djds

How I mount my encrypted bcachefs array at boot.

In /etc/fstab/ include a x-systemd.requires=unlock-bcachefs-vault.service mount option. This service does the unlocking before the mount is triggered. Example line as in my /etc/fstab:

UUID=bf512699-6643-4d96-a793-daaf3f1d34f1 /mnt/vault bcachefs nofail,x-systemd.requires=unlock-bcachefs-vault.service 0 0

The content of the unlock service:

Verify and Repair Disk Permissions via Terminal (Mac OS X)

Verify Permissions

diskutil verifyPermissions /

Repair Permissions

diskutil repairPermissions /

Migrating a Rails project from MySQL to PostgreSQL

This brief guide is written from my own experience with migrating a large (~5GB) MySQL database to PostgreSQL for a Rails project.

No warranties, guarantees, support etc. Use at your own risk and, as always, ENSURE YOU MAKE BACKUPS FIRST!

I chose [pgloader][1] because it's extremely fast. YMMV.

Replace mysql2 gem with pg in Gemfile.
Update config/database.yml for PostgreSQL. I used [Rails' template][2] as a starting point.

NixOS on Fedora

Please note that these instructions are not offically supported or condoned by Nix and are not guaranteed to always work, but from my testing everything seems to work perfectly fine.

These steps may not be required if NixOS/nix#2374 is resolved.

SELinux

These commands are required for both Fedora Workstation and Fedora Silverblue

Ceph StaticSites Configuration, with HAProxy & SNI

An instructional document by Robin H Johnson [email protected]. I wrote much of the staticsites functionality of Ceph-RGW, during during late 2015 and early 2016, based on an early prototype by Yehuda Sadeh (yehudasa). It was written for usage at Dreamhost, but developed in the open for community improvement.

It is fully functional as of Jewel v10.2.3 plus PR11280 (ceph/ceph#11280). Prior to that, neither the non-CNAME nor CNAME-to-service modes will function correctly.

These configuration files represent how to quickly set up RGW+HAProxy for staticsite serving. I've tried to make them more readable, without leaving out too many details. You are strongly recommended to run a seperate RGW instance for staticsites, on a DIFFERENT outward-faciing IP than your normal instance (and in fact, certain functionality is not supported without it).

In place of using HAProxy, you could run the second rgw instance on port 80,

Arch Linux ARM on Crostini

I got Arch Linux ARM installed on a Lenovo Chromebook Duet! I mostly used the instructions from the Arch Wiki as reference.

0. Before we begin

Keybase proof

I hereby claim:

I am djds on github.
I am djds (https://keybase.io/djds) on keybase.
I have a public key ASDleX4o1dySEx8cO1Cq07ooac8zsDnASAufX36YbagufQo

To claim this, I am signing this object:

	There appears to be a string encoded in the binary payload:
	https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01#file-hashes-txt-L115

	Which functions as a killswitch:

	https://piaille.fr/@zeno/112185928685603910

	Thus, one workaround for affected systems might be to add this to `/etc/environment`:

	```

	# Module for configuring libvirt with static NixOS networking
	# instead of using libvirt managed bridge.

	{ config, lib, pkgs, ... }:
	with lib;

	let
	cfg = config.virtualisation.libvirtd.networking;
	v6Enabled = cfg.ipv6.network != null;
	v6PLen = toInt (elemAt (splitString "/" cfg.ipv6.network) 1);

	#!/bin/bash

	# needs openssl 1.1+
	# needs `basez` https://manpages.debian.org/testing/basez/base32hex.1.en.html
	# (but something else that decodes the base64 and re-encodes the raw key bytes
	# to base32 is probably fine too)

	##### generate a key

	openssl genpkey -algorithm x25519 -out /tmp/k1.prv.pem