Author: Shadow8472

Posted on

I Touched Up a Special Photo

Good Morning from my Robotics Lab! This is Shadow_8472 with a 1-night special project based on a mini-project I did a few weeks back. Let’s get started!

I’m no stranger to using my family’s photo trunk as fodder for a long-running project. Besides, there’s a special occasion coming up, and I thought it would be nice to restore a special photo where the photographer had his flash misaligned.

The first part was smuggling one of the scanners up to my room, where it wouldn’t be so obvious that/when I’m working on it. For reference, I’m working with an Epson Perfection V550 Photo and Manjaro Linux. My previous attempts at getting this and another Epson Perfection working with Linux using a driver called SANE were spotty at best. I even went so far as to save a cloned drive over my difficulty in reproducing my success.

> SANE: Scanner Access Now Easy

Long, boring story short: I landed at sane-project.org, where the whole series of Epson Perfection V[100-600] Photo is listed as “unsupported.” [1] The only reason I got it to work before was because I had Image Scan! for Linux installed, as I learned through a combination of user-forsaken forums and personal experimentation. My notes for this project made note to mention “[Epson Perfection V series scanners are] supported by the epkowa backend plus non-free interpreter.” I stopped trying to fully sort its meaning out after getting the V550 working thanks to an AUR package.

> AUR: Arch User Repository

With a working scanner, it wasn’t much more trouble to connect it to the XSANE plugin for GIMP, where I made a collage of different scans with slightly different settings. It took a while to zoom in and align each piece pixel-perfect; ironically, this process was aided by the dust and scratches I couldn’t get off. To finish off the project, I used a feathered eraser tool to smooth the edges.

Takeaway

If I had more time, I’d have feathered the edges after each scan. Like I said, this was a project I am finishing last-minute. I now have the picture looking the best it has in years, but it’s still due for plenty of help – some beyond my skill level.

Final Question

I have a pretty strong feeling I know the answer, but do scanner drivers communicate any additional information when optimizing a scan, or was I just needlessly exposing a special picture to extra light?

Work Cited

SANE, “SANE: Supported Devices,” sane-project.org, [Online]. Available: http://www.sane-project.org/sane-mfgs.html#Z-EPSON. [Accessed Mar. 13, 2023].

Posted on

I Studied Podman Volumes

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project of the week. Let’s get started!

Nextcloud has been a wish list item since I gave up using Google’s ecosystem (Drive, Calendar, Office, etc.). This open source almost-drag-and-drop alternative proved above my skill level at first, but I’ve learned a lot about server management and running OCI “Docker” containers in Podman in the years since.

Demo of Nextcloud

Nextcloud was relatively simple to demo: one non-privileged port forwarded. During my self-guided tour, I was amazed at the potential power there. In addition to its calendar, office, and file storage functions I expected, its recommended suite apps include email, chat, and contacts servers – with more apps available for download.

As much as I can see myself moving in right now, it’s important that I master how its persistent data is stored. Ideally, everything would live on GoldenOakLibry, my home network storage configured with RAID 5. But I hate waiting for HDD spin-up. If it had an SSD out the back (it has two USB ports), I could mount a directory there from a Nextcloud container and back it up to deep storage on a weekly or monthly basis. At the same time, I may want the capacity of the main disks if Nextcloud turns out to be good for hosting the family’s photo archive.

The solution: use two “volume” structures like I started looking at last week. They work similarly to directly mounting directories as I’ve been doing in theory, but are abstracted similar to containers. See my Tangent heading later on for more information.

With this purpose in mind, we ordered a USB–SATA adapter and dug up our MineOS SSD from once upon a time. I archived around 411 GB worth of Minecraft worlds to free up space. I got the poor idea to try compressing it to both .tar.gz and .zip, two widely used compression formats which turn out to be implementations of the same algorithm. GoldenOakLibry had ZIP, but not TAR, so I tarballed/compressed it to 393.5 GB over an hour vs the NAS struggled to produce a 393.77 GB .zip over a full day. With a savings that small, I’m probably best off curating it uncompressed – especially if I have family members interested in seeing it again.

RAID 5: A hard drive redundancy scheme resistant to a single drive failure. In my case: four matching disks with three drives’ worth of usable space.

TAR: Tape ARchive: An early archive tool often paired with the GNU Zip compression program.

To Do List

Regretfully, I have to split this topic just as it’s getting good. I was running a test to see if GoldenOakLibry can respond on the USB share without spinning up, but creating new network shares is not a skill I can perform reliably yet. I had it working once, rebooted, and now it won’t re-connect like the proven ones. If for whatever reason I can’t get GoldenOakLibry to share from MineOS’s SSD without spinning up, I’ll have to mount it internally to ButtonMash and play the BIOS game to disable booting to it.

Even if I was making good enough time with the USB share, I’d still need to study up on databases. The lightweight one included with the Nextcloud container I’m working with is meant for browser traffic only, and I want to try out its clients.

Tangent

I started with the working theory that volumes needed to be started and stopped like containers, and I would therefore need one of Podman’s signature pods to manage them alongside Nextcloud’s. It’s basically a container for organizing and running containers on a homelab scale. I rigged up a script to automate my attempts with it, but eventually realized that volumes are passive, and I had just learned the wrong tool for the job. I’m sure I’ll make use of it eventually.

Final Question

I’d like to open up the discussion. Two big choices remain: Where do I host my fast Nextcloud SSD (GoldenOakLibry or ButtonMash), and how do I host my archive pictures (Nextcloud, Mediawiki, something else)?

I look forward hearing your answers in the comments below or on my Socials.

Posted on

My Podman Containers Boot With Systemd

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am reasonably sure my Podman containers won’t be randomly going down anymore. Let’s get started!

I enjoy using Podman as a stand-in for Docker, but its rootless approach to running containers inherently challenges sysadmins facing Docker’s help and tutorial legacy. The most problematic difference I’ve experienced has been keeping containers running long-term. Months ago, I learned how to enable account lingering. This allows Podman containers without something remaining logged in as their respective users. I’ve been living with manually restarting containers as needed. Well, since I decided to enable automatic security updates, starting containers automatically would be prudent before expecting other family members to rely on them.

Against all odds, my initial search this past Wednesday yielded a blog article from Red Hat about integrating Podman containers into Systemd [1] to start them at boot. It was posted the day before.

Podman and Systemd

I trust Red Hat to not post malicious commands, but it’s still a good idea to learn about strange commands before running them. Red Hat’s tutorial starts with making a new user, enabling linger, and running a containerized web server. The first important command I ran was

$ podman stop httpd && podman rm -a && podman volume prune

This command appears to thoroughly clean out Podman. I’ve mounted volumes from the host before to persist data, but there’s a more flexible volume structure I only learned about just now when researching for another section I had to spin off into a near-future post. I haven’t used them yet, but I’m sure they’ll be useful once I learn how to use them.

$ podman generate systemd --new --files --name httpd

This command makes a new systemd file. The –new option recreates the container fresh each time it’s brought online. –files sends the configuration to a file instead of the terminal. –name must be the name of a running container or pod.

$ cp -Z container-httpd.service ~/.config/systemd/user/

The file generated previously goes in a directory where systemd will find it when used with the –user flag. The -Z flag matches permissions with the destination directory. The tutorial finishes with a daemon-reload followed by starting and enabling the user’s service.

Takeaway

This is a resource for my bookmarks. That is all.

Final Question

I took the opportunity during this project to put a Minetest server on ButtonMash, but I’m having difficulty obtaining permissions. I can see its logs in Cockpit-Podman, but I don’t have access to the server command line. How am I supposed to get started with adminning Minetest?

I look forward hearing your answers in the comments below or on my Socials.

Work Cited

[1] A. Oliveira, “Configure a container to start automatically as a systemd service,”redhat.com,Feb. 21, 2023. [Online]. Available: https://www.redhat.com/sysadmin/container-systemd-persist-reboot [Accessed Feb. 27, 2023].

Posted on

I Made a Single-Task Computer

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project of the week. Let’s get started!

A situation at my church’s elementary school has recently come to my attention: the library lacks a computer, the conference is pushing online timesheets, and the librarian doesn’t use a smartphone. I know a little about get-me-online machines, so when I felt a little prompt from On High, I got to work.

My first thought was to shift directions on the old church office computer from my recent work with Puppy Linux, but it lacks a monitor, mouse, or keyboard. Then my sister’s netbook surfaced (Toshiba NB505). As spiritual predecessor to Chromebooks, netbooks are perfectly sized for toddlers. The original power brick had a frayed cord, but I found a spare. It booted to Windows 7 Starter Edition (32 bit). It reportedly slowed way down at some point. Even Puppy Linux (running 64-bits) felt sluggish running Firefox. Nevertheless, I accessed the timesheet website.

I soon learned about Firefox’s –kiosk mode; it got me thinking about launching it as part of boot directly to the needed webpage. Instead, I sought out a specialized kiosk distro and downloaded myself Porteus Kiosk. I substituted my Ventoy USB for whatever the oddly worded instructions aimed at store managers would have me do. The install media (“first boot”) walks the user through connecting to the Internet, downloading Firefox or Chrome, creating or loading a config file, and flashing (“burning”) a customized image to a hard drive.

The system took a night’s work to install a few times and harden. I password protected the BIOS and disabled booting the Windows drive because I’m more worried about the SD card surviving an accidental removal and landing last in the boot order than someone using a strange, bootable USB. I tediously refined my installation procedure until I was consistent. Its slow boot wasn’t fun.

I had 15 minutes the next day with the school Wi-Fi. Much of that was tracking down the password. Once online with browser obtained, I loaded my config file from the previous night, flashed the SD card, and rebooted, ticking away what time we had scheduled and more – only for a failure to reach the Internet. Discouraged, I packed up left – my only consolation a surplus Valentine’s Day goodie bag.

We figured it was probably some network whitelist until the kiosk worked properly back at home. Had the it failed? I didn’t catch the success/failure message flashing by earlier, so maybe? Another day’s attempt at the school involved accessing site with a laptop from a different school-owned network. I paid close attention to the allegedly successful output, but it again found my Wi-Fi and not the school’s.

Just as I was about to start report a failure for now, I noticed my home Wi-Fi name and password hidden in the config file I was loading each time after the first. I slapped the school’s credentials and left it for my mother to deploy, though not without a Puppy Linux USB as a backup plan. I wrote detailed instructions on getting online and saving the first day’s session. Thankfully, they were unneeded.

Takeaway

Production. I’ve never done a project intended to operate outside my supervision before. I’m proud of this project, and I’m glad it will be of service while until a more permanent solution.

Final Question

I noticed this week how much I seem to be using my Ventoy multi-boot USB. What is your most valuable tool?

Let me know in either the comments below or on my Socials.

Posted on

It’s Time I Install EndeavourOS

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project for the week. Let’s get started!

OS installation side project. We’ll see how this goes.

Manjaro has a hate club, and I sympathize with it. It’s stable most of the time, but gives me a large bombshell or two per year. I’ve been meaning to try out EndeavourOS, another user-friendly take on Arch, and my hard drive filling up is as good an excuse as any.

One small task before starting: my file system hangs whenever I try to access a down or inaccessible NFS share on GoldenOakLibry, and it won’t unfreeze until making contact again or forced closed. LibreOffice Writer is a notable offender as it can lock up attempting to autosave. A deeper look into this issue and it works as intended. For what it’s worth, GoldenOak’s HDD’s spin up in loosly 45-50 seconds, so allowing for a rounded minute in the automount file seems reasonable (TimeoutIdleSec).

NFS:
Network File System

HDD:
Hard Disk Drive – specifically the kind with spinning platters

EndeavourOS Installation

I updated the EndeavourOS installer on my Ventoy USB drive and verified it with sha256sum. When I booted to it though, I found it in legacy BIOS mode, and I’m after UEFI experience. I tried my PopOS image from working with UEFI on my sister’s computer, and it too ended up in legacy BIOS. I even booted my old copy of Windows 10 – legacy BIOS. Does my hardware support UEFI or not?!

In short: yes. I dug up a setting in my motherboard firmware to allow UEFI and Legacy, disable Legacy, or disable UEFI. Curious, I disabled Legacy to force UEFI boot. Windows disapeared, EndeavourOS hung, and Manjaro surprisingly loaded just fine, though it sat so long on a black screen I thought was hanging the first time. Sure enough, it had an efi directory, confirming a UEFI boot:

$ ls /sys/firmware/
acpi dmi efi memmap

Ventoy’s Grub2 option got me into UEFI/EndeavourOS for installation. It was otherwise an unremarkable experience compared to other “easy” installers I’ve used. I researched each unfamiliar option and chose systemd-boot as my boot loader even though it only works for UEFI installations.

Moving In (Pacman)

Moving in was dead simple and super clean. Mind blown. In order of installation, my top priorities (after a lefty mouse and stylized pointer) were Firefox, LibreOffice, and NFS – the minimum needed to continue drafting this post. EndeavourOS lacks a visual package manager, so I formally introduced myself to Pacman.

Firefox came preinstalled. I mounted my Manjaro drive and copied ~/.mozila over. Boom! All my tabs, windows, extensions, bookmarks, and everything else was present and accounted for. Maybe a font was different, but I’ll research it later if I’m not adjusted by then (editing note: I’m adjusted now).

LibreOffice was a pain, if you could call it that. I needed to research the “fresh” and “still” branches (testing and stable, respectively), and opted to see what I had on Manjaro. I pulled a massive shortcut and used chroot to approximate a Manjaro shell instead of rebooting back and forth a bunch. Power rush! After a break to mentally process the power grab, I installed the “still” version and later followed it up with hunspell-en_us so spell check had a dictionary.

chroot:
CHange ROOT – starts a shell with a root directory deeper within the file system.

NFS was the last and most routine piece to access GoldenOakLibry: create mountpoints, copy and enable .mount/.automount files. Ray Lyson’s NFS/Samba guide is easily a favorite bookmark [1].

I began listing other things to bring over: ~/.ssh, Discord, FreeTube, AngryIP, Balena Etcher, and Steam are all things I use with varying frequencies. SSH and Discord involved packages from Pacman and copying my old data, like I did with Firefox. Steam offered me my first non-elective challenge when I had to research the correct Vulkan libraries (graphics drivers) to use.

Moving in (Arch User Repository)

My other listed programs will be built with the Arch User Repository, a listing of user-submitted scripts called PKGBUILD files. It is strongly recommended you inspect AUR scripts before running them, and to avoid using automated tools like yay until you’ve manually built and installed a few packages. Hold bad files accountable by flagging them, and vote for ones that build packages properly. Reputable AUR packages may be adopted by a “Trusted User” and relocated to the main repositories.

FreeTube has five different AUR listings. Git (potentially unstable), Wayland (outdated), and appimage (few votes) are all unsuitable – leaving freetube-bin and freetube for serious consideration. Freetube-bin has almost 3x more votes and 22x the popularity (how recently/widely used a package is) as well as having a longer maintenance history. On closer inspection, freetube builds from source, while freetube-bin converts a .deb package. For the purposes of learning AUR from 0, I’ll be using freetube-bin.

Freetube-bin’s AUR page has a Git clone link. Its PKGBUILD file looked simple enough. Makepkg finished, leaving me with the original .deb it downloaded and a .pkg.tar.zst file I eventually found and installed with Pacman. I copied over ~/.config/FreeTube, only to find it was from a broken install I had replaced inelegantly.

AngryIP scanner has only one version: ipscan, but it requires Java. I went through the process of installing GraalVM for Java19/aarch64, replicating a set of symbolic links pointing to Java.

$ java -version

Wrong architecture. I replaced my install with the amd64 version, and that worked. I made a note there in /usr/lib/jvm to use amd64 next time and deleted my raw downloads.

AngryIP/ipscan’s PKGBUILD file builds it from source, and as such looks more involved. The most suspect thing was a for loop I didn’t understand right away. I went to build the package and mere Java doesn’t count as java-runtime. It wants one of 124 Java packages to satisfy its one dependency. I found a version of jre-OpenJDK. Pacman wasn’t amused with my GraalVM shortcuts though, so I disabled them. Both jre-openjdk was installed shortly and ipscan compiled afterwords. Over the weekend between download and installation, AngryIP had gotten a minor revision. I’ll pass for now.

Oh, Balena Etcher. WOW! Three popular candidates showed up – two were a version out of date, and the other a very new appimage with zero maintenance history. I downloaded the the Appimage PKGBUILD anyway and instected it. It looked enough like the others I decided to go with it. Building and installation went smoothly.

Takeaway

It speaks volumes to my personal progress that I thought this might be “side project.” I was wrong, but I must remember that similar projects used to take at least one week for the base OS install and another for each major program I wanted. My impression is that EndeavourOS is for people who are/ want to be fluent in the command line, but don’t want to deal with straight Arch.

EndeavourOS is taking my skill to the next level. I’ve learned by both blitzing the boring tasks and slamming into using the AUR without cheating packages in with pamac. KDE is all purple, but I’m game for the change from the traditional blue.

GRUMBLE! EndeavourOS had a core package update as I was finishing my editing, and now it hangs while booting. I’m back on Manjaro, and updates were waiting. I moved some stuff over so my 1.8gb download could fit. I also linked ~/.mozilla to my EndeavourOS copy.

This computer is messed up right now.

Final Question

I’ve had a busy week with material going on for three potential projects. How was yours?

I look forward hearing your answers on in the comments below or on my Socials.

Work Cited

[1] R. Lyon, “On-Demand NFS and Samba Connections in Linux with Systemd Automount,” Ray Against the Machine, Oct. 7, 2020. (Edited Aug. 26, 2021). [Online]. Available: https://rayagainstthemachine.net/linux%20administration/systemd-automount/. [Accessed Feb. 13, 2023].

Posted on

Call the Electrician

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project of the week. Let’s get started!

My house has been having intermittent electrical issues for a while, but they flared up enough to diagnose a couple weeks ago. It affected our computer room and the downstairs/backyard lights. Kitchen appliances and most other outlets were on other breaker circuits, thankfully.

It was Monday afternoon. Last week’s post was up, and I was tentatively researching February’s big project. My sister, Taz, asked for help moving her workstation to another room and off the faulty circuit. She warned me about her outlet sparking, so I equipped some leather gloves before I began jiggling out her UPS.

UPS:
Uninterruptible Power Supply.

The outlet crackled as blue arcs flashed within the empty, upper socket and along the blades of the UPS plug as I wrestled with it. The room lights flickered off a few times, adding to the gut feeling I was aboard a starship, working over a console ready to explode in my face.

I put an amount of effort befitting a temporary relocation while arranging Taz’s computer. The challenge was her Internet connection. With OpenWRT fresh in my mind, the hardest part was deciding on a previous project SD card to overwrite.

Each card’s identity was easily confirmed by mounting it and checking <disk>/etc/label. One Raspberry OS install stuck out as redundant now that I use BalenaEtcher for disk imaging.

We quickly ran into an important gap in my networking knowledge: DNS. I shelved PiHole last week in part because I couldn’t get OpenWRT’s DHCP server to properly advertise it as the DNS server. Manjaro/KDE was mostly in last week’s attempts – even allowing for a DHCP IP with a manual DNS, but Windows’ “manual” IP configuration got wiped each time I tested “automatic (DHCP)”. This led to confusion and frustration when Taz saw our hosted Minecraft server online, but not the authentication servers for lack of DNS.

DNS:
Domain Name Service – translates URL’s into IP addresses, a “phone book” for computers

DHCP:
Dynamic Host Configuration Protocol – Automatic IP address configuration, a matradee for networks.

The electrician gave our sparking outlet a checkup. He said that as first goodie on the breaker circuit, everything else is wired in series. When it shorts, everything else is affected before breaker pop. Our outlet has buckled under a heavy load over years’ time; we’ll minimize its usage until repairs happen this coming week. Fun fact: lights and sockets sharing a breaker is a code violation, but it could have been fine when the house was built.

In the meantime, I idled a day or two while trying/failing to fix my DHCP configuration for lack of search terms. OpenWRT’s Lu-Ci web interface strikes a good balance: it’s user-friendly without being baby or admin-proofed. Nevertheless, I took my issue to r/techsupport’s Discord, where I learned about DHCP-options. So far as I can tell, DHCP-options is just a lookup table. Option 6 specifies a list of IPv4 addresses as DNS servers:

6,192.168.0.2,192.168.0.20

Takeaway

Messing with a sparking outlet the way I did was stupid. A few days’ retrospect told me I should have had a fire extinguisher ready. Editing this the night before posting, it dawns on me that de-energizing the whole breaker circuit would have been better still. I’m thankful nothing happened and that the situation is stable enough to wait for a repair.

I’m also glad to have learned about DHCP options. Of note, I picked up this week that Raspberry Pi Wi-Fi radios were never going to win any performance prizes. My Internet slowdowns are not just me.

Final Question

I’m trying something new by isolating glossary terms in a column. They were a pain to figure out, but I think I can control them now. What do you think?

Let me know in either the comments below or on my Socials.

Posted on

My PiHole is “Half Baked”

Good Morning from my Robotics Lab! This is Shadow_8472, and today I am installing PiHole. With luck, I’ll have be configuring some of its other functions to augment my home’s network as well. Let’s get started!

PiHole, Take II

I can rant about the evils of Google ‘til boredom do its part. However, this search engine is between inconvenient and impossible to ignore, given its impressive list of “hobbies” from STEM projects to smartphones. It’s an open secret few care to think about that their empire is built off user exploitation. I installed ad blocker browser plugins over their aggression last presidential election cycle.

Earlier this month, I read about Manifest v3, the new browser-plugin interface library created by Google. Their precautions against spyware just so happen to cripple ad blockers, among other legitimate plugins. This walking conflict of interest is set to roll out January, 2023, and Firefox is going along with it.

When a browser loads a web page, it asks a DNS service to translate the page’s URL into an IP address. It then finds, loads, and renders the page at that IP. This may involve loading other pages –such as ads– as elements of the original page. Network ad blockers protect you by fudging bad URL’s addresses.

Objectives

My main goal this week is to kill ads across my home network. Follow-up objectives include advanced PiHole features and a private DNS for even better protection.

Night 1

My first attempt at PiHole was messy. I set up PiHole OCI/“Docker” containers across my two servers – ButtonMash and my old laptop. Like before, the main router skipped IP’s on me. I had it repaired within an hour thanks to my same laptop functioning as a workstation with a static IP. With the router upgrade to my upstairs workstation, I easily archived its settings and outfitted it with its own wider network static IP – complete with a netmask wide enough to chase down its rogue counterpart should it shift again (Did I have laptop’s static IP netmask configured incorrectly this whole time?!).

Surprise! The expanded subnet didn’t work because the rogue router had its own subnet mask I was outside of. The dance was too involved for a play by play, but I only really felt helpless while trying to avoid hiking around to different workstations to clean up after this failed networking spell. As I reassembled the router for normal operation, I reasoned out that my router’s firmware is hardwired not to consider a DNS coming from a LAN connection, like I’m trying to do.

Flashing open source firmware is out of the question. For one, I wouldn’t know how to fix it and don’t have a replacement. Two: apparently its chipset manufacturer isn’t a fan of open source – the help thread I spotted recommended contacting OP’s government representative if he wanted to do anything about it.

Night 2

I did a bit of research before dismantling the network again. DHCP settings include optional fields for DNS requests. This should let me direct computers straight to PiHole instead of relaying the request in a convoluted workaround involving a NAT table and possibly causing a network loop.

This means each router is now a separate task. The responsible thing to do now is ensure my subnet router can behave before working on the main one. It’s not long before I fry my DNS settings. Navigation around my local network remains unaffected, but I eventually resort to restoring my backup from yesterday, re-applying the static IP, and updating the backup.

My best bet from here is to finalize my PiHole install. My initial container creation was the absolute minimum: port 80 web interface, port 53/TCP+UDP. There’s a lengthy list of environment variables to browse.

A Few Days Later

Jackpot! My mind cleared enough before bed to skim PiHole Docker’s documentation on GitHub. It has a list of example deployments – including a shell script. I converted it for Podman, entered my environment variables, and –during debugging– axed the logic for relaying logs as it was causing problems and I can view them directly with Cockpit-Podman.

PiHole User

But where to land it? I’ll eventually integrate as I master Caddy. Leaving the container running as root lets it use the proper ports, but I know better. Thanks to discoveries I spun off into last week’s project, I can now make more underprivileged, Cockpit-enabled users than I will ever need by using loopback the address (127.0.0.1/8).

The run script was easy to copy over to my new PiHole user. I gave it the directories it wanted as mountable volumes and shifted ports around until I was happy. I took the time to tidy up my firewall, combining a couple related entries and reclosing the normal DNS port.

I remember having issues with Vaultwarden’s stability over the course of days to weeks. The problem was occasionally annoying as Bitwarden only requires its home server when modifying the password vault, but PiHole will be sorely missed the moment it goes down. The one place I found the solution was in the official Podman troubleshooting guide on their GitHub [1]:

loginctl allow-linger userName

I sadly could not verify this was my previous, solution to my Vaultwarden long-term issues, but it’s not entirely unfamiliar, and it’s my best-informed guess.

DNS Port Forwarding

With PiHole secured in its own, easily accessible account, I soon experienced how picky DNS requests are about using the privileged port 53. All my attempts at manually telling OpenWRT to use port 5300 failed. I expect the the story will be the same if I try with on my main router.

I found the solution where Woody from b-woody.com blogged about almost the exact same project last May [2]: port forward port 53 to port 5300. Paranoid about goofing my firewall over command line I ran my version of Woody’s commands past r/TechSupport’s Discord channel. Moderator Donjuanal confirmed my omission of a trailing “:toaddr=”, but questioned my blind use of tcp, explaining how DNS clients default to udp for speed.

sudo firewall-cmd --zone=public --add-forward-port=port=53:proto=udp:toport=5300 --permanent

Even with this measure in place, I had to access the web console and tick Settings>DNS>Interface settings>Potentially dangerous options>Permit all origins before my local requests made it through. This may need to be addressed later.

Takeaway

I am so glad to have PiHole installed, even if it doesn’t appear to be doing much more than the uBlock Origin Firefox plugin. I’m researching the next segment though, and I estimate another week or more worth of work before it is configured alongside a private DNS server. Worth noting is that Firefox is leaving in the features ad block requires, despite potential security concerns. This is as good enough stopping point.

Final Question

Do you use PiHole? I’d be happy to hear about your experience.

I look forward hearing your answers on in the comments below or on my Socials.

Works Cited

[1] eriksjolund, “Podman\ Troubleshooting\ A list of common issues and solutions for Podman,” github.com, Nov. 19, 2022. [Online]. Available: https://github.com/containers/podman/blob/main/troubleshooting.md [Accessed Jan. 30, 2023].

[2] Woody, “Run PiHole in a rootless Podman container,” b-woody.com, May 12, 2022.[Online]. Available: https://b-woody.com/posts/2022-05-12-pihole-on-a-rootless-podman-container/ [Accessed Jan. 30, 2023].

[3] Can You Block It, “CAN YOU BLOCK IT?\ AN SIMPLE AD BLOCK TESTER” canyoublokit.com, 2021. [Online]. Available: https://canyoublockit.com/ [Accessed Jan. 30, 2023].

Posted on

I Glitched Cockpit and Discovered Multi-user Login

Good Morning from my Robotics Lab! This is Shadow_8472 with a side project for the week. Let’s get started!

My mother needed an extra browser, so I installed Firefox hardened it a little. I took the liberty of adding the Bitwarden plugin, encouraging her to make an account on my self-hosted instance. Remembering my failure so far to diagnose the “Network Error” blocking log in, I spared the time to learn how new Bitwarden clients are slightly incompatible with old Vaultwarden servers.

I easily could have updated Vaultwarden with maybe a note on the blog Discord. Instead, I felt like adding VaultwardenUsr@localhost to Cockpit with “Add new host.” This stunt worked at the cost of forwarding shadow8472@ButtonMash to VaultwardenUsr@ButtonMash when to logging in. Relogging didn’t help, and the hosts list saw VaultwardenUsr as the primary login – disallowing me from removing it, and as a remote login – blocking my attempts to add my real primary account back in with the same stunt.

While exploring this bug, I logged into my old laptop server and linked its Cockpit back into ButtonMash without getting forwarded to VaultwardenUsr. At this point, I submitted a bug report to Cockpit’s GitHub. I soon found the malformed host list at /etc/cockpit/machines.d/99-webui.json. I backed it up, purged the malformed entry, and updated GitHub with my workaround.

Out of curiosity, I added VaultwardenUsr@192.168.0.— as an alternate host. This sends packets for an extra detour, but it works as required. Only after all this did I update my Vaultwarden image from Docker Hub and deploy a new container from it using the same command as the last two successful times.

Note: While working on next week’s project, I logged into VaultwardenUsr@127.0.0.1 and other loopback IP’s with no problems. It’s just name@localhost that causes problems.

Takeaway

1 day for the win! My push for PiHole and supporting network projects has been intense lately, so it’s great to have a smaller project where I still learn while by doing something important.

Final Question

Have you ever misused a software feature successfully? What challenges did you face before getting it to work how you had in mind?

look forward hearing your answers on in the comments below or on my Socials.

Posted on

Networking Is Magic

Good Morning from my Robotics Lab! This is Shadow_8472, and if you missed last week’s post, feel free to check it out. It… was a minor disaster. I tried setting up PiHole network adblocker, but my home router unexpectedly moved its local IP address in the process. I cleaned up what I could really quickly and noticed my little hackjob of a subnet router was running an end-of-life operating system. Today, I am fixing that oversight. Let’s get started!

Replacing My Hackjob Router

Hackjob Router was my consolation prize after a failed quest to implement the open source router firmware, OpenWRT, onto my Raspberry Pi 4B in early 2020 and another in 2021. Both times, the exact version I needed was still under development. Dealing with testing versions was too advanced of a magic spell for me. I did, however, find an easy tutorial within my reach, but it did little to advance me beyond an aspiring networking mage with smoke and mirrors, but no fire or glass. When I looked this week, the beta warning was lifted.

I downloaded OpenWRT and flashed it over Hackjob Router’s SD card. Sure enough, the web interface was complete. I’ve used at least half a dozen ranging from limited config options to full access. OpenWRT’s “Lu-Ci” web interface puts everything on display with a helpful tool tip. It is comparable to other network devices I’ve worked with, but is simpler to look at, and has slightly more functionality.

My final configuration was surprisingly easy for a project that’s been hanging for almost three years now. At no point did I gain a key insight directly from an online search. But mistakes were made, and background information was researched and shelved for later.

My first mistake was a wrong Wi-Fi password. When I finally located and corrected it, my connection to OpenWRT died. I quickly learned how to assign a static IP in KDE’s settings thanks to intuitive interface design. I researched br-lan, a virtual network interface used for assigning one IP to multiple physical interfaces, thinking I needed to add the physical Wi-Fi radio to the one automatically generated to host all of the one Ethernet port and “bridge” the two sides that way.

The problem was actually a bad netmask. IPv4 network addresses come in four eight-bit numbers between 0 and 255. Local networks mask off leading bits – typically in multiples of 8 (for example: 10.0.0.1/8). Routers can use DHCP to dynamically assign local IP addresses with in their assigned subnet. My subnet ranges between 192.168.1.0 and 192.168.1.255 – properly denoted 192.168.1.1/24. Originally, my trailing mask was /16, allowing DHCP to assign my workstation to 192.168.0.200. Correcting the mask made it behave.

An unanchored memory I have regarding this week’s research is that some devices can route packets directly between network interfaces as opposed to routing them manually. I doubt the Raspberry Pi 4 has this ability, but it would be nice to know for sure.

Takeaway

Networking is magic at times. I still have a long way to go before I understand enough to do everything I want to, but I’ve cleared a large and long-standing burrier toward that goal this week. This is in part thanks to OpenWRT’s Lu-Ci with its educational help tips about every drop-down menu, text field, and tick box.

Final Question

Do you ever study a known science and everything inside you insists it’s magic?

I look forward hearing your answers on in the comments below or on my Socials.

Posted on

Never Underestimate Your Gremlins

Good Morning from my Robotics Lab! This is Shadow_8472 and today I am working on my home network. Let’s get started!

Where to begin? Last week I left off with Puppy Linux. Well, I successfully installed it to a USB. While hardening FireFox, I noticed that the popular search-engine/online-advertising company is pushing out a new set of standards for their popular browser called Manifest 3 that will cripple functionality browser-based ad blockers rely on to keep prying eyes out (all in the name of privacy, of course); Mozilla/FireFox will be adopting these standards, with roll out this month: January 2023.

Network Collapse

In response, I prioritized setting up PiHole, a network-based ad blocker which won’t be affected by Manifest 3 and will work on Android devices. I soon learn it’s available in an OCI/“Docker” container. Long story short, I install it to ButtonMash and my old laptop for logistical reasons involving my dormant Family Photo Trunk project. I went to adjust the router’s DNS (Domain Name Server) settings to point at my PiHole containers figuring the worst that could happenwould be I just need five minutes tops to revert changes… the router moved itself from 192.168.0.1 to 162.168.1.1, collapsing the home network – including the workstation I was planning on using to fix it!

I was more than a bit stunned. Lucky for me, my old laptop was on a static IP address; unlucky: Bitwarden password manager has been a pain on that machine as of late, so I had to copy it manually from elsewhere. Once I was in, I reverted the DNS settings to automatic and most computers recovered by toggling network off and on (or rebooting) to refresh the automatic DHCP settings.

Upstairs Workstation

A while back, I rigged up a Raspberry Pi to work as a Wi-Fi catcher/subnet router, and it’s served me well up to this point. I switched its static, subnet-facing IP so it didn’t conflict with the one now claimed by the router, but as Iwas researching how to adjust its DHCP settings for the new subnet, I noticed its base operating system is at least months past end-of-life.  

Takeaway

I need to stop quoting optimistic worst-case scenarios. Gremlins can and will make a fool of me. On the other hand, I’m very thankful I had my laptop-server still able to navigate the crippled network with its static IP.  

I’ll be keeping the router where it is and see how saving the band of 192.168.0.* for static IP’s plays out. I guess I have the rest of this month’s projects planned out…

Final Question

What is the biggest computer oops you’ve ever had (and recovered from)?

Furthermore

I had a small adventure getting this post from LibreOffice on my upstairs workstation over to my blog without Internet. The way my filesystem is set up, it the save feature hangs badly when a mounted network drive doesn’t respond. I ended up using a .txt file on a thumb drive, and dumping it to the command line with cat, a terminal program to concatenate.

Privacy Policy