].

Calibrating my 3D Printer: Overhangs and Supports

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am continuing to work with my 3D printer. I’m covering a lot of ground this week, so let’s get started!

.Gcode Flavor

I left off last week wondering what was with my printer cooling its head when I had already preheated it through firmware. I reached out to various help channels until I randomly speculated that my printer was speaking a slightly different dialect than what PrusaSlic3r was feeding it. A helpful user suggested I switch my .gcode flavor to Marlin (listed as Marlin (legacy) in Slic3r).

I compared outputs from the two flavors after slicing the same object. The two files were similar, but legacy machines like mine –it would seem– do best with some additional information before any custom .gcode a user might want.

In retrospect, I probably should have learned to make my own temperature tower. Running .gcode meant for a larger printer can cause any one from a number of problems. At the same time, I’m glad I printed the tower with raw .gcode or else I might have easily given up.

Calibration Park

Armed with an optimal or near-optimal printing temperature, I set about printing a calibration multi-test [1]. I came back part way through the print and found that a PVC pipe I use to extend the filament holder had fallen off and both the X and Y had been gotten way off (I’m just glad it wasn’t on a more serious print). Additionally, the base was warped something awful. The test was still stuck to the printbed, but it was almost trivial to remove. I figured my bed was too low, which it was, but it took me until I noticed my heated bed turning off after the first layer that I had a setting wrong in Slic3r.

I was able to save my second serious attempt at the test by manually adjusting the temperature from my printer’s touchscreen. It turned out pretty well after that. The scratch in the middle of the bed was obvious, and a lot of the fine details in the lettering describing each test were lost. Otherwise, everything appeared to do OK at the very least. The overhang test was technically still together at the 80 degree inclination, but artifacts were beginning to show up by around 45 degrees. Most importantly: the large artifacts I had when unknowingly printing with wet filament were fixed.

Planning a Complex Print

To date, the most complex print I’ve successfully probably pulled off would have to be my Blinkie Pie case, where I modified a PacMan ghost case so a camera could see out one eye. Aside from a little impossible bridging that quickly evened itself out, that wasn’t a difficult print. But the world of 3D printing is much more diverse than variations on simple shapes.

I decided to try printing a model of unicorn Twilight Sparkle — both for her (percieved) relative simple geometry compared to her friends and so I wouldn’t have to risk her potentially breakable wings as seen across most of the show. I found a model on Thingverse after looking at several different places that wouldn’t let me download without creating an account — free or otherwise [2].

I went back and forth with it between Slic3r and Blender a time or two to refine Twilight’s model. While skimming through the planned layers, I noticed she had a sizable oral cavity. Her tongue and teeth were simple enough to delete, but it took a bit more patience to remove the rest of her mouth and stitch it back together. Somewhere in there I got rid of her eye lashes, which were also separate meshes from her main model as I was sure they would be hardly there to begin with and likely would be damaged while removing support material.

Speaking of support material, I knew from the beginning that I wasn’t getting away without a bunch of it. Twilight’s mane has a number of spots that hang down from layers printed later – let alone her tail as it arches up, backwards, and not quite to the ground. I messed with the automatic settings until I had what looked like a minimal amount of support, but after seeing the results of the overhang test, I put the settings back up. I also ordered up a raft three layers thick to cover up the scratch in the middle of my build plate.

Another concern I had was what Twilight’s center of mass was going to look like. At one point, Slic3r had her tail slotted for mostly solid infill with her head at 15% honeycomb infill. While I was able to find a solution involving analyzing the sliced figure with a Blender plugin, I ended up scaling Twilight up to about four inches as opposed to about three/three and a half – big enough so her tail was also rendered as a shell with infill, but small enough that her legs were solid.

A closer inspection of some supports gave me the distinct impression that Slic3r was being silly. The most complicated part of Twilight’s geometry is her mane, and there were more than a few tiny “overhangs” I figured would be fine being bridged instead of supported. I found some support blocker cubes I could move and scale, but it was clunky and there’s a better system for painting on supports I’ll be looking into next week. I wasn’t the happiest with the results I had, but I printed it anyway.

Cleanup and Repair

Between six and seven hours later, I had a pony standing on my build plate rendered in my recovered red filament. Cleanup started quickly as I cut away large sections where I knew there wasn’t anything, but as I got closer in, needle nose pliers and cutters were getting to be a little too awkward. My father arranged for a poker fashioned from some construction grade tie wire often used for holding re-bar in place while pouring concrete structures. Even then, it was a bit thick to fit in all the needed places. My mother offered a sewing straight pin which was versatile, but bowed more easily.

I quickly became jealous of dual+ head printers that can possibly use a soluble filament for easy support removal. It was a major morale boost when I was finally able to free Twilight’s face. Other tough spots included the arch of her tail, The tight spots between her legs and up across her belly, several tight spots in her mane, and the raft stuck to her hooves. I am very glad I scaled her up as much as I did.

There were a few moments when I wasn’t as careful as I should have been. I broke Twilight’s right back leg below her hock (the ankle-like joint most of the way up her leg) about half way through, and snapped her mane a few times in a couple places. Sections across her belly had to be cut away.

Despite the missing leg, there remains a piece just behind Twilight’s front legs. I had a feeling from the beginning that the supports between her forehead and bangs wouldn’t be coming out and they haven’t. At this point, I’d need to melt a handle to the remaining support material and carefully yank. The toughest holdout is physically trapped between her neck and the bit of her mane hanging to the side. I’ve already chipped the tip of her mane there trying to get it out.

I had already decided that I’d be reslicing and reprinting – I just haven’t yet. However, it doesn’t feel right to leave this Twilight without at least reattaching her leg and doing what we can with her mane. My father and I worked on the remaining bits of raft with a razor stuck to her hooves and used some superglue. The first repair on her mane didn’t go the best, so we’re using some painter’s tape to hold it in place. The leg was more promising, so at least she can stand while she waits. Maybe I’ll come back to her when I have more skill, but for now, this model has served as a learning experience so my next print should go better.

Side Project

I accidentally closed my main FireFox window. Normally that’s annoying, but since there was an update cued, I managed to destroy it completely in my attempts to recover it. I checked around online and learned a little about how Firefox stores saved sessions and I found a backup from not quite two weeks ago. It’s not perfect, but I’ll take 96% restoration over nothing!

Takeaway

3D printing is an art form, even if you’re printing other people’s .stl files. There are many factors to adjust to keep your printer in top condition. Slicing programs require knowledge about your printer’s tolerances to use effectively. Even if it prints correctly, you may want to sand, prime, and paint it.

Final Question

Have you ever set aside a work-in-progress for when you’re better equipped to finish it?

Works Cited

[1] majda 107, “*MINI* All In One 3D printer test,” Thingverse.com, Feb. 25, 2018. [Online]. Available: https://www.thingiverse.com/thing:2806295. [Accessed Jan. 3, 2022].

[2] dragonator, “Mane 6 models MLP:FIM,” Thingverse.com, April 09, 2012. [Online]. https://www.thingiverse.com/thing:21076. [Accessed Jan. 3, 2022].

[2*] David, “Mane 6 models MLP:FIM – Fixed,” Thingverse.com, June 19, 2012. [Online]. Available: https://www.thingiverse.com/thing:25282. [Accessed Jan. 3, 2022].

* The second [2] hosts the same models but “fixed” variants. I don’t know for sure which version I used, but I’m slightly more sure than not that I used the 21076 models.

Calibrating My 3D Printer: Temperature Tower

Good Morning from my Robotics Lab! This is Shadow_8472, and today I am recalibrating my 3D printer after leaving things to rot for a year or so. Let’s get started!

Printer Alignment

The first step in getting my printer operational again was to start from the beginning: alignment. My father got out the bubble level and I folded some large papers to get the plethora of degrees of freedom all lined up.

Tuning continued with the built-in, poorly communicated bed leveling tool. The printhead traveled to each corner and I slipped a calibration sheet under it and adjusted the corners such that it could slide, but not freely. When the right Z-axis was found to be misaligned, my father reached in and turned it a bit. I was sure it would have been frozen, but we were able to level the horizontal bar.

Temperature Tower

One well-used calibration test is the temperature tower. Regular printers use ink/toner (which original manufacturers go to great lengths to regulate) and paper (which is so standardized, it’s rare to see messed up). 3D printer filament is at least as varied and presents itself as universally interchangeable as long as it fits and the printer can melt it. As a result of differences between specific models –and even specific printers/printing environments– filament and printer manufacturers can only make broad guesses as to what the best setting will be for your specific printer.

That is where the temperature tower comes in. Instead of printing the same test shape over and over again on different jobs, they can be stacked one on top of the next and an instruction to change printhead temperature for each “floor” can be inserted.

From what I’ve gathered, temperature towers are normally assembled manually in a slicer for the exact printer, but I decided to try one straight from gcode (that went hot to cold; I didn’t want the filament freezing on the bottom and making a mess trying to print atop thin air). I didn’t first make sure the printer would be able to understand it; I didn’t make sure it would fit within my printer’s volume. I just loaded it up and hit print. Surprisingly, it worked. I had adjusted my bed a bit high and the first layer was smooshed (making it very difficult to remove), but I’m officially printing again.

I used my red filament and the tower that came out demonstrated its ability to bridge, overhang, and produce fine points. Each floor is numbered after the temperature it was printed at. The whole range was fairly good, but there was less stringing higher up, where the printhead was cooler. All other tests performed well at most temperatures.

Side Project

This month’s effort to reward award goes to getting my father printing on Debian. I sat down with him to get it working and we installed the CUPS universal printer driver and it worked with no additional fiddling.

Takeaway

Printer calibration is an important step to understand and use when needed – 2D or 3D. 3D printing is a much younger technology with a literal extra dimension for things to go wrong; it requires a greater degree of technical mindedness to keep in working order to the point where you at least need to be or know a hobbyist to have continued access to this amazing consumer level technology.

Final Question

I had more planned in terms of printer calibration, but it looks like that will need to wait for next week as I figure out the thought process for PrusaSlicer. It looks like they have some sort of preheat function in the .gcode header, but in practice, I already preheat my bed and hot end before selecting a file to print. In my workflow, this programming blurb ends up telling things to cool. Any ideas where the setting is to control it?

Baking Old Filament May Reduce Water Content

Good Morning from my Robotics Lab! This is Shadow_8472 and today, I am getting back into 3D printing, but I doubt it’s going to be pretty. Let’s get started!

Inspection of Equipment and Materials

My 3D printer is in used condition. The print bed is scratched and one of the two Z-axis rods got bent at around the same time. My filaments are old and brittle. I can’t even use the slicer it came with anymore because it’s both outdated and made exclusively for Windows. I’d rather just start over with a standard one designed to be user-serviceable. But that’s not an option at the moment.

I should learn about what I already have and work from there. There’s not much I can do about the scratch unless the original replacement pad shows up or unless I’m willing to fill it in/cover it up somehow. As much as I’d like to replace the Z-axis rod, a suitable replacement proved elusive for reasons discussed above; besides, the tweak doesn’t look that bad – the top of the rod only moves back and forth a little when the print print head is moving vertically and is down low. Alternate slicers exist. Long story short, I may as well give this printer one last chance before giving up on it completely.

Filament Reclamation

I have two PLA filaments I’m considering today: my original, red one and an opaque white one I got later and hardly ever used. Red used to just work. White felt different from its day 1 and never printed nicely. After a couple years of absorbing moisture from the air, they’re both as stiff as spaghetti. I even bent one piece of White until its middle piece snapped out from between the ends.

Besides causing stiffening, absorbed water evaporates when exposed to heat, causing problems such as the ones I experienced last time I tried printing. Water from within the filament forms steam, and it’s the steam that causes mysterious jams that seemingly go away come time for diagnostics.

A number of places have listed methods for drying out filament: bake it. Just be aware of the material’s glass transition phase where it goes from resembling a wire to resembling a more squishy rubber. The whole spool will fuse and you’re reclamation efforts will be for none. For PLA, that transition is somewhere around 140 degrees Fahrenheit.

To be safe, I elected to aim for 100-120 degrees F. My stove at home doesn’t hold its temperature that low. We put a bowel of water in overnight with a rising loaf of bread and it tested way cooler than needed. We tried our old toaster oven and tested at 125 F – close, but as I only had one shot to fix what I have, I didn’t want to risk it.

Specialized devices exist to dry out filaments. I was able to approximate one by modifying a food dehydrator operating at 125 F. My final design involved a rheostat from my father’s soldering iron to adjust the otherwise fixed temperature, some Duplos (a Lego-like block aimed at younger ages we’ve had laying around since I was little) to hold up the lid, and a tall, plastic film from my mother’s cake supplies to extend the tray. Without a thermostat, I monitored the temperature myself with a digital cooking thermometer we got for my sister’s bread making.

Both Red and White were dried overnight. White still felt stiff, so I left it in for several hours more. The temperature was difficult to keep constant. I left the contraption in a small room, and the room warms up and I have to turn the power down. If I had known how to easily, I would have built a thermostat capable of operating in those ranges. In retrospect, it would have been better to just leave it in the toaster oven on warm and not worry about it.

Side Project

I was able to get Vaultwarden running by forwarding the incoming traffic to the container’s port 80 instead of 443. However, this is still sub-optimal. I have my ability to manage passwords between devices back, and that feels sooo good after months of downtime, but I’ve been strongly encouraged to use a reverse proxy. This week, I looked into NGINX, and I believe that will be a focus some time in the coming weeks.

Takeaway

The path to my improvised filament dehydrator was a little longer than going right there. My early approach was At first, I figured I’d want to build something with a couple appliance bulbs like what the oven uses. The food dehydrator I eventually used as a base only has an on-off switch, so to lower its steady state temperature, I used some short Duplo stilts to raise a lower level to let ambient air in. I kept them for my production run, though if I have to run it again in the future, I’ll leave the sides closed and turn the power down lower on the rheostat.

Final Question

What would you tell someone who is ready to know more about 3D printing than: use slicer, level bed, load filament, press start?

Self-Signed Vaultwarden Breakdown

Good Morning from my Robotics Lab! This is Shadow_8472 and today, I am going over creating a self-signed certificate for my Vaultwarden. Let’s get started!

I’ve spent a long time trying to figure out proper HTTPS, but slapping on a solution and going without understanding the underlying workings doesn’t feel right. I don’t even have that. As long as I learn something each attempt, that should be good enough. I’ll be following the tutorial from Vaultwarden [1] with commentary from censiClick’s video [2]. My commentary here will be largely guesswork based off those and associated manual pages [that I have no idea how to properly cite but are available by typing man <command> in most Linux terminals].
https://github.com/dani-garcia/vaultwarden/wiki/Private-CA-and-self-signed-certs-that-work-with-Chrome
https://www.youtube.com/watch?v=eCJA1F72izc

Step 1: Generate Key

openssl genpkey -algorithm RSA -aes128 -out private-ca.key -outform PEM -pkeyopt rsa_keygen_bits:2048
openssl genpkey

This base command generates a private key for OpenSSL.

-algorithm RSA -aes128

RSA and aes128 are encryption algorithms for generating the key. RSA is a public/private key system and aes is a powerful single-key algorithm. Here, they can be seen working together to create a powerful encryption without having to find a relatively private back alley to exchange keys.

-out private-ca.key -outform PEM

These flags specify where to save the key after it’s generated and what format to save it as.

-pkeyopt rsa_keygen_bits:2048

(Private KEY OPTion) This flag lets you manage options for key generator algorithms, in this case: using the 2048 version of RSA.

Step 2: Generate Certificate

openssl req -x509 -new -nodes -sha256 -days 3650 -key private-ca.key -out self-signed-ca-cert.crt
openssl req

(REQuest) This command obtains certificates. In this case, it’s generating one itself, but as the name implies, it’s aimed more at requesting them from an authority.

-x509 -new -nodes -sha256 -days 3650

-x509 specifies that this root certificate will be self-signed. The -days flag will set it to expire in ten years minus leap days. The -new flag has the user fill in some additional information for the certificate, -nodes leaves private keys unencrypted, and -sha256 is a hash function.

-key private-ca.key -out self-signed-ca-cert.crt

These final flags are I/O. key loads the key from the previous command, out names the certificate.

Step Three: Preparing to Sign

openssl genpkey -algorithm RSA -out bitwarden.key -outform PEM -pkeyopt rsa_keygen_bits:2048
openssl req -new -key bitwarden.key -out bitwarden.csr

These commands are similar to before but for Bitwarden. They lack components needed to make the root certificate authority. There’s also some sort of special configuration file I’m not looking to break down, but is around under Vaultwarden’s GitHub [1].

Step Four: Signing the Certificate

openssl x509 -req -in bitwarden.csr -CA self-signed-ca-cert.crt -CAkey private-ca.key -CAcreateserial -out bitwarden.crt -days 365 -sha256 -extfile bitwarden.ext

Finally, it’s time to bring everything together to sign the certificate. Many of these flags are familiar from previous commands. Reading through it, it feels like the last stop to make sure all your papers are in order. Some operating systems are rightfully cautious about certificates signed for an overly lengthy time.

From here, it’s a matter of starting the Vaultwarden container with its new certificate and assuring whichever browsers you’re using that you trust the new certificate authority [2].

Practice to Practical

I’m glad I took the time to study this a little more closely than blindly following instructions this time. When making using openssl req, I was able to confidently regress by deleting a few files so I could give a different common name to the root CA and Vaultwarden’s certificates respectively.

The next challenge was successfully launching the Podman container. Following along with the censiCLICK tutorial, I had three new flags relative to last time I was working with Podman. One was to restart the container unless stopped (no elaboration provided).

The second flag tripped me up. I confused a pair of default ssl certificates for the of self-signed ones required later on, bitwarden.crt and bitwarden.key, created in earlier steps. I copied those two files into their own Podman-mountable directory. Once again, I added the :Z flag to tell SELinux it’s OK.

-e ROCKET_TLS='{certs="/ssl/bitwarden.crt",key="/ssl/bitwarden.key"}'

The final flag sets an environment variable as the container finishes starting. This particular one is configured to tell Vaultwarden where the files are to encrypt HTTPS. If they aren’t there –as I found out while I was still sorting the system certificates– something inside the container shuts it down; it was not a fun combo with the restart unless manually stopped flag as I had trouble removing the container so I could create a new for my next attempt. I knew I was done when podman ps returned a container running for longer than a second or two…

…or so I thought. I went to import my root certificate authority to Firefox, and I still can’t connect even when specifying https://<ButtonMashIP>:44300.

Long Story Short:

podman run -d --name vaultwarden --restart unless-stopped -v /home/vaultwardenUsr/<path/to/vw-data>/:/data/:Z -v /home/vaultwardenUsr/<path/to/private/certs>/:/ssl/:Z -e ROCKET_TLS='{certs="/ssl/bitwarden.crt",key="/ssl/bitwarden.key"}' -p 44300:443 vaultwarden/server:latest
Edit Jan. 6 2022: Vaultwarden listens on port 80, so I'm using -p 44300:80 now. And when you go to verify in a browser, be sure to use https:// or you get "The connection was reset".

This is my current command to generate a Vaultwarden container with Podman and no root privileges. In the end, the only major differences with Docker containers are the paths to mount the volumes Vaultwarden needs from the host machine and the :Z flags for SELinux. Currently, I’m not able to establish a secure connection. I have a help request out, and will edit if I get an update later today, otherwise, I already know what next week’s side project will be.

Side Project

Thursday held a startling surprise as a new zero-day exploit appeared affecting Minecraft, among other things. I must have found out within a few hours of it going public. After doing my research and checking sources, I concluded it was real and with the help of tech support, I was on a patched version of Paper within an hour or so of finding out.

Log4Shell (as this one has come to be called) is scary both because an attacker can take full control of a vulnerable computer and how common vulnerabilities are. On the other hand, once such exploits go public, things get updated pretty fast.

Here is the best article I’ve seen as of about ten hours of the exploit going public: https://www.lunasec.io/docs/blog/log4j-zero-day/

The moral of this story is to keep your software up to date, especially if you see any big stories about computer security.

Takeaway

All the HTTPS literature I found appears to be aimed at the curious pedestrian or the seasoned system administrator. This made it very difficult to be someone in an in-between level of understanding. On a personal note, I learned that pressing the / key while in a man page lets me search the document, a feature I really wished I knew about two years ago.

One important critique I’d offer the censiCLICK video is that the tutorial was dumped straight into the home directory and no effort was given to change default usernames/passwords, which I would consider very important for a monolithic tutorial.

Final Question

Have you ever had a project fight you to the bitter end?

Works Cited

[1] “Private CA and self signed certs that work with Chrome”github.com, [Online]. Available:https://github.com/dani-garcia/vaultwarden/wiki/Private-CA-and-self-signed-certs-that-work-with-Chrome. [accessed Dec. 13, 2021].

[2] censiCLICK, “Full Guide to Self-hosting Password Manager Bitwarden on Raspberry Pi,” on YouTube, Nov 15, 2020. [Online video]. Available: https://www.youtube.com/watch?v=eCJA1F72izc. [Accessed Dec. 13, 2021].

Emergency Power Reserves

Good Morning from my Robotics Lab! This is Shadow_8472, and today I am adding an uninterruptible power supply to ButtonMash instead of actually finishing the Bitwarden job because SSL certificates are very confusing to research. Let’s get started!

Computers 101

Here is the first lesson in computer literacy: power in, stuff happens. But unlike simple light bulbs, computers are essentially endlessly shifting labyrinths of electronic circuits. Complex patterns of information flash back and forth at near light speed both within any given computer. Networked computers form even more complex circuits. Everything is timed on the scale of nanoseconds or tighter. Power a local node off suddenly, and these patterns can be interrupted. That is why it’s important to use proper shutdown procedures.

But power outages are almost always a surprise. Planned maintenance or safety shutoffs can happen, but more often than not, the power company is just as surprised as its customers left in the dark. Backup systems are about as varied as their applications. I’ve heard of an old diesel locomotive engine rigged to jump start power generation for an entire college campus. Combustion-powered generators are popular at many scales. The hardware I’m dealing with today is an Uninterruptible Power Supply (UPS) from CyberPower.

First Impressions

This particular unit is essentially a battery with an inverter and some electronics to monitor everything. Going off just the box and literature it shipped with, it can power a little network device for several hours or a gaming console and TV for half an hour. Just don’t go trying to vacuum with it or run a space heater off it.

The unit has a USB-B connector in back, but little more is said about it than it carries data. I had to do a bunch of background research online to know beyond the shadow of a doubt that my particular model here could communicate a power outage so the system can gracefully shut down. Otherwise, it’s useless for long and unattended outages.

I did not find the CyberPower website helpful. The Linux driver section kept listing RHEL/CentOS 7 and ButtonMash is running a RHEL 8 compatible system. By the time I got around to seeking personal assistance finding the right driver, we had lost the receipt and didn’t know the exact date of purchase, which was the only field labeled required by the help form.

I borrowed a phone and called in. After explaining my situation, retrospect has me believe I was shepherded into the part of the help script pointing me past the one spot where the RHEL driver included version 8, and by then I had forgotten I was still wondering if my specific model could actually use the driver. Assuming it could, it wasn’t clear if the driver could hook into Cockpit or if it would want an open port all to itself.

Open Source Driver: NUT

CyberPower’s official support may be official, but it left a bad impression. When I saw that the driver needed root privileges, I decided to research an open source driver. Not many appear to exist. I reached out to my usual Linux community support channel, but it was quiet all day. I eventually landed on a mention of Network UPS Tools (NUT).

Unfortunately, my research here is incomplete. My impression is that they’ve been around for a while and that I will need to familiarize myself with some less beginner-friendly Linux rituals to operate effectively there. NUT appears to be exclusively distributed as source code signed with GPG. I haven’t mastered either skill. Furthermore, even if I do get the driver working, my specific model isn’t on their known working list. In any case, I will need to reach out to this specific community at some point if I want to see it working.

Side Project

My sister is into a game called Stardew Valley. It recently had a slightly clunky update that broke her modded setup through something known as SMAPI. My father and I took turns working on it. I opted to try a clean install on the virtual machine I’m trying to set up for her, but I ran into a problem when the virtual drive filled up its physical space without dynamically expanding. I had made a copy of the whole VM, so I was able to delete the troubled clone. In the future, I should take snapshots to restore.

Meanwhile, my father worked on the original Windows install. Together, we traced the problem to the wrong specific version the dotnet 5 framework being used when I took the shasum of the install file and compared it against the files available for download. We later identified the problem as a failure to communicate on the part of the download page. The three Windows versions looked like they could be one download each for Windows, Linux, and Mac where the correct version was located in the “column” below the Linux tab’s heading.

Takeaway

It’s safe to say I’m well beyond beginner-friendly Linux territory now. I start doing sysadmin level stunts, I best expect to subside on sysadmin grade assistance. For now, I’m happy knowing ButtonMash can survive a brief power blink and that I have a while to manually shut it down if I notice an outage as it starts.

Final Question

Has quality of help ever chased you away from a particular product?

Slow and Steady Builds a Server

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am continuing the grind on my Rocky Linux server running on my ButtonMash workstation. Let’s get started!

Quality of Life

I’ve had a single-focus mindset of getting Bitwarden/Vaultwarden working, but I’ve overlooked an important aspect of running a reliable server. One evening, any new connections to ButtonMash were failing. When I investigated the next day, the system was on and the network was connected, but when I logged in to console and pulled up the address with ip a, I found the router had incremented the IP by 1.

The task of setting up static IP’s is not alien to me. On some systems, I’ve even edited config files by hand. Cockpit has a Networking tab, though. From there, I was able to quickly worm my way into the correct network interface and configure a static IPv4 back to where it belongs. Cockpit tried to reestablish its connection with the new configuration and predictably failed. I had to make the change permanent with a follow up prompt.

Container Isolation

One of the draws of Podman over Docker is rootless containers. In the unlikely event someone hacks into Vaultwarden’s container and breaks out into the host system, he won’t be able to do as much damage if he finds himself in a non-root account – even better is if he finds himself in an account without sudo privileges.

With that, I added a user special for running Vaultwarden with sudo useradd vaultwardenUsr and I locked it with sudo usermod -L vaultwardenUsr to block any normal login attempts. sudo su vaultwardenUsr will still let me Substitute User into the account. And of course I find the tools to do all that under Cockpit tab Accounts.

From within my dedicated Vaultwarden container user, I looked for the two containers listed by the plugin. But I found nothing. From my background research I should have put together, containers are owned by users like any normal file. The two images the plugin listing their owner as “system” were actually owned and operated by root, as clarified by a test where I stepped back from Administrative access to download a new container image. Novel as it is, the plugin won’t be of much help for my use case unless Cockpit lets me access it without a password.

Bringing Vaultwarden Online

podman run -d --name vaultwarden -v /home/vaultwardenUsr/vw-data/:/data/:Z -p 44300:443 vaultwarden/server:latest

This is a long, complex command that took me while to puzzle into working order.

podman run

This is the base command. I used it to go from a container image to container.

-d

“Detach” runs containers in the background.

--name vaultwarden

By default, containers are given random pronounceable names. You can just spin up multiple copies of the same image without needing to give it much thought. Here, it’s best to have something descriptive.

-v /home/[username]/vw-data/:/data/:Z

“Volume” mounts a directory from the host into a directory in the container. This part deviates from most Vaultwarden guides the farthest. First of all, Docker installation assumes you’ll be mounting directory /vw-data/ directly from the root of your file system. However, that directory is off limits without elevated privileges, so it needs a place in the user’s home directory and a full path to that directory.

The other solved issue involves the :Z at the end. At one point, I seemingly had everything else sorted, but when ran **podman ps** to list running containers, it kept coming back empty. My online searches for Podman and Vaultwarden kept sending me back to last week’s progress-report of a post, but I eventually located a discussion on Vaultwarden’s GitHub. I didn’t do much follow up research after I got it working, but it appears to be related to SELinux (Security Enhanced Linux), a kernel level security module.

-p 44300:443

“Port” forwards ports from the host machine to individual containers: host on the left and container on the right. Recommended behavior (with Docker in mind) is to forward port 80 (HTTP), but I’d rather use HTTPS on port 443. Additionally: ports 0-1023 are reserved for system use, so I added a couple zeros on the host end.

vaultwarden/server:latest

With all the flags out of the way, this is the container image being copied into an operable format.

With the container running, all I had to do was punch a hole in the firewall and I can now have Firefox laugh at me for a failed secure connection. During assembly, I was able to make a non-secure HTTP connection with -p 8000:80 and bring up a Bitwarden login.

The next step is to obtain a security certificate, but that’s a topic for another week…

Side Project

When I walked my father through installing Debian/LXDE on his computer, he was left with a few specialty keys on the keyboard going unresponsive – particularly the volume up, down, and mute keys. The system is usable without them, but it would be nice if these keys worked. Originally, I assumed the problem would be somewhere with Debian itself, but when I tried a search targeting LXDE instead, I knew from the search results that I had today’s side project.

As we researched, I started building a system flow chart from key press to volume adjustment. The Keyboard transmits its key events to a USB receiver. The receiver communicates with some sort of keyboard driver be it discrete or compiled into the Linux kernel. The kernel then passes key events to the Xorg server. From here, we used xev (X EVent) to confirm that volume key events were all making it thus far.

At some point, PuleseAudio takes over and tells the Linux kernel what to push to the speakers and how loud to play it. While testing, we cut off a song with pulseaudio –stop / –start and had to refresh the webpage to get it back.

I personally think we’ll find the problem either within Xorg or between on a direct link between Xorg and Pulseaudio. In the meantime, the search continues.

Takeaway

For both these projects: ready-made solutions out there we could just copy, paste, and wish for luck but we’re trying to learn the innards of Linux, so it’s okay to take extra time.

Final Question

Have you ever had to program your keyboard events by hand?

I’m Learning Vaultwarden and Podman!

Good Morning from my Robotics Lab! This is Shadow_8472, and today –with a heap of luck– I’ll be putting a Bitwarden server on ButtonMash (or getting so close I can’t help but finish next week). Let’s get started.

Vaultwarden

I’ve already talked about the importance of password strength before. Longer is better, but a unique password per login is more important in case one gets compromised. But who has the attention span to remembering fifty passwords across every obscure site, app, or game he’s ever interacted with? A good password manager solves this by organizing your passwords so you can easily access them from a client, but anyone without your key can’t.

I started researching for this project by revisiting the first time I switched to using Bitwarden and I decided to self-host a server from a Raspberry Pi [1] following a straightforward tutorial by censiCLICK [2]. My SD card corrupted one day, and I’ve been out a password server ever since, despite efforts to repair it. I’ve been covering my exploration of Rocky Linux, a RHEL family OS, on my ButtonMash server/workstation, and now I’m ready to start putting it to work.

The tutorial by censiCLICK was well presented. It takes you from Raspberry Pi 3B+ and layers on Raspberry Pi OS, Docker, and finally Bitwarden_RS all while giving basic introductions to skills you’ll need along the way like SSH and security certificates. It is unfortunately out of date. Around six weeks after I started using it, the project leader announced that there was some confusion over trademark[3] so he was renaming it to Vaultwarden…

Odd… Looking through my posts shortly after the name change, I was already having issues with my Bitwarden server. It could still have been card corruption or me trying to play with Git. I guess I’ll never know…

…In any case, ButtonMash is ready for the next step.

Docker or Something Else?

Docker is a technology I still haven’t fully visualized. While researching instructions to install it on Red Hat systems, I stumbled across a mention of Podman. Online hosting solution Liquid Web provided a decently clear explanation [4]: containerization essentially makes single-purpose VM’s without the overhead of full operating systems. Docker has a master process that runs Docker containers. Podman runs containers separately, doesn’t require root, but requires a separate piece of software called Buildah to create containers to run and doesn’t have available professional support.

Further research confirms that RHEL now endorses Podman over Docker, so Podman I will use. Even so, I had to install it separately along with a Cockpit plugin to manage it. From there, I made just a few well-researched clicks to download Vaultwarden. The Docker-Podman plugin had a lot of fields I didn’t recognize, so I installed the Docker HelloWorld container to play with. I had to run it from terminal, but it appeared to work. I expect running a Vaultwarden container will be my side project next week.

Side Project

Last week for my side project, I set up a Wi-Fi gaming router to hopefully reduce downtime on my Wi-Fi catcher Pi. This week, I made the two get along. First, I thought it might be Wi-Fi drivers, so I updated, getting myself into a tedious cycle of incomplete updates failing when the file system flipped to read-only against the background of Wi-Fi dropouts. I had to flip the power switch because the reboot command broke and reconfigure packages to clean things out before continuing.

My real problem was the static IP landing outside the router’s 192.168.X.X range. Attempts to manually change IP kept failing, so I backed up a known good config file on top of the file I actually needed to go back to dynamic IP and spent many hours piecing it back together. In the end, I was finally able to connect.

Takeaway

PPolished computer tutorials are great for catapulting students of tech over barriers of entry, but they’re each anchored to a fixed point in time: lessons of the recent past compiled for the near future. As much of an accomplishment making a definitive guide to subject X might be, it will only be but a single focus point for future users to look back on when compiling their own procedures.

Final Question

Have you ever gone back to old project notes for insights for follow up projects?

Works Cited

[1] Shadow_8472, “BitWarden: My New Password Manager,” Let’s Build Robotics With Shadow8472, March 15, 2021. [Online]. Available: https://letsbuildroboticswithshadow8472.com/index.php/2021/03/15/bitwarden-my-new-password-manager/ [Accessed Nov. 22, 2021].

[2] censiCLICK, “Full Guide to Self-hosting Password Manager Bitwarden on Raspberry Pi,” on YouTube,Nov 15, 2020. [Online video]. Available: https://www.youtube.com/watch?v=eCJA1F72izc [Accessed Nov. 22, 2021].

[3] d. garcia, “1.21.0 release and project rename to vaultwarden #1642” on GitHub, Apr. 19, 2021. [Online forum]. Available: https://github.com/dani-garcia/vaultwarden/discussions/1642 [Accessed Nov. 22, 2021].

[4] Liquid Web, “Podman vs Docker: A Comparison,” Liquid Web, Sept. 10, 2021.[Online]. Available: https://www.liquidweb.com/kb/podman-vs-docker/ [Accessed Nov. 22, 2021].

Building A Fake Computer to Split

Good Morning from my Robotics Lab! This is Shadow_8472 and today, I am building a Linux virtual machine for my mother and sister to split. Let’s get started.

Machines Within Machines

Switching operating systems is like moving to a new house. It’s intimidating. Things are arranged in different spots. The pattern of your daily life will shift and there will be an uncomfortable adjustment period.

But at least with computers, anyone with a semi-recent CPU and enough other system resources can host a “guest” operating system for evaluation. While I previously have no experience with this method, for others, it serves as a sandbox where they can try things with Linux without the pressure of learning everything at once or else risk being out a computer if a problem commands a chunk of research time.

VirtualBox

I’ve done my share of research on Virtual Machines (VM’s) in the past. VirtualBox is a well-respected name, and I can see why. Once I installed it on my sister’s Windows machine, I didn’t have to research anything about it specifically until I was looking at a desktop and my sister wanted the VM to use both screens. Otherwise, the experience was intuitive.

PopOS is quickly becoming my go-to easy mode for Linux. Their downloads come with shasum verification hashes, which I made use of. In one way, it was even easier to install because I could just install straight from the disk image without any physical install media. I did have one problem during installation where the installer window rendered larger than the screen resolution. Instead of brute forcing a virtual screen size from VirtualBox, I just used Super (Window key)+click&drag as I learned to do while working with GIMP on a boxy tube monitor with a similarly nostalgic resolution.

Dual screens had me stumped on their instruction set. From what I can tell, I had to insert a virtual CD that came with VirtualBox and install it into PopOS’s virtual disk drive. A bit of computer wizardry happened that involved some sudo password prompts that crashed and duplicates thereof happened and I seemingly needlessly rebooted the VM several times before I unlocked the necessary options to enable dual screen. I will want to pay more attention next time.

The default desktop environment for PopOS was based on GNOME 3, but it’s not for us. System76, the makers of PopOS provided an awesome command by command guide for installing a large selection of alternate desktop environments, so I loaded a few my mother and sister should feel most comfortable with. KDE is my favorite, but Cinnamon and MATE are other names I recognize.

Speaking of KDE, If Linux is the OS of customization and decision fatigue, KDE compliments it perfectly. I spent more of my blog project time this week trying to chase down the color settings than I would have liked. I was hoping for some sort of base color picker that would then populate the rest of the theme with different shades, but I found some options to pick each shade individually. Unfortunately, you’d have to be an artist to make something that looks decent. I was able to find a user-submitted theme with an acceptable color palate.

Side Project

My Manjaro workstation has been getting its Internet through a Raspberry Pi for a while now, but lately I’ve been getting periods of having the Pi’s Wi-Fi connection drop randomly. My father picked up a special gaming Wi-Fi router and I set it up today after months of other projects constantly taking priority. Long story short: I was easily able to use my laptop to connect and arrange default configurations on the router, but I have yet to get it to agree with the Pi 4. I’ve tried looking into possible inherit compatibility issues, but all the guides for finding information on Wi-Fi from Linux assume the presence of tools that aren’t present in Raspian. I thought this was small enough for a side project, but it appears I was wrong.

Takeaway

Setting up a new computer and getting it tweaked properly takes a while and a VM is no exception. One point I didn’t go into was how our NFS drive didn’t admit the VM on account of its IP address. I also learned that one of the intended host machines sits a little too heavy on its existing RAM, so it will need an upgrade for comfortable VM operation. I expect a follow up to this project at a later date.

Final Question

Do you have any tips for working with virtual machines?