Author: Shadow8472

Posted on

Telescope for Christmas

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am covering a new telescope I got for Christmas. Let’s get started!

I’ve wanted my own telescope since before I was old enough to responsibly take care of one. My childhood Monopoly set is a novelty Astronomy Edition. Solarquest was an even more dear game – though we’ve learned a bit more about our solar system since our copy was made.

Unboxing and Assembly

Unboxing was straightforward enough. I followed the assembly instructions, but had a little trouble extracting the tripod’s hex wrench out of its storage slot the first time. The kit reminded me of how a good camera may be bought in accessory parts as easily as a starter kit. Standardized interfaces on interchangeable parts make for an upgrade path.

The instructions cautioned against letting adults unfamiliar with with the telescope on top of the usual warning about children. To see why, I needed look no further than the fine adjustment tools. While intuition says to point them like a camera aiming stick, they’re actually designed to rotate.

The star scope was of interest to learn about. To use, aim the main telescope such that a little, red dot is over the object you wish to view. No matter the direction you look into it, it points at the same spot. The instructions said to aim the main telescope at a land-based location a distance away to calibrate it.

First Light

One “Sabbath afternoon” drive after unboxing the telescope, my father and I scouted a local lake after sundown for stargazing locations. The best spot we found is above a boat ramp, but it has a gate we found open. While a ranger may ask us to leave if we use that area, it’s not like we’d be doing anything more destructive than intended use. We [my mother and I] later called the visitors’ center during hours to confirm a good spot.

After the drive, the clouds broke at home enough to get some nice details of the moon. With the telescope’s magnification, the Earth’s rotation is apparent, but not impossible to manually track while taking turns looking. I tried holding up my tiny Nicon digital camera I’ve used in 3D printing, but was only able to get some blurry pictures before clouds dimmed the sky.

Accessorizing

Starting a new hobby involves cost. There exist a wide range of accessory lenses, filters, eyepieces, tracking systems, and more, but I don’t yet know how seriously I will take this telescope over the course of months to years. First off, I got a bag to take it in the car. Other than that, I at least want some good pictures of the moon and hopefully Saturn’s rings.

The included smartphone mount is nice, but I don’t have a functional smartphone at the moment. My PinePhone prototype unit might work, but the mount will mess with the power button when lining up the camera properly. Another idea is to rig something with a Raspberry Pi. They’re releasing a new generation after what feels like forever, but I’d need to be careful about exactly what case I pick. I’d want something to accommodate a nice touchscreen and a power bank.

Camera Bracket

My first thought was to get a second cell phone mount and pinch fit the tiny Nicon by the camera lens. The obvious concern here is when the battery runs dry and the lens retracts. I’ve abused a similar vintage camera when it was relatively new, and my guess is it would be fine. Nevertheless this idea evolved into cutting up a pool noodle just right to grip the telescope eyepiece and support the camera.

Guess what! Pool noodles are out of season at the moment. Early on we’d considered using the standardized photography mount somehow, but upon closer inspection, all we’d need is a corner bracket. We considered 3D printing, wood, and even bending a retired road sign we [legally] have as aluminum stock, but a near-perfect steel bracket turned up while chasing down compatible bolts and wing nuts. It just needed the holes enlarged a little.

The bracket ended up going together in a single night as my father and I refined a design that would be safest for both the camera and equipment.

We took the telescope out for a second night. I aimed it at what I thought was Saturn, but turned out to be Jupiter. It clearly picked up the four Galilean moons around it. A real time tracker online informed me that Saturn was below the horizon and that the moon was almost new at the time. I was unable to get the bracket to cooperate and a gentle wind occasionally made it difficult to keep the telescope still.

Takeaway

There is still much to do in getting started with my telescope. I plan on follow up posts in the coming months.

Final Question

Have you ever used any optics to observe the night sky?

I look forward to discussing your answers in the comments below or on my Socials!

Posted on

Maintenance: Pacman and Power Supply

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am working on my Upstairs Workstaion. Let’s get started!

Twin Issues Both Alike in Annoyance

Over Black Friday this last November, I picked up a time travel sandbox game called No Time where our main character takes his totally-not-a-DeLorian with a totally-not-a-flux-capacitor on a journey through the history of Pine Island. My Upstairs Workstation struggled to keep up with rendering time portals when I drive [or fly] fast enough, but I made it through the main story [to date] without issue. Fun game, I can recommend it.

While hunting down a few more Steam achievements –however– I started getting sudden power cutoffs followed by the motherboard booting to an warning after a few seconds. It explained how an anti-surge mechanism tripped from a potentially faulty Power Supply Unit (PSU). I dusted it, and the problem went away for a couple weeks, but now it’s back.

While I have at least a couple projects I’ve actively worked on this week, it’s always bad news and top priority when the package manager breaks. I ignored the first issues over Mickey’s Public Domain Day release celebration post, but the second would otherwise get priority 1.

Pacman PGP Key Lockout

I want to install a power diagnostic tool for the PSU, but can’t with Pacman crippled. It took a couple sessions on different days, but I circled back around to a near-perfect description of my problem (but with a different list of keys), which you can read about on the EndeavourOS community forum. Link in Works Cited section [1]. I suspected at first that the keys expired over New Year’s – including one important to re-installing the keyring system, but I’m not curious or annoyed enough yet to find out for sure.

The solution that worked for me was found in a linked FAQ on another thread on the same forum: basically move Pacman’s keys to a backup in root’s home directory and follow a few steps for repopulating them.

Motherboard Crash

Having repaired Pacman, I installed Powertop, but couldn’t figure it out on my own. When I looked it up, I just got more confused. One source even recommended using some other laptop battery utility instead.

My suspect PSU is 650 Watts. Derpy has a PSU rated at 1,000 Watts, so an initial plan was to move that one over, but I also have a 500 Watt PSU that shipped with my sister’s computer, but wasn’t good enough for her system. The big power draws are CPU and GPU. My father and I looked up the ones I’m using, and they totaled in the 300 Watt range, so we installed my sister’s old supply.

A power supply transplant is the single most invasive procedure without needing to change thermal paste. Given the motherboard geometry with the heat sync towering over the CPU, the CPU power connector is tightly wedged into the corner of the case. I used a pair of needle nose pliers to extract it. Installing the new CPU power cord was even more of a hassle. The power cord barely reached as it was and the replacement PSU is a fraction of an inch shorter. Consequently, it took a shortcut across the top of the RAM on its way to the case’s cable management area.

While the PSU was out though, we took the opportunity to re-attach a plastic foot. Originally, it snapped into place, but we installed a screw/washer/nut to match another foot which had similarly undergone repair. At some point, I’d like to get a PSU tester to see what exactly it’s doing that trips my motherboard’s protection.

The new PSU solved the problem. Otherwise, I suspected we’d be looking at a dying graphics card or the possibility of the UPS (Uninterruptible Power Supply) giving an unstable voltage. Worst of all would have been the motherboard frying. All that was left was to refresh some encryption keys from Caddy, as I got that working again, but I still don’t have it fully figured out.

Takeaway

I’m thankful I had that spare part around. Otherwise, I’d be down a machine. In any case, I’ve already got a my month lined up. Hopefully we don’t get any more priority 1 side projects until those are cleared out.

Final Question

What side topics could you get excited about this year?

I look forward to discussing them in the comments below or on my Socials!

Work Cited

[1] points, et. al, “Cannot update due to key errors,” endeavouros.com, Feb. 14, 2023. [Online]. Available:https://forum.endeavouros.com/t/cannot-update-due-to-key-errors/37286 [Accessed Jan. 8, 2024].

Posted on

New Year’s 2024! Let’s Talk Public Domain

Good Morning and Happy New Year/Public Domain Day 2024! This is Shadow_8472 and today in the US public domain we welcome original Mickey Mouse along with many other works from 1928. Let’s get started!

The Need for Copyright

Art takes effort to create, but less to copy. We live in a world where the collected works of around 35-40 authors spanning around 1,500 years have been preserved by tens of thousands to millions of scribes, monks, reformers, translators, archaeologists, shepherds, curators, app developers, system admins, and more. The cost of a copy is negligible to the point of free; one could probably squeeze more than a couple million copies onto a 2 Tb external drive sold on Amazon for $10.50. (This figure assumes individually compressed 4.3 Mb files. I did not actually compress a full text Bible as a proof of concept.)

By the same principle, it is similarly trivial to copy and distribute any non-material good. Uncontrolled, it will disincentivize the creation of new works. This is why we have copyright protection so we can enjoy new works.

The Need for Public Domain

Art takes inspiration to create. Somewhere between whatever day you are reading this blog post going back to antiquity is a point where a work’s original creator is long gone and further copyright protection only serves to let the work either fade into irrelevancy or turn into a perpetual income source for the cost of maintaining an archive.

Meanwhile artists wishing to use copyrighted material must either sign a contract with the copyright holder or work in a legal gray zone. To a non-legal expert such as myself, all is fair in this gray zone except directly selling works containing copyrighted content unless the owner bothers stopping it with a cease and desist notice. And if/when it ends up in court, legal experts may explore the possibility it might have been fair use all along.

Some Intellectual Property (IP) holders are chill and consider fan works as unsponsored advertising, while others ruthlessly defend their copyrights to the fullest extent of the law. While the Sir Arthur Conan Doyle estate was bad with Sherlock Holmes’ stories, Disney has been the most ruthless of them all – going so far as to lobby themselves up a total of 40 years of extended protections atop the original 53 entitled to Mickey Mouse. All this was done while ladling stories from the very same public domain they were sabotaging.

Be it from financial troubles, forfeit legal privileges, pressure from social media, or something else, they did not seek another copyright extension, and the public domain finally contains long sought after characters such as Mickey, Minnie, as well as the second of two original storybooks about Whinny the Pooh – releasing Tigger along with it.

Speculation: If Copyright Was Never Extended

The first national copyright law in the US was the Copyright Act of 1790, which came the year after the constitution. It provided up to two 14 year terms of protection assuming the copyright holder was alive to renew within 6 months of an upcoming expiration. Assuming subsequent copyright expanded to cover new technologies beyond maps, charts, or books, aggregated expirations to January 1 in the same way, but never extended the total of this term, what would the next few years look like? Probably too wildly different to explore right now. But suppose they were to snap back instead…

The first thing that comes to my mind is the WINE project. WINE Is Not an Emulator; it’s a compatibility layer that translates Windows programs’ system calls into Linux equivalents on the fly – often for gaming. To skirt copyright, its developers are split into two teams: one team decompiles Windows files and takes notes. The other team uses these notes to re-implement open source files based on these notes without ever having seen the original code.

If copyright lasted 28 years tops, we would be getting Windows 95 into the public domain today. From prior research I might not have posted about, I know DosBox runs early Windows programs just fine until Windows 95 because up until then, it was all a glorified command prompt and backwards compatibility was in its nature. In this scenario, Windows 95 files would be fair game for WINE team 2 to directly use and improve so long as they remove all trademarks. Microsoft would have competition as upset users switch to one of a growing list of forks – both community driven and commercially maintained by 3rd parties. There would be security patches and I’d be surprised if nobody developed a 64 bit version.

In the entertainment industry, people would have a chance to independently retell the original stories they grew up with before old age. Original copyright holders would have to tell a better story if they want the nostalgia money. Meanwhile, fans would have a chance to hire original talent to extend canceled classics. Game devs who originally made works for hire could patch/modernize old code for another generation to enjoy. Comic book fans who have lost loved C-list characters to a disgruntled artist walking off with most of the copyrights could have hope of seeing them restored to the story.

In some ways, this feels a bit like Year of Jubilee stuff God told Israel to observe every 50 years.

Takeaway

Be advised that only the earliest Mickey animations are public domain; his colorization, friends, and details added later are still protected. Furthermore: Mickey Mouse in particular still has a lot of trademark hooks which could render him unusable anyway. My take is that Mickey Mouse has belonged in the public domain for a long time and that trademark ought not smother his use outside brand recognition. I expect legal fireworks in the coming years whose fallout will set precedent for generations to come.

Final Question

Imagine if I were to build a business empire strongly associated with the 500 year old Mona Lisa by Da Vinchi and I became so successful and diversified you’d need to live as a hermit on Mars to get away from me – and even then you would see Mona Lisa branded equipment when shopping for homesteading supplies. Should I be able to claim copyright infringement on someone selling posters of the original painting?

I look forward to debating answers –especially from an opposing viewpoint– in the comments below or on my Socials!

Posted on

Merry Christmas 2023

Good Morning and Merry Christmas from my Robotics Lab! This is Shadow_8472 with a side project. Let’s get started!

My church has a still life Nativity we’ve been helping with since I was a kid. In our production, the story of Jesus’ birth as read in the books of Matthew and Luke is broken up into several scenes with a matching audio track lasting around a minute each. After years of my scene director calling dibs on me as a wise man searching for Jesus, I wanted to see the production edited up as a video.

It’s been another five or six years, but we finally managed to get our camcorder and tripod on the set. My father was kind enough to film all the scenes on our breaks between shifts.

For an open source video editor, I found OpenShot to be around my skill level. I took a video editing class in high school, so I’m comfortable moving things around between layers on a timeline. While I could have done with a better visual representation of the audio, it was heaps better than when I tried Windows Movie Maker.

I only had a couple technical issues this time around. The old version in the Ubuntu repositories didn’t run once installed on my father’s new computer. I found an appimage file which both has a newer version and actually launched. My second problem was how my father’s fancy new (probably still drop damaged as it turns out) computer was struggling with the preview. I found a recommendation aimed at Windows users about bumping up the audio sample rate to match a new native frequency, and that helped me.

Editing itself took a bit longer than I expected. Long story short, I couldn’t edit out all the chimes meant to tell visitors when to advance to the next scene, the addition of two scenes to the audio track last year was rushed, the lighting was poor more often than not… The list goes on. I did the best with what I had. And for the effort invested, I’d say it did pretty well.

Takeaway

My original vision I still wish to pursue is to have a special session where attention is given to the lighting and the same actors play the same parts when they show up in multiple scenes.

Final Question

Creative writing prompt: How would you infiltrate Santa’s workshop to plant the plans for a new toy?

I look forward to hearing from you on my Socials!

Posted on

Commissioning my Father’s New Computer


Good Morning from my Robotics Lab! This is Shadow_8472 and today my father (Leo_8472) and I are diagnosing, fixing, and commissioning the new Thelio Mira we ordered from System76. If you haven’t yet, be sure to read last week’s post where we unboxed it. Let’s get started!

Continuing on from last week where Leo and I verified receipt of the purchased hardware and started customizing KDE (desktop environment), I made my own account and began stress testing it with an old? benchmarking program called GLmark2. At no point did I hear any fans straining to keep components cool when running this test, but my first time running it, the whole system destabilized spectacularly. Effects included a hue shift and massive color depth reduction – followed by a constellation, of glitch rectangles poking through from a terminal session – and finally a seemingly irrelevant section of system log with purple (and later sometimes green) glitch lines in front of them. The system responded to system requests (alt+print screen+<command key>), so I got well acquainted with using them to reboot.

Included with the purchase is a 1 year warranty, but it cost me a day waiting for my father’s administrative assistance, which turned into the motif of the whole week. In the meantime, I ran an additional battery of tests. I ran MemTest86+ and passed the RAM. I demonstrated the crash happened while using both X and Wayland variations on the official PopOS desktop environment, but not while booted to a live session of Bodhi Linux. We had a crash while using FreeTube, and sometimes it would crash while idling.

It took a couple days, but Leo and I got in touch with tech support from System76. He talked us through reinstalling the NVIDIA driver. Initial tests were promising with the system idling for hours on end, but when I powered through Steam’s confirmation e-mail dance (see Takeaway section below) to install Sonic Frontiers, a game I’ve been looking to play, Steam downloaded it at around 94 mbps; we have gigabit service. Furthermore, it knocked out DNS service to the house. We identified the issue by pausing the download, but figured it could be solved later.

When I finally did start the game, I had some black screen issues with Proton, but after around 10 minutes of total game time, hopes were dashed with a slightly less colorful crash sequence. I showed initiative exploring the problem while waiting for daily support tag and found a Portal [1] mod with RTX that crashed it in 30 seconds. Somewhere in there, I enabled SSH it was only the graphical shell crashing.

One day, I sent the whole system log, and we confirmed the issue was with the NVIDIA card. Talks were had of possibly needing a return label, but we offered to try re-seating the card just in case it was a poor connection. While talking with support, we’d learned from the manual how at least one part of the business inside the case I was intimidated by last week was a brace for the graphics card only needed for shipping. While re-seating the card, we found some white paint transferred from the card to the brace; this matched a crushed edge on the shipping box: someone along the way dropped our box clearly marked fragile.

Fortunately for both us and System76, re-seating the card appears to have fixed the system. I about went straight for the RTX enabled Portal mod, and for the moment, we’re calling it good. The computer has been pushed into service.

As for the bad download speed: our first fear was a bad switch. It would have explained both the slow download speed as well as the choked DNS. Turns out it was a bad Cat 6 cable, and the DNS remains a mystery I lack the incentive to definitively solve at this time. My father pulled out his pocket knife and invited me to cut off the bad cord’s tips – only then did I realize it would have been interesting to run it past our conductivity tester. Oh well.

Takeaway

While attempting to make Steam happy with the new computer, I needed a confirmation e-mail. My e-mail wanted a password change, properly taking care of which would have required time working on Vaultwarden on ButtonMash, which I’ve mindfully laid aside as much as reasonably possible this December.

I had to make an effort to stay on task so I could finish the project at hand instead of doing all kinds of tech demonstrations as is my custom.

Final Question

Have you ever benchmarked/stress-tested a modern graphics card? What open source solutions have you used?

Posted on

Unboxing: System76 Thelio Mira

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project of the week. Let’s get started!

Some weeks ago, I helped my father, Leo_8472, spec up a Thelio Mira from System76, and it arrived this weekend. The first thing we did after unboxing yesterday (as of posting) was open it up and look inside the case. While everything appeared to be there, the system is very self-aware when it comes to airflow – having a dedicated duct from the side to the back for the CPU and an all around crowded feel inside the case. If you’re considering one of their systems, I’d recommend not opting to assemble your first one yourself.

We became concerned when the graphics card appeared to be the later-released budget variation on the NVIDIA RTX 4070 Ti one we thought we ordered. Leo found his receipt listing parts we remembered, and we set it up by my server stack for initial setup and taking inventory.

It shipped with PopOS installed – on a recovery partition with self-contained installation media. The installer appeared normal, but it skipped over/I didn’t notice it asking for installation drive, time zone, or host name – the later two of which we provided later.

When we ordered, Leo was very interested in Bluetooth, but I couldn’t find it. One of the first things he did after logging in after initial updates was find and test it. I installed SuperTuxKart to test it with his hands-free headset. He even beat a few races.

Other stuff we loaded up: Firefox data from Mint (4 tries to get right), FreeTube, Discord. I installed KDE as a desktop environment for when I need to use the computer, and chose SDDM for a login manager, and we had fun picking out themes. We found this black hole login splash screen I hacked to display mm/dd/yyyy instead of its default dd/mm/yyyy.

Over this process, we verified hardware with a few commands: lsblk (hard drive size), lspci (GPU, failed), free (RAM size), neofetch (installed special, wasn’t insightful towards GPU). Eventually, we confirmed the correct graphics card from within KDE’s System Settings>About this System.

Unfortunately, the system destabilized before we finished moving in. Leo documented the failure and we contacted support. I further noted that it still failed colorfully under the default “Pop” theme.

To do: copy over MultiMC, enable SSH, NFS mounts/automounts.

Takeaway

Even though it wasn’t immediately plug and play, I’m thankful for the time I’m spending with my father working on this system.

Final Question

Have you ever bought a system designed for Linux?

Posted on

My First Computer “Rack”

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project of the week. Let’s get started!

So far, I’ve been assembling my servers (ButtonMash, RedLaptop, and GoldenOakLibry) on and under a foldable table. Add a workstation, and it’s getting a bit cluttered. We’ve had a set of glass shelves going unused for a while now, and I think they might do nicely to organize the servers’ room.

I started by measuring ButtonMash’s case against the shelves’ metal frame. While it was close, I estimated an inch vertical clearance once the shelves were in place. Otherwise, the tentative plan was to remove a shelf. My father and I moved the shelves in and loaded them and the setup’s UPS (Uninterruptible Power Supply). Wiring was relatively straightforward with the traditional wire Medusa in the back, but out from underfoot.

Unfortunately, I left ButtonMash in a precarious state such that a reboot before moving it knocked out my known house of cards supporting PiHole and Unbound. What I didn’t realize was that I never got Caddy working on that machine in the first place. In trying to fix Caddy, I wiped the containers I actually the whole house was using for DNS. As a patch, I pointed the router back at our normal DNS servers.

While I’m trying to avoid server work this month, I went ahead and looked up how to change my specific DNS settings temporarily to restart my DNS containers. From there, I did not encounter any notable issues, though I wasn’t up to testing the removal of my patch.

Takeaway

I have a rack. That’s my story and I’m sticking to it.

Final Question

How do you organize your tech stack?

Posted on

Rocky Server Stack Deep Dive: 2023 Part 5

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am learning more about Podman Quadlets for my homelab. Let’s get started!

Systemd and Quadlets

From my incomplete research going into this topic, I already know Quadlets is a system for efficiently integrating Podman containers in with Systemd. It was merged into Podman v4.4, and I had a small pain of a time trying to find a distribution with both that and legacy BIOS support along with a list of other requirements.

But what is Systemd? In short: Systemd is the init process –a process that manages other processes– used by most Linux distributions that aren’t trying to optimize for a low RAM or storage footprint. As it turns out, I’ve already had minimal exposure to it while writing unit files for NFS [auto]mounts and a static IP address on Debian. Systemd in turn bases units off these unit files to manage the operating system.


While Systemd unit files defining Podman containers can be written by hand, Quadlets can automate their creation based off simpler unit files of its own: .container, .network, .volume, and .kube. The first three look similar enough to concepts I’m familiar enough with that I figure I could hack an example into doing what I need.

But I’m interested in pods. With .pod unit files only a controversial feature request at best, that leaves me to explore .kube files, which run Kubernetes YAML files. I know nothing about writing Kubernetes YAML files from scratch, and I refuse to cram for them Thanksgiving week.

My project died here for a few hours. One Systemd tutorial brought up Syncthing in an example, and I spent a while on a tangent looking at that, but it too is too large to cram for this week. I unenthusiastically browsed back to Kubernetes, and found:

podman generate kube

Looks like I just might get away with adapting my scripts after all this week. With this in mind, I copied over my files from my laptop’s Debian drive to its new-last-week Rocky 9 installation. Focusing on Nextcloud, I cleared out my dead-end work with Fuse, abstracted volumes, and other junk before realizing BusyBox was likely a more suitable testing grounds.

My First Kuberneties File

I came up with the following bash script for such a pod:

podman pod stop busyBoxPod
podman pod rm busyBoxPod
podman pod create busyBoxPod
podman create \
    --pod busyBoxPod \
    --name BusyBox \
    --volume fastvolume:/root/disk \
    -it \
    --rm \
    busybox

And here is

# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-4.6.1
apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: "2023-11-23T01:29:45Z"
  labels:
    app: busyBoxPod
  name: busyBoxPod
spec:
  containers:
  - image: docker.io/library/busybox:latest
    name: BusyBox
    stdin: true
    tty: true
    volumeMounts:
    - mountPath: /root/disk
      name: fastvolume-pvc
  volumes:
  - name: fastvolume-pvc
    persistentVolumeClaim:
      claimName: fastvolume

I saved this output as busyBoxPod.yml and returned to Nextcloud.

Nextcloud put up a small tantrum getting re-updated for Podman 4.6.1. I had to look up how to Podman Secrets, and apply :z to volumes to satisfy SELinux. Redis however, refused to accept a password from Podman Secrets, so I rolled back that change. The pod should insulate it anyway. I got it to a point where it needed a domain name.

Branching out to bring up Pi-Hole and Caddy, I learned how the default Unbound configuration for the container I used only forwards DNS requests to Cloudflare. I’ll want to fix this later. I used firewall-cmd to forward ports for HTTP, HTTPS, and DNS to underprivileged ports for rootless containers.

Takeaway

UNCLE! I find more and more of my time supposedly working on server is procrastinating and stressing over either minutia or blankly staring at my screens when I muster enough focus to ignore distractions. There’s no way around it; I’m officially burned out on this project. I’ll maybe come back to it after the new year. I really wanted to get my .kube files working for at least Pi-Hole and Caddy, but it’s going to be a hard pass at the moment.

Final Question

I’m considering covering a free/open source game or few over December. What are your recommendations?

I look forward to hearing from you on my Socials!

Posted on

Rocky Server Stack Deep Dive: 2023 Part 4

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am exploring fuse-overlayfs as a possible patch between Podman and NFS. Last week’s post was practically a freebee, but I expect this one to be a doozy if it’s even possible. Let’s get started!

Context

For my homelab, I want to run Nextcloud in a rootless Podman 3.0.1 container with storage volumes on our NFS. For logistical reasons, Nextcloud needs to be on RedLaptop running Debian 11 (Linux kernel 5.10.0-26-amd64 x86_64). The NFS share I wish to share is mounted via systemd.

My most promising lead is from Podman Github maintainer rhatdan on October 28, 2023, where he made a comment about “fuse file system,” asking his colleague, @giuseppe, for thoughts to which there has been no reply as of the afternoon of November 10 [1]. I documented a number of major milestones there, which I’ll be covering here.

File System Overlays

Fuse file system turned out to be fuse-overlayfs, one of a few systems for fusing file systems. Basically: there are times when it’s useful to view two or more file systems at once. File system overlays can designate a lower file system and an upper file system. Any changes (file creation, deletion, movement, etc.) in this combined file system manifest in the upper file system, leaving the lower file system[s] alone.

Through a lot of trial and error, I set up a lower directory, an upper directory, a work directory, and a mountpoint. My upper directory and work directory had to be on the NFS, but I ran into an error about setting times. I double checked that there were no major problems related to Daylight Savings Time ending, but wasn’t able to clear the error. I sent out some extra help requests, but got no replies (Sunday, Nov. 12). A third of my search results are in Chinese, and the others are either not applicable or locked behind a paywall. Unless something changes, I’m stuck.

Quadlets

Github user eriksjolund got back to me with another idea: quadlets [1]. Using this project merged into Podman 4.4 and above, he demonstrated a Nextcloud/MariaDB/Redis/Nginx setup that saves all files as the underprivileged user running the containers. In theory, this sidesteps the NFS incompatibilities I’ve been experiencing all together.

The first drawback from my perspective is that I need to re-define all my containers as systemd services, which is something I’ve admittedly been meaning to do anyway. A second is again that this is a feature merged into Podman much later than what I’m working with. Unless I care to go digging through the Podman GitHub myself, I’m stuck with old code people will be reluctant to support.

Distro Hunt

Why am I even using Debian still? What is its core purpose? Stability. Debian’s philosophy is to provide proven software with few or no surprises left and the user polishes it to taste. As my own sysadmin, I can afford a little downtime. I don’t need the stability of a distro supporting the most diverse Linux family tree. Besides, this isn’t the first time community support has suggested features in the future of my installation’s code base. Promising solutions end in broken links. RAM is becoming a concern. Apt package manager has proven more needy than I’d care to babysit. If I am to be honest with myself, it’s time to start sunsetting Debian on this system and find something more up-to-date for RedLaptop. I’ll keep it around for now just in case.

My first choice was Fedora to get to know the RedHat family better. Fedora 39 CoreOS looked perfect for its focus on containers, but it looks like it will require a week or two to configure and might not agree with installing non-containerized software. Fedora 39 Server was more feature complete, but didn’t load up for my BIOS (as opposed to the new standard of UEFI); I later learned that new BIOS-based installations were dropped on or around Fedora 37.

I carefully considered other distributions with the aid of pkgs.org. Debian/Ubuntu family repositories go up to 4.3. Alpine Linux lacks systemd. Souls Linux is for desktops. OpenSuse Tumbleweed comes with warnings about being prepared to compile kernel modules. Arch is… Arch.

Fresh Linux Installation

With time running out in the week, I decided to forgo sampling new distros and went with minimal Rocky 9. Installation went as best can be expected. I added/configured cockpit, podman, cockpit-podman, nfs-utils, and nano. I added a podmanuser account, set it up to allow-lingering, and downloaded the container images I plan on working with on this machine: PiHole, Unbound; Caddy; Nextcloud, Redis, MariaDB; busybox.

Takeaway

I write this section on Friday afternoon, and I doubt I have enough time remaining to properly learn Quadlets and rebuild my stack, so I’m going to cut it off here. From what I’ve gathered already, Quadlets mostly uses Systemd unit files, a format I’ve apparently worked with before, but also needs Kubernetes syntax to define pods. I don’t know a thing about using Kubernetes. If nothing else, perhaps this endeavor will prepare me for a larger project where larger scale container orchestration is needed.

Final Question

Do you know of a way I might have interfaced Podman 3 with NFS? Did I look in the wrong places for help (Debian forums, perhaps)?

I look forward to hearing from you on my Socials!

Work Cited

[1]. Shadow_8472, D. “rhdan” Walsh, E. Sjölund, “Rootless NFS Volume Permissions: What am I doing wrong with my Nextcloud/MaraiDB/Redis pod? #20519,” github.com, Oct. 27, 2023-Nov. 10, 2023. [Online]. Available: https://github.com/containers/podman/discussions/20519#discussioncomment-7410665. [Accessed Nov. 12, 2023].

Posted on

Rocky Server Stack Deep Dive: 2023 Part 3.1

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project on my home server. Let’s get started!

Not My Problem

In the greater context of setting up Pi-Hole (network ad blocker) on my home server, ButtonMash, I’ve learned a thing or two about how the Domain Name Service (DNS) works and what happens when I break it locally. Normally, when a device connects to a network, a DHCP server (often on the router) advertises a DNS server. When resolving a URL, this DNS server either has the answer cached or ask another DNS server until a match is found or the system gives up.

My Internet Service Provider (ISP) has been having some trouble with its site (including our main e-mail). Not once, but twice my family asked if I was doing something with the Internet. Both times, I used a terminal application called “traceroute” to display [most of] the hops my requests went. Ones handled by ButtonMash were very short – (I tested buttonmash.lan and a known entry on my blocklist), while others took up to 30 hops. My ISP’s site fell in the later category.

However: one cell phone in the family was still reaching our ISP’s site while on cell data. This meant that the site was fine, but the failure was with the larger DNS system (or most of their servers were down behind their reverse proxy, but I thought of that later). In either case, I looked at a couple “Is it down?” type sites, and concluded the outage was most certainly not my problem.

Unbound

But I had a project to try. Unbound is a tool for increasing digital privacy by setting up a recursive DNS server. Every domain is registered at its authoritative DNS server. When Unbound receives a request, it finds the domain’s authoritative DNS server and caches it for later. This reduces digital footprints in DNS server logs, making you harder to track and reducing your vulnerability to a hacked/confused DNS servers.

I’ve been interested in building my own Unbound OCI “Docker” container for a while as there’s no officially maintained one, but I went ahead and downloaded an image from docker.io based on the quality of documentation. I spun up a container in Podman and pointed Pi-Hole at it. It worked first try with no special configuration.

It just so happened that when I brought the fix online, we were on a call with tech support, and I was able to pass my diagnosis back to our ISP to help them restore service to their customers in my community – however large or small that number may be.

Takeaway

What’s with no persistence volumes on this container? If it resets, it will have to start over on caching. If/when I come back in a few months, I may take a closer look. Otherwise, this has been a big shortcut I can live with.

Final Question

Have you worked with Unbound before? Would it even benefit from a persistence volume?

I look forward to hearing from you on my Socials!

Privacy Policy