What programming/technical projects have you been working on?

My wife asked me what kind of investment it would take to make our home server more reliable and more performant. I couldn't believe it. So I sourced an old(er) desktop poised for the trash at work to set up a new Proxmox server onto, and am now looking at ways to build a cheap NAS with TrueNAS. Looking at keeping new purchases under $600 CAD or so since I'll likely need to buy some large capacity hard drives (and maybe a case for those drives).

I'm very excited about this project.

I made a small fish shell function yesterday which I'd like to share:

function abbr_random_line -a name -a path
    eval "function __abbr_random_line_$name; shuf -n1 $path; end"
    abbr --add "$name" --function __abbr_random_line_$name
end

This allows me to put a text file somewhere filled with interesting commands to run. Then I can type a short command and it will substitute the commandline with one of the lines from that file.

For example, I have abbr_random_line wt ~/watch in my fish config. When I type wt and press space it will expand to a random line from the ~/watch file.

Been playing with adding small controllers to home assistant to use LEDs to display status of things.

Mostly because I have a few pi picos that have been on the "find a project" bench for awhile now so was trying to make use of parts on hand instead of ordering exactly what a tutorial/blog laid out. Got one wired to an airlift wifi module but it was enough of a pain trying to get them to actually connect to the wifi I switched over to a pico w, which was incredibly straightforward to get connected all the way to home assistant. Went to get the LED strip I'd seen in the pile and it was already wired up to a Zooz z-wave module that I'd apparently set up and couldn't decide what to do with it.

So now there's a nice little light strip above the washer/dryer that goes red if they're turned on during peak electrical pricing and can otherwise just add directed light to the room when the main light comes on or be a nightlight or whatever. Which is neat.

But now I'm back to square one on "what can I use these picos for". Could maybe light a bookcase I suppose but that seems like a waste of an addressable LED strip and the capability of the little controllers. Maybe somehow get it setup so each shelf can be lit up individually? That actually sounds neat.

I tried to -- and failed to -- setup Kubernetes on my home-server. I was running a few things in Docker/Portainer before, but I felt like the server was getting too "messy".

The platonic ideal would be to have a server that can be wiped and re-constituted easily if need be. Ansible would probably have worked to accomplish the goal of having a reproducible system, but I had worked with Ansible in the past and wanted to try something new.

So, Kubernetes. Google-scale on a single machine... 🤦 (though I planned on adding more machines later on to get a proper quorum of three). Why, oh why, did I think this was a good idea?

Talos Linux is a distribution that runs nothing but Kubernetes. You can't even SSH into the server because there are no system tools installed -- everything runs through the Kubernetes API. There are a ton of good tutorials on YouTube from the creators of Talos, and I got relatively far with my first attempt: everything needed for running containers worked (modulo a detour where there was not enough entropy in the system to derive encryption keys for the hard disk).

But I couldn't manage to get a port forwarded to an application, specifically ports 80 and 443. Theoretically I could have installed something called MetalLB or just lived with the fact that NodePorts are generally assigned in the 30000+ range, but at that point the idiocy of the whole endeavor caught up with me.

However, my research triggered the YouTube algorithm, and I got served videos about something called Incus. Incus is a Container/VM manager that allows very easy creation of docker containers, system containers (containing an entire operating system except for the kernel) and full virtual machines.

So I wiped Kubernetes, threw Ubuntu Server on the server and installed Incus. It took a bit of fiddling until everything was setup to my liking, but the docs are thorough, so it was mostly smooth sailing.

With a bit of setup you can use <container>.incus DNS names to resolve the containers from the server itself, so that different containers can talk to each other over a network bridge. I used that to my advantage, installing a Debian container with Caddy as a reverse-proxy, and now all software on there was accessible via HTTPS (using a self-signed cert).

It is very nice that you can use different Linux distributions from the image library without having to go through a manual installation. I installed Forgejo in a NixOS container, because on NixOS that's like 10 lines of configuration to set it up, whereas most other distributions would have required manual setup. Heck, even a docker-compose for Forgejo is more complicated to setup.

So yeah. Kubernetes was a stupid idea, but it led to Incus, which worked out fantastic so far. You can snapshot containers and VMs and copy or migrate them to other hosts as well. In theory I can wipe the server, transfer backed-up snapshots to it, and be up and running again if things ever get too messy.

Work continues on building a musical keyboard. I got a one-key prototype working last week and now I'm working on multiple keys.

Dipping my toes into ansible. I have tons of experience with puppet and terraform, but somehow never had the opportunity to work with ansible.

I am creating some roles related to server hardening. Things are going smoothly though I am struggling to pick good "sizes" for my roles.

Should I have a bunch of small roles like "noexec on shared memory mount", "configure unattended upgrades" or should I have one role that handles all the hardening.

I am assuming I should go for the former, but that would mean that in each playbook I need to specify the individual hardening roles. And if I then add more, I need to make sure not to forget adding them to my playbooks.

I could make a playbook for hardening and include that in other playbooks, or I could make a hardening role that has all the small roles as dependencies. But both of these options seem frowned upon from what I could find for best-practices.

nothing special, but something I need. This adds two buttons to imdb.com/title/.../reference to look up the movie on Letterboxd and also reddit (via truefilm and criterion by way of google)

// ==UserScript==
// @name         IMDb Links for Useful Sites
// @namespace    http://tampermonkey.net/
// @version      1.4
// @description  Adds Letterboxd and Reddit search links to IMDb /reference/ pages
// @match        https://www.imdb.com/title/tt*/reference/*
// @grant        none
// ==/UserScript==

(() => {
  const imdbId = location.href.match(/(tt\d{7,8})/)?.[1];
  const genreDiv = document.querySelector('.ipc-chip-list__scroller');
  const titleMatch = document.title.match(/^(.*?)\s\((\d{4})\)/);

  if (!imdbId || !genreDiv || !titleMatch) return;

  const [_, title, year] = titleMatch;

  const buttons = [
    { text: 'Letterboxd',
      url: `https://letterboxd.com/imdb/${imdbId}`
    },
    { text: 'Reddit',
      url: `https://www.google.com/search?q=${encodeURIComponent(
        `${title} ${year} site:reddit.com/r/truefilm OR site:reddit.com/r/criterion`
      )}`
    }
  ];

  buttons.forEach(({ text, url }) => {
    const a = document.createElement('a');
    a.href = url;
    a.className = 'ipc-chip ipc-chip--on-base';
    a.tabIndex = 0;
    a.setAttribute('aria-disabled', 'false');
    a.target = '_blank';
    a.rel = 'noopener noreferrer';

    const span = document.createElement('span');
    span.className = 'ipc-chip__text';
    span.textContent = text;

    a.appendChild(span);
    genreDiv.appendChild(a);
  });
})();

its pretty easy to add to if you wanted to have it go to your favorite Linux ISO search.

https://i.imgur.com/NPNUeZV.png

edit: I also added a way to send the IMDB ID, Title, and Year to a Google Sheet via POST -- pretty handy -- (demo)