/Users/<user>/Movies/Motion Templates → Titles, Transitions and so on.Little did I know and long did I debug: The folders are actually suffixed with .localized - but this is not visible in the finder as demonstrated in this example where the supposed same folder exists twice, but one actually ends in .localized
Make sure the Motion Templates folder and all next subfolders end in .localized
/Users/<user>/Movies/Motion Templates.localized/Composting Elements.localized
/Users/<user>/Movies/Motion Templates.localized/Effects.localized
/Users/<user>/Movies/Motion Templates.localized/Generators.localized
/Users/<user>/Movies/Motion Templates.localized/Titles.localized
/Users/<user>/Movies/Motion Templates.localized/Transitions.localized
Apple, why...
]]>I just updated and found out that my external displays (1440p, 165hz) connected to my iVanky FusionDock Pro were constantly disconnecting and re-connecting again. But not long enough to debug within the System Settings what was going on. The whole UI froze.
I was digging around and remembered that my dock can only drive 3x 1440p 120hz - not 165hz. In previous macOS versions, this was no problem - I just went into the display settings, changed resolution and/or refresh rate and everything was fine.
In this update, the screens will get re-connected around every second.
Since the system settings UI is unusable and CLI is always more reliable: There is a tool called displayreplacer which allows you to define the layout, resolutions and more via a command.
Install via Homebrew: brew install displayplacer
First, run displayreplacer list and you will be presented with a command that applies the currently configured state to your display config.
Such as:
In my case, all displays had hz:165 configured which I could not change through the System Settings ui. So simply change it to hz:120, save the command in a shell file (e.g. displays.sh) and run it sh displays.sh
The IDs are persistent and won't change, so you can even make multiple presets and apply them wherever you got a different set of external displays. At home vs. at work.
]]>Update Forgejo Runner to v12.5.3, where this PR is included.
The only possible solution fixing this bug is deleting the runners cache.
Using every single version and variations of actions/checkout@v6 / https://github.com/actions/checkout@v6
Using with.clean = true or with.fetch-depth = 0
Passing current ref to checkout action
The docs state:
It is recommended that
jobs.<job_id>.runs-onis omitted when usinguses, as this will allow Forgejo to perform workflow expansion. Workflow expansion results in the target workflow’s jobs appearing in the UI as separate jobs. This provides an easier to understand experience for accessing the logs of each job, and permits the jobs to run on separate runners with their ownruns-onfields.
Well, this doesn't work at all. Just add the runs-on field to the workflow reference. I have reported this bug.
This year, it looks like MotoGP is also providing their own calendar (red button "Sync calendar") through "ECAL" but you will have to give them your email address and agree to their ToS so I haven't tried it.
This is a configurator where you can decide yourself, to which leagues or events you want to subscribe. The default choices are Qualifying and Races events for the MotoGP league.
Missing anything or have questions? Leave a comment!
Note: As of January 2nd only a couple of dates have been announced. New ones should appear automatically once they are published.
If you're reading this in your RSS reader, that's a good time to head over to the website.
When you've finished tinkering with the parameters above, copy the URL above and paste it to your favorite calendar client. You have the option to just download a .ics file and import it once or subscribe to the URL. I'd recommend the second option since changed in the schedule will automatically update.
Select from the bottom "Calendars"
In the bottom left corner select "Add Calendar"
Select "Add Subscription Calendar"
Paste the URL and hit "Subscribe"
Set a Title and select "Add"
In your Calendar app, select from the top menu "File" → "New Calendar Subscription"
Paste the URL and hit "Subscribe"
Choose a name, like "MotoGP"
Set "Auto-refresh" to "Every day"
Select "OK"
Go to calendar.google.com (in browser)
On the left sidebar, click the "+" next to "Other calendars"
Select "Subscribe to calendar"
On the left select "From URL"
Paste the iCal URL and git "Add calendar"
Image source: motogp.com
]]>Before you start deploying this list in your cluster, some tips upfront on how to manage your services. More about that in detail in another blog post soon (subscribe to the RSS feed)
Use a real domain for your services (like service.yourname.net, point DNS to your server/cluster IP) which will allow you to run a cert-manager and issue valid Let's Encrypt SSL certificates. This will save you a lot of headaches.
If you want to access services remotely or share links to users without a VPN connection, setup a remote server that is only acting as a reverse proxy (like Caddy, with automated SSL certs) and only allow this specific IP to connect to your routers public IP via firewall rules.
Make your server/cluster deployment reproducable. Don't rely on fancy web UIs but rather configuration files. Document all changes and keep a single-source-of-truth configuration repository which can be instantly deployed.
Always deploy the docker images with a fixed version (eg. henrygd/beszel-agent:0.17.0) and manually update. You can monitor new image versions in Glance or subscribe to Github releases with your RSS reader.
If you're using Kubernetes, apply Network Policies to all deployments so than can only communicate to allow-listed IP spaces and services.
There's a lot I want to add in the coming year. Some of that includes:
Smart meters for my gas heating
Monitoring birds in my backyard via BirdNET
Self-hosting images via Immich (thank's AI for those SSD prices)
Tracking flights with own receiver
Backup more things locally
Looking into making AnyType and Excalidraw self-hostable
The following list is separated into 1. Tools, 2. Monitoring, 3. Media and 4. Internal.
I'm self-hosting my calendar and contact data and found that Baikal works best for me
If you have tummy aches when uploading somewhat sensitive document into a "free online pdf tool converter", you should run your own instance of BentoPDF which provides many many features for editing PDFs.
Tip: Use the bentopdf-simple image so that the marking section, similar to the landing page, is hidden.
Pretty ugly but insanely powerfull. Convert anything to anything with ConvertX.
You should start reading more news and blog posts. Great time to setup your own instance of FreshRSS - an RSS aggregator with nice integration to NetNewsWire and many other clients.
Maybe you don't need to upload anything to GitHub just so Microsoft can train their shit AI on it, so start hosting your own Gitea instance, Helm chart included.
In my opinion the best HomeLab dashboard, customizable, pretty and feature-rich. Get Glance.
This text only exists so I can link to Home Assistant on GitHub - no introduction needed.
iSponsorBlockTV integrates SponsorBlock with your smart TV - like Apple TV.
You can host your own Mermaid Live editor, no platform with saving, sharing and such but helpful if you're using Mermaid charts.
MeTube is just a frontend for yt-dlp so I don't have to fight with annoying ads when sicherheitsspeichern YouTube videos.
A neat GUI database / spreadsheet-like web application, also good for collaboration: NocoDB.
Tip: Set env vars NC_DISABLE_SUPPORT_CHAT and NC_DISABLE_TELE to "false".
Stop pumping your geolocation into your Google account and start using self-hosted Owntracks with the Owntracks frontend.
Tip: Take a look at the Owntracks frontend configuration options which can really enhance the look.
If you also have a lot of mailboxes, it's a great idea to host Roundcube instead of syncing every single one of them with your mail client.
Tip: Enable the included managesieve plugin with $config['plugins'] = ['managesieve']; to allow editing mail rules directly in Roundcube.
A self-hosted image sharing platform for quickly sharing images: Slink.
Similar to Owntracks but Traccar more optimized for tracking vehicles and collaborating with multiple users and clients.
Beszel is great for getting an overview about CPU and memory with multiples machines.
You should already know Grafana, a data visualization tool.
You can monitoring many many websites for uptime & SSL validity with Kuvasz.
Can't use Grafana without Prometheus - can you?
Pretty okay-ish Speedtest monitoring with Speedtest Tracker. It's running Ookla so be aware that all results are being logged by them.
Jellyfin provides media management and video players for your movies and TV shows.
If you know you know, "RSS aggregator" for Linux ISOs with Prowlarr.
Can't boot Linux without an ISO, so share and care with qBittorrent.
Radarr is a movie organizer/manager for usenet and torrent users.
Sonarr is a smart PVR for newsgroup and bittorrent users.
If you have multiple normie users watching movies on your Jellyfin, they can also request new media via Seer (formerly Jellyseer)
A lightweight universal DDNS Updater written in Go with a small but helpful web UI.
In case GitHub get's flöten or Microsoft or their rogue AI deletes your GitHub account, setup a mirroring for your repositories with Gitea mirror.
Biochon can pull your mails via IMAP - but has no restore/export functionality yet. Looks really good and is in active development.
]]>Create a backup and upload it to Stalwart → Use imap-backup then the stalwart-cli to import it
Migrate your mails directly from server to server via imapsync
My recommendation: Create a backup - leave it as it is - and then use imapsync
We want to make sure that all changes can be reverted in case anything fails catastrophically.
If you're using macOS, you can simply select your Mailbox in Apple Mail, click "Mailbox" → "Export Mailbox..."
⚠️ Important: Check if the folder size is realistic. Sometimes Apple Mail won't export all mails.
If this doesn't work for you or if you're running Linux, use imap-backup
The setup will take you through a wizard.
Press 1 to add an account
Press 2 to set your existing password
Press 3 to set your previous IMAP server
(optional) Press 7 to change the backup directory
Press q to return to main menu
Press 4 to save and exit
This will now create a backup of your mailbox.
⚠️ Be careful: imap-backup will create a config file in ~/.imap-backup/config.json with all of your accounts + passwords in plain text. Make sure to delete this after creating the backup.
I have chosen to not import the previously created backup but rather use a dedicated migration tool. If you wish to restore or use the backup for the migration, consider mbox2imap or
Stalwart comes with it's own CLI that allows you to import archives in mbox or Maildir format.
In order to run only the CLI on your local machine (so you don't have to upload your backup to your server and mount it to the Docker container)...
download the latest compatible build (stalwart-cli-aarch64-apple-darwin.tar.gz for me)
extract the stalwart-cli executable to any folder
make it executable sudo chmod +x ./stalwart-cli
it can happen that macOS prompts you to allow the execution. Go to System Settings → Privacy & Security → "Allow Anyway"
execute the import command:
Troubleshooting
Aborting redirect request to unknown host: Make sure your HTTP hostname is the same as your public facing URL (GitHub Issue)
Alternatively, you can use imapsync to instantly copy all mails directly from my previous provider to Stallwart.
imapsync is an "Email IMAP tool for syncing, copying, migrating and archiving email mailboxes between two imap servers, one way, and without duplicates."
On macOS, simply install via Brew.
Then execute imapsync with your previous mail provider (--1 arguments) and your new Stalwart account credentials (--2 arguments).
This motivated me to write about services I'm hosting that you might have never considered.
I will not write about stuff you probably already run on your home lab such das Home Assistant, Speedtest Tracker or Monitoring like Beszel or Grafana.
I'm running all services in a Kubernetes cluster on Talos OS. I currently don't plan on publishing my Kubernetes configs because much of it is straight forward but maybe hit me up, write a mail or leave a comment if you're interested in this and I'll get in touch.
I've explored many projects that allow me to self-host a server & frontend to record my own location history. Currently I'm only ingesting geo data via my phone but I plan on installing a GPS tracker in my car because BMW recently shut down third party access to their API. I will definitely write an article about that in the future.
psst, there's a RSS feed.
My favorite self-hostable project for GPS tracking yet is OwnTracks. It offers the best app experience - at least on iOS - and was very easy to deploy. OwnTracks comes with a barebones web UI but also offers a separate frontend which you can easily spin up in a container.
OwnTracks allows you to see your current location and history including a heatmap. Any map tile provider with a standard API can be used.
The single downside for me is, that there are no user accounts or authentication. Every user can see all devices and their location. Not that important to me yet, but a fact to consider.
Within the car / GPS device tracker community, Traccar is very popular. As the name suggests this service is optimized towards tracking cars and offers huge compability with many GPS trackers.
One major downside for me is, that the web UI does not offer a location history other than the recorded position changes since you've opened the page. Not sure if there's any way to enable that but I haven't found it yet.
Positive to note, Traccar offers separate user accounts with their own devices and trackers.
dawarich was my first choice because I liked the look of the web UI and the project seemed more modern. But looking more into it and using the service, I found many things that annoyed me. For one, it requires multiple containers of the app to process geodata which all operate on the same volume. That caused some difficulties for me.
Also the documentation and sample Docker Compose files did not line up. Possibly because much of it is vibe coded.
I am already subscribed to YouTube Premium on my YouTube account - this removed display and in-video first party advertisement but not sponsors. You can start a discussion about the ethics of this - I will not.
Similar to the Sponsorblock Browser Extension, there is a hostable application called iSponsorBlockTV which will block sponsorings on any TV that runs the YouTube app (also includes Apple TV). As far as I've inspected, this also works for devices that are not on the same network.
You will need to create a config - this is independent from the platform you'll deploy the app on. Simply execute the docker run command to create the config file (Instructions)
Now you can deploy the service on Docker, Kubernetes, UNRAID or whereever you whish
To verify everything works, inspect the container logs while starting to watch a video with a known sponsor segment.
Occasionally I need to send an image over a conferencing system or chat which does not support attachments. Before I've sometimes used imgur who now block requests from certrain IP ranges which they identify as VPN traffic. I don't want to be at the mercy of a random company.
This is where Slink comes to the rescue. It has nearly too many features for my taste but you can configure it to your liking. Those are some of mine environment variables:
Pair this with DDNS and Cloudflare as reverse proxy and you can share locally hosted images anywhere!
I've already written about why you should host your own CalDAV / CardDAV server.
There are many different projects from which to chose, here are some of the most popular I've tried so far:
Project | Language | State | Multi-User | Authentication |
|---|---|---|---|---|
PHP | active development | yes | yes | |
Python | active development | no | yes | |
PHP | maintenance | yes | plugin | |
Python | active development | no | no | |
PHP | active development | yes | yes |
The reason why many projects don't ship with built-in authentication is that the CalDAV / CardDAV standard works with Basic Auth that can be realized with any web server that operates before the DAV server.
I went with Baïkal becuase it is fairly light-weight and matched all of my criterias. If I had already deployed a Nextcloud instance that would probalby be my choice.
]]>Why go through the hassle of configuring servers, installing applications, setting up containers and spending quite a substantial amount of money on hardware that will not even run under optimal data center conditions (consumer-grade internet connection, no failover, no auto migrations)?
I will also give some specific recommendations on what you could and maybe should self-host.
You saw that coming.
Privacy is not a god-given right but has to be fought for. Big Tech and governments (like with chat control in the EU) want to shine light in every part of your personal life. Self-hosting services can reduce or even completely mitigate the risk of being surveilled. But it also requires a lot of technical knowledge so you can make a difference and educate your family or friends and even host some services for those who don't have the capabilities.
Your calendar says more about you than you probably think. Apart from your full identity it can also give away information about regular contacts, family, coworkers, confidential business meetings, your health information such as medical appointments, sleep and workout routine, legal obligations, financial information like scheduled loans, subscriptions, political beliefs through scheduling to visit a protest and even let's other profile your behavior for identity theft to find out when you're available and when not.
Same goes for contacts, your social graph can say so much about you, combined with metadata such as queries for certain contacts and creation dates. Did you recently add an unusual amount of new contacts with the same sex, first name only and phone number? You must be dating. Just created a contact for a doctor? Looks like you're visiting a therapist.
Most people don't even think about where their social graph data is stored and probably assume it comes with their phone when in reality that data is being processed by Google, Apple, Samsung or whoever knows.
I don't want a single company holding all that sensitive information and possibly deriving data points from that. Even with Apple's Advanced Data Protection your calendars and contacts are not end-to-end encrypted.
Many many years ago I was running an Android phone with Google services like Google Maps. One day I was looking for a feature in my Google account and saw that GMaps recorded my location history for years with detailed geocoordinates about every trip and every visit.
I was fascinated but also scared about that since I've never actually enabled it myself. I do like the fact that I could look up my location for every point in time but I want to be in control about that and know that only I have access to that data.
It's beyond the scope of this post to list every possible way, your data can be traced back to you and argument why you should be conscious about that. I want to motivate you to start a new journey!
Digital sovereignty for me means to be in control of, choosing what I do with and controlling who I share my data with.
You constantly hear about cases of tech companies locking down accounts with no apparent reason and it even happened to me in the past with Google. I do not want to be at the mercy of a giant tech firm which you can not even contact or if - get annoyed by a garbage AI chat bot (see my Microsoft rant for more fun). Besides - why are there no regulatory requirements for tech companies to provide a way to get in contact with an actual human?
I like protocols and file standards, no "Gmail" API - we call that thing SMTP and IMAP (yes, they are dated but the best we currently have. Thus I still welcome the new JMAP initiative). Another paragraph without bashing Microsoft? Hell no, Big Tech like Microsoft really wants you to use their AI-Copoilit-enabled-365-Office-Live-Outlook spyware software - that's why they have recently disabled SMTP access for Office 365 accounts.
Let's get to the bread and butter of this article and give some straightforward examples on what to self-host.
Some of those applications need to be available outside of your local network if you don't want to be constantly connected to a VPN. I will write more about how to do that securely and all available options in an upcoming post. If you want to read that, subscribe to the RSS feed.
I'm fortunate enough to work at a company (enum.co) where digital sovereignty is not just a phrase. That's why I got provided with three mini servers where I'm running a highly available Kubernetes cluster (which my boss also helped me set up, thanks Max!). Also... more on that in a later blog post.
As stated above, calendar and contact data is more sensitive than one might think. This is why I am hosting my own CalDAV / CardDAV server.
There are some options on servers for you which all have their ups and downs. Here are just a few:
Radicale (Python, basic web ui, only single user, does not work with apple devices from my experience)
⭐ Baïkal (PHP, active development, advanced web ui, multi-user)
DAViCal (PHP, haven't tried)
Xandikos (Python, No built-in authentication, no web ui)
Nextcloud (PHP, If you're already using it go for it - too bloated for me)
Being conscious about what other can do with your calendar and contact data also mean to review, which apps have access to your contact book and calendar.
Oh no, I said the forbidden phrase: Self-hosted mail server. I was always told to never under any circumstances do that. But it's really not that deep.
"Recent" developments like Stalwart or Mailcow made it really easy and straighforward to self-host email. Beware I'm not talking about marketing mails but rather personal inboxes.
Of course, you don't want to self-host your mail server at home since it requires a static IP and needs to be reachable from the whole internet. Going into that, you want to start with a clean IP address. Choose a hoster you trust, get a server, look up the IP address in mail blacklists and repeat until you get a clean one. After setting up the server, you want to make sure you can receive mail and every required protocol has been correctly configured. I found the internet.nl online test tool to be super usefull to ensure everything works. Start by sending mails to Google, Microsoft and Yahoo addresses to check if your mails are getting redirected to SPAM. Iterate on that, check DNS, DMARC, SPF, TLS etc.
I will probably write a detailed blog post on that in the future.
When I started hosting my own Home Assistant instance a couple of years ago it was just an experiment to see what I can do since I wasn't really missing anything with Apple Homekit. Since then more and more smart home companies went bankrupt, sunsetted their cloud services, jacked up prices or put free services behind a paywall.
For me, Home Assistant paid off a couple of weeks ago when I heard that Philips Hue will force users to create an account just to use any feature for their lights, they already paid real money for. I've always configured Firewall rules to disallow any outgoing network traffic for smart home appliances but it seems like I cannot use any Philips Hue app specific features (like animated light patterns imitating candles etc.) even on my local network. I haven't looked into this but I hope there's some community plugin which emulates this functionality.
I will never, under any circumstances, create an online account for an appliance I will only use locally.
Also I am now obsessed with tracking energy usage and plan on building and developing a Raspberry Pi + camera device which tracks energy usage of gas meter via machine vision.
I am subscribed to many news sites and blogs over RSS which is by itself already decentralized and sovereign. This is why self-hosting an RSS aggregator is kind of optional and only the last mile to go.
On my iPhone and Mac I'm running NetNewsWire, in my opinion the best RSS reader, even open source and backed by incredible people. NetNewsWire comes with a native integration for FreshRSS - a feed aggregator that also provides many more features like filtering and lets you subscribe to sources which don't natively provide an RSS feed.
I've deployed an instance of dawarich (German for "I was there") which is a server for ingesting and viewing geolocation data. It also allows you to choose from many available mobile apps which can track send your current location to the server. At the time of writing this includes:
official dawarich app (always shows a navigation icon in the iOS notch)
Overland (high battery drain for me)
⭐ Owntracks (works best for me on iOS, only app settings are crazy confusing)
I recently re-worked my homelab and went from a single big server to a 3 node Kubernetes cluster. This gives me much more flexibility in the kind of applications I can host.
This is a list of apps and tools I want to have a look at:
EteSync: End-to-end encrypted CalDAV & CardDAV
AnyType: Self-hosting my own AnyType server instance
Passbolt: Password manager (no I really don't like Bitwarden)
BirdNET: Monitoring bird species outside with a microphone
penpot: Like Figma but free & open source
Habitica: Habit manager
vert: File converter
InvoiceShelf: Invoice manager
There's also selfh.st - a great resource where can spend hours finding self-hostable applications.
My new article on some more ideas: 👀
]]>EDIT: Adam Conover recently released a video podcast "The Ensh*ttification of Everything" with Cory Doctorow, the man who invented the word "enshittification". Great watch!
If your website annoys me with a „subscribe to my newsletter“ popup the first time I visit the page and the information presented is not unique in any way, I will leave.
Shut the fuck up.
I was supporting a fundraiser on gofundme, now they sent me an update mail. Not to be cold hearted but I never subscribed to that and in most cases I'm not interested.
Shut the fuck up.
Clicking on the „update notification preferences“ link in the mail, they want me to create an account - the donation was done through Apple Pay without creating an account.
Fuck you.
When I've previously signed up on a website with my email address and password but I'm now forced to click a magic link in some fucking email when signing in, you deserve to go to hell.
Shut the fuck up.
I am a subscriber to YouTube Premium because ads are fucking annoying and I get "better" 1080p video quality (YouTube says the original 1080p quality wasn't scrambled to push people to "1080p Premium" but that's a fucking lie).
I always set the video quality to the highest value my monitor or TV supports. Which is fucking meaningless since after a couple of videos, YouTube reverts the video quality to "Auto" which is mostly 1080p on 1440p and above and defaults to "free 1080p" instead of "1080p Premium". I had to write a Tampermonkey script for that.
YouTube, let me pick my custom quality I want to consum content in - and don't say "you won't even notice the difference". I do. This is why I'm writing this paragraph.
Same for every fucking movie streaming service. Let me pick the quality and fuck off with your auto bandwidth quality. My internet speed is sufficient to stream a 4k Blu-ray so don't further mangle the quality of your shamelessly compressed shit movies.
Fuck you.
My phone contract is expiring and there's no where I will pay 70,00 € for 80 GB of mobile data. This is why I wanted to switch to a prepaid provider which I've already used in the past. Getting greeted in their customer web interface, a messages pops up "we will no longer support the web interface, please use our app to make the following changes...". Oh wow, I can not imagine what will go wrong here.
Okay, downloading the app...
Trying to log in with the random sequence of characters they gave me as a username
1Password can not fill the web form of the in app browser
Copying over username & password manually like a fucking monkey
Oh cool, there's just the button I looked for (Bumping the process of transferring my phone number over to the new provider)
Pressing the button
An in-app-browser opens
I need to login again with username & password (WHICH - REMEMBER - CAN NOT AUTOFILL FROM PASSWORD MANAGER)
Copying username & password manually like a fucking monkey AGAIN
Waiting for a "second factor" by SMS (Seriously? What if I loose my phone and want to block my number so it can not be used? (Nope, they don't provide TOTP or passkeys))
Hey, wow. It worked.
Forcing me to download a shitty app just to interact with an in app browser and saying they will deprecate the customer web interface.
Fuck you.
]]>Hugo Osvaldo Barrera made an awesome cli tool for interacting with CalDAV & CardDAV servers: davcli.
You will need the Rust toolchain to be available on your device. To install davcli, build it from source and make it available to your shell.
davcli works with pre-emptively defined environment variables for authentication. Those are the same values you used to sync the calendars/contacts on your end devices.
The structure of Dav servers consists of collections and items. A collection can be understood as a single calendar (CalDAV) or an address book (CardDAV). Items would be single events or people in your address book.
Calendar events are in the ics format, address book entries in vcf.
The discover command gives you an overview of the Dav servers URIs, context path and resolved principal.
With the list-collections command, you can discover all calendars / address books present on the server.
I recently moved from iCloud to another self-hosted Dav server. For this I've tried out many servers which won't have a user interface and I've found myself wanting to delete all previously imported items.
The following script will iterate through all collections, within that through every item and delete it. After deleting every item, the script attempts to also delete the collection which will not always work since Dav servers often require that a minimum of one collection persists.
I feel like I shouldn't say that but BE AWARE THIS DELETES ALL CALENDARS AND CONTACTS.
]]>ShouldBeUnique InterfaceGoal: Prevent multiple jobs from being dispatched at the same time.
Behavior: A job will not be dispatched if another instance of the job is already on the queue and has not finished processing. Jobs are "unlocked" after a job completes processing or fails all of its retry attempts.
On failure: ...
Unique Id: You can define a uniqueId method on the job class to return a certain unique Id.
Timeout: You can define a uniqueFor property after which the job's unique lock will be released
ShouldBeUniqueUntilProcessing InterfaceGoal: Prevent multiple jobs from being dispatched at the same time.
Behavior: Unlock the job when it starts processing.
On failure: ...
Unique Id: You can define a uniqueId method on the job class to return a certain unique Id.
Timeout: You can define a uniqueFor property after which the job's unique lock will be released
WithoutOverlapping MiddlewareGoal: Prevent jobs from running in parallel.
Behavior: Any overlapping jobs of the same type will be released back to the queue
On failure: ...
Unique Id: Provide the WithoutOverlapping with a contructor string argument to define a unique id: new WithoutOverlapping('some-job')
Timeout: You may also specify the number of seconds that must elapse before the released job will be attempted again by calling ->releaseAfter() . Jobs may unexpectedly fail, in this case the lock won't be released. Call ->expireAfter() to let the lock automatically expire.
There are some related browser settings, but those will not work. Nonetheless, you should rather disabled those.
A setting that will fully stop Firefox from suggestion form data but also disable search history in the following. If this works for you - here you go.
The best solution is to alter a config key which is not accessible from the settings UI.
In the address bar, type about:config and press Enter
search for formfill
Double click browser.formfill.enable so the new value is false
Reload all tabs
FINALLY, no form suggestions!
]]>One of my top priorities in a TOTP app is the ability to decrypto a backup file locally on my computer. There is a Python decryptor for OTP Auth but the repository hasn't been touched in at least 6 years which leads to a whole lot of problems with Python dependencies.
Last week I've discovered the andcli project by Thomas Gensicke. This is a terminal app that takes in encrypted backup files from all common TOTP apps (except OTP Auth) and lists entries them in a nice terminal interface - only in memory so no decrypted data is vulnerable.
Export a non-encrypted backup file from 2FAS and save it as otp.json.
jqYou will need the CLI tool jq installed.
The command output will be a list of TOTP links with inserted secrets.
]]>This is where - after an update - I was just greeted with this error message.
Could not find the virtual camera system process.
This may be resolved by logging out of and back into your macOS user account, or by restarting your computer.
Of course, neither re-logging or restarting helped.
Go to your System Preferences → General → Login items & Extensions
Scroll down to Camera Extensions
Now, this is important:
Quit OBS
Uncheck the Toggle Button
Open OBS & quit it again
Check the Toggle Button
Open OBS - the issue should be resolved
If you had any applications running which access the camera and "OBS Virtual Camera" is not showing up anymore, restart those.
This always worked for me. Let me know if you have any different suggestions or problems this way in the comments below.
]]>php-fpm.confIn your Dockerfile, make sure to allow your PHP user (www-data by default) to write to the slow log file.
Also make sure, the php-fpm.conf is getting copied or mounted in the Docker container.
ptraceThe PHP-FPM slow log needs additional security capabilities to use strace / ptrace. Those must be allowed in order for PHP-FPM to capture traces.
If you're running Docker in the CLI or with Docker Compose, add the following argument to the Docker run command.
If you're using HashiCorp Nomad, you will need to firstly allow the ptrace capability globally for the Docker plugin,
nomad.hclThe following line add the sys_ptrace capability onto the Nomad default value. Check the docs on that to ensure you're just appending the required cap.
Now, in your job spec, add the previously allow capability.
job.hclNext, I'll show the following:
How to download higher quality voices in macOS
Use the new voices within Firefox' Reader View
Read content from a text file aloud with a CLI tool
You will be surprised about how many Siri and TTS voices are actually available on macOS which generally sound natural and are sufficient for Text-to-Speech.
I've found that 🇺🇸 Zoe (Premium) and 🇩🇪 Anna (Premium) sound the most natural.
To download new Voices, you will need to head over to the macOS System Settings.
Go to Accessibility → Spoken Content.
Press the (Info) icon next to System voice.
Select your preferred language on the left and hit "Voice".
Now download the voices via the blue download Icon. I found to like 🇺🇸 Zoe (Premium) and 🇩🇪 Anna (Premium).
Once you've downloaded new Voices via your System Settings, you can restart Firefox and see those voices being available in the Firefox Reader View!
If the TTS sounds weird to you, try reducing the speed.
I've put together a Fish Shell script which just reads content from a specified text file and simultaneously shows the current transcription.
Once put inside your Fish functions folder, you can use the CLI tool by calling
tts.fishI'm using Fish as my shell but I'm sure you can convert it to bash by throwing it in a LLM.
]]>I don't think that anyone in Adobe's development department is talking to people beyond their team. How else would you land in such a huge mess?
Well, let's fix that and stop any Adobe related process with a simple script that you can even execute via Raycast.
To execute the script, we need to move it to the scripts folder configured in Raycast. For that...
in Raycast, type "Extensions" and open the Raycast Extensions Settings
in the list, scroll down to "Script Commands"
on the right side, hit "Add Directories" and select the folder, your F*ck Adobe script lives in
you should see the script being available when typing "F*ck Adobe" in Raycast
You can also configure the script output to show in Raycast with @raycast.mode fullOutput
This is a the Shell script responsible for collecting & stopping all Adobe related processes. Please note that the script is optimize for macOS!
If you've found any other process names, please leave a comment so I can include those!
If you want to also improve the experience of getting rid of Adobe stuff, you can add a preview icon to the script folder, referenced in @raycast.icon
Add a custom Validator class extending the default Validator.
Return your custom Validator in the extend() Closure.
You're on the 2025 edition calendar, click below for season 2026!
I was always a fan of seeing all important events directly in my calendar. And the MotoGP races were no exception to that. Starting in 2021 I've started generating iCal Feeds for MotoGP seasons so I won't miss a race.
For the 2025 season, I've added a configurator where you can decide yourself, to which leagues or events you want to subscribe. The default choices are Qualifying and Races events for the MotoGP league.
Missing anything or have questions? Leave a comment!
If you're reading this in your RSS reader, that's a good time to head over to the website.
MotoGP also has an official iCal calendar but this just provides each race day as a multi-day timestamp event which looks terrible and doesn't provide concrete race times.
When you've finished tinkering with the paramters above, copy the URL above and paste it to your favorite calendar client. You have the option to just download a .ics file and import it once or subscribe to the URL. I'd recommend the second option since changed in the schedule will automatically update.
In your Calendar app, select from the top menu "File" → "New Calendar Subscription"
Paste the URL and hit "Subscribe"
Choose a name, like "MotoGP"
Set "Auto-refresh" to "Every day"
Select "OK"
Select from the bottom "Calendars"
In the bottom left corner select "Add Calendar"
Select "Add Subscription Calendar"
Paste the URL and hit "Subscribe"
Set a Title and select "Add"
Go to calendar.google.com
On the left sidebar, click the "+" next to "Other calendars"
Select "Subscribe to calendar"
On the left select "From URL"
Paste the iCal URL and git "Add calendar"
There are some rules:
Don't go beyond 1440p, since I only have 1440p displays
Select 1080p Premium, if available. This will required YouTube Premium ofc
Install the Tampermonkey Extension for Firefox, Chrome, Edge or Safari
Go to the Tampermonkey Dashboard
Click the "+" Button to create a new script
Copy & Paste the Scripts below
If you don't want to enable auto updates or you want to modify your script, remove the updateURL and downloadURL lines.
This is done through a GitHub Action workflow.
Notice anything? The Microsoft Edge workflow has failed.
Recently, Microsoft deprecated their v1 API endpoint to publish new extension packages and disabled it on January 10th.
Cool, so we've implemented the v1.1 API endpoint. They changed around some authentication parameters but everything else was the same.
BESIDES THE FACT THAT IT DOES NOT WORK.
Every single API request fails with a HTTP 500.
When debugging this, I wanted to login to our company account and try to reach the support.
So let's log in
open partner.microsoft.com
get redirected to login.microsoftonline.com
wait a minute for "Trying to sign you in"
get redirected to login.live.com
enter your email address
wait a couple of seconds for the UI to shift around
enter your password
get asked if you want to stay logged in
get redirected to a blank page on partner.microsoft.com
So let's open a support ticket.
Oh cool there's only a fucking AI support Assistant which can't even respond to questions regarding Edge workspace. What's Edge workspace? No fucking clue.
Outstanding, so I'll just select some random topic and ask it about my issue.
Awesome, the AI Assistant recommended to contact the AI Assistant. What a time to be alive.
At least, there's now a "Contact Support" button.
PERFECT, Microsoft won't even talk to you if you have any issues with their Edge workspace.
Microsoft is a fucking mess.
]]>We can easily visualize progress with a value and max property:
All browsers ship a default style which can be overridden by settings the accent-color CSS property on the element itself or any parent.
The accent-color only alters the active portion of the element (blue above) and adding any other CSS property like background-color will reset the default styling like height and border-radius.
The Progress Element is made of various pseudo elements which can be styled individually. The following HTML structure is the representation of Safaris and Firefox' DOM structure.
To add more confusion to the topic, Chrome & Safari's -webkit-progress-value is equivalent to Firefox' -moz-progress-bar .
To style the background part...
Target the element itself & (for Firefox)
Target -webkit-progress-bar (for Chrome & Safari)
To style the bar that represents the amount of progress that has been made...
Target -moz-progress-bar (for Firefox)
Target -webkit-progress-value (for Chrome & Safari)
Adding border-radius also has some caviats. Firefox will easily round the whole progress element if a border-radius is applied to the element itself.
Chrome & Safari will not add rounding unless the progress element itself has an overflow: hidden property set.
You can also add text to progress elements by simply creating elements inside it.
Altering the text color of those elements isn't as straight forward as adding a color CSS property to the progress element. In fact that's the only variant that won't work.
For styling text inside progress elements, target the child element or the progress' parent element.
Translating our knowledge to Tailwind classes using CSS self & pseudo selectors we get the following element. Using a bg-green-300 for the background and bg-red-500 for the progress made.
dd() helper function did not display anything to my browser when calling it in any place and simply responded with a HTTP 500 and literally 0 bytes of body.I was digging around and found out that spatie/ignition - the pretty error pages you'll see on unhandled Exceptions - will replace the Synfony VarDumper Handler with a kind of middleware that collects all dumps (and displays them when another Exception is thrown? idk).
Well, how to get it working again?
Define a new environment variable VAR_DUMPER_FORMAT inside your project.
The value any isn't actually defined an can be replaced by any gibberish text. There are some special cases:
html: Always display the dump as HTML - also in CLI applications
cli: Always display the dump in CLI format
server: Dumps via a remote connection, only server actually just dumps to HTML or CLI based on the runtime
tcp://...: Dumps to a remote server via TCP
Inside the VarDumper class, a setHandler method used by Laravel-Ignition will check if the previously mentioned environment variable is set and prevents overriding the existing handler.
Lando offers a streamlined experience but I didn't like the .lnd.site domains for my projects. So I want to use another one - in this case .code domains. The Lando docs on using a custom domain are not that great and it didn't work for me out of the box.
This post will provide step-by-step instructions on how to setup a custom domain for local development projects using dnsmasq - this will also work besides Lando.
dnsmasqI will use Homebrew for convenience since the DNS service is automatically booted on system startup.
I've modified the Lando config to use a custom domain name and also enable the Traefik dashboard on http://127.0.0.1:50572/dashboard/
This option will make your local DNS server only handle local domains.
Good: Makes your local DNS server kinda secondary
Good: Most other things work if you f*ck up
Bad: Cached responses from external DNS providers can confuse
This will instruct macOS to resolve code TLDs with our local nameserver. Other domain names will be forwarded to our systems default DNS servers.
dnsmasq config for the .code domainThis will instruct dnsmasq to resolve and *.code DNS queries to localhost 127.0.0.1
/opt/homebrew/etc/dnsmasq.d/code.conf
This guide will make your local DNS server the only DNS server your system relies on. DNS calls to unknown domains will be forwarded by your local DNS server to third party providers.
Good: Single source of truth for configuration
Bad: No DNS if your setup breaks
Bad: doesn't work with some VPNs
dnsmasq config for the .code domainThis will instruct dnsmasq to resolve and *.code DNS queries to localhost 127.0.0.1
/opt/homebrew/etc/dnsmasq.d/code.conf
Now we'll tell macOS to use our local dnsmasq name server for all DNS queries.
Go to System Preferences
Go to Network
Select your Network Interface
Press the Details... button
Go to the DNS section
Add 127.0.0.1 as DNS server
Now, restart your system and you should be able to access your Lando projects on your new custom domain.
When using VPNs like Mullvad with this configuration, you may run into issues where your local dnsmasq server can not forward DNS queries to other DNS servers. This is a known issue with Mullvad VPN.
Your best bet now is just to add the project Domains to your /etc/hosts file.
If you've already built projects with Lando, make sure to rebuild them so all traffic is correctly routed.
dnsmasq is runningdnsmasq manually to see errorsFor this, you need to stop any processed run by Homebrew.
dnsmasq configurationEnsure 127.0.0.1 is the first DNS server.
The following command should output "Firewall is disabled. (State = 0)"
dnsmasq as DNS serverGo to System Preferences
Go to Network
Select your Network Interface
Press the Details... button
Go to the DNS section
Add 127.0.0.1 as DNS server
In the dig output, you should get something like
Companies squeezing every last penny out of their customers is no news. And Canon is no stranger.
Last year, I've bought a Canon G5 X II camera which I wanted to use mainly for taking pictures at concerts. For me, it was the perfect match of focal range (zoom) and sensor size (more light) for any compact camera I've compared.
Because I'm only using this camera for a small range of events, it's just collecting dust in the meantime.
So, why don't use it as a webcam with my Macbook?
Admittedly, it did not cost me the $6300 from the article's title, much closer to $900. Nonetheless, everything I'm describing translates to every other Canon camera model!
I've tried this at first in 2024 with macOS 14, which did not work. I had similar experience with FUJIFILM's X Webcam software where either the camera will not get recognized by the software or the camera feed will freeze or simply be not available within other apps.
As of January 2025 with macOS 15 Sequoia, these issues have been resolved for me.
Well actually, only if you are able to download the software at all. Seems like their Microsoft IIS server is having some issues. The following error page will be presented to you, after they asked you for your full legal name and mail address - without which you can not download the software.
So I've been really excited when I finally found a downloadable file on the Canon webpage which was not blocked by a faulty newsletter grift and saw the live feed of my camera!
Well the excitement didn't last long since nearly every single setting is disabled if you're using the software without a paying Canon account.
No brightness adjustments, no color correction, only 720p. Even in the paid version there doesn't seem to be a white balance adjustment setting.
Canon will happily take your credit card for you to pay a small monthly price of $4.99 per month or even a discounted $49.99 per year!
** The 30-day free trial is valued at $4.99 and can be cancelled at any time during the free trial period through your MyCanon Account Dashboard. After the free trial period, your subscription will automatically be rolled over into the annual or monthly non-refundable, auto-renewable subscription selected upon enrollment in the free trial, which can be cancelled at any time through your MyCanon Account Dashboard. The current available subscription plans are $49.99/year or $4.99/month.
In a support document, Canon lists all differences between the free and paid version. So you can be very gladful, they allow you to even connect the camera.
Software development isn’t free, and I’m happy to pay for software I use regularly. However, Canon is a hardware company, not a software company, and they should—due to the lack of standards—provide software that allows you to use their cameras as intended. Aside from development costs, there’s no justification for a subscription model, particularly from a company earning nearly $1.9 billion in profit*.
So Canon will not allow you to use your own camera on your own computer with your own cables the way you intent to without paying for another subscription.
Canon, what the fuck?
* In an earlier version of this article I wrote "$3 billion in profit"
]]>MaxAttemptsExceededException.With our analytics and stream tracking at Streamfinity, we are processing hundreds of thousands data points each day. Presumabily in every analytics assembly job, we are aggregating around 50.000 data points.
So as you can imagine those are long running jobs with non deterministic execution time.
Thus, we need to make sure that only a single job is processing the data at a time. This can be achieved with the WithoutOverlapping middleware. As long as a job is being locked (right before it starts processing) using Laravel atomic locking, each following attempt to process the same job class will result in a MaxAttemptsExceededException.
Because our jobs are long-running, errors can occur and jobs will fail. In case of failure or timeout, the lock will not be released and each following attempt of disaptching a job will also fail.
This is why you should always define an expiration time after which you can surely assume, the job has silently failed using the expireAfter() method.
I just love organizing my digital life. This also includes collecting various links, like new apps, interesting articles or fun tools. Recently I've just been using AnyType with a Markdown doc but Anybox is a gamechanger!
A native macOS & iOS app with iCloud sync. Also ships with a browser extension for saving links.
Price: $1.99 (monthly), $14.99 (yearly), $39.99 (lifetime)
The Browser Company recently rug-pulled from their pretty popular Arc Browser - so is it smart to switch to the Firefox-eqlivalent, Zen Browser? Maybe not. But it's awesome!
The sidebar offers loads of customization possibilities and workspaces allow for neat organization. There are also built-in tools for split views. They have also been really quick with bumping their Firefox versions.
Price: Free & Open Source
Yep, we're going RSS. I recently switched from Reeder to NetNewsWire. I did not really like the version 5 of Reeder, many config options were dropped and the link saving functionality was too present for me because I'm using Anybox for that.
NetNewsWire is nearly perfect! The only thing missing for me is a preview of the OG Image, but I can live without.
Price: Free & Open Source
frame0 is a pretty new (currently in beta) desktop app for sketching, diagrams and wireframes. Think of it a the small child of Excalidraw and Figma.
The screenshot above is my own Vim cheat sheet, btw.
Price: Free
I didn't know that I could fall in love with a Terminal emulator but here we are. If you've slept over Ghostty, first of all - how? Secondly: It's fire!
Recently I've made a small blog post on setting up Ghostty + Zellij + Fish Shell.
Price: Free & Open Source
AirBuddy is a macOS app that seamlessly connects AirPods or other Bluetooth headphones to your Mac, providing a convenient and efficient way to switch between devices with ease.
Price: 12,99 €
Rectangle is a handy macOS app that enables users to efficiently manage their windows by offering customizable keyboard shortcuts and easy window resizing options, making multitasking and organizing workspaces a breeze.
Price: Free & Open Source
]]>At first I did not understand why Ghostty got so much hype. I've used WezTerm and was pretty satisfied with it (even did some fun scripting for transparent window background when the window is out of focus).
Although there were some quirks with WezTerm:
I could not get WezTerm to forward macOS CMD + ... keybindings to Zellij,
This is what we're gonna solve.
I had to set a separate DPI and font size for each of my external displays and the integrated Macbook screen.
Automatically works in Ghostty.
Ghostty
Well, head over to the Ghostty install docs. I assume you already did that if you clicked on this article.
Fish
A shell environment - but modern. Easily extendable.
Zellij
Zellij is basically a modern type of tmux, written in Rust - of course.
We have some requirements:
Automatically launch Zellij when opening a Terminal in Ghostty
We do not want Zellij if we're in another Terminal - such as the integrated Terminal in JetBrains IDEs
Forward typical macOS tab-management keybindings to Zellij
Ghostty as an initial-command config option but I didn't feel like the Ghostty config was the right place for our environment check. Additionally, we would loose the automatic shell detection when overriding this config option.
For keybindings, I do not need native Terminal tabs but rather want to use tabs + panes in Zellij. So I want to use the usual key combinations of Command + n (new tab) and Command + Option + Arrow for switching between them.
ghostty Config fileSee Ghostty Configuration docs, I've placed my config in ~/.config/ghostty/ghostty.
The default configuration works really well for me out of the box, I've only made some minor adjustments:
config.fishGhostty should automatically detect your Shell if you've installed Fish correctly. If this is not the case, add the following config line to your Ghostty config file.
See the Fish tutorial docs for more info, typically the config should be placed in ~/.config/fish/config.fish.
config.kdl Config fileAbove, we've specified the ZELLIJ_CONFIG_DIR, so place your config.kdl in that folder, in my case ~/.config/zellij/config.kdl
If Zellij is not starting into Fish shell, add the following config line to your config.kdl
And this is what we got!
]]>.wezterm.lua Config file ready in your home directory and it's correctly loaded by WezTerm. Refer to the Configuration Docs.The configuration as a constant opacity variable which is just there for consistency. An initial background opacity will be set when the configuration is read the first time.
We then listen to the window-focus-changed event to - get any previous and - set a new config override.
This is inteded to run on macOS, apparently you can build a similar effect on Windows.
One issue I ran into is auto formatting code. I'm a fan of auto formatting since this preserves a cohesive code style over many projects and helps to reduce merge issues.
Formatters in Zed work a bit different than some implementations in VSCode or similar editors.
You can configure an external formatter by specifying an external key with a command and arguments values.
Once you run the editor: format action or save the file (with format_on_save enabled), you can provide the formatter with the current file in two ways
Set a {buffer_path} placeholder variable
Append a - to pipe in the file contents to the command
We will use the second way since you could also call commands inside docker containers. When mounting your project root inside a container, the absolute path placed inside {buffer_path} will mismatch and you will need to do some magic to convert it into a relative path.
I've created a bin script in my PHP-CS-Fixer Config project that takes in the STDIN, calls PHP-CS-Fixer to format the file contents and returns the result as STDOUT.
The bin script is pretty opinionated and only uses the fix command of PHPCS, feel free to fork it, contribute or do whatever!
You could just install the PHP-CS-Fixer-Config dependency or copy the script below. Make sure to alter the command path if you wish to use the manual way.
Imagine you want to request some video details from the YouTube API but also want to inspect some headers of the response.
The Google/YouTube PHP library does not allow you to do so.
Instead, we simply add a history middleware to the HTTP client, in our case Guzzle.
It's that easy.
]]>Lets take this absolutely non-scientific flow diagram.
Our goal is, to reduce load on our backend servers and hit the database as little as possible. This can be made possible using multiple stages or layers of cache at different points.
There are some caviats to caching responses and data. At first, we want to make sure that we only return cached responses for the right requests. This includes not using response caching with URI indexes on authorized routes because the response content differs for every user sending a Bearer token.
An ideal scenario for response caching is a static endpoint which could be replaced by a simple JSON file. An example at Streamfinity would be the endpoint which returns all possible extension stores for our browser extension stores, such as Chrome Web Store, Firefox AMO etc. The client sends a request with a simplified User-Agent as GET parameter. The endpoint then returns all available stores with the first compatible store featuring a recommended key. This endpoint is unauthenticated and thus qualifies ideally for response caching.
Static assets like images, JS and CSS files are cached by Cloudflare by default. Every new build of our application generates frontend assets with a unique hash so the clients always receive the latest version independent of Cloudflare's cache.
At first, just some base goals:
We want to cache server responses in HAProxy
We only want to cache the response if a X-Proxy-Cache header has been sent from the server
HAProxy will only cache the data if all of the following are true:
The size of the resource does not exceed max-object-size
The response from the server is 200 OK
The response does not have a Vary header
The response does not have a Cache-Control: no-cache header
The cache section defines the cache store to use. This is the place to configure objects sizes and cache durations. The default max-age can be overridden by the Cache-Control header.
Let's look at the following HAProxy backend we use at Streamfinity and intersect every line.
The cache-use statement instructs HAProxy to use the cache store named bucket for all cache-related actions.
If HAProxy finds the header X-Proxy-Cache in the server response, we want to store the response (cache-store) in the cache bucket
The original Cache-Control header with the duration should be removed, so we only cache the data on the HAProxy and don't instruct clients to keep the data locally
You can also add a header which indicates if a given response originates from the HAProxy cache or was served by the backend server. Thse two lines check if the srv_id fetch method returns the name of a server that was used to handle the request. If no value is returned, it means that HAProxy used the cache.
We use Redis in a Cluster deployment to cache application data which is accessed from multiple places or cache partial responses which are not eligible for full response caching via HAProxy.
]]>The PHP Coding Standards Fixer (PHP CS Fixer) tool fixes your code to follow standards; whether you want to follow PHP coding standards as defined in the PSR-1, PSR-2, etc., or other community driven ones like the Symfony one. You can also define your (team's) style through configuration.
Especially when working in teams, different syntax formatting can lead to merge conflicts resulting in frustration and possibly bugs. Thus, a standardized syntax is a key element in collaborating with others. All of my projects require the same coding style.
Over the time I've built a preferred style config for my own projects which I've open sourced at romanzipp/PHP-CS-Fixer-Config. This repository contains some curated PHP-CS-Fixer rules with custom presets. Of course, presets can be extended and rules can be overridden in each consuming project.
.php-cs-fixer.dist.phpTo run PHP-CS-Fixer, just execute...
One argument of the PHP-CS-Fixer cli we can make use of, is --dry option. This will not modify your code and only run the validation which returns an error code if the optimal code format missmatches the source. This will allow your to integrate a syntax linting step into your CI, failing builds if the format is off.
Tip: Add a hotkey to your IDE such as CMD + SHIFT + C to automatically format your code.
PHPStan is a static linter for your PHP projects. As simple as that.
Configuration is done through YAML files, which contain the PHP language level, strictness and other parameters. This is an example phpstan.neon.dist
To run PHPStan, just execute...
PHPStan can also perform linting and show issues directly inline in your IDE, such as PHPStorm. See the official JetBrains PHPStorm guide on how to integrate with PHPStan.
Laravel has catapulted PHP to a new level and the language is more popular than ever. But one thing that has always driven me crazy is the lack of typing which leads in developers needing to rely on IDE plugins to get helpful code suggestions.
This is why I've created the Laravel-Model-Doc package, which automatically generates PHPDoc comments for all of your Models and writes them to the class file.
Laravel provides many handy features, such as accessing loaded relationships via a magic accessor. Unfortunately, static linters will see this as a syntax error since the attribute has not been explicitly declated. Additionally, you will not get any autocomplete support from your IDE.
With added PHPDoc blocks, declared relationships will get the according accessor and provide a _count attribute. And much more!
Laravel-Model-Doc takes many sources into consideration when generating doc blocks, such as...
Model Relationships
Model Factories
The Database structure (attributes, fields)
Custom accessor methods
Query scope methods
In the latest update, the package will also add generics annotations such as Collection<ModelClass>.
One tiny caveat before using the package: You will need to make some adjustments to your models, which - in my opinion - additionally provide more safety. These are:
Specify the table name explicitly protected $table = 'users';
Add return types to your relationship methods public function teams(): HasMany
Add return types to your accessor methods
Properly resizing images on web pages offers several advantages:
Improved Load Times: Reduces file size, leading to faster page loading and better user experience.
Enhanced Performance: Decreases bandwidth usage and server load.
SEO Benefits: Faster loading pages are favored by search engines, potentially improving rankings.
Mobile Optimization: Ensures images display correctly and load quickly on mobile devices.
Bandwidth Savings: Minimizes data consumption for users, particularly important for those on limited data plans.
User Experience: Avoids layout shifts and ensures images fit within the intended design.
Accessibility: Enhances accessibility by ensuring images are appropriately sized for screen readers and other assistive technologies.
Cost Efficiency: Reduces hosting and CDN costs due to smaller file sizes and reduced bandwidth usage.
Cloudflare offers an Images product which can easily resize images hosted on their R2 storage buckets or on your own web page.
To enable CF Images, ...
head over to your Cloudflare Dashboard
Go to Images
Select Transformations from the Sidebar
Choose your Domain/Zone
and click "Enable for zone"
Ad new file CloudflareImageTag should have been created in the folder app/Modifiers.
To show the resized version of an image, simple attach the cf_image tag.
rosetta error: Rosetta is only intended to run on Apple Silicon with a macOS host using Virtualization.framework with Rosetta mode enabled
Here's how to fix it.
Run the following command to install the Rosetta translation layer if not already done.
Update your Docker Desktop installation by navigating to Settings > Software Update > Check for Updates.
There are chances that you will need to update XCode when upgrading your macOS version. Check for updates using the following command.
You will get an output like:
Copy the Label text and paste it into the -i argument.
If you have issues with the installation, download XCode from the Apple Developer Hub.
As a last step, try disabling the x86_64/amd64 emulation using Rosetta on Apple Silicon in your Docker Desktop General settings.
]]>I’m stoked to announce the official launch of Streamfinity. It’s an innovative platform that connects streamers, video creators, and communities in a way that’s never been done before, making it possible to reveal previously hidden view counts through livestream and video reactions.
Streamfinity offers a bunch of features that provide significant value for streamers, video creators, and viewers alike. For instance, you can track which livestreams are reacting to a YouTube video. Streamers can analyze how individual videos perform in their streams. Plus, with the new Streamfinity Trends, you can see which videos are hot in the livestreams.
But that’s not all. Our core mission is to enable fair and transparent reactions, and for that, clear usage rights are absolutely necessary. To make these easy to manage and communicate to everyone, anyone with a YouTube account on Streamfinity.tv can specify how their published videos can be used in livestreams or other YouTube videos. These so-called Reaction Policies are then played out to all users via the open-source browser extension - the Streamfinity Buddy.
The Streamfinity Buddy reveals even more potential. With a large number of users, a simple communication platform is created directly on YouTube. Through this, people can write and rate Community Notes for individual videos starting from 01.07. These Community Notes aim to clarify whether a video is spreading so-called fake news, disinformation, or even hate & agitation. All this with the help of a simple explanation, appropriate timestamps, and external sources.
For the future, more exciting features and optimizations are planned. For example, we’re gearing up to track the co-streaming of selected live events. For this, we have an “Event Hub” planned, where event organizers can promote their own event, inform about it, and track the co-streams - and much more.
Streamfinity has become a massive project. In 2022, Roman Zipp and Christian Fassbender started it. Completely independent, with the goal of making the Reaction Game better, more fair, and more transparent for everyone. Over time, we received support from Chris Staufer, Romina Schöner, and Matthias Münzel. No investors, no restrictions. We’re just a group of friends with a vision.
Roman Zipp
Founder & Lead Software Engineer
roman@streamfinity.tv
Christian Fassbender
Founder & Managing Director
christian@streamfinity.tv
Chris Staufer
Co-Founder & Creative Director
chris@streamfinity.tv
Romina Schöner
Head of Campaign Development
mina@streamfinity.tv
Matthias Münzel
Software Engineer
matze@streamfinity.tv
Web: https://www.streamfinity.tv
LinkedIn: https://www.linkedin.com/company/streamfinitytv/
Discord: https://sfin.it/discord
This post will explore the possibility to run multiple GitHub Actions steps inside a Docker container that is built in the same workflow.
I will visualize this with a simple example of a PHP project utilizing PHPUnit, PHPStan and PHP-CS-Fixer but this of course works for every language or tooling.
With GitHub Actions you have the possibility to choose from endless available workflows built by the community such as PHP-CS-Fixer or PHPUnit.
The problem with this that - if you're distributing your project as a Docker container (as you should) - your CI environment can be vastly different from your container environment.
You have the option to pin a specific PHP version but nonetheless if you've worked with Docker containers before you will know there are a lot of quirks - such as Alpine images, specific environment variables, multi-step build stages, ...
Speed.
TLDR; If you just want to see the full workflow file, scroll down.
We want to firstly build a reusable Docker container and then run any tasks in parallel afterwards.
In this build step we will build the container and save it as a tarball to a temporary directory /tmp/project.tar. To make it later available to other jobs we will upload it as an artifact named project.
In any other following job, we attach a needs: [ build-image ] to tell GitHub Actions that we depend on the previous job.
The first step is to download previously uploaded artifact (container) project and load it into the Docker daemon.
Since we made use of artifacts, these files will be persisted after the default cleanup time of 30 days. This will take up storage quota from your GitHub account.
Note to add if: always() to always execute this step - even if previous jobs failed. Also specify all previous build steps in the needs: [] array.
If you're using the same Dockerfile for your production and CI environment, be sure to add a configuration/environment variable which indicates the Docker build to only install production dependencies outside of the CI.
If your workflows are running for a longer time and GitHub Actions quota is important to you, note that we have observed that running multiple steps in parallel using different jobs counts more to your quota since every job counts against your quota on its own. The following example is not representative of actual execution times since the job logs originate from different points in time but rather visualize the issue.
Full GitHub Actions workflow file using PHPUnit (+MySQL), PHPStan and PHP-CS-Fixer.
]]>First, run ifconfig to check if the interface is available and get it's name.
If your networking is configured correctly you will find your private interface named like ens..., enp....
You can either hardcode the interface name or use the go-sockaddr/template templating language to get the private interface name.
The following example will get the name of the first network interface in the 10.0.0.0/8 address space (this will match all ip addresses from 10.0.0.0 to 10.255.255.255).
It's important to restart Nomad and all jobs afterwards. Only restarting Nomad will not be enough since the job will keep running in the background.
See Nomad network_interface Docs
To see all configuration values and debug info, run nomad operator debug and quit using Ctrl+C. A .tar.gz file will be created in the current directory. Download, extract it and check the cluster/agent-self.json file for the NetworkInterface value to see if the value has been set correctly.
This post will compare the new X100VI to the predecessors X100V, X100F, X100T, X100S and X100 in important key facts that really matter.
40MP BSI CMOS APS-C X-Trans sensor
35mm equiv F2 lens
In-body IS rated at up to 6EV of correction
Hybrid optical/electronic viewfinder (3.69M dot OLED panel)
Machine-learning trained subject recognition AF
14 film simulations
6.2K video capture and 10-bit recording
Built-in ND filter
Tilt up/down rear touchscreen
Available for $ 1.599 from February 28.
This is by no means a complete feature list - but rather important key facts that were important to me like film simulations, screen size, autofocus systems or sensor types. You can also download this table as PDF.
Here are some accessories I use for my X100S that I actually own and like. Of course, you can buy all items on Amazon via the referral link - you know how it goes!
The Tiffen Glimmerglass filter adds a kind of cinema-like bloom to your images without being too intruding like the Black Pro-Mist filter. All of my X100S images are taken with the Glimmerglass filter. See GxAce's video on the filter for some great examples.
Currently 64,77 € on Amazon
To use any 49mm filter on your Fujifilm X100 series camera you need a adapter ring. Otherwise the lense element will touch the filter glass resulting in an error and possibly damaging your camera in the long run.
Available for only 9,99 € on Amazon
There is a custom red konkav and konvex shutter button included in this kit.
Currently 7,94 € on Amazon
A great advantage of the X100 series is it's compact formfactor - which is also one of its negativ points. You can greatly increase your grip with a custom thumb grip which fits perfectly in the hot shoe.
Available for 7,44 € on Amazon
If you feel like a thumb grip is not necessary, a neat hot shoe cover with the "FUJIFILM X" logo can be a great fit. I am rocking this cover item on my X-S10.
Currently 12,08 € on Amazon
Peak Design has undeniably created the best ecosystem of camera carry equipment. The thinnest of their camera straps is a perfect fit for your X100. I'm also carrying a Peak Design Cuff in my backpack.
Available for 52,98 € on Amazon
Unfortunately only the X100T and above ship with built in WiFi so this adapter comes in handy if you want to transfer images to your iPhone.
Currently 35,00 € on Amazon
Currently 35,90 € on Amazon
]]>Available for 4,99 € on Amazon
In the sense of sustainability don't be preassured to buy anything listed here unless it helps you to create!
When I only carry a single camera body and needed to change lenses, I always ran into the inconvenience to take off my backpack and fumble around with lenses which takes time and
Especially when shooting concerts or protests, you need to have all your gear on hand which made me search for better alternatives.
The Dörr QC-2 Lense Changer has two attachment points for lenses (available for Sony E, Canon EF and Nikon F mounts) and can be carried around your body so you always have access to 3 lenses at the same time (1x on the camera, 2x on the QC-2).
25,41 € on doerr-foto.de (Sony E, Canon EF, Nikon F)
If you knew me you'd be familiar that I'm a sucker for bagpacks. The Tenba Axis V2 (24L version here) is by far the best camera backpack I've come across.
In this configuration I can easily carry: 1 Sony camera body, 3 lenses, 2 flashes, 1 compact camera, 1 Godox flash accessory kit, 1 Godox remote trigger, 1 cleaning kit, 2 straps, 1 carry vest, 1 rain cover.
Some of my favorite features:
Quick access side pocket for camera body + 24-70mm lense
Quick access top pocket for misc items
2 chest straps, 1 detachable belly strap
Separate laptop deparment
Multiple smaller pockets for random stuff
Molle attachment points all over the outside for additional pockets
On the left side below the first aid kit you can also see my Tenba Tools Reload Battery * pack which can hold 2 normal sized camera batteries for quick access. On the front you can also mount a tripod. The right water bottle comparment can fit up to a 32 oz Hydro Flask bottle.
A light all-metal cold shoe mount for you smartphone which you can use for BTS footage or even self portraits.
This 5-in-1 reflector from smallrig is a great value for everyone who wants to shoot portraits with natural light. You can also use the white base part as a diffusor for an off-camera flash.
If you have an older Godox flash with a rectangular mount and want to adapt GODOX Accessories made for the V1 flash * you can do just that with the S-R1 magnetic adapter which screws on your TT-Series flash.
Probably the best and most versitile value flash out there.
228,00 € on Amazon * (but you can find it cheaper elsewhere)
When shooting concerts, I normally carry two Sony bodies - one with a wide lense and a multi-purpose 24-70mm. This vest allows you to attach two cameras without having any straps interfering with another.
I also 3D printed four attachment points for Peak Design anchors so I never have to switch out my ARCA-Swiss plate.
⬇️ Download the .obj file for 3D printing
This is by far the best valued Tripod I encountered. All metal construction with a detachable leg for monopod operation!
This metal constructed and sturdy adapter lets you mount any smartphone to a ARCA-Swiss fitted base plate. Handy if you want to use your iPhone on a tripod.
Tihs UES brand camera cleaning kit includes everxthing you need to keep your sensor & camera from dust and even comes with a sturdy case.
Some flashes - especially from GODOX - still come with AA batteries which can be really frustrating to work with. Instead of tossing them in a garbage pocket of your backpack and losing track of which were already empty - just stuff them away easily with some labeled boxes.
The Issue
Although the following lines may not be directly correlated with the issue, I chose to include them just in case anyone - like me - searches for those errors and actually has the same - but different problem.
Solution
Add the current server IP address to the retry_join array in your consul.hcl config.
Here you go.
]]>AnyType is like Notion on sterodies - with privacy and security. Notion has been my go-to tool for organizing any strucutred and non-stuctured information which are not specific enough to been designated to a separate app.
My problem was always that I had to split up certain private and sensitive information because Notion is an online-first cloud service without E2EE (which doesn't even support two factor authentication). AnyType in contrast is an offline-first app with a possibility to sync data between devices on your local network with an equal - if not superior - featureset.
Price: free (Open Source)
the everything app for those who celebrate trust & autonomy
TickTick is a seamingly simple reminder / ToDo app. The feature that sold me on TickTick (and is not supported by any other app right now) is importing & deleting items from the iOS stock Reminders app which allows me to use Siri for creating tasks.
Price: free ($36/year option)
If you find yourself on this blog post, you probably already heard about Raycast. If not: New & hyped alternative to Alfred / built-in Spotlight.
Price: free
We need to make RSS feeds great again.
Price: $ 9.99
It seems that 30 bucks is a bit much for a simple outlining app which only supports basic layouting. But Bike allows me to quickly take notes and structure them in a hierarchy which is optimal for my workflow.
When researching topics, all notes firstly land in Bike.
Price: $ 30.00
Deliveries is an all-in-one parcel tracking app with support for a unholy amount of shipping providers. You can also forward your shipment notification mails to a provided address for automatic tracking.
Price: 5,49 €/year (or 0,99 €/month)
LaTeX made easy.
Price: 49,99 €
]]>Make sure you download the FUJIFILM X Webcam Software first.
Change your connection mode to USB Tether Shooting Auto SETUP → CONNECTION SETUP → CONNECTION MODE → USB TETHER SHOOTING AUTO
Try changing your USB cable
Start your FUJIFILM camera
Set the mode dial to P
Flip out the display
Connect the camera to your Mac
Following these steps will help and maybe fully resolve issue with stuttering or laggy video.
Notice that you need to disconnect your camera first in order to change any setting on your camera.
Turn the mode dial to P
Disable EYE AUTOFOCUS
Switch focus mode to MANUAL FOCUS
Change power mode to BOOST
SETUP → POWER MANAGEMENT → PERFORMANCE → BOOST
SETUP → POWER MANAGEMENT → BOOST SETTING → fps
Try changing the DIGITAL ZOOM option in the FUJIFILM Webcam X Softare to a value greater than x1.0
Enable NATURAL LIVE VIEW on your camera
SCREEN SETTING → NATURAL LIVE VIEW → ON
Change DYNAMIC RANGE to 100
Select either AUTO or POWER SUPPLY OFF/COMM ON for USB POWER SUPPLY/COMM SETTING in the network/USB setting menu.
Choose 6: USB WEBCAM for SELECT CONNECTION SETTING.
For me many apps such as Discord, FaceTime or WebEx won't recognize the FUJIFILM X Webcam softare as a camera. You can work around this by streaming your camera feed through OBS which will create a virtual camera.
Download OBS Studio for macOS
I also ended up using a Capture Card to get a clean and smooth feed from my camera. For the FUJIFILM X-S10 you will need a left angled Micro HDMI cable. I'm using the Guermok 4k30 / 1080p60 which works just fine for video conferencing software. This solution costs around 27 € at the time of writing.
Make sure to enable "Clean Feed HDMI Output" to avoid getting UI overlays on your output.
I still ended up buying a used X100S but there are some awesome compact cameras which could fit your needs.
One of my main concerns is sensor size. I've marked APS-C size sensor in bold.
23,6 x 15,8 mm: APS-C sensor size
8,8 x 6,6 mm: smaller CMOS type sensor
Brand | Model | Focal Length | min. F | Year | MP | Sensor | Film Sims | Price |
|---|---|---|---|---|---|---|---|---|
Fujifilm | 35mm | F2 | 2020 | 26,1 | 23,6 x 15,8 mm | ✅ | - | |
Fujifilm | 35mm | F2 | 2017 | 24,3 | 23,6 x 15,8 mm | ✅ | 1200 € | |
Fujifilm | 35mm | F2 | 2014 | 16,3 | 23,6 x 15,8 mm | ✅ | 700 € | |
Fujifilm | 35mm | F2 | 2013 | 16,3 | 23,6 x 15,8 mm | ✅ | 600 € | |
Fujifilm | 35mm | F2 | 2011 | 12,3 | 23,6 x 15,8 mm | ✅ | 400 € | |
Fujifilm | 28mm | 2018 | 24,2 | 23,6 x 15,8 mm | ❌ | 500 € | ||
Fujifilm | 25-100mm | 2012 | 12,3 | 8,8 x 6,6 mm | ❌ | - | ||
Fujifilm | 25-100mm | 2015 | 12,3 | 8,8 x 6,6 mm | ❌ | - | ||
Fujifilm | 25-100mm | 2013 | 12,3 | 8,8 x 6,6 mm | ❌ | - | ||
Fujifilm | 28mm | 2016 | 16,7 | 23,6 x 15,8 mm | ❌ | 650 € | ||
Fujifilm | 28-112mm | 2014 | 12,3 | 8,8 x 6,6 mm | ❌ | 490 € | ||
Fujifilm | 28-112mm | 2013 | 12,3 | 8,8 x 6,6 mm | ❌ | 450 € | ||
Fujifilm | 28-112mm | 2011 | 12,3 | 8,8 x 6,6 mm | ✅ | 200 € |
Price: $ 29.00
CleanShot is a supercharged screenshot utility which adds tons of functionality compared to the built-in macOS screenhot utility. CleanShot can be bought as a one-time payment or used with a $8/mo subscription if you need their cloud service.
AirBuddy is a macOS app that seamlessly connects AirPods or other Bluetooth headphones to your Mac, providing a convenient and efficient way to switch between devices with ease.
Price: 12,99 €
Little Snitch is a powerful macOS app that allows users to monitor and control outgoing network connections, providing an enhanced level of privacy and security by keeping a close eye on all the data leaving their Mac.
Approving an denying ever connection can be a bit tedious but it's worth it to deny apps syping on you or even stop malware to connect to remote servers.
Price: 69,00 €
Rectangle is a handy macOS app that enables users to efficiently manage their windows by offering customizable keyboard shortcuts and easy window resizing options, making multitasking and organizing workspaces a breeze.
Price: free + Open Source
I am storing much of my data on a NAS in my home network. Unfortunately, Finder does not work great with SMB shares resuling in long copy times, directories take forever to load and the Finder gets unresponsive regurarily. ForkLift has a much better support for network shares.
Price: $ 19,95
Easy Move+Resize is a convenient macOS app that simplifies window management by providing intuitive keyboard shortcuts and mouse gestures, making it effortless to move and resize windows on your Mac for optimal productivity.
Price: free + Open Source
There is also an alternative app called Hummingbird which has a similar functionality and is originally inspired by Easy Move+Resiize but allows you to move & resize any windows without clicking.
Download Easy Move+Resize on GitHub
Linear Mouse allows you to modify the scrolling & acceleration preferences of any non-Apple mouse.
Price: free + Open Source
Download Linear Mouse on GitHub
Pure Paste is a utility that cleans the copy+paste stash from any formatting. Allowing you to copy text from any WYSIWYG editor to another without messing up the formatting.
Price: free
]]>You will need...
A Cloudflare account
A domain connected to your Cloudflare account which will be used to route external traffic
Lando with a configured project
Create a new directory .cloudflare in your project root
Authorize Argo Tunnel for Domain
Select your domain
A file cert.pem will be starting to download
Store cert.pem in .cloudflare/cert.pm
Run cloudflared tunnel --config=.cloudflare/config.yml --origincert=./.cloudflare/cert.pem create "RabbitHole"
The output should be
Created tunnel RabbitHole with id
<TUNNEL-ID>
Set the value of the tunnel attribute in .cloudflare/config.yml to the previously returned <TUNNEL-ID>
For example
tunnel: fbedd849-eadc-47f1-82aa-02458008fd2f
Create DNS CNAME record with any custom subdomain (like "local.domain.tld") pointing to <TUNNEL-ID>.cfargotunnel.com
Start Tunnel via the script below
In my case I want to expose the appserver_nginx Lando service to the tunnel.
You can debug all requests using the --loglevel debug flag.
You should now reach your Lando service externally using your previously added CNAME DNS record ("local.domain.tld").
]]>But which of the FUJIFILM X100 series cameras is the best fit? I watched many YouTube videos and read articles but haven't found any compact comparison chart with all important key facts - so I made one. In this comprehensive blog post, I'll compare and contrast all of the X100 models - from the original X100 to the latest X100VI.
FUJIFILM X100 FinePix (Manual)
FUJIFILM X100S (Manual)
FUJIFILM X100T (Manual)
FUJIFILM X100F (Manual)
FUJIFILM X100V (Manual)
FUJIFILM X100VI (Manual)
This is by no means a complete feature list - but rather important key facts that were important to me like film simulations, screen size, autofocus systems or sensor types. You can also download this table as PDF.
Here are some accessories I use for my X100S that I actually own and like. Of course, you can buy all items on amazon via the referral link - you know how it goes!
The Tiffen Glimmerglass filter adds a kind of cinema-like bloom to your images without being too intruding like the Black Pro-Mist filter. All of my X100S images are taken with the Glimmerglass filter. See GxAce's video on the filter for some great examples.
Currently 64,77 € on Amazon
To use any 49mm filter on your Fujifilm X100 series camera you need a adapter ring. Otherwise the lense element will touch the filter glass resulting in an error and possibly damaging your camera in the long run.
Available for only 9,99 € on Amazon
There is a custom red konkav and konvex shutter button included in this kit.
Currently 7,94 € on Amazon
A great advantage of the X100 series is it's compact formfactor - which is also one of its negativ points. You can greatly increase your grip with a custom thumb grip which fits perfectly in the hot shoe.
Available for 7,44 € on Amazon
If you feel like a thumb grip is not necessary, a neat hot shoe cover with the "FUJIFILM X" logo can be a great fit. I am rocking this cover item on my X-S10.
Currently 12,08 € on Amazon
Peak Design has undeniably created the best ecosystem of camera carry equipment. The thinnest of their camera straps is a perfect fit for your X100. I'm also carrying a Peak Design Cuff in my backpack.
Available for 52,98 € on Amazon
Unfortunately only the X100T and above ship with built in WiFi so this adapter comes in handy if you want to transfer images to your iPhone.
Currently 35,00 € on Amazon
Currently 35,90 € on Amazon
]]>Available for 4,99 € on Amazon
Wir haben hier einen kleinen, kompakten Guide erstellt, der eine Sensibilisierung im Thema der IT-Sicherheit herstellen soll und eine Orientierung mit konkreten Maßnahmen vorgibt. Auch wenn die hier angeführten Maßnahmen nicht sehr komfortabel erscheinen und zusätzliche Schritte im Alltag erfordern, ist die digitale Sicherheit heutzutage um so wichtiger.
Alle hier empfohlenen Apps sind open source & kostenlos und wurden von mir genutzt oder mindestens evaluiert.
Datensicherheit
Welche sensiblen Daten sind wo gespeichert? (Sensible Daten sind beispielsweise Dokumente, Fotos, Kontaktdaten) Prüfe auch, ob sensible Daten auf Fotos in deiner synchronisierten Fotobibliothek vorhanden sind. (Fotos von Ausweis/Führerschein)
Vermeide, sensible Daten auf Cloud-Speichern zu hinterlegen (Dropbox, Google Drive, iCloud)
Achtung: Wenn du sensible Daten gelöscht hast, entferne diese auch aus dem Papierkorb
Beschränke auch den physischen Zugriff zu Daten. (Passwörter und PINs bei Smartphones, Laptops, Desktop-Rechnern. Festplatten mit Passwörtern sichern)
Stelle sicher und teste, dass du deine Geräte jederzeit entfernt orten und sperren kannst.
Stelle sicher, dass du jederzeit den Verlust deiner Daten - beispielsweise durch Schadsoftware - auf Rechner und Smartphone verkraften kannst. (Desaster Recovery)
Dafür sind regelmäßige Backups von wichtigen Daten erforderlich
Stelle sicher, dass die Speichermedien für das Backup nicht dauerhaft mit dem Computer und/oder Netzwerk verbunden sind.
Versuche, so wenig Daten wie möglich anfallen zu lassen. Daten, die nicht anfallen, können auch nicht abhanden kommen.
Dein persönliches Sicherheitskonzept nur so sicher wie das schwächste Glied in der Kette.
Accountsicherheit
Mit einem Passwort-Manager bewegt man sich nicht nur sicherer sondern auch schneller und effizienter durchs Internet.
Der eingebaute Passwortmanagers des Browsers (Chrome/Firefox) sollte auf alle Fälle vermieden werden.
Jeder Dienst/Website/App sollte ein eindeutiges, langes Passwort haben. (mindestens 16 Stellen)
Mit dem Master-Passwort sicherst du den Zugriff zu deinem Passwort-Manager.
An das Master-Passwort solltest du dich leichter erinnern können. Es muss dennoch lang und komplex genug sein. (z.B. ein ausgedachter Satz)
Das Master-Passwort sollte niemals aus persönlichen Informationen bestehen (Geburtsdatum, Wohnort, Automarke o.ä.)
Das Master-Passwort sollte niemals irgendwo digital abgelegt werden.
Stelle sicher, dass du jederzeit von überall Zugriff auf den Passwort-Manager hast. Die meisten Passwort-Manager verfügen über eine Cloud-Synchonisierung. Diese ist idR sicher und wird dringend empfohlen.
Wenn möglich, aktiviere die 2-Faktor Anmeldung auch für deinen Passwort Manager (mehr dazu im folgenden Absatz)
Bitwarden https://bitwarden.com (Alle Plattformen, iOS, Android, Desktop, Browser Add-On, uvm. inkl. Synchronisation)
Es sollte für alle Accounts die 2-Faktor Anmeldung aktiviert sein. Dabei muss bei jedem neuen Login für einen geschützten Dienst ein automatisch generierter Code von einem anderen Gerät (“der 2. Faktor”) eingegeben werden.
Aktiviere die 2-Faktor Anmeldung für alle Accounts, bei denen es möglich ist.
Nachdem du die 2-Faktor Anmeldung bei einem Dienst aktiviert hast, werden oft Backup-Codes generiert. Diese sicher speichern.
Die 2-Faktor Anmeldung über SMS sollte vermieden werden - ist aber besser als garnichts.
Erstelle regelmäßig ein Backup der 2-Faktor Authenticator App.
⚠️ Mit dem Verlust der 2-Faktor Authenticator App geht auch der Zugang zum Konto selbst verloren.
iOS: Ravio Authenticator https://apps.apple.com/de/app/raivo-authenticator/id1459042137
iOS: 2FAS https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794
Android: Aegis Authenticator https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis
Android: 2FAS https://play.google.com/store/apps/details?id=com.twofasapp
Der Google Authenticator sollte auf keinen Fall genutzt werden! *
Cloud-Speicher (Dropbox)
Social-Media (Twitter, Instagram, TikTok, Discord, Twitch)
Finanz-Apps (PayPal, Banking, Investment)
Google https://myaccount.google.com/signinoptions/two-step-verification
Microsoft https://account.microsoft.com/security
Welche Personen haben noch Zugriff auf deine Accounts?
Ist dieser Zugriff zwingend notwendig?
Ist der Zugriff von weiteren Personen mit 2-Faktor Anmeldung geschützt?
Aktiviere Benachrichtigungen über neue Logins (standardmäßig oft aktiv)
Haben andere Dienste Zugriff auf meine Accounts?
Auf vielen Diensten kann man sich über seine bestehenden Accounts anmelden (z.B. “Login mit Google”).
Diese Dienste haben damit bestimmte Zugriffsrechte auf deinen Accounts. (z.B. im eigenen Namen Tweets verfassen, auf Kontakte zugreifen etc.)
Prüfe, welche Anwendung Zugriff auf wichtige Accounts haben und entferne diese, wenn sie nicht zwingend notwendig sind. (Diese Liste ist selbstverständlich nicht vollständig)
Instagram, TikTok, Discord …
Welche Smartphone Apps haben welche Berechtigungen? Entferne nicht notwendige Berechtigungen.
Sind alte Geräte in deinem Google/Apple Account registriert? Diese bei Bedarf entfernen.
Windows: Prüfe, ob der Windows Defender aktiviert ist. Antivirus/Antimalwaresoftware von anderen Herstellern ist nicht zwingend notwendig und kann sogar ein Risiko sein.
Prüfe welche Anwendungen auf dem Gerät installiert sind und/oder im Hintergrund laufen. Bei unbekannten Diensten den Namen googlen und/oder Experten konsultieren.
Sei vorsichtig, wenn du auf Links aus externen Quellen klickst
Stimmt die Internetadresse genau überein?
Wirst du per E-Mail aufgefordert, eine Aktion in deinem Konto vorzunehmen (bsp. PayPal möchte dass du dein Passwort aktualisierst), besuche die Internetseite selbst im Browser anstatt auf den Link zu klicken.
Ad-Blocker haben oft eingebaute Phishing & Malware Filter Empfehlung: uBlock Origin https://ublockorigin.com/
Dein Passwort-Manager (als Browser Add-On) wird dir ein Passwort nicht vorschlagen, wenn die Adresse nicht exakt übereinstimmt. Der Passwort-Manager wird dich beispielsweise niemals bei einer betrügerischen Seite services-paypal.scam mit deinen paypal.com Zugangsdaten anmelden lassen.
Roman Zipp, ich@ich.wtf, Version 03-2024
* Bei Verlust des Zugriff auf das Google Konto wird auch der Google Authenticator gesperrt.
]]>This is a short shell function which builds a MySQL/MariaDB connection URI string using the lando and jq binaries.
JQ is a lightweight and flexible command-line JSON processor made by Stephen Dolan which is used to extract details form the lando info JSON output.
Of course, you can alter the function to output any combination of connection details.
This example always uses the database lando service.
There is a workaround by overriding the available memory and/or CPU power in your Nomad client config file.
You can compute your "real" CPU compute power by multiplying the number of cores with the MHz. Example: 4 core CPU with 2 GHz each = 4 * 2000 = 8000.
To get your CPUs clock speed, use the lscpu util:
The Nomad client config is located at /etc/nomad/nomad.hcl by default.
Fortunately there's a way to reset all synced events without loosing any preferences.
Quit the Calendar app
In Finder: Go to Users ▸ You Profile ▸ Library ▸ Calendars
If you don't see the Library folder, press CMD ⌘ + Shift ⇧ + . (Dot)
Delete the following files:
Calendar.sqlitedb
Calendar.sqlitedb-shm
Calendar.sqlitedb-wal
Now, re-open the Calendar app, press CMD ⌘ + R and wait for the calendars & events to re-sync cleanly. This can take a couple of minutes based on the size of your remote calendars.
If you're missing any items in the sidebar, go to Settings ▸ Accounts and toggle "Enable the account".
]]>Note that this templates uses the Nomad Server client.disable_file_sandbox option se we can mount the environment config file as env values
Create a folder on your host machine. In the example we will use /mnt/plausible
Update the values in plausible-conf.env
plausible-conf.envThis post will guide you through the initial setup of Nomad, Consul and Vault.
Additionally, I will cover some common additional steps for
AWS CLI (for ECR)
Docker (+ Authentication)
Nomad uses CNI plugins to configure the network namespace used to secure the Consul service mesh sidecar proxy. All Nomad client nodes using network namespaces must have CNI plugins installed. See the Consul CNI Docs for more information.
See Nomad Install Docs for more information
This script configures multiple env values NOMAD_ADDR, VAULT_ADDR, CONSUL_HTTP_ADDR so we can run cli commands without appending the address and port every time.
You need to obtain the private IP of your chosen network interface. Check if the command below fits your needs or set the IP address manually.
See the official Docker install guide for more information.
See the official install guide if your prefer to use the prebuilt binary.
We will create a new /etc/docker/config.json file to provide Nomad with our Docker login credentials. Replace <aws_id> and <aws_region> with your own values.
Before getting started with Nomad instances, we need to configure some environment values in /etc/nomad.d/nomad.env
We will now configure your Nomad instances as client and/or server. Place this file in /etc/nomad.d/nomad.hcl
The server server.bootstrap_expect values defined, how many nomad server instances need to be running in order to select a leader.
The client.template.disable_file_sandbox allows you to mount host files into you job allcos.
To enable internal TLS encryption we need to generate a certificate using the following commands. See the Consul TLS docs for more information.
You now need to distribute the generated consul-agent-ca.pem certificate to all consul agents and place it in /etc/consul.d/certs/consul-agent-ca.pem
On your host Consul server, generate an agent certificate for each Consul agent you want to deploy.
Distribute your agent certificate to the respective server
Again, choose which servers will be used as client or server for your Consul instances.
Here are some handy commands I commonly use for debugging.
]]>I am mainly using JetBrains products for my daily work such as PHPStorm and GoLand. I've been sticking to the GitHub Theme for several years now which includes a light and dark version.
My Terminal is iTerm2 with a customized oh-my-zsh Theme.
I am currently running a 2021 14" MacBook Pro with a M1 Pro and 32 GB RAM.
Keyboard: Apple Magic Keyboard / Logi MX Keys for Mac
Mouse: Logi MX Master 3s for Mac
Webcam: Logitech StreamCam
Audio-Interface: Audient ID14 MKII
Speakers: Yamaha HS6
Microphone: audio-technica AT2020
Headphones: Beyerdynamic DT770 Pro
ADAT Interface: Behringer ADA8200 Ultragain Digital
E-Guitar: Fender Player Series Strat PF
E-Guitar: Ibanez GRG121DX-BKF
Acoustic Guitar: Fender Malibu Player
Ukulele: Fender Billie Eilish
Amp-Modeler: Hotone Ampero
Lando is a dead-simple but highly customizable wrapper for local development using Docker containers. When working with multiple PHP projects on different versions, spinning up Docker containers for PHP, nginx, databases or services only takes a simple lando start.
After looking through all possible logfiles the kern.log showed a lot of errors which indicated a network issue.
A Conntrack Firewall is a type of firewall that uses the Linux kernel's connection tracking system (known as "conntrack") to improve network security. With this firewall, incoming and outgoing network traffic is examined to determine its state, and rules are applied based on that state.
The conntrack firewall is based on the idea that all network traffic should be classified into one of several states, such as "new," "established," or "related." These states are based on the protocol and port information contained in each packet, as well as other information such as source and destination addresses. The firewall then applies rules to each state, allowing or blocking traffic based on criteria set by the system administrator.
This error message means that the connection tracking table has reached its limit, causing various issues like network timeouts that can occur randomly or consistently.
The conntrack table stores information about active connections that are being processed by the kernel. In Nomad clusters, this frequently happens when jobs communicate with external endpoints or other services within the same cluster via Consul. NAT and stateful firewall rules are used in such situations, and these rules are maintained in the conntrack table as entries.
You can determine the current maximum table size via the following command:
You can use the sysctl utility to increase the maximum table limit. I've used a value of 262144 for a 8 GB ubuntu system. Please keep in mind that the table will be regurarily flushed.
To persist this change, add the following config file to your sysctl daemon which will be run on each boot.
]]>Sprinter allows you to monitor your internet connection latency and uptime. It's a self contained go application delivered via Docker.
You can easly deploy a Sprinter instance via Docker.
docker pull ghcr.io/romanzipp/sprinter:latest
Copy
See Sprinter on GitHub.
]]>Wanderer is a self-hosted deployment tool for Nomad orchestrated jobs.
Provides a centralized repository for Nomad HCL templates
Offers API for CD tools to automate deployment of new versions
Simple Web UI for editing templates & monitoring deployments
Supports Nomad instances behind Cloudflare Access Zero Trust network
GitHub Actions Workflow available for easy pipeline integration
Wanderer comes with a basic Web GUI which provides all necessary operations such as editing Nomad clusters, templates or issuing API tokens.
Nice to know: There is not a single line of JavaScript.
You can also deploy Wanderer in your Nomad cluster. This is an example HCL template:
See Wanderer on GitHub.
]]>Add the symlink option if your filesystem supports symlinks.
The url value can be the absolute or relative path to the package
Be sure, to add the @dev version