I was interested in testing my USB cables that I know work, but wanted to see if they had any retransmission going on.

Then today, I found out Linux has a kernel module that allows you to “monitor” usb interfaces. Like… using wireshark.

I won’t explain how to set up wireshark for your distro, that’s for you to figure out.

Once you have wireshark set up, you just sudo modprobe usbmon then lsusb. Find the USB interface you want to monitor in the list, then select it when starting wireshark (gui).

That’s about it… you can filter like this:

usb.urb_status != 0 && !(usb.urb_status == -115)

Short post, but hope this helps you test your own USB cables for any errors that aren’t shown in dmesg, like failed packets.

Introduction

In this post I simply want to share a NixOS flake that might help you in the case you enabled secure boot on a device such as the Steam Deck OLED, still have keys because you backed them up, and want to get back in to either disable secure boot with sbctl, or fix your unbootable NixOS system.

Configuration

First, here is the flake that will load your configuration:

{
  description = "";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
  };

  outputs = { self, nixpkgs }:
    let
      system = "x86_64-linux";
      pkgs = import nixpkgs { inherit system; };

      nixosImage = nixpkgs.lib.nixosSystem {
        inherit system;
        modules = [
          ./image-config.nix
        ];
      };
    in
    {
      packages.${system}.disk-image = nixosImage.config.system.build."image";

      defaultPackage.${system} = self.packages.${system}.disk-image;
    };
}

Now the config that you can use to build an image.

(
  {
    config,
    lib,
    pkgs,
    modulesPath,
    ...
  }:
  {

    imports = [ "${modulesPath}/image/repart.nix" ];

    boot.loader.grub.enable = false;
    boot.initrd.availableKernelModules = [ "usb_storage" ];
    boot.supportedFilesystems = [ "btrfs" ];
    hardware.enableAllHardware = true;
    environment.systemPackages = with pkgs; [
      btrfs-progs
      # sbctl # if you want it to be able to disable secure boot
     ];

    fileSystems."/".device = "/dev/disk/by-label/nixos";

    networking = {
      networkmanager = {
        enable = true;
        wifi.backend = "iwd";
      };
      wireless.iwd = {
        enable = true;
      };
    };

    users = {
      users = {
        codebam = {
          isNormalUser = true;
          home = "/home/codebam";
          description = "Sean Behan";
          extraGroups = [
            "wheel"
            "networkmanager"
            "libvirtd"
            "video"
            "uinput"
            "wireshark"
            "pipewire"
          ];
          hashedPassword = "$6$TIP8YR83obmkq8T2$T3lYdPbPj9wysMznNlS5J0qHo2eyTr43aF/ZWSMWHdNRob4dkBB0s3KpBLUgYRTyPZxbb1ZgeqCrrx.DEEkQX1";
        };
      };
    };

    image.repart = {
      name = "image";
      partitions = {
        "esp" = {
          contents = {
            "/EFI/BOOT/BOOT${lib.toUpper pkgs.stdenv.hostPlatform.efiArch}.EFI".source =
              "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${pkgs.stdenv.hostPlatform.efiArch}.efi";

            "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
              "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
          };
          repartConfig = {
            Type = "esp";
            Format = "vfat";
            SizeMinBytes = "96M";
          };
        };
        "root" = {
          storePaths = [ config.system.build.toplevel ];
          repartConfig = {
            Type = "root";
            Format = "ext4";
            Label = "nixos";
            Minimize = "guess";
          };
        };
      };
    };
  }
)

Building

Building the Image

nix build

Make sure you change the user and password, or you won’t be able to login. Also note that if you are using a Steam Deck OLED like me, WiFi won’t work so you’ll need to use either ethernet or an external wireless adapter that has support in the kernel.

Signing for Secure Boot

So ok you burn it to your USB drive:

(replace X with your USB drive letter, and add sudo or elevate)

dd if=./result/image.raw of=/dev/sdX bs=4M status=progress

Now you have to sign it if you want secure boot to work. Assuming you already have keys set up you just run:

(again with sudo or elevate)

mount /dev/sdX1 /mnt
sbctl sign /mnt/EFI/BOOT/BOOTX64.EFI
sbctl sign /mnt/EFI/Linux/nixos.efi
sync
umount /mnt

Booting and Repair

Now you’re ready to boot it, so plug it into your USB hub or however you planned on plugging it into the Steam Deck or your device.

Once you’re in you will have access to a NixOS installer, and you should know what to do next to repair.

What are Quadlets?

In this post I’ll show you what a quadlet is and how you can use it to manage your containers.

Quadlets are a new way to manage containers using systemd. They are a new format for systemd units that allow you to manage containers using systemd.

Container Quadlets

Here’s an example of a container quadlet.

[Container]
Image=docker.io/library/alpine:latest
Exec=sleep infinity
AutoUpdate=registry

If you put this in ~/.config/containers/systemd/alpine.container you can start it with systemctl --user start alpine and it will start a new container.

Just make sure to systemctl --user daemon-reload to reload the systemd daemon after you create the quadlet. You have to do this every time, I won’t repeat this throughout the blog post.

Pod Quadlets

You can also use quadlets to manage pods. Here’s an example of a pod quadlet.

[Pod]

Yep, that’s it. If you put it in ~/.config/containers/systemd/mypod.pod you can start it with systemctl --user start mypod-pod and it will start a new pod.

But the best part is this. If you want to add a container to a pod all you have to do is this.

[Container]
Image=docker.io/library/alpine:latest
Exec=sleep infinity
AutoUpdate=registry
Pod=mypod.pod

Now when you start mypod-pod it will start the container as well.

Dependencies

You can add dependencies.

[Unit]
After=alpine.service

[Container]
Image=docker.io/library/archlinux:latest
Exec=sleep infinity
AutoUpdate=registry
Pod=mypod.pod

Now archlinux will start after alpine.

There are even more options. You can start .kube, .network, and .build quadlets too and they can depend on each other. See the docs for more info!

Example: Nginx and Certbot

Okay so now lets run something useful :)

How about an nginx container and a certbot container to get a certificate for it?

Nginx Container

First lets create a directory to hold our files.

mkdir -p ~/.config/containers/systemd/www

Next we create a quadlet for our nginx container.

[Container]
Image=docker.io/nginx:latest
PublishPort=80:80
PublishPort=443:443
AutoUpdate=registry
Volume=./www:/usr/share/nginx/html

This will run a web server for us. If you aren’t root, you’ll need to enable unprivleged ports.

sudo sysctl net.ipv4.ip_unprivileged_port_start=0

Now we can start it with systemctl --user start nginx and it will start a new container.

If you browse to http://localhost you should see the nginx welcome page.

Certbot Container

Now we need to get a certificate for it. We can use certbot for this.

[Container]
Image=docker.io/certbot/certbot:latest
Volume=letsencrypt:/etc/letsencrypt
Volume=./www:/mnt
Exec=certonly --webroot --webroot-path /mnt --agree-tos --email your@email.com -d your.domain.com
AutoUpdate=registry

Make sure to replace your@email.com and your.domain.com with your own email and domain.

Then start the container with systemctl --user start certbot and it will get a certificate for you.

Nginx with SSL

Now you can use the certificate in your nginx container.

[Container]
Image=docker.io/nginx:latest
PublishPort=80:80
PublishPort=443:443
AutoUpdate=registry
Volume=letsencrypt:/etc/letsencrypt

That’s great, but now we need to configure nginx to use the certificate. We can do this by adding a volume for the configuration file.

[Container]
Image=docker.io/nginx:latest
PublishPort=80:80
PublishPort=443:443
AutoUpdate=registry
Volume=letsencrypt:/etc/nginx/certs
Volume=./nginx.conf:/etc/nginx/conf.d

Along with a configuration file for nginx.

server {
    listen 443 ssl;
    server_name your.domain.com;

    ssl_certificate /etc/nginx/certs/live/your.domain.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/your.domain.com/privkey.pem;

    location / {
        root /usr/share/nginx/html;
        index index.html;
    }
}

Again, make sure to replace your.domain.com with your own domain.

Now you can start the container with systemctl --user start nginx and it will start a new container with the certificate. You can verify this by going to https://your.domain.com.

Now you have a web server with HTTPS.

Automatic Certificate Renewal

If you want to renew your certificate automatically it’s as simple as this.

[Container]
Image=docker.io/certbot/certbot:latest
Exec=renew
AutoUpdate=registry
Volume=letsencrypt:/etc/letsencrypt

Now you can create a timer for it in ~/.config/systemd/user/certbot.timer.

[Unit]
Description=Renew Certbot certificates

[Timer]
OnCalendar=Sun 00:00:00
Persistent=true
Unit=certbot.service

[Install]
WantedBy=timers.target

Now you enable the timer.

systemctl --user enable --now certbot.timer

Now your certificate will be renewed every Sunday at midnight.

That’s it! Now you have a web server with HTTPS and a certificate that will be renewed automatically.

How it Works

In this post I’m just going to show you something cool I made using cloudflare workers.

import { EmailMessage } from 'cloudflare:email';
import { createMimeMessage } from 'mimetext';

export default {
	async email(message, env, ctx) {
		const content = await new Response(message.raw).text();
		const messages = [
			{ role: 'system', content: 'you are an email responder, reply to the given message' },
			{ role: 'user', content }
		];
		// @ts-expect-error broken bindings
		const { response } = await env.AI.run('@cf/meta/llama-3.2-11b-vision-instruct', { messages });
		const msg = createMimeMessage();
		msg.setHeader('In-Reply-To', message.headers.get('Message-ID') as string);
		msg.setSender({ name: 'Sean Behan', addr: 'contact@seanbehan.ca' });
		msg.setRecipient(message.from);
		msg.setSubject('RE');
		msg.addMessage({
			contentType: 'text/plain',
			data: `${response}\n\nThis was an automated message. If this is urgent, message Sean on Telegram https://t.me/codebam`
		});

		const replyMessage = new EmailMessage('contact@seanbehan.ca', message.from, msg.asRaw());

		await message.reply(replyMessage);
		await message.forward('codebam@riseup.net');
	}
} satisfies ExportedHandler<Env>;

This small amount of code is all it takes to automatically reply to all my emails with llama3.2!

Feel free to copy it and use it yourself. The source code is on GitHub.

Introduction to Flakes

Flakes in NixOS allow you to write Nix code that has custom inputs and outputs. For example this is a simple example of a Flake. You can get a copy for yourself by running nix flake init.

{
  description = "A very basic flake";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
  };

  outputs = { self, nixpkgs }: {

    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;

    packages.x86_64-linux.default = self.packages.x86_64-linux.hello;

  };
}

Flake Structure

As you can see there are inputs (nixpkgs), and outputs (self, nixpkgs).

Managing Dependencies with flake.lock

If you build this Flake using nix build you’ll end up with a new directory called result which is a symlink to where the package was built in your Nix store.

result -> /nix/store/yh6x9ia5kxxw3w90vkb09vqgfvhb416k-hello-2.12.1

You’ll also end up with a flake.lock. If you’ve used npm before flake.lock is very similar to package-lock.json. If you haven’t, a quick explanation is that it keeps track of package versions and keeps them locked between updates. If you want to update your lockfile so you can get a newer package version you can do so with nix flake update

Now so far I’ve only showed a very basic example of a Flake, the example from nix flake init. You can see more templates with nix flake show templates.

Development Shells (devShell)

One thing I like using Flakes for is to create a devShell. You can initialize a Flake with a devShell preconfigured with nix flake init -t templates#utils-generic

{
  inputs = {
    utils.url = "github:numtide/flake-utils";
  };
  outputs = { self, nixpkgs, utils }: utils.lib.eachDefaultSystem (system:
    let
      pkgs = nixpkgs.legacyPackages.${system};
    in
    {
      devShell = pkgs.mkShell {
        buildInputs = with pkgs; [
        ];
      };
    }
  );
}

In this example you can add packages from nixpkgs to buildInputs for them to be installed temporarily. You can activate it with nix develop. This is the devShell I use for my typescript projects.

# ...
      devShell = pkgs.mkShell {
        buildInputs = with pkgs; [
          efm-langserver
          nil
          nodePackages_latest.nodejs
          nodePackages_latest.typescript-language-server
          nodePackages_latest.prettier
          vscode-langservers-extracted
          nodePackages_latest.bash-language-server
        ];
      };
# ...

Building Packages with Flakes

You can use Flakes to build packages as well. You can look at just about any Nix package for an example. Just choose one in nixpkgs. Flakes have many functions to build different types of packages as you can see in nixpkgs.

This past week I spent rewriting cf-workers-telegram-bot. Here I’m going to show you the newly updated API that anyone can use to run a Telegram Bot on Cloudflare Workers or any other serverless platform.

Project Setup

First you need to set up a new Cloudflare Workers project using wrangler.

npm create cloudflare@latest

This will prompt you for a project name first. Choose a name for your new project or use the default.

Next you’ll be prompted for the type of application you want to deploy. You should choose a “Hello World” Worker.

After that you’ll be asked a few more questions, like if you want to use TypeScript, and Git (optional, but recommended). You don’t need to deploy just yet.

Adding Your Bot Token

Next you can add the token you get from @BotFather on Telegram as a secret so you don’t have to keep it in the code.

npx wrangler secret put TOKEN

Once you’ve created your project and created your secret you’ll want to install the cf-workers-telegram-bot library to start coding.

cd your-new-project
npm i @codebam/cf-workers-telegram-bot

This will give you access to my TelegramBot class for creating a Telegram Bot.

Writing the Bot

To get started you can open src/index.ts in your favorite editor such as vscode or vim. Then you can import like this.

import TelegramBot, { TelegramExecutionContext } from '@codebam/cf-workers-telegram-bot';

Then you can simply write your bot like this.

export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    const bot = new TelegramBot(env.TOKEN);
    await bot.on('start', async function (context: TelegramExecutionContext) {
      switch (context.update_type) {
	case 'message':
	  await context.reply('Hello from Cloudflare workers');
	  break;

	default:
	  break;
      }
    }).handle(request.clone());
    return new Response('ok');
  },
};

Deployment and Webhook

Now you’re ready to deploy.

npx wrangler deploy

You can set your webhook by going to the URL you’ve been given plus your token and ?command=set.

Like this. https://telegram-bot.username.workers.dev/YOURTOKENHERE?command=set

Now when you send your bot a message on Telegram it should respond with Hello from Cloudflare workers.

Starter Template

If you’ve got this far and you don’t want to code it all by yourself, you can fork my repository here to get started with a working copy.

Introduction

In this post I’m going to show you how I made the search bar on the posts page and main page of my website.

Implementing the Search Bar

I used a library called fuse.js for fuzzy searching for titles, here’s how it works.

<script lang="ts">
	import { Heading } from 'flowbite-svelte';
	import Post from '$lib/components/Post.svelte';
	import Fuse from 'fuse.js';
	import { afterUpdate } from 'svelte';
	export let posts: { path: string; meta: { title: string; date: string } }[];
	let query = '*';
	let results = posts;
	const options = { keys: ['meta.title'] };
	const fuse = new Fuse(posts, options);
	afterUpdate(() => {
		let results_ = fuse.search(query);
		results = results_.map((result) => ({ path: result.item.path, meta: result.item.meta }));
	});
</script>

<Heading
	tag="h4"
	style="display: inline"
	class="ml-8 my-4 text-secondary dark:text-dark-secondary w-auto">Posts</Heading
>
<input class="text-secondary" bind:value={query} />
<ul>
	{#each results as post}
		<Post {post} />
	{/each}
	{#if results.length === 0}
		{#each posts as post}
			<Post {post} />
		{/each}
	{/if}
</ul>

How it Works

You can see I initialize the query to '*'. All this really does is sets the search field to * instead of being empty. Then in the input element I bind to the value of query so that when the user types in the field the value of query will change.

I do some more initialization of fuse.js to search and then I register afterUpdate(). This allows me to search only when the page changes.

Finally I added some logic to display all the posts if there are no results, like for example when the page loads.

All this together looks like the search bar you see on /posts and /.

Introduction

Recently I implemented HTTP Basic Auth using a session cookie in SvelteKit on Cloudflare Pages using Cloudflare D1 as a database backend. Here I’ll show some code snippets so you can do the same.

Project Setup

First you would want to set up your project according to this. So you can have a basic project set up.

Database Setup

Next you’ll want to add the database to your project. It’s easy to create using wrangler. Just remember to link it to your project in your cloudflare dash under settings > functions.

wrangler d1 create your-database-name

Then you can copy it into your wrangler.toml so your local dev works with it. To run with support for D1 you can use this oneliner.

npm run build && wrangler pages dev .svelte-kit/cloudflare

My final schema looks like this. Yours might be a bit different, but mine allows for adding songs to a playlist which will be the purpose of my website.

CREATE TABLE IF NOT EXISTS Users (id TEXT PRIMARY KEY, password TEXT);
CREATE TABLE IF NOT EXISTS Playlist (id TEXT PRIMARY KEY, email TEXT, url TEXT, date TEXT);

You’ll want to create these tables using wrangler both locally (on your dev server) and remotely.

wrangler d1 execute svelte-auth --local --file=./schema.sql
wrangler d1 execute svelte-auth --file=./schema.sql

Now you can add it to your app.d.ts like this.

declare global {
	namespace App {
		interface Platform {
			env?: {
				DB: D1Database;
			};
			context: {
				waitUntil(promise: Promise<any>): void;
			};
			caches: CacheStorage & { default: Cache };
		}
	}
}

export {};

Authentication Implementation

Now you’re ready to set up authentication. It’s probably easier to just show you how I did it. I imported sha256 which is just a simple function I wrote to call web crypto to get the sha256sum of a string. Here is my code.

I added form actions. These allow you to quickly write code that will work with HTML <form>‘s.

import { redirect } from '@sveltejs/kit';
import sha256 from '$lib/sha256';

export const actions = {
	register: async (event) => {
		const data = await event.request.formData();
		const email = data.get('email');
		const password = await sha256(data.get('password')?.toString() ?? '');
		const { success } = await event.platform?.env?.DB.prepare('INSERT INTO Users VALUES (?, ?)')
			.bind(email, password)
			.all();
		if (success) {
			event.cookies.set('session', JSON.stringify({ email, password }));
			throw redirect(303, '/');
		}
	},
	login: async (event) => {
		const data = await event.request.formData();
		const email = data.get('email');
		const password = await sha256(data.get('password')?.toString() ?? '');
		const results = await event.platform?.env?.DB.prepare('SELECT password FROM Users WHERE id=?')
			.bind(email)
			.all();
		if (results.results[0].password === password) {
			event.cookies.set('session', JSON.stringify({ email, password }));
			throw redirect(303, '/');
		}
	}
};

Checking Authentication Status

Now this is enough to save a cookie with the user auth, but to re-auth on a page we need to check if their cookie is valid. So how I do this is I wrote another function called tryLogin.ts.

import type { D1Database } from '@cloudflare/workers-types';

const tryLogin = async (session_cookie: string | undefined, DB: D1Database) => {
	if (session_cookie) {
		const { email, password } = JSON.parse(session_cookie);
		const results = await DB.prepare('SELECT password FROM Users WHERE id=?').bind(email).all();
		if (results.results[0].password === password) {
			return true;
		}
	}
	return false;
};

export default tryLogin;

Now I can call this inside +page.server.ts.

import tryLogin from '$lib/tryLogin';
import getCurrentSong from '$lib/getCurrentSong';

export const load = async (event) => ({
	auth: await tryLogin(event.cookies.get('session'), event.platform?.env?.DB),
	song: await getCurrentSong(event.platform?.env?.DB)
});

Using it inside the +page.svelte is as simple as this one line.

export let data: {auth: boolean, song: {id: string, url: string}};

Playlist Management

Now I wrote more form actions for adding and removing songs from the playlist here.

import { redirect } from '@sveltejs/kit';
import tryLogin from '$lib/tryLogin';

export const actions = {
	add: async (event) => {
		if (await tryLogin(event.cookies.get('session'), event.platform?.env?.DB)) {
			const session = JSON.parse(event.cookies.get('session'));
			const email = session.email;
			const formdata = await event.request.formData();
			const v = new URL(formdata.get('url')).searchParams.get('v');
			await event.platform?.env?.DB.prepare('INSERT INTO Playlist VALUES (?, ?, ?, ?)')
				.bind(crypto.randomUUID(), email, v, Math.floor(new Date().getTime()))
				.all();
		}
		throw redirect(303, '/');
	},
	remove: async (event) => {
		if (await tryLogin(event.cookies.get('session'), event.platform?.env?.DB)) {
			const formdata = await event.request.formData();
			const id = formdata.get('id');
			await event.platform?.env?.DB.prepare('DELETE FROM Playlist WHERE id=?').bind(id).all();
		}
		throw redirect(303, '/');
	}
};

User Interface

Now this allows us to add songs, we just need the interface for it. So I wrote the main page to allow logged in users to submit songs.

<script lang="ts">
	import { enhance } from '$app/forms';
	import YouTube from '$lib/svelte-youtube.svelte';
	export let data: { auth: boolean; song: { id: string; url: string } };
</script>

{#if !data.auth}
	<p>Visit <a href="/login">login</a></p>
{/if}

<YouTube
	on:end={() => document.getElementById('remove_song')?.click()}
	videoId={data.song.url}
	options={{ playerVars: { autoplay: 1 } }}
/>

<form style="display: none;" method="POST" action="/playlist?/remove" use:enhance>
	<input name="id" value={data.song.id} />
	<button id="remove_song">remove</button>
</form>

{#if data.auth}
	<form method="POST" action="/playlist?/add" use:enhance>
		<label
			>Submit a song
			<input name="url" type="url" placeholder="paste a youtube link" pattern=".*v=.*" />
		</label>
		<button>Submit</button>
	</form>
	<p><a href="/logout">Log out</a></p>
{/if}

Conclusion

If you have any problems or you want to see the entire repo. The code is here and the live demo is here.

Introduction

You might know I’ve made a Chat Bot cf-workers-telegram-bot. Recently I added AI to it using Cloudflare AI. Here I’m going to show you how and how you too can make your own chatbot using Cloudflare AI.

Cloudflare Workers AI Setup

First you’ll want to add the AI section to your wrangler.toml.

[ai]
binding = "AI"

Using the AI Model

Then you can simply import

import { Ai } from '@cloudflare/ai';

And you can use it like this

const ai = new Ai(env.AI);
prompt = 'hello world';
const result = await ai.run('@cf/meta/llama-2-7b-chat-int8', {
	prompt
});

Other Models and Tips

That’s it!

There are other models you can use as well on Cloudflare AI so you should check them out here for other cool things you can do https://developers.cloudflare.com/workers-ai/models/

I’m hoping for a 70B model soon :)

If you want to use this to make a chat bot make sure when you restore the prompt you wrap user input in [INST] [/INST] tags so llama2 knows what was user input and what it said.

If you want to try out my Chat Bot it’s on Telegram.

Introduction

Ostree is the software that allows rpm-ostree in Fedora Silverblue to keep snapshots of previous deployments and do incremental updates, but did you know it can also be used to keep snapshots of your own files? It’s actually quite easy once it’s all set up.

For this I would strongly suggest you use root for your ostree. Although you can use it without, you will be able to use files that regular users can’t use such as hardlinks if you’re root, which will speed up incremental snapshots very much.

Initializing the Ostree Repository

First you’ll want to create your inital ostree. Do this in a new folder, on a drive with lots of free space for the files you want to snapshot. You’ll need as much free space as all the files you want to snapshot.

mkdir tree
sudo ostree init --repo=tree

Committing and Restoring Files

Next you can start committing files to your new tree. Be sure to check the man pages for ostree-commit and ostree-init.

sudo ostree commit --repo=tree --branch=master $PWD/dir

Keep in mind you cannot commit individual files, only entire directories at a time. Now when you change something inside /dir you can commit again with the exact same command and you will have both copies in your ostree. To restore the original copy you can then use ostree-checkout.

ostree refs --repo=tree master

This will show you a list of all your commits. Now choose the one you want to restore.

ostree checkout --repo=tree --union your-commit-sha dir

Important Considerations

Make sure you check ostree -h for a list of ostree commands and read each of their man pages if you want to use them fully.

I use this on a filesystem that is already a RAID1. Make sure you keep proper backups, ostree can create snapshots but it won’t help you if your entire drive fails.

The Problem

If you’ve switched to Flatpak for gaming you may notice that Mesa is sometimes a little bit old. The issue I had myself was that my 6000 series AMD graphics card didn’t have up to date graphics drivers, resulting in OpenGL games not running on the graphics card, but rather the CPUs OpenGL implementation, which made games such as CS:GO and Minecraft run at 5 or 10 FPS.

The Solution

To get the latest Mesa git on Flatpak you can install it like this:

flatpak install org.freedesktop.Platform.GL.mesa-git org.freedesktop.Platform.GL32.mesa-git

This will allow you to install the latest Mesa graphics drivers to allow applications to detect hardware properly and run better. Make sure when you are prompted for a version of Mesa to install you choose the latest version number that doesn’t have “beta” at the end.

Usage

Once you’ve done this you can run your Flatpak like this to use Mesa git.

FLATPAK_GL_DRIVERS=mesa-git flatpak run com.valvesoftware.Steam

You can also export FLATPAK_GL_DRIVERS=mesa-git in your .bashrc or .profile to use Mesa git for all Flatpak applications. This may cause issues though, and I’d personally advise you only use it when it’s needed.

BTRFS RAID1 Setup

I mentioned in my previous post that I use an external drive to keep my Steam games on. In an attempt to not have to re-download hundreds of gigabytes of games I keep them on a RAID1 with 2x5TB drives that I use BTRFS to manage. In this post I’m going to outline how I set it all up, and how I manage it when issues arise.

Formatting Drives

First of all I had to format the drives, so I made sure they were empty and everything was backed up. Don’t do this unless you know for sure that all the data on all your drives is backed up somewhere else, or you want to delete it permanently.

Okay so the commands are easy, you just have to make sure you’re using the right ones as not to lose your data. Don’t run these commands without understanding what they do. Replace _ with your drive letter. A lot of these commands need to be run with root, make sure to either elevate to root (sudo -s) or prepend the commands with sudo.

lsblk

mkfs.btrfs /dev/sd_1
mkfs.btrfs /dev/sd_1

Creating the RAID1 Array

Now you can mount the newly formatted drives to a single RAID1.

mount /dev/sd_1 /mnt
btrfs device add /dev/sd_1 /mnt
btrfs balance start -dconvert=raid1 -mconvert=raid1 /mnt

The last command might take a little bit of time, but once it’s finished your drives will be all ready to be used.

Managing the Array

Now if you need to swap out a drive, add another, or you unplug one when it’s writing you can simply balance again and btrfs should be able to balance back onto the drive.

btrfs balance start -dconvert=raid1 -mconvert=raid1 /mnt

You can view the status of the balance using:

btrfs balance status

You can remove a drive or add another using:

btrfs device remove /dev/sd_1
btrfs device add /dev/sd_1

Just make sure you balance right afterwards (which will take a VERY long time if you have lots of data, beware)

btrfs balance start -dconvert=raid1 -mconvert=raid1 /mnt

Introduction

I was using Fedora Silverblue for nearly a year before I realized I had been using Flatpak’s for nearly all my software, which mind you isn’t much, but I can use Firefox, Chrome, and play any video game I want using Flatpak alone so it makes sense for me.

To get this working all you need is a distribution where you can install Flatpak. I’m using Alpine Linux edge with musl and even that works. Using Flatpak allows me to use proprietary video and audio codecs in Firefox and Chrome since musl doesn’t support those codecs as of right now.

Setting up Flatpak

If your distribution doesn’t already come with FlatHub like Alpine, you’ll need to add it.

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

Installing Applications

This will allow you access to the entire Flatpak library. You can search for software using:

flatpak search steam

Then install using:

flatpak install com.valvesoftware.Steam

Make sure you periodically update your Flatpak’s as well using:

flatpak update

Steam and Gaming

For Steam to work you’ll likely need to install some other Flatpak’s as well, but once they’re installed all your other gaming Flatpak’s should “just work”.

flatpak install com.valvesoftware.Steam.CompatibilityTool.Proton

You might also want to install your distribution’s steam-devices package if you want to use a game controller.

sudo apt-get install steam-devices # ubuntu / debian
doas apk add steam-devices         # alpine

Managing Permissions with Flatseal

I like to give the Steam Flatpak access to my external drives so I can keep games there instead of on my hard drive. To do this I simply install Flatseal and use Flatseal to give rw (read+write) access to the directory where my drives mount to.

flatpak install com.github.tchx84.Flatseal

Google Chrome

Next if you want to install Google Chrome.

flatpak install com.google.Chrome

Conclusion

That’s all you have to do, then you would have Google Chrome installed.

Flatpak uses it’s own runtime, remember to update all your Flatpak’s periodically with flatpak update to avoid security vulnerabilities and other issues.

For my wireless card, the Alfa AC1900, I had to compile the module to get it to work on Linux since it wasn’t already part of the kernel.

Prerequisites

To do this you will need:

1. make and gcc or clang
2. kernel-debug-devel package
3. sudo permission to insmod the compiled module

This^1 is the only one I found that worked for me on the latest stable linux kernel, which as of today on Fedora is 5.17.6.

Kernel Header Installation

First you need to install the kernel development header package.

# Fedora
sudo dnf install kernel-debug-devel

# Ubuntu
sudo apt install linux-headers-$(uname -r)

^2

Building and Loading the Module

Next you need to make the module.

git clone https://github.com/morrownr/8814au.git
cd 8814au

Now simply make the module using the make command and use insmod to load it.

make -j16
sudo sh -c "modprobe cfg80211; insmod /home/codebam/8814au/8814au.ko"

If everything worked successfully, you should now have a loaded 8814au module that you can use along with your wireless card to connect to WiFi.

Introduction

X11Docker is a nice command line tool that allows you to run graphical applications inside podman or docker by passing them to xpra or your wayland socket. To do this you first need a Containerfile or Dockerfile to build an image with the application you want to run. In this example I’m going to run telegram-desktop.

Building a Container Image

FROM ubuntu:latest

RUN apt-get update
RUN apt-get install -y telegram-desktop

CMD ["telegram-desktop"]

Running the Application with X11Docker

We build this image with podman build . -t telegram and wait for it to install our packages. When it’s done we can simply run it with x11docker localhost/telegram and it starts Telegram in Xpra.

Running with Wayland

If we wanted to start it under Wayland instead, we could run x11docker --wayland localhost/telegram however the package for Telegram on Ubuntu doesn’t seem to have support for Wayland when I tried it.

This should work for any graphical software, even that which isn’t in the repositories. You can even install more than one piece of software in a single image. Then you pass the CMD as an argument to x11docker like so x11docker localhost/telegram telegram-desktop.

Introduction

Podman^1 has a nice feature called generate that lets you generate different kinds of configuration files for starting pods. One that I use often is podman generate systemd which generates a new user service that can be started with systemctl --user start container-yourcontainer.service or enabled.

Auto-Updating Containers

If you want your container to auto update you can simply pass it the flag --label "io.containers.autoupdate=registry" when you’re creating it. The systemd service will automatically pull the latest versions of containers before starting them. You can manually update your container images now using podman auto-update.

If you want to update your images on a schedule you can enable the podman-auto-update.timer using systemctl --user enable --now podman-auto-update.timer which will auto update your containers every Monday morning.^2

Kubernetes YAML Generation

You can also generate a Kubernetes YAML configurations using podman generate kube. This can then be loaded in Kubernetes to run your containers.

Introduction

Podman^1 is a container management software similar to Docker that can run OCI containers as regular users (not root) by using container management libraries such as crun or runc, and cgroups v1 or v2. It can be used as a drop-in replacement for Docker and supports docker-compose using podman-compose.

Unfortunately for some distributions after installing podman the operating system defaults to cgroups v1 and runc, not cgroups v2 and crun. As was the case on Rocky Linux for me.

Switching to crun

First we can switch to crun instead of runc by installing crun with our package manager. It was already installed for me, but on Fedora you would use sudo dnf install crun

Then you can edit the file /usr/share/containers/containers.conf and change the line runtime = "runc" to runtime = "crun". Now you can verify that you’re using crun with podman info | grep crun.

name: crun
package: crun-0.20.1-1.module+el8.4.0+643+525e162a.x86_64
path: /usr/bin/crun
  crun version 0.20.1

Enabling cgroups v2

Now the harder part was enabling cgroups v2. Luckily I found a comment on a GitHub issue outlining the steps you need to complete to get cgroups v2 to work.

First we can enable it in the kernel with

sudo grubby --update-kernel=ALL --args="systemd.unified_cgroup_hierarchy=1"

Then we can enable linger. This will also allow our containers to remain running after logging out.

sudo loginctl enable-linger codebam

Then the last step which made everything work for me is to set the pid_limit=0. For me it was in /usr/share/containers/containers.conf instead of /etc/containers/.

Verification

Now you can reboot. podman info | grep cgroup should say

cgroupControllers: []
cgroupManager: systemd
cgroupVersion: v2

Now we’re using cgroups v2 and crun.

Introduction to useState

In React when we want to manage individual state there is a function we can import called useState that gives us a getter and setter letting React know when it needs to re-render.

import React, { useState } from 'react';

const myComponent = () => {
  const [count, setCount] = 0;
  ...
}

This initializes count as a state variable that can be accessed with count and set with setCount.

Incrementing a Counter

If we wanted to write a function that incremented count, we could add a button.

...
return (
    <>
      <p>Count is: {count}</p>
      <button onClick={() => setCount(count + 1)}>+1</button>
    </>
);

Here we wrapped our text and button in a React Fragment. Since components can only return one DOM parent element, Fragments allow us to return more than one without creating more divs in our markup.

Then I set the onClick for button to an inline function that increases count by 1 using setCount. If we were to do this without a state variable, i.e. const count = 0 React wouldn’t know when to re-render our data.

Managing List State

This can be used to hold any state or object however, not just numbers and strings. If we wanted to instead append to a list we might write a function that gets passed to the onSubmit of a form.

...
[list, setList] = useState([]);
...

const onFormSubmit(event) {
  event.preventDefault();
  list.push(form.name);
  setList(list);
}

Handling Form Input

Changing all our input onChange methods as well to update the state of form when the data changes.

...
<label>
  <p className={"text-label"}>Name:</p>
  <input
    onChange={handleSetForm}
    type="text"
    name="name"
  />
</label>
...

...
[form, setForm] = useState({ name: '' });
...

const handleSetForm = ({ target: { name, value } }: any) => {
  setForm((form) => ({ ...form, [name]: value }));
};

This updates our form state whenever the data changes. Allowing us to use form to append to our list above whenever the submit button is clicked.

Introduction

I’ve been learning React so that I can build my web applications for others and myself. React is component based. You create reusable components and render them with data. Here I created a card component that lets me insert cards. They can even contain other cards and are easy to understand from the App.js.

Creating the Card Component

To create a new component I just create a new file called Card.js and import it at the top of App.js.

import Card from './Card.js';

Then inside Card.js I can create my Card. At the top I import my styles and return the JSX Card object.

import './Card.css';

function Card(props) {
	return (
		<div className="Card">
			<h2 className="CardTitle">{props.cardTitle}</h2>
			<p className="CardContent">{props.children}</p>
		</div>
	);
}

export default Card;

At the bottom I set the default export to Card so that we can import it properly in App.js.

Styling the Card

My styles are fairly simple, they just create a nice looking card.

.Card {
	text-align: center;
	background-color: lightgrey;
	border: 1px solid grey;
	border-radius: 0.5em;
	margin: 1em;
	height: 20em;
	overflow: hidden;
}

.CardTitle {
	font-size: 1em;
}

.CardContent {
	background-color: white;
	height: 100%;
	border-radius: 0.5em;
	border-top-left-radius: 0em;
	border-top-right-radius: 0em;
	padding: 1em;
}

Using the Card Component

That’s great but we still have to insert our card in App.js. Now that we’ve created a component and imported it all I have to do in App.js to create a card is this.

<Card cardTitle="Example Card Title">Hello World</Card>

Conclusion

Finally we can see that this builds a card.

This can be used for building any kind of component, such as dialog boxes, forms, or anything you can imagine in HTML/CSS.

Introduction

Over the past few months I experimented with some new Linux distributions. Here I’ll show you the one I’m currently using and why I think it’s great.

Atomic Updates and Rollbacks

Fedora Silverblue is what’s known as an Atomic operating system. On Fedora Silverblue every update is checked out similar to how git checks out a new reference. If you want to install packages into the base image you can use rpm-ostree install like you usually would, the only difference is that you need to reboot to boot into your new base system reference.

Toolbox for Development

If you don’t want to reboot there is a better way though. Instead of layering packages into your base image you can use a tool called toolbox which is simply a wrapper around podman for creating containers with the current Fedora image. You can use toolbox enter and install and run any software as well as access files inside your home directory.

Rebasing and Customization

If at some point you do updates and your system doesn’t boot, you don’t have to worry. You can simply reboot and choose the last working base image and your system will boot up as normal, allowing you to fix any breakage.

Silverblue is so much more powerful than that though. You can rebase your entire system on different base images or Fedora versions. Now instead of installing your new desktop environment and risk breaking your operating system you can do an rpm-ostree rebase and rebase on another desktop environment. I used this to rebase on an image from Kinoite called base which just includes all the base packages and no desktop environment. Then I installed my window manager of choice and it’s dependencies. Now I have a fully modular Fedora installation along with Sway and all the dependencies I need to use it.

What is LBU?

Alpine Linux has a cool feature called LBU that lets you create a backup on top of the Live ISO. These backups are called local backups.

I plan on using LBU as a system maintenance drive. It allows you to save changes you make to the Live ISO and restore them automatically when you boot the next time.

Setup and Committing

To set up LBU I booted the Alpine Linux ISO, ran setup-alpine, mounted my drive to /media/alpine_usb and when I got to the disk selection I selected no disk, and alpine_usb as where to store the configs, and the default for cache.

Now when I make changes in the Alpine Linux Live ISO I can commit them.

To see what is being committed I first check lbu status which lists all the files being added or removed, then lbu commit to commit the changes.

When I was rebooting I had an issue where the drive would automount itself to /media/sdb and then wouldn’t work with lbu when I wanted to commit or check the status because it was already mounted. To fix this I just had to umount /dev/sdb on boot and then lbu worked as expected.

Caching and Configuration

To use cache you have to mount it to /media/alpine_usb so that it can write the cache files when you’re installing packages. I want this because it makes reinstalling my packages on reboot a lot faster, they can just be loaded from cache instead of from online repositories.

Upon reboot I had to reinstall all the packages I had installed using apk upgrade but since the cache is there it just installs everything really quickly.

I uncommented and changed the number of backups in /etc/lbu/lbu.conf to 20 so that I would be able to revert up to 20 commits in case I broke my configs.

I see Alpine LBU as a good way to keep a backup of changes to the ISO so it could be used as a system recovery disk with the tools that are needed.

Password Management

I’ll start this post by saying one thing. Are you SURE you want to wipe that yubikey? I spent the last 2 weeks redoing my entire password manager. Silly me forgot that I had my passwords encrypted using the yubikey I wiped to create new PGP keys.

Anyways over the past week or two I moved all my passwords from pass into keepass and then back into pass when keepass didn’t meet all my needs for a password manager. KeePass supported using yubikeys for decryption, but not more than one at a time. If I were to lose the key I would get permanently locked out.

Features I want in my password manager:

• 2FA for password manager decryption
• Mobile and desktop apps
• Secure encryption

What I settled on was this. I bought myself a Yubikey 5C NFC to go alongside my previous Yubikey 5C. There might be better alternatives, but this is the one I purchased. This one had NFC and was convenient for accessing passwords on my phone and laptop.

Yubikey PGP Key Generation

To generate my PGP keys I actually generated them on the Yubikey itself, this way the private key never touches the laptop I used to generate the key.

$ gpg --card-edit
gpg/card> admin
gpg/card> key-attr
gpg/card> generate

The key-attr command lets you choose the type and size of key you’re generating on the device. I used RSA 4096 for my Yubikey 5C and ed25519 for the Yubikey 5C NFC. I can’t use RSA or larger keys if I want to be able to use it with NFC.

I backed up my revokal certificates that were put in the ~/.gnupg/ directory as indicated after they were generated, and I exported and backed up the public keys, then I uploaded the keys to a keyserver.

gpg --export --armor 0F6D5021A87F92BA > 0F6D5021A87F92BA.asc
gpg --send-keys 0F6D5021A87F92BA

gpg --export --armor F9BC985B3BF972C7 > F9BC985B3BF972C7.asc
gpg --send-keys F9BC985B3BF972C7

I started putting passwords into pass using pass init 0F6D5021A87F92BA F9BC985B3BF972C7. That lets me encrypt to both Yubikeys at once. Now if I lose or accidentally wipe one of the Yubikeys again the other will be able to decrypt my passwords. I also signed the keys with each other, just to show that both are valid if one were to be lost.

While I did all this I thought I might as well enable 2FA using both the Yubikeys on every account that supported it. Google actually has something cool called Advanced Protection which allows you to set up your account with 2 yubikeys to login with, so I enabled that for my Google account.

I downloaded the password store Android app for my phone, along with Openkeychain. This part wasn’t too hard to set up, I just searched for my key on the keyserver that I just uploaded it to, then imported it. I went through the setup to add a security token and imported it so that it was recognized as one of my keys.

Git and Password Store Sync

At this point I set up my password store with git to use for syncing. I set it up on some mirrors just in case one went down, and I backed it up to Nextcloud.

git remote add all git@seanbehan.dev:pass
git remote set-url --add --push all git@seanbehan.dev:pass
git remote set-url --add --push all git@git.sr.ht:~codebam/pass
git remote set-url --add --push all git@git.maych.in:codebam/password-store
git push --set-upstream all master

I actually set up git on my own server here too. To do this I added a new user named git and added my ssh keys to it, then inside it’s home directory I made git repositories to push to using.

mkdir pass
cd pass
git init --bare

Yubikey for SSH

I generated a new SSH key from within the password store app and used that for authentication from my phone. On my laptop I set up gpg-agent with ssh support so that I could use my yubikey as an SSH key as well as a PGP key.

~/.bashrc

export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
gpg-connect-agent updatestartuptty /bye > /dev/null

~/.gnupg/gpg.conf

use-agent

Then I used ssh-add -L to show my public SSH key for each yubikey to put on the server.

I used pass for 2FA as well because the password store app supports that. I just scanned the code and installed pass-otp on Fedora to get support for OTPs.

I installed the PassFF Firefox extention to get support for pass in my browser, and turned on autofill on my phone so that it can autofill everywhere.

I set up git to sign all my commits so that it shows that my commits are signed and valid.

git config --global user.signingkey 0F6D5021A87F92BA
git config --global commit.gpgsign true

System-level U2F Authentication

As an extra layer of security on Fedora I installed the pam-u2f package on and generated U2F logins.

sudo pamu2fcfg -uroot >> /etc/u2f_mappings

I ran it once for each key, then opened the file and edit it so it looked like this.

Before

root:key1root:key2

After

root:key1:key2
codebam:key1:key2

In /etc/pam.d/system-auth I added a line to the very top above all the other auth.

auth	    required              pam_u2f.so authfile=/etc/u2f_mappings

I added the same line to /etc/pam.d/su as well so that my user and root requires a yubikey to su.

This makes it so that sudo, su, and logging in through a getty (not in GDM for some reason, but I haven’t fixed it) require you to tap the yubikey before typing the password. Two factors of authentication for my computer, and every online service that supports it, backed by hardware.

Once I was done all this I committed my changes to my dotfiles pushed them to git so that I could easily set the same thing up on my desktop which is also running Fedora.

Introduction

Today I’ll show you how you can write incredibly fast code in Rust. This is part one of a tutorial series.

This is an intermediate tutorial, if you are unfamiliar with Rust basics I would suggest reading the Rust book for free at [https://doc.rust-lang.org/stable/book/].

Project Setup

Lets dive right in.

cargo new rust-tutorial
cd rust-tutorial

Let’s build our websocket server.

Edit your Cargo.toml and add ws to your [dependencies].

Your Cargo.toml should now look something like this.

[package]
name = "rust-tutorial"
version = "0.1.0"
authors = ["Sean Behan <codebam@riseup.net>"]
edition = "2018"

[dependencies]
ws = "*"

Building the WebSocket Server

Import our libraries.

use ws::listen;

Start a websocket listener.

fn main() {
    listen("127.0.0.1:5000", |out| {
        move |msg: ws::Message| {
            // handle the msg here
        }
    }
}

Handling Messages

We’ll respond to recieved messages and just echo them back for now.

Of course you could easily pass this data into any function and use it to generate a response. In fact the incoming and outgoing data doesn’t even have to be text.

out.send(format!("recieved message: {}", msg.into_text().unwrap())).unwrap();
out.close(ws::CloseCode::Normal)

Testing the Server

If we connect to this now using websocat, which can be installed with cargo install websocat, we can see the server echos back messages that we send to it.

$ websocat ws://127.0.0.1:5000
hello world
recieved message: hello world

This isn’t that interesting. It’s cool that we can do all this in just 8 lines of Rust though!

Next Steps

In the next part of this series I’ll show you how to use use tokio to create an asyncronous server so we can manage simultaneous connections. Stay tuned!