Benjamin Black benjaminblack

Keybase proof

I hereby claim:

I am benjaminblack on github.
I am benjaminblack (https://keybase.io/benjaminblack) on keybase.
I have a public key whose fingerprint is C3E6 79C4 C079 03C0 6C1C 8746 C27D 77E6 FAF4 E2DB

To claim this, I am signing this object:

After much head-scratching trying to figure out from where by default Nginx decides to read its main configuration file, and where it decides to write its log files, it turns out that they are all set at compile time (configuration options broken onto separate lines for clarity):

$ nginx -V
nginx version: nginx/1.12.1
built by clang 8.1.0 (clang-802.0.42)
built with OpenSSL 1.1.0f  25 May 2017
TLS SNI support enabled
configure arguments: 
--prefix=/usr/local/Cellar/nginx/1.12.1

From two articles on stackoverflow and an MDN article:

In external SVG files (which should be served as image/svg+xml):

Include the prolog:

<?xml version="1.0" encoding="utf-8"?>

Include a DTD:

Nginx server configuration location block which will match //host/s3/{bucket}/{path/to/resource} and transform it into a reverse proxy for an S3 bucket configured with static website hosting and named with a conventional prefix (adjust region accordingly), like //{s3prefix}-{bucket}.s3-website-us-east-1.amazonaws.com/{path/to/resource}.

E.g. assuming I prefix all of my S3 buckets with bb, like s3://bb-mybucket, and create my buckets in the us-east-1 region, then:

http://example.com/s3/mybucket/img/header.jpg

will be transformed into a proxied request to

http://bb-mybucket.s3-website-us-east-1.amazonaws.com/img/header.jpg

Edit: Deprecated as of 380.67 - see documentation

If https_crt_save variable is turned off, turn it on:

# nvram get https_crt_save
0

# nvram set https_crt_save=1
# nvram get https_crt_save

If the Linux kernel is compiled with the EFI stub loader (grep CONFIG_EFI_STUB /boot/config-*), then an EFI BIOS can boot the kernel directly, without the need for a bootloader like GRUB. This only requires that the kernel and the initrd exist on the EFI partition. The EFI boot menu and boot order can be managed with the command-line utility efibootmgr.

Copying the kernel image and initrd onto the EFI partition the first time is simple; the problem is keeping them up-to-date as the system is updated. In particular, lots of software packages can trigger the initrd to be rebuilt. The most recent kernel image and initrd need to be copied to the EFI partition every time they are updated.

The Debian Linux Kernel Handbook documents initramfs hooks, stating that "Packages for boot loaders that need to be updated whenever the files they load are modified must also install hook scripts in /etc/initramfs/post-update.d

With a modern UEFI motherboard, it is possible to boot Linux directly from the UEFI boot manager, without relying on a boot loader like GRUB.

First, the kernel has to be compiled with the "EFI boot stub" option enabled, which modifies the kernel so that it can be directly executed by the UEFI boot manager.

Debian enables this flag: grep CONFIG_EFI_STUB /boot/config-*

Second, the EFI System Partition (ESP) must be large enough to hold the kernel and the initrd image. The UEFI boot manager executable files must be on the ESP; therefore, the kernel and initrd must be on the ESP, since the kernel is the EFI executable, and the kernel requires the initrd to be somewhere it can find it.

The ESP in Debian is usually 100-250 MB, which is fine.

It is possible to update the kernel to the most recent backports version during installation.

Proceed with an expert installation all the way through configuring the package manager, and ensure the Backports option is selected.

Switch to the console (Alt-F2), and chroot into the installation:

mount --rbind /dev/ /target/dev/
mount --rbind /run/ /target/run/
mount --rbind /sys/ /target/sys/

Let's Encrypt certbot ACME client manual DNS challenge

certbot certonly [--dry-run] --manual --preferred-challenges dns-01 \
--domain example.com --domain www.example.com [...]

For each host passed via --domain, Let's Encrypt will prompt the user to create an _acme-challenge TXT record (_acme-challenge.example.com, _acme-challenge.www.example.com, etc.) with a specific value.

	TweenLite.to({val: 1}, 1.0, {
	val: 100,
	onUpdateParams: ['{self}'],
	onUpdate: ({target: {val}}) => console.log(val),
	});