Conner's Corner

A homescreen from 14 years ago

Thu, 09 Jul 2026 00:00:00 UTC

Oh boy, here is a blast from the past. I was looking at my memories from Immich. Immich takes a simple approach, it surfaces photos you took on this date and month in past years, without curation. I like this approach over the curated experiences Google Photos tended to create. I do not need 12 photos of my dead cat on a random Tuesday, but maybe 3 I took 7 years ago would be fine.

Anyway, today there was a screenshot in my photos from 14 years ago. It took me down memory lane, so I thought I’d share.

Some thoughts on the various rows.

Row 1 (Phone, Messages, Camera, Fahrenheit) Defaults, except for weather. I have no recollection of this app, but I am pretty sure the temperature was a hack they pulled off by using the notification badge to display the temperature.
Row 2 (Settings, Clock, Todo.txt, Maps) Fairly boring. I never got into todo.txt but it is a great idea. My maps app is in the same basic spot on my current phone. Muscle memory for the win.
Row 3 (Instagram, Facebook, Entertainment, Safari) The only interesting thing on this row is the Entertainment folder.
- Rdio - Spotify Competitor that was bought by Pandora. It was much nicer than Spotify back then.
- MPoD - A music player daemon controller. I had a decently fun streaming setup in my apartment
- Pandora - Still around, but I maybe use it 1 time a year
- Itunes - default
- This American Life - They had to distribute an app for their podcast. I miss those days.
- Photos - useful but default
- iMovie - did anyone actually use this?
- Roku - Still use this, though with their impending sale to Fox I am searching out alternatives
- Kindle - Left this ecosystem several years ago, also I never enjoyed reading a book on my phone.
Row 4 (Reminders, foursquare) - I am sure that reminders app was used sparingly. Foursquare though, I loved that social experience. Paired with a Twitter that could still feel like a small town, it made going out for drinks to win back your mayor badge something you probably did too often.
Home Row - You know these were the most important apps.
- 1Password - Still use it, still recommend it.
- Mail icon - I have no idea what mail app this was.
- Google Voice - I still cannot believe we used to have to listen to voicemails. I still keep my Google Voice account just for the transcription feature.
- Fantastical (I think) - I think the 8 means this photo is actually dated incorrectly, and was captured the 8th instead of the 9th. Oh well. That badge was the same hack as the weather app used.
- TweetBot - 3rd party clients and Twitter were conversation starters in those days.

Today I have an Android device, and looking through my photos it looks like I switched in February of 2014. If you are curious about what some of my daily apps are now, you can find my defaults here.

How This Blog is Deployed

Mon, 06 Jul 2026 00:00:00 UTC

I mentioned last month I had changed the underlying tech driving this blog to be primary written in golang. I may release the structure of that application at some point, but for now I thought I would document how I deploy this service to my VPS.

My VPS is hosted on hetzner, I try to host most of my external-facing things there to avoid my in home NAS from being too much of an attack surface. My previous deployment process was faily simple but not pipeline-driven.

Previous Deploys

Write new content or add a new feature
run make build
run make sync

This did a docker build which exported the contents of the static site generator’s output to a local folder, then make sync ran rsync to push the changes to a folder on my vps. My site at that time was a nginx service sitting behind my nginx proxy.

I wanted to keep a similiar process with the rewrite, but I wanted it to be backed by a pipeline, so I could write anywhere with access to my git server, and deploy with a push. I also wanted this to be much more secure and locked down than my previous action, which involved my primary user copying files to the service. This user had full sudo access to the machine, which is not ideal security practice.

After some research and experimentation, here is where things stand.

Server User Setup

I have a user deploy on my VPS. My VPS is named ext(yes this is a departure from my naming system). This user has a home directory in my service folder.

sudo useradd -M -d /var/docker-service/blog/ -s /usr/sbin/nologin deploy
sudo chown -R deploy:deploy /var/docker-service/blog/

Then I created a wrapper script named /usr/local/bin/blog-compose for running docker-compose commands in that directory. `

#!/bin/bash
set -e
cd /var/docker-service/blog
exec docker compose -f /var/docker-service/blog/docker-
compose.yml "$@"

Make this script executable

sudo chmod +x /usr/local/bin/blog-compose

Now you need to allow that script to be run with sudo as your user. This allows this user to perform docker commands without needing to be a member of the docker group

sudo visudo -f /etc/sudoers.d/blog
### contents
deploy ALL=(root) NOPASSWD: /usr/local/bin/blog-compose
deploy ALL=(root) NOPASSWD: /usr/local/bin/blog-compose *

Finally, you need to generate an ssh key and add it to /var/docker-service/blog/.ssh/authorized_key file. I added a passphrase for additional security. There are 1 million articles on this on the web, so I won’t repeat those details.

Docker Compose

I run all my services as docker containers. This is partly for encapsulation and partly because it makes adding and removing services simple. I front the containers with nginx-proxy and it’s acme-companion, which makes SSL super low maintenance. Because of this, the site is run as a Docker container. Here is the corresponding compose file.

Notes: I use scratch as my base image for running the site, this makes for a smaller image and reduces potential attack surfaces. Because of this I am mounting the root SSH keys and timezone data into the container. Without these, requests to my mealie instance fail as it cannot validate the ssh key and using a timezone to gatekeep post publishing fails as it cannot find timezone data.

services:
  connermccall.com:
# I run a docker registry internally for personal projects
    image: registry.connermccall.me/personal/connermccall.com:latest
    environment:
      - "URL=connermccall.com"
# Recipe retrieval requires a key
      - "MEALIE_API_KEY=${MEALIE_API_KEY}"
# there are the important things, this tell the proxy and companion what domains we are serving this site on. 
      - "LETSENCRYPT_EMAIL=conner@connermccall.com"
      - "LETSENCRYPT_HOST=connermccall.com,www.connermccall.com"
      - "VIRTUAL_HOST=connermccall.com,www.connermccall.com"
      - "VIRTUAL_PORT=8080"
    networks:
      - network-nginx-proxy
    restart: "unless-stopped"
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
      - "/etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro"
      - "/usr/share/zoneinfo:/usr/share/zoneinfo:ro"
    logging:
      driver: syslog
      options:
        tag: "docker/connermccall-com"
# I mark this as external as it is created with tofu elsewhere. The container has to be on this network for the proxy and companion to recognize it
networks:
  network-nginx-proxy:
    external: true

CI Setup

I use Forgejo as my forge. It has been rock solid for the past several years and I have a runner configured on my local NAS. This gives me more compute than my VPS provides along with plenty of disk space and access to local resources.

I will walk through the pertinent parts of my script, the full version is at the end of this post.

The first five steps are checking out the container, setting up build details, and actually building and pushing the container. Once that is done we need to update the running container on my VPS, which we do through SSH.

I chose to protect my ssh key with a passphrase. This passphrase is stored in 1Password. They provide a github action for fetching secrets. This takes a Service Token and then a map of keys to values. In this case we map the password field from the secret named ssh_passphrase in the forgejo vault to the output SSH_KEY_PASSPHRASE.

- name: Fetch Passphrase
  id: fetch_passphrase
  uses: https://github.com/1password/load-secrets-action@v4
  env:
    OP_SERVICE_ACCOUNT_TOKEN: ${{ env.OP_SERVICE_ACCOUNT_TOKEN }}
    SSH_KEY_PASSPHRASE: op://forgejo/ssh_passphrase/password

Once we have the passphrase we need to update the image and recreate the container on my vps. I used an ssh action to accomplish this. We need to pass the ssh key, the passphrase, the hostname, user, and ideally the host fingerprint to the command. Finally the command must be run with sudo so that the user has access to the necessary permissions for interacting with docker.

- name: Update compose
  uses: https://github.com/appleboy/ssh-action@v1.2.5
  with:
     username: ${{ vars.USER }}
     host: ${{ secrets.HOST }}
     key: ${{ secrets.SSH_KEY }}
     passphrase: ${{ steps.fetch_passphrase.outputs.SSH_KEY_PASSPHRASE }}
     fingerprint: ${{ secrets.HOST_FINGERPRINT}}
     script: |
        sudo /usr/local/bin/blog-compose up -d --pull always --force-recreate

Gotchas

Ensure you set the permissions correctly on the .ssh directory and authorized key file.

ext:~$ chmod 700 .ssh/
ext:~$ chmod 600 .ssh/authorized_keys

I technically named my user something different which included a dot in their username. This tripped up sudo when I added the file user visudoers.d with the actual username. sudo ignores files with dots in their name. The easy fix was renaming the file with a - instead of a dot. But to confirm that you successfully granted the user permission you can run.

sudo -l -U deploy

You may need to try a couple different host keys to figure out which one will work. I initially used the ssh_host_ecdsa_key fingerprint and the pipeline failed. I settled on the ssh_host_ed25519_key.

ext:~$ ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
256 SHA256:XXXX....XX root@ext (ED25519)

You need the 2nd string, including the SHA256 part. SHA256:XXXX....XX

Full Pipeline

name: Build and Deploy New Version

env:
  IMAGE_NAME: connermccall.com
  REPO: registry.connermccall.me/personal


on:
  push:
    branches:
      - 'main'

jobs:
  docker-build:
    name: Build and push docker image
    runs-on: docker
    container:
      image: catthehacker/ubuntu:act-latest
    steps: 
      - name: Checkout
        uses: actions/checkout@v4
      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REPO }}/${{ env.IMAGE_NAME }}
          flavor: latest=auto
          tags: |
            type=ref,event=branch
            type=sha
            type=raw,value=latest,enable={{is_default_branch}}
      - name: Resolve version info
        id: version
        run: |
          echo "GIT_HASH=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          push: true
          context: .
          cache-from: type=registry,ref=${{ env.REPO }}/${{ env.IMAGE_NAME }}:latest
          cache-to: type=inline
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            ASSET_HASH=${{ env.GIT_HASH }}
      - name: Fetch Passphrase
        id: fetch_passphrase
        uses: https://github.com/1password/load-secrets-action@v4
        env:
          OP_SERVICE_ACCOUNT_TOKEN: ${{ env.OP_SERVICE_ACCOUNT_TOKEN }}
          SSH_KEY_PASSPHRASE: op://forgejo/ssh_passphrase/password
      - name: Print masked secret
        run: 'echo "Secret: ${{ steps.fetch_passphrase.outputs.SSH_KEY_PASSPHRASE }}"'
      - name: Update compose
        uses: https://github.com/appleboy/ssh-action@v1.2.5
        with:
          username: ${{ vars.USER }}
          host: ${{ secrets.HOST }}
          key: ${{ secrets.SSH_KEY }}
          passphrase: ${{ steps.fetch_passphrase.outputs.SSH_KEY_PASSPHRASE }}
          fingerprint: ${{ secrets.HOST_FINGERPRINT}}
          script: |
           sudo /usr/local/bin/blog-compose up -d --pull always --force-recreate

Comparing Word Docs

Sat, 04 Jul 2026 00:00:00 UTC

I have a client who sends me Word documents quite frequently. They are almost always a revision of a previous document. The document is very long and can be challenging to parse. For many years I would just manualy look for what changed, or use the Compare feature in LibreOffice. This never worked well, as it was based on text movement and formatting which caused a lot of changes to be irrelevant. So I mostly just read the entire thing to ensure no changes impacted features I was building.

This week I got a new version and for some reason I thought to myself, can I compare this with diff. It turns out we can.

pandoc -f docx -t old-document.docx -o old-document.md
pandoc -f docx -t new-document.docx -o new-document.md
diff old-document.md new-document.md

The pandoc conversion is excellent and since you end up with a plain txt file, diff does what it does best. I was able to quickly review what had changed and provide feedback without needing to read the entire 8 page document. It is kind of a weird scenario, but hopefully I help one or two people who are also stuck in a document Groundhog’s Day loop.

ESPHome Controlled Fireplace Blower

Wed, 01 Jul 2026 00:00:00 UTC

Our home had a gas fireplace in our living room when we moved in. Though the radiant heat from it felt good when winter came, there was no blower installed so a lot of the heat was wasted. After one winter of wasted heat, I purchased a blower designed for gas fireplaces. It gets inserted into the base of the unit and turns on based on the temperature. The fan pulls air from under the unit, which is exposed to the room, and blows it through a vent in the back of the unit which heats the air and ejects it through the vent at the top.

This worked great for years, but this winter I was being driven insane by the noise. The fan was loud enough to require cranking up the volume when watching TV. The only way to stop it was to unplug it and we would inevitably forget to plug it back in.

I considered a few options:

Just use a smart plug and be able to control it if needed, with automatic on overnight.
Buy a new, more expensive fan and hope it would be quieter
Do it myself.

I like do it myself as an option, so I dug into the possibilities. I was sure I could use ESPHome to accomplish my goals and after some research I learned that yes, ESPHome could handle this problem. I listed these as my goals.

Goals

[ x ] - Quiet operation
[ x ] - Able to control the fan from Home Assistant
[ x ] - Use standard components, so I can fix it if something fails
[ x ] - Monitor Temperature from Home Assistant
[ x ] - Original remote must still work(spousal approval)

Stretch Goals

I done some preliminary research on how to achieve these, but have yet to spend a ton of time working on them.

[ ] - Control Fireplace burner state from Home Assistant
[ ] - Determine Fireplace burner state in Home Assistant
[ ] - Climate Control

Build Details

I ended up with the following components:

Three 120mm PWM fans
esp32
DHT11 Temperature and Humidity Sensor
12v Buck Converter

The fans are wired in series, 12v from the DC transformer, PWM signals, and ground are all wired together.

The buck converter receives 12v from the transformer, drops the voltage and sends 5v to the dht11, and the vin pin on the esp32. Ground from both the dht11 and esp32 is wired to output ground on the buck converter, along with the ground from the fans.

PWM from the fans is wired to a PWM output pin on the esp32 and the DHT11 signal pin is wired into a GPIO.

Once I validated everything worked well, I soldered things together and stuck them into a plastic case. The fans were mounted to a 3d printed case that allows air to flow from underneath and push up through the vents. I also stuck a case around the DHT11 and attached it to the top of the lower compartment with a magnet, which improves temperature pickup.

Software Notes

The important bits of my esphome configuration file are at the bottom of this post.

My primary goal was to ensure this would continue to function even if Home Assistant or the network went down. Home Assistant’s only role is as a dashboard and allowing for setting thresholds remotely. The actual decisions to turn the fan on, speed, and turning it off is fully handled by the esp32 device.

I am extremely happy with the result. The fans are significantly quieter when running at lower speeds and if I bump their speed up a bit beyond silent they move a ton more air than the purpose build blower did.

# Allows setting thresholds within Home Assistant but storing them on the device. 
number:
  - platform: template
    name: "$friendly_name Low Temp Threshold"
    id: low_temp_threshold
    optimistic: true
    min_value: 50
    max_value: 80
    step: 1
    initial_value: 70
    unit_of_measurement: "°F"
    mode: box
    restore_value: true

  - platform: template
    name: "$friendly_name High Temp Threshold"
    id: high_temp_threshold
    optimistic: true
    min_value: 80
    max_value: 120
    step: 1
    initial_value: 98
    unit_of_measurement: "°F"
    mode: box
    restore_value: true

  - platform: template
    name: "$friendly_name Max Fan Speed"
    id: max_fan_speed
    optimistic: true
    min_value: 13
    max_value: 100
    step: 1
    initial_value: 65
    unit_of_measurement: "%"
    mode: slider
    restore_value: true

# the lamda here does most of the work. It triggers the fans on based on the temperature thresholds above and ramps up the fan
# as the temperature increases. 
sensor:
  - platform: dht
    pin: GPIO21
    model: DHT11
    temperature:
      id: "fireplace_temperature"
      name: "$friendly_name Temperature"
      accuracy_decimals: 1
      filters:
         - exponential_moving_average:
             alpha: 0.1
             send_every: 1
         - lambda: return x * (9.0/5.0) + 32.0;
      unit_of_measurement: "°F"
      on_value:
        then:
          - lambda: |-
              float temp = id(fireplace_temperature).state;
              float low_temp = id(low_temp_threshold).state;
              float high_temp = id(high_temp_threshold).state;
              float max_speed = id(max_fan_speed).state;
              bool manual_mode = id(manual_control).state;

              if (temp <= low_temp) {
                // Below low threshold - turn off
                id(fireplace_fan).turn_off().perform();
              } else if (manual_mode) {
                // Manual mode is on - do nothing, let user control
                return;
              } else if (temp >= high_temp * 0.95) {
                // At or above 95% of high temp - max speed
                id(fireplace_fan).turn_on().set_speed(max_speed).perform();
              } else {
                // Between low and 95% of high - linear ramp
                float temp_range = (high_temp * 0.95) - low_temp;
                float temp_position = temp - low_temp;
                float speed_percent = (temp_position / temp_range) * max_speed;
                speed_percent = max(1.0f, min(max_speed, speed_percent));

                id(fireplace_fan).turn_on().set_speed((int)speed_percent).perform();
              }
    
# Some fun wiring up of output and fan to allow fan monitoring in home assistant
output:
  - platform: ledc
    pin: GPIO25
    id: fireplace_fan_pwm
    frequency: 25000 Hz  # Above audible range
    min_power: 13%
    zero_means_zero: true

fan:
  - platform: speed
    output: fireplace_fan_pwm
    id: fireplace_fan
    name: "$friendly_name Fan"
    speed_count: 100  # Gives you 0-100% control

# Allows full manual control of the fan.   
switch:
  - platform: template
    name: "$friendly_name Manual Control"
    id: manual_control
    optimistic: true
    restore_mode: RESTORE_DEFAULT_OFF

Note:

I ran into a really frustrating issue throughout this project where Home Assistant would stop communicating with the device. I could get data from the device to HA, but not consistently send updates. I managed to track it down and wrote a post mortem.

The Wizard is Naz More

Sat, 27 Jun 2026 00:00:00 UTC

Thursday I saw the headline “Wolves Trade Naz Reid to Hornets for LaMelo Ball”. I frantically clicked the link and yes, that was real, the Wolves had done something I thought impossible, they traded their most loved big man away for a player who looks extremely flawed but could be a potential star.

My thoughts on the trade aside, Nas Reid was such a fixture in Minnesota. From the moment he started getting consistent minutes, until he played through a damaged shoulder in this year’s playoffs, he was beloved. I had many moments of screaming “NAZ” in excitement and “NAZ” in frustration. Other people went further, getting tattoos of his name on their bodies. His beach towel became a symbol of unity and hearing Michael Grady say “Two Words” was magnificent when Reid started splashing threes from all over the floor.

During the 2025 Playoff run, we got a Bark Box that came with a little wizard. It was an immediate smash hit. Fin loved that thing from day one, and even today it is in his rotation. The night before Reid got traded, the Wizard was laying somewhere in the house, and while we were watching TV all of a sudden you heard galloping and here comes the dog with the wizard in his mouth, ready to party. It coincided perfectly with the newish nickname fans had bestowed on Nas, The Wizard of Naz. Game days for that series always meant we got out the wizard, who not only remained a hit toy, but also somehow avoided being torn to shreds, a fate most toys face.

Maybe Fin sensed the phone calls the Wolves were making over in Minneapolis, but today at lunch I looked down and I think the Wizard looked sad. I think a lot of Wolves fans are feeling the same, Nas was a symbol of hard work and dedication and we took pride in him being one of us. He will be missed and I think we all wish him the best in Charlotte.

I build a Website for my Home

Thu, 25 Jun 2026 00:00:00 UTC

We have lived in our home for five years now. I have done a lot of stuff in it, both physical improvements and digital additions. My house is on the edge of being too smart, which is exactly how I like it.

One thing I love to do is garden. Initially this just meant growing edible plants in my garden beds, but as time has passed I have started to push outside the beds and expand my garden to encompass more of my yard. Doing this though required paying more attention to the species of plants that were already there and I planted.

Garden journaling has always failed me. Digital, analog, it did not matter. I would start all excited documenting my plans and maybe even the first planting, then nothing. Come October when we started cleaning out I had no notes on what went well or what went poorly.

I had always wanted a little site for my home that someone could visit to learn about it and realized this could solve my note taking problem. At the time I had gotten more intrigued by Go. So I started writing. I intentionally avoided LLMs and just tried to figure out as much as possible through documentation. And I ended up with a pretty solid piece of software.

My goal with this website is for it to be discoverable by passers-by. Currently it has a little homepage with some details about the house, the current temperature and humidity, and the weekly rainfall(quite a bit this week).

But the real fun is my plant database. I started adding labels with QR codes to my plants as I identified or planted them. Now anyone passing by or in my yard can scan this QR code and get a page showing information about that plant and its species.

Each QR code leads to a stake id, which is tied to a plant. My current stakes are temporary, so making new ones for new plants is not a big deal, but ideally I would figure out a way to make them permanent, maybe by etching them directly onto the stakes. Then I can reassign the stake to a new plant whenever I want.

Along with the public facing page, each plant also has more data on the admin side. Particularly notes. I can add notes, and additional photos very quickly. I even setup a custom redirect on my phone’s browser, which redirects from the public page to the admin page. So adding a new photo or note just requires a quick scan of the QR code, then I can add what I want. This has made keeping a better running log of a plant’s progress a lot more natural.

I have a few features I want to add and having this starting point will lead to more ideas. Currently I want to add a QR code to my in progress Little Free Library where people can leave notes for other readers (might be a terrible idea), expose more climate information by adding a weewx dashboard, and a log of projects we have done or are doing that are visible from outside.

It has been a fun addition to my web portfolio, something small, meaningful, and maybe something that will drive connections with neighbors.

This Site is an Executable Binary

Tue, 23 Jun 2026 00:00:00 UTC

I have a lot of excuses for not writing more, but recently I had a whole list of ideas of things to write and I got caught up in the problem of publishing too many things at once.

This is mostly just a lame excuse, but it led me down a path of trying to find a way to automate post publishing so I could write a bunch of content at the same time and have it slowly trickle out.

My site has run as a static site built with Astro for 3 years. This served me well, except for the fact that publishing a new post was a manual act. Whether pushing to a git repo to trigger a build and deploy or manually building and pushing, in all cases, I could not deploy any content I wanted to show at a later date to my production server.

My initial plan was to setup a workflow in Forgejo that would run on a schedule, check for branches matching a date pattern, if the date was today or earlier, merge it back and deploy the built site. This got complicated and seemed failure prone. I would have had to build at least two new workflows and also remember to name my branches with a date with no validation of the name before the workflow ran. This is not what git does well. So I reached for a tool I have been spending time learning. Go!

I managed to replicate almost everything from Astro in just a couple of days. I can still write in Markdown, have Front Matter. I still have recipes available from Mealie. The one missing piece is publishing Webmentions. As I have never gotten a mention I will add this if it is useful. The best part is now everything is contained in a single go binary with significantly less dependencies than Astro.

I am using Go’s embed to include all content, images, and templates into a single file which can be run with a simple ~/ > ./connermccall-com. Go’s build system also means that it is mostly trivial to build a version for different platforms. So if I provision an ARM machine one day, I can run it there.

This was a fun endeavor and great exercise to push my language knowledge. I really like the fact that I could write, commit, and build the site on Tuesday and have this post go live on Thursday without any intervention at publish time¹.

¹ Technically this should be date, since currently I just use date strings.

Docker VLAN Netmasks

Wed, 28 Jan 2026 00:00:00 UTC

I wrote previously about using ipvlans in Docker. For the first few months everything was groovy, but I ran into a surprising and irritating issue I thought I should write about.

About a month ago I changed my network to expand the IP address pool. Going from 10.49.1.0/24 to 10.49.0.0/22, which added addresses from 10.49.0.x, 10.49.2.x, and 10.49.3.x. I had reasons and things just worked for the most part.

I was working on a new ESPHome project a little bit later and was running into a very annoying bug. While the ESPHome node was happily sending updates to Home Assistant, Home Assistant would stop being able to send data to the node after a short time window. I would see the message in the logs WARNING Home Assistant 2025.10.2 (10.49.1.98): is unresponsive; disconnecting followed by INFO Successfully connected. I would be able to connect for about 10-30 seconds, then poof, connection gone.

I went down a ton of rabbit holes with ESPHome, and opened an topic on their forum. The culprit turned out to be a Docker configuration issue on my end.

When I updated my subnet, I failed to update the Docker vlan subnet. My initial configuration looked like.

resource "docker_network" "vlan" {
  name   = "ipvlan"
  driver = "ipvlan"

  ipam_config {
    subnet   = "10.49.1.0/24"
    gateway  = "10.49.1.1"
    ip_range = "10.49.1.0/24" # optional
  }

  options = {
    parent = "enp2s0f0"
  }
}

This worked great, and since all the devices that get an address on my vlan are mostly sending data either to the Internet or in response to data, I did not notice the problem when I expanded my subnet on my OPNsense LAN interface.

Home Assistant could establish a connection when the ESPHome node announced itself, but after a few moments the connection dropped. Since the Docker vlan subnet (10.49.1.0/24) didn’t include the node’s actual IP (10.49.0.50), the routing table lacked a route back to the node’s IP, preventing reconnection. So even though the node had the correct subnet and could communicate, Home Assistant’s network interface couldn’t route back to it.

Once I diagnosed the problem, the fix was easy:

resource "docker_network" "vlan" {
  name   = "ipvlan"
  driver = "ipvlan"

  ipam_config {
    subnet   = "10.49.0.0/22"
    gateway  = "10.49.1.1"
    ip_range = "10.49.0.0/22" # optional
  }

  options = {
    parent = "enp2s0f0"
  }
}

Now containers on my vlan know about my entire network and have correct routing tables. My ESPHome node is now stable and I am back to mostly just cursing at YAML.

Why Did The Devs Do That?

Fri, 23 Jan 2026 00:00:00 UTC

I saw the question “How do you find the “why” behind old code decisions?” on Hacker News and had to respond.

This is what I said.

The honest answer is you probably won’t find it. Historical documentation is hard, it is the first “features” cut when teams are scrambling to meet a deadline. There is no malice in this, it’s just something that the end user doesn’t need or see so when shit hits the fan, it get skipped.

Commit logs, slack/email/etc, documentation silos, or issue trackers are your best bet, other than actually being able to talk to the author(s) of the code.

But in general, the decision was made because in the time the developer had to implement the feature or fix, this was the best solution they could come up with. Hopefully if there were clear tradeoffs, there is some comment as to what they might have done with more time. Likely though they were rushed, told their team they wanted to go back and fix this, and then were ushered into a new project the second this one stabilized.

I think gghhjnuhbb has the best alternative to finding actual documentation and that is sitting and putting yourself in their headspace. That can sometimes lead to insights you might have missed.

I had more to say, so I will say it here.

These days I spend 90% of my working time on a digital art project with over 30 years of development history. Before a single line of code was written, the creator of the project spent 20+ years thinking about it. So 50ish years of decisions are sitting on my machine right now, both development and artistic.

The code base is made up of several repos, most of which were messily transitioned from svn to git at one point. History was lost, documentation is scattered in an old svn repository, Jira, a archived Trac project, git markdown files, inaccessible Slack channels, Jabber chats, and meeting notes lost to the bitrot of time.

So how do I consider previous decisions when I am modifying code written by developers who are long since departed this codebase?

I look for comments in the source. I also read the code. With a decade on this project, I occasionally have flashes of insight. Usually it involves the client¹ changed their mind. (Honestly this is the answer 89% of the time on all projects. If you think there is not a client, you need to look harder).
I ask the client. This can be useful and sometimes leads to deeper understanding of the intention of a feature that was marked as completed in the past. For most projects this is probably only a few months, but if you are learning about a code base, the more business/human context you have the better.
Old emails and Issues are also good resources, if you have a way to search them. Hopefully you will get a comment thread where the developer or developers are clarifying expectations as they go. But usually all you will get is a title, maybe a reasonable description, and then a marked completed activity.
VCS history is very rarely super useful in figuring out why without additional context in my experience. Only on projects where VCS hygiene was extremely vigorous do commits and commit messages signal why. Usually they end up being a mix of; fixed a bug, whoops, ci commit, ci commit, etc. But git blame can at least help you when searching old emails or issues.

The truth is that even after doing all of this, there is a better chance I have to just guess at intentions. They were probably good, they may have been misguided, rushed, or not backed by as much skill as we might like. Someone asked for something, the developer delivered it, and if it’s been in the code for more than a few weeks, it probably solved a real problem.

In the end, the why something happened is not the important bit anyway. Why can help you feel good or worse about something. But today’s problem is what is important. Instead of wondering why they (and let’s be honest, you) did something 6 months ago, instead focus on what the impact of changing this decision will be. And leave a comment and write a good commit message, do better than the past.

¹ Client may be singular but can be made up of numerous individuals. Someone, maybe just you the developer, is the client.

Slow Horses -> Slough House

Wed, 21 Jan 2026 00:00:00 UTC

Several months ago I decided to check out Slow Horses. This is a drama on Apple TV that has gotten solid attention. It has won several awards and since it is a “spy” story, it intrigued me. It also has Gary Oldman, who I tend to enjoy, but the first few episodes didn’t grab my attention and I dropped it for other things.

Then I learned that it was based on a book series called Slough House. I saw one of Mitch Herron’s books on a table at Barnes and Nobels with a promo sticker referring to the show. I was curious, especially when a few reviews mentioned John le Carré as a comparison.

It turns out the books are great. They are a perfect blend of dry humor, spy craft, mystery, and suspense. Nearly every character is deeply flawed, yet you can’t help but root for them to get through whatever bizarre circumstance this ragtag bunch finds themselves caught up in.

I have blown through the first three books and just started the fourth, Spook Street. If you are a fan of le Carré, slightly messy heroes(?), or dry humour, I’d pick up Slow Horses and give it a read. There are currently nine books and a few novellas. I would recommend following the order. The characters grow and change with each book, even if the throughlines in the stories are not particularly broad.

Heck, I have enjoyed them so much I might go back and give the TV show another shot. Sometimes seeing how the screenwriters turn a book into a show adds to the fun.

Cleaning out the Cobwebs #1

Tue, 13 Jan 2026 00:00:00 UTC

Inspired by a few things, but primarily Cliff’s Cliff Notes. I don’t intend on these being on any specific cadence, but just a way to dump some thoughts that I have been toying around with but don’t feel like fleshing out.

I broke my shoulder the Friday before Christmas in a fall on the ice. I finally went to the Dr. three weeks in, had an MRI. We found that I broke my greater tuberosity. My left arm is in a sling and I start PT soon. Thankfully it was not a torn rotator cuff, which was the initial fear of my Dr.
I had to stop skating lessons due to this, too much risk of a major injury if I was to fall. I am sad, but learned there are summer classes. I setup a changedetection.io watcher on the lesson search page so I can be notified when they open. Works as both a way to ensure I get in and as a reminder to actually sign up. This little tool is fun to find uses for.
Sports have been fun the last few weeks. College Football playoffs have been interesting, if kind of boring on the field. NFL playoffs were insane this last weekend, so much fun. Wolves are rolling and Wild, though struggling are fun with their big acquisition of Quinn Hughes. Not a bad set of circumstances when I am trying to stay mostly still.
In other sports news. Saint Paul was the host of the World Juniors hockey tournament. We were able to snag tickets to one of the USA games. It was a lot of fun. The game and the events around it were great. I really hope they can host again in the next decade.
My injury has definitely made typing more challenging. I am still looking for other options, but I discovered Handy, which is pretty nice. Lets me hit a button on my keyboard and speak to put text into any text field. It is not perfect, but for quick notes and thoughts it does enough.
I snagged a refurbished OLED Steam Deck after my changedetection.io instance alerted me to availability. Tough to play much with a single arm, but I am excited about the possibilities. Poked at Blue Prince for an hour or so today, which is a great title when you can be relaxed with your reaction times. I am not sure I quite get the game yet, but I have yet to feel stuck.
This will inspire a longer post, but I am also working on an esphome backed fireplace fan controller. Basically I want to replace the fan we bought when we moved in with a quieter, controllable version. Today I got the first fan wired up correctly so I can control the speed through Home Assistant. Running into some connectivity issues where the esp32 loses communication with Home Assistant, which is a weird bug I will figure out.

Self Hosted Slashpage

Mon, 05 Jan 2026 00:00:00 UTC

Two years ago I posted information on my homelab. Today I am publishing a new slashpage /self-hosted which will be the new place to showcase the services I am hosting. I hope to keep this updated at least quarterly. I have plans on putting more information on how I am hosting the various services as well as the list of services.

Addressing Annoying Wiring with Smart Devices

Sat, 03 Jan 2026 00:00:00 UTC

This fall, we did some updates to our dining room. Along with adding a fun fake brick wall to a closet we repurposed for a dry bar, we replaced our lighting with much brighter lights.

The wiring in the room had a two way switch for one of the lights with an outlet in between. This outlet was not in a great place for lights or really any device you might want to control with a switch. In fact the main purpose we put it to was vacuuming. Regardless we do not use the outlet much, but we also wanted a dimmer. Installing a dimmer switch with a standard 110V outlet downstream will damage either the equipment or the switch.

So my ideal scenario was that we would wire the outlet directly to mains bypassing the switch. The existing wiring made this impossible without opening walls. Not a project I was interested in starting, but maybe one day.

After some brainstorming I realized that having Home Assistant could give me a solution.

I installed a Shelly Dimmer 2 behind the light fixture. This allowed me to control the on/off state of the light and dim it through Home Assistant.
Next I installed new Zigbee compatible switches, but I left the load disconnected. Instead I wired the hot wire directly from the main to both the outlet and switch load wires, keeping both always powered. This meant the outlet was always powered as was the Shelly Dimmer.
Finally, I created new Home Assistant automations that mirrored the state of the Zigbee switch to the Shelly Dimmer.

Overall this has worked really well. I do wish that the dimming was a bit smoother, there is definitely a bit of a hiccup between when the zigbee switch reports it is dimming and the Shelly gets updated. And occasionally there is a brief stutter from toggling off/on and the light responding. But in almost 4 months we have had only a couple instances of it getting out of sync or failing to respond.

This modification has broken one of my rules for Home Automation, which is that all devices should be functional even if the smarts go out. If we lose wifi or Home Assistant goes down, the light stays in its current state until service is restored. But rules are meant to be broken and being able to dim the lights and also fix the outlet/light dependency made breaking this rule acceptable.

One other thing this has led me to do is create a wiki for our home. It is a work in progress, but my end goal is a manual for all the weird quirks we either create ourselves or find as we continue this homeownership journey.

Here is the template for the automation if you are interested.

description: "match state of dimmer switch to state of shelly dimmer"
triggers:
  - entity_id:
      - light.dining_room_north_dimmer_switch
    trigger: state
conditions: []
actions:
  - if:
      - condition: device
        type: is_off
        device_id: light.dining_room_north_dimmer_switch
        entity_id: light.dining_room_north_dimmer_switch
        domain: light
    then:
      - type: turn_off
        device_id: light.dining_room_north_dimmer
        entity_id: light.dining_room_north_dimmer
        domain: light
    else:
      - action: light.turn_on
        target:
          entity_id: light.dining_room_north_dimmer
        data:
          brightness: >-
            {{state_attr('light.dining_room_north_dimmer_switch',
            'brightness')}}
mode: single

2025 - Food I Remember

Mon, 29 Dec 2025 00:00:00 UTC

I have been in a bit of a “work” funk and have been spending maybe a bit too much time clicking around Kagi’s small web feature. That has led to several year in review posts, which can be really fun, even if you are not familiar with the writer.

I started to think about what I remember about 2025, I did a what I have done post, but the other thing I like to think about is, meals that I remember. Maybe this becomes an annual tradition.

Whipped Feta and Calamari at Balaboosta - After a detour to a Jonathan Waxman restaurant, we arrived here, which was our original plan. The whole meal was amazing, but the calamari, which was not fried and the feta, which was like a dream still resonate with me.
Prosciutto & Burrata at Barbuto - Due to a naming mishap, I tried to spell Balaboosta and managed to get closer to Barbuto and failed to verify. We ended up eating one of the most ridiculous Prosciutto and Burrata dishes. Just amazing cheese draped with amazing cured pork.
Scallop Crudo at Spoon & Stable - The whole dinner was amazing, but this was so light and so refreshing. It was one of the few times I have had tepache and it was a great introduction.
Cachapa at Crasqui - Cheesy pancake goodness. I really do not have much else to say.
My Brisket on Thanksgiving - I have made brisket several times, but this one was just perfect. almost 20 hours on the grill with a 6 hour rest. Worth every moment of my time.
Hot Dogs at Rudy’s - The whole experience was perfect. NYC is such a great place to visit, and when you find beer for $4, you have to go. But the kicker is you get a free hot dog with every drink and they are actually good. Anthony Bourdain filmed here and we get it.
“Redemption” Paisano at Pezzo - Pezzo is one of my favorite hometown spots. Great pizza, good wine, nice people. But mid-year we stopped in and it was not right. The only thing good was the bar service. But they changed ownership and we went back and it was the old experience. They did not call it Redemption, but it is the story I tell myself.
Barramundi at St. Pierre - I had remembered Massimo making a dish with crazy water on Top Chef and being intrigued. This was so, so good.
Oysters at Smack Shack - Mostly because I shucked them myself, but all 12 were delicious
Bolognese at Acqua - Another local favorite, I might actually go check for reservations for NYE right now.
A pretzel from Aki’s Breadhouse - Eaten outside while listening to 4 on the Floor.
The eggrolls at Thai Boat 89 - I went for the Pho and ordered this for some reason and wow.

A few other hits; Momos at Marketfest, Hoagie from Cup n’ Cone, Pocket Full of Soul from Ville City Pizza Co, the perfect Tex Mex Nachos at Pinehaven farm, savory cannoli at Liliana, dumplings at Thep Thai.

I have no photos of this food. I never remember(or really want) to take photos of my food. But maybe this coming year I can remember to photograph menus consistently. That is more interesting to me anyway.

Using Docker VLANs

Mon, 22 Dec 2025 00:00:00 UTC

My homelab is the unfeeling brain of my home. Without it we would survive, but boy would we miss some things. Two of the most important are Homeassistant and Pihole.

A few months ago I was troubleshooting some DNS issues on my internal LAN. More often than I would like, DNS was super slow and local name resolution was either not working at all, or working randomly.

My DNS is setup so that local clients should ask Pi-Hole for the address first. If Pi-Hole does not have the address on a block list and does not have it cached, it hits Unbound DNS. Pi-Hole lives on my NAS in a docker container and Unbound is a service on my edge router running OPNsense. I register any local names on OPNsense, allowing Pi-Hole to focus on blocking and caching.

My issue is that exposing port 53 for both TCP and UDP was not reliable. Pi-Hole’s official documentation recommends assigning NET_ADMIN as a capability for Pi-Hole. NET_ADMIN grants broad control over the network stack, and I wasn’t comfortable giving Pi-Hole those elevated privileges just to bind DNS ports.

For Home Assistant, I had purchased a Tempest weather station, which is wonderful because it can operate fully locally. It broadcasts the data over multicast UDP. Which is a little weird, but also allows anything you wish to have locally read the data. Since Home Assistant was on its own docker network it was unable to listen to these UDP packets and find the device.

Enter ipvlan. By default, Docker isolates containers in their own network, which blocks multicast and broadcast packets from reaching them. ipvlan lets containers get real IP addresses directly on your physical LAN instead, so they can receive all the network traffic they need. Since I use OpenTofu, in my .tf config I created the network:

resource "docker_network" "vlan" {
  name   = "ipvlan"
  driver = "ipvlan"

  ipam_config {
    subnet   = "10.49.1.0/24"
    gateway  = "10.49.1.1"
    ip_range = "10.49.1.0/24" # optional
  }

  options = {
    parent = "enp2s0f0"
  }
}

Then in any container where I would like it to have a real IP address, I added:

networks_advanced {
    name         = docker_network.vlan.name
    ipv4_address = "10.49.1.99"
  }

Updated 2026-01-27: Be sure to keep your subnet updated to match your network topology or you might find weird issues down the road

Now instead of assigning my NAS’s primary IP as DNS I was able to assign 10.49.1.99 and Pi-Hole had full access to the network over UDP, multicast, and TCP. By doing the same for Home Assistant I was not only able to discover and easily add my Tempest device, but I also found that using Chromecast devices was much more stable.

While this does expose the container more directly to the network, it removes the security hole that granting a service NET_ADMIN permissions opens up, only exposing the container to the network instead of giving the container the right to modify your networks.

I still access the web interfaces for both these services via proxy; this gives me SSL and allows me to restrict access to only local network devices, either on my physical LAN or via Wireguard.

Notes:

enp2s0f0 is a secondary network device on my NAS. You can use any physical network device on your machine. I happened to have a second network device that was barely utilized.
Technically both services can be accessed via their web interface over their assigned IP. Ideally I should probably set up firewall rules to block that completely. It would be trivial to do this with ufw.
You can also mark the vlan as internal and tag the traffic for 802.1Q isolation. I have not used this, but it is on the “want to explore” list.

YNAB - A Tool I Love

Thu, 18 Dec 2025 00:00:00 UTC

I recently had a friend bring up some efforts they were making to change how they budget. I immediately jumped in and told them I use YNAB and that it was a life changer for me. I was working on a recommendation email for them and this blog post fell out.

I have been using YNAB for 10 years. This means I started with the fully offline version and migrated to the web app, which meant a monthly subscription, a jarring change at the time. Now, it is one of those things I am happy to pay for every year. It gives me significant peace of mind. I say that even as I try to move more and more services to be self-hosted, nothing I have found has made the trade-offs worth it.

But why do I love and pay for YNAB?

At its core, the system is just an envelope system: set aside money for a specific thing, spend from that envelope when it’s time. Then around that core function is the philosophy. The app does not enforce things; it’s just there to help you pull it off. These days they call the philosophy The Method. I distill it into:

Every dollar you actually earn needs to be given a job.
Do not anticipate earning a dollar, even if you expect a check to land tomorrow, it does not exist until you have it in your account.
You should expect adjustments; your budget is not written in stone.
The better you know your spending, the easier it is to put money into that envelope today for spending in the future. It helps avoid scrambling to figure out how to pay for predictable but irregular expenses.
Plan for fun spending and actually spend it. For example, I have an “Allowance” for both me and my wife every month. It has no rules; it’s just there in case either of us spends on something unexpected, which happens pretty much every month. Your budget should not be limiting, it should be freeing, at least eventually.

The reason YNAB clicked with me back when I was younger and dumber was that it preached flexibility. So I would often say something like, “hey, this month I had to replace my tires, so I didn’t get to put money in my vacation bucket” That’s fine, even if it is disappointing. Granted the stakes are different now that I own a home and share a life with a spouse, but the same philosophy applies. They used to call this Roll with the Punches. It was extremely freeing since it didn’t make me feel like a failure if I had to adjust mid-month. It also helped me cushion for predictable expenses. The first year, every time an unexpected, but predictable, expense popped up, it was a Roll with the Punches moment since I did not have money ready for it. But then I created a new category and set aside money every month to pay that expense when it would resurface. Yes, even my driver’s license has a category. I put aside $1.58 a month. Insane? Yes. Freeing? Yes.

The big actions are creating categories and then setting goals for that category. Goals can be:

The exact dollar amount of a bill (your mortgage, cell phone bill)
An amount to set aside to spend that month that will likely fluctuate (groceries, dining out)
An amount to save for a future known expense (insurance premium, Costco membership)
An amount to save for some unknown date (unexpected house expenses, travel).

I have my system down so that when I get a paycheck, I can mostly just have the system auto-distribute it, but that took a lot of time honing my budget. It takes time to make the software work for you, but that time is hopefully spent adjusting your relationship with money. It did for me. I spent the first 10+ years of my adult life fighting with money. It never seemed like I had enough and I was always on the cliff. Part of what changes is I got lucky and got a job in development, but the other change was YNAB. Figuring out how to track and understand my spending through their lens was a gamechanger. I highly recommend giving it a shot.

If you like this post and want to give it a try, this referral link will get us both 1 month free if you sign up at the end of your trial.

Hello Again

Tue, 16 Dec 2025 00:00:00 UTC

My last post was back in April, not exactly meeting my goal of a post a week. But I have made a few changes to reduce the friction of publishing posts. In the meantime, I was busy this summer. A few things that kept me busy.

Patio Project

In May we tore up our old brick patio. Several months later I laid the final brick on our new patio. This was an intense project, and maybe something I should have hired out. But the pride I get when I look at it now is worth the blood, sweat (so much sweat), aches and pains.

Before, we had red bricks that were extremely uneven, lacked drainage, and had lost any semblance of a border.

Now we have brand new pavers on top of 8 inches of tamped down class 5 and leveling sand. We expanded it quite a bit by going straight across instead of “curving” like our old patio did.

In addition, we installed a drainage system. Our yard and house grade is a little wonky, so to make the patio sit above the grade of the yard we had to slope it inwards. So under the middle of the patio we installed a 50 gallon drain barrel with an overflow to the side yard. I installed a hidden drain which worked well all summer. I might write a longer post on this in the spring if it works well during winter and the thaw.

Retaining Wall

The back of our back yard ends in a steep drop to an alley. There must have been a retaining wall there years ago, but by the time we moved in it was gone. It was an overgrown, uneven eyesore, that was slowly eroding away. We cleaned it up by installing a new wooden retaining wall and extending the concrete block wall along the driveway. I expect we will need to replace it within 10 years, but it is a significant improvement at a reasonable cost. Excited to plant some native flowers in the spring.

ASL

At the prompting of my friend and business partner, I enrolled in my first college class in 20-ish years. I just wrapped up an accelerated version of ASL 1 and ASL 2 at Saint Paul College. This was a challenge, but I mostly enjoyed it. American Sign Language is such an expressive and fun way to communicate. I am looking for other ways to continue my learning, as another accelerated course is not in the cards for next year.

Converted a Closet to a Bar

Our dining room came with a coat closet, which makes some sense if we ever used our front door, which we do not. So my wife designed a bar and we made it happen. The brick is glued on, then we used actual mortar. The cabinets were custom made by a local company and they did great work. The light came from our last home. We had purchased it for the dining room then and still loved it, but could not figure out a good location for it herer. So this was a double win.

Oyster Shucking

It was just one evening, but I took an oyster shucking class on National Oyster Day. It was easier than I anticipated, and something I would be happy to do again. It was hosted by Smack Shack and came with several beverage pairings.

Yard Destruction

One of the outcomes of the patio build was the yard between my fence and the street was torn up. I had dreamed of getting rid of the turf grass there and took the opportunity to cover it in mulch. If you are ever looking for wood chips, Chip Drop is amazing.

I have several post ideas in my head, so hopefully I can end 2025 and start 2026 with some interesting content.

Check your Groups

Tue, 08 Apr 2025 00:00:00 UTC

In preparation for rebuilding my home server with some parts sourced from eBay, I made a point to upgrade to the latest LTS version of Ubuntu. I was two versions behind, not yet out of support, but with the new hardware I was inspired to make the move.

In general, upgrades on fungi (my server) are fairly painless. All my services run in Docker containers, so the underlying OS has a limited role. At first, everything seemed to go smoothly. My services were running, I could access everything, and there did not appear to be any surprises.

A few days later, I got a note from my mother-in-law saying she was having trouble accessing some content I host. I run Plex and have a small router at their house that creates a WireGuard connection back to my server, letting their Roku stream content from my house. It has worked flawlessly for a long time, until suddenly it did not. I could not isolate the problem and was left saying, “I don’t know,” which never inspires confidence in your end-users.

I did some troubleshooting but could not find a clear reason for the issue. Then, I started running into playback issues while watching a movie at home. I quickly logged into fungi from my phone, and BINGO htop showed Plex transcoding was chewing up my CPU. This was strange, because I have an older GPU installed specifically to avoid this.

It did not take long to figure out that during one of the major version upgrades, Ubuntu had changed the group ownership of the video card device. Plex could see the GPU but could not use it. A quick usermod -aG video plexmediaserver && docker restart plexmediaserver later, CPU usage dropped to nothing, and I could see my GPU calmly sipping on MP4 frames.

I am a little annoyed that Plex gave no indication anything was wrong. I had checked the transcoding settings, and the GPU was selected and nothing suggested it was unusable. I would have preferred a loud failure with an error message about an inaccessible transcoding device over silent fallback. But I also know the Plex team puts a lot of effort into the whole “just work, dammit” approach, which sometimes leads to these kinds of tradeoffs.

A naming system

Mon, 07 Apr 2025 00:00:00 UTC

I think I started running a “server” in my home sometime around 2009. I honestly can’t recall what I used it for, but I know I upgraded my PC and then took the old system into our basement and hooked it up as a headless server. I have no idea what I gave it as a hostname it but I assume it was something boring.

Once I had my own apartment, I remember thinking a bit more about what I was going to name my server and desktop. I do not know why, but I ended up naming things after locations in the Redwall book series. I know I used both Redwall and Mossflower. I probably used a few others but it was early 2010’s so there was not nearly as many devices connected to my home network.

During my last rebuild, during Covid. I switched things up. I did some thinking and ended up deciding that everything was going to have a hostname related to food. Food is magic and I love cooking and eating. It makes naming things a bit more fun.

I don’t name every device, but it is fun when I do. sometimes it is something I just ate, sometimes it’s just a food I love. I have named systems, fungi, bucatini, burrito, cheeseburger, baobun, and burrito. The great thing is that the list of options is almost endless. I also named my wi-fi networks after food items. It is fun to tell people they can use “pepperoni pizza” to connect. A lot more fun then “Asus_WR3332”.

Would I use this if i was provisioning systems for an organization? No, the names are not meaniful to anyone but me. But for my home network the only person who cares is me, so I can have fun if i want to.

Funny enough, I just switched to using Wasabi as my offsite backup service. I did not choose it due to the name, but it was a nice perk.

Using Gnu Parallel for chaos

Tue, 01 Apr 2025 00:00:00 UTC

I’ve used Gnu Parallel in the past, and it’s an exceptional tool for processing a large number of tasks. I highly recommend it.

Today, I started a task where we generate 5,000 things. Each task runs for about 10-15 minutes, generates a bunch of data, modifies it, and writes it elsewhere.

Last week, I ran this running parallel commands seperately on on five different machines. which was kind of a pain to manage. So today, when kicking off another batch of 5,000, I came up with this command:

parallel --eta --progress --joblog jobs.log --tagstring {} --results output -j 10 --delay 10 --retries 4 -S ubuntu@10.0.0.213,ubuntu@10.0.0.66,ubuntu@1 0.0.0.58,ubuntu@10.0.0.71,ubuntu@10.0.0.14 "IDENTIFIER={} REALM=2 /home/ubuntu/bin/run" ::: {1..4999}

Which produces this lovely output.

Computers / CPU cores / Max jobs to run
1:ubuntu@10.0.0.71 / 16 / 10
2:ubuntu@10.0.0.14 / 16 / 10
3:ubuntu@10.0.0.213 / 16 / 10
4:ubuntu@10.0.0.58 / 16 / 10
5:ubuntu@10.0.0.66 / 16 / 10

Computer:jobs running/jobs completed/%of started jobs
ETA: 0s Left: 4999 AVG: 0.00s  1:10/0/20%/0.0s  2:10/0/

Now I’ve got 50 jobs running across five machines, and as they complete, more will start until we hit all 4,999 tasks (I already created job 0 earlier, which brings the total to 5,000).

Quick breakdown.

--eta outputs the expected completion time based on how long completed tasks have taken. (It currently shows 0 because no jobs have finished yet.)
--progress shows how far along we are
--jobslog jobs.log maintains a file of completed jobs. Can be used to restart the entire run if something goes wrong.
--tagstring any stdout that goes to the screen get prefixed with x where x is the input 1-4999.
--results store the job stdout and stderr to files in /output
-j 10 runs up to 10 jobs on each machine
--delay 10 wait 10 seconds before starting new jobs.
S ubuntu@... is a comma-separated list of hosts to run jobs on. You can include localhost too. It’s also possible to set a specific number of jobs per host.

Finally you have the command, followed by ::: {1,4999} In this case we are expanding the input to be all the numbers between the two digits. Finally, the ::: syntax is followed by {1..4999}. This expands the input to all integers in that range.

This was fun and I hope you find an excuse to use parallel in the future.

Tofu/Terraform Whoopsie

Fri, 28 Mar 2025 00:00:00 UTC

Here’s something dumb you can do with Tofu + HTTP state

terraform {
  backend "http" {
    username       = "${var.tfstate_username}"
    password       = "${var.tfstate_secret}"
    address        = "${var.tfstate_host}/client/${var.tfstate_team}/${var.tfstate_project}/${var.tfstate_environment}/state"
    lock_address   = "${var.tfstate_host}/client/${var.tfstate_team}/${var.tfstate_project}/${var.tfstate_environment}/lock"
    unlock_address = "${var.tfstate_host}/client/${var.tfstate_team}/${var.tfstate_project}/${var.tfstate_environment}/unlock"
    lock_method    = "POST"
    unlock_method  = "POST"
  }
}

Then point tfstate_host at the very server your managing with this Tofu config.

Now run a plan that takes down that box’s state server or proxy.

What happens, you might ask?

Tofu cheerfully builds the plan. You don’t think twice. You type:

tofu apply bad-idea.tfplan

It starts applying… and then suddenly throws a big red error:

🚨 “Failed to update state”

Well duh. The HTTP state server is gone. So now you’re in a half-broken world — the proxy’s down, random containers might be gone, and your infra is in limbo.

What do you do to fix it?

Here’s what I ended up doing:

Spun up a new lynx instance manually:

   docker run -d -p 4000:4000 --name tmp-lynx clivern/lynx:latest

(There is more to this command, but basically you can convert your .tf definition to a docker run command, adding exposing port 4000.)

Connected it to the right Docker network so it could talk to my database:

   docker network connect --alias lynx network-lynx tmp-lynx

Updated my tfstate_host variable to point to localhost:4000
Unlocked the state manually:

   curl -u username:password -X POST http://localhost:4000/client/team/docker/prod/unlock

Reconfigured Tofu:

   tofu init -reconfigure

Ran a fresh plan, crossed my fingers that it would recreate the missing containers.
Applied the plan and verified everything came back, especially the Lynx container.
Cleaned up the temp Lynx:

   docker stop tmp-lynx && docker rm tmp-lynx

I also added lifecycle rules to my Lynx container in Tofu to prevent deletion:

lifecycle {
  prevent_destroy = true
}

And I wrote a little shell script that handles spinning up a temp Lynx container in case I ever do this again.

The “right” answer is probably to move Lynx out of Tofu entirely… but that’s a problem for another day.

Recommendation: Mealie

Mon, 25 Mar 2024 00:00:00 UTC

I used an Android application called Cinnamon for years to manage my grocery shopping. It was very unstructured, allowed me to put items in different categories like “produce”, “meat counter”, “deli”, and mostly just stayed out of my way. It provided just enough help to make it more useful than pen and paper. Sadly, the author stopped updating it, and when I moved to a new phone, I couldn’t transfer it over without hoop jumping.

I tried Home Assistant’s task feature, tried using a plain text list, and even contemplated building my own, but none of those really worked for me.

At the same time, I was struggling a bit with recipes. I love cooking, and love trying new recipes, but I found myself thinking back to recipes I had tried from my various cookbooks and magazines and being unable to recall which ones we really loved. I needed a better way to manage recipe recall.

Obviously, this could all be solved with a pencil and paper or a text file. But I know myself, that wouldn’t be a long-term strategy. So I did some research to see if there was a recipe application I could host myself.

My research led me to Mealie, a self-hosted and open source (AGPL) recipe manager.

Here is a bit about how I use Mealie.

Recipe Imports

I subscribe to a couple of magazines, and tend to get a lot of inspiration from them. Before, I would find a recipe, set the magazine aside, cook the recipe a few weeks later, then file away the magazine. Weeks or months later, I would have to dig through my entire collection to figure out which issue the recipe I made came from. Sometimes I never could find it.

With Mealie, when I find a recipe I want to try, I flag it, usually with some painters tape. Then later, I go through the magazine at my computer, open Mealie, find the online version of the recipe, and import it. Mealie grabs the ingredients, instructions, and description and creates a new recipe. Then I can add any additional information. I usually tag the recipe with the magazine I found it in and add a note for the issue and page. So I get the joy of enjoying a physical magazine and finding things to try, but then digitize it for easy retrieval.

I do the same thing for recipes I might discover when browsing the web. I have also started adding recipes from cookbooks I own that I consider go-to options.

Tracking New Recipes

There are always new recipes I want to try. I used to either keep a stack of magazines somewhere or try to just remember that I saw something. Now, I just tag anything I have not made yet with #totry. I have a cookbook that only shows me those recipes. So when I want to try a new recipe, I can find something quickly. Once I make it, I not only remove that tag, I can track when I made it and rate it. Long term, this will be super helpful for letting me return to recipes we love and sharing those with friends and family.

Meal Planning

Ever since Covid Quarantine, my spouse and I go shopping together once a week. This is a departure from pre-covid when we would both shop on our own and I would often shop multiple times per week. Having the good fortune of both working from home has kept us shopping together. This change means that we usually have a meal plan prepared before we go shopping. I wish I had had something like Mealie early in this transition, because I have found that being able to go into the app, add things I want to cook to specific days to be much better than my old notebook solution. I just add a recipe to the plan and after confirming with my spouse that we are not making similar things, I can build my shopping list using the recipes. I can add all the ingredients from the recipe, excluding those I know we already have on hand.

A couple of “Hacks”

Placeholder Recipes

I have a subset of meals that I use as a base and then relying on what we have in the fridge or what looks good at the store, the garden, or farmers market.

One example of this is pizza. I love making pizza, but I rarely know what kind when planning. So in those case, I can just make a placeholder meal to throw on my plan. I sometimes add the “core” ingredients that I almost always purchase to the recipe. For The Pizza recipe, I only have Cheese in that section since I rarely buy sauce or crust and tend to choose my toppings in the moment.

Pantry Label

There are things like olive oil, salt, soy sauce, etc., that we almost always have on hand. I label these as Pantry, and when I am building my shopping list, if I am not 100% sure we have enough for the recipe, I can add them to the list and “hopefully” check before we head off to the store.

Finally, because why not, I have integrated Mealie with this site. So I can now select a recipe to share and when the site publishes, it gets a page on my site. This is not only fun for blog purposes but is also a nice way for me to share recipes with others without needing to publicly expose my recipe site to the public Internet. I actually wrote a post about this already if you want to know some of the technical details. A simple recipe I am sharing this way is this super easy and delicious pasta.

I hope you give Mealie a try, the author is working on launching a paid version that might be a great option if you are not someone who wants to host it themselves.

Integrating Webmentions with Astro

Mon, 18 Mar 2024 00:00:00 UTC

I spent a bit of time over the past week and weekend learning a bit more about webmentions. I finally learned enough to get them enabled on this site. You can see the first mention displayed on my ai naming post. I thought I would write up a post showing how I got mentions working.

Receiving

Initially, I had plans of writing my own webmention receiver, but after some consideration I decided that using an open source tool would be faster. I did not find a lot of options, and I settled on installing webmentiond. This seems to be a solid implementation that is written in Go and can be fairly easily hosted using Docker which met my requirements. I have yet to run into any missing features I care about, but knowing I can learn some Go while extending it is a plus for me.

After getting this up and running, I was able to successfully start receiving webmentions.

Displaying

Webmentiond provides a small Javascript snippet that can fetch webmentions from your server based on a page’s url. This is basically a JS widget. Since one of my goals for this site is not running any required javascript, this approach did not work for me. I ended up adding functionaity to my Astro site to include the mentions at build time.

CI Authentication

Happily webmentiond provides a simple api that we can use to fetch all mentions for your site with 2 requests. The first request uses what is technically a preshared key to generate a access token. This key should be generated by you, stored security, and added to the startup uption for webmentiond. This looks like:

--auth-admin-access-keys YOUR_GENERATED_KEY=ci

Note that the =ci portion is just an identifier, it can be anything, but ci works well since the main use is to integrate this into a Drone build process.

Fetching your mentions

Now that we have a preshared key, you will want to add two new ENV variables. For development purposes I just added these to a .env file in the root of my astro projects.

PUBLIC_WEBMENTIOND_TOKEN = The url that is used to access your webmentiond instance 
PUBLIC_WEBMENTIOND_URL = YOUR_GENERATED_KEY

Then we can fetch the mentions. The code for this looks like*.

let promise: Promise<Response>;
let fetching = false;
import type { Response } from "./webmentions";
export default async function(approved=true) {
    if(!fetching) {
        fetching = true;
        
        promise = new Promise(async (resolve) => {
            const mentions = await fetchMentions()
            if(approved) {
                resolve({items: mentions.items.filter((mention) => {
                    return mention.status === "approved"
                })});
                return
            }
            
            resolve(mentions);
        })
    }
    return promise;
}

async function fetchJWT(){
    return await (await fetch('https://wm.connermccall.com/authenticate/access-key', {
        method: "POST", // Using POST method
        headers: {'Content-Type': 'application/x-www-form-urlencoded'},
        body: \`key=\${import.meta.env.PUBLIC_WEBMENTIOND_TOKEN}\`,
    })).text();
}

async function fetchMentions(): Promise<Response>{
    const jwt = await fetchJWT();
    return await (await fetch('https://wm.connermccall.com/manage/mentions', {
        headers: {'Authorization': \`Bearer \${jwt}\`},
    })).json()
}

In this code you’ll notice I wrap the fetch in a Promise. This prevents the Fetch from running for every single post. This approach caches the first request and reuses the response for all future posts. The chain of requests is to first use the long lived token to fetch a JWT token, then use that JWT token to fetch the mentions.

One thing you may want to do from a security standpoint on your webmentiond service is set --auth-admin-access-key-jwt-ttl to something like 10s or 30s. Since we do not reuse this key it should expire almost immediatly after we use it.

*Technically I should have made these a data content type in Astro

Displaying mentions

Now that we have a way to fetch our mentions, we need to actually display them. In this case I created a new .astro file that exports a React component to fetch and display the mentions based on a slug.

import fetch_webmentions from "../lib/fetch_webmentions";
import Like from './mentions/Like.astro';
import Reply from './mentions/Reply.astro';
import Repost from './mentions/Repost.astro';
import Mention from './mentions/Mention.astro';
import Rsvp from './mentions/Rsvp.astro';
import Comment from './mentions/Comment.astro'
interface Props {
	slug: string;
}

const { slug } = Astro.props;

const mentions = (await fetch_webmentions()).items.filter((mention) => {
    return mention.target.indexOf(slug) > -1
});

---
<div class="webmentions mx-auto mb-2 text-base">
    {mentions.length > 0 &&  <h2 class="text-lg">Mentions</h2>
 <ul class="mb-4 text-base ">
    {mentions.map((mention)=> ( 
        <li class="mb-4 border-b">
            {mention.type && mention.type === 'like' && <Like mention={mention} />}
            {mention.type && mention.type === 'reply' && <Reply mention={mention} />}
            {mention.type && mention.type === 'repost' && <Repost mention={mention} />}
            {mention.type && mention.type === 'rsvp' && <Rsvp mention={mention} />}
            {mention.type && mention.type === 'comment' && <Comment mention={mention} />}
            {mention.type && mention.type === 'mention' && <Mention mention={mention} />}
            {mention.type === undefined && <Mention mention={mention} />}
        </li>
    
    ))}
    </ul>}
    <p><a class="text-sm text-gray-600" href="/replying">How to reply to this post</a></p>
    </div>

Now in my BLogPost.astro layout, I can just add <Mentions slug={slug} />

This component fetches the mentions, filters for the mentions with a target that matches the given slug, then displays the mention using a specific component based on the type. This makes it extremely easy to work with a single mention type, add a new type, or even remove a type all together. Based on my reading the six types I chose should be the most common types you would encounter.

A lot of folks are using Webmention.io to handle receiving webmentions. If you go that route, you would need to modify fetch_webmentions to use their endpoint for fetching all links on your domain. You’ll likely need to modify the rest of the code to match what the JSON format for the mentions looks like.

You can see the code for my site, including the webmention pieces on github.

Enabling webmentions

Fri, 15 Mar 2024 00:00:00 UTC

I finally finished one of the tasks I had remaining for joining the indie web. This site now support webmentions.

I wrote a post with some details on how I implemented them.

OTP on the CLI

Thu, 14 Mar 2024 00:00:00 UTC

I have used a Yubikey as the primary way of managing my OTP codes for several years now. I usually use the Yubico Authenticator application, which is great. But, sometimes when I am working in my editor and terminal I just want to stay there.

So I wrote this little wrapper around ykman to make my life a bit easier. It is very simplistic, but it gets the job done for me. To use, just make sure it is executable and in your path, then you can just type something like otp github and it will stick the code into your clipboard, assuming you have xclip installed.

#!/bin/bash
# alias pbcopy="xclip -sel clip"
if [ -z "$1" ]
then
   echo 'need account name '
   exit 1
else
    CODE=$(ykman oath accounts code $1 | awk '{print $NF}')
fi
echo $CODE | xclip -sel cli

The only error checking this does is check to ensure you pass an account name. If you have multiple accounts that match your account name, things will be weird. I also do not think this will handle codes that require touch.

Stop Saying AI

Wed, 13 Mar 2024 00:00:00 UTC

In a conversation with a colleague today I realized I have decided to no longer refer to LLMs as AI. I guess this is my tiny rebellion against the ongoing hype.

I think LLMs are amazing and have made work that I used to really dislike a lot less frustrating. You can probably tell I use DALL-E to generate some of the hero images on this site. I use one to help me proofread and edit things quite often. They are going to have negative impacts on the number of jobs in some industries. But they are not intelligence and anyone who spends time with them quickly realizes they are just a very superpowered suggestion engine. AI gives the idea of them way more power than they deserve, so let’s stop calling them that.

Adding External data in Astro

Thu, 07 Mar 2024 00:00:00 UTC

I am working on a longer post about how I have started using Mealie to organize my recipes and manage my grocery list. In the middle of that, I decided I wanted to have an easy way to share recipes from Mealie. I currently block external traffic to Mealie, so the “share” feature that is built into it does not work for me. I could open it to public traffic, but I am working toward a zero trust policy on my network so that would go against that philosophy.

I built this site using Astro so I had flexibility, and I realized I could fetch recipe data from the Mealie API. So, what if I used Astro to fetch the data and used that to generate my recipe content? Turns out you can, I wired things up, and I can now easily choose recipes from Mealie I want to share, add a bit of context, and when my site deploys it includes the recipe details. The nice thing is that if I tweak a recipe, those tweaks show up the next time I publish content, without any effort on my part.

You can use this same method to fetch data from pretty much any source to add external data to a static site built with Astro.

Here is how I integrated Mealie into my Astro site.

First, I created a content collection. Add this to src/content/config.ts

Technically you could use the external data directly, but having a collection gives more control than just fetching.

const recipes = defineCollection({
	type: 'content',
	schema: ({image}) => z.object(
		// Using this so that I do not need to build fetching of images into the process. It is an extra manual step, but then we can take advantage of Asto's image handling. 
		heroImage: image().refine((img) => img.width >= 1080, {
			message: "Cover image must be at least 1080 pixels wide!",
		  }).optional(),
		// This is the slug for the recipe in Mealie
		recipe_slug: z.string(),
		pubDate: z.coerce.date(),
		is_draft: z.boolean().optional().default(false)
	}),
})

In this code the heroImage is an image I store in the content directory of my site. and recipe_slug refers to the slug of the recipe in my Mealie site.

Next, you will want to create two new pages src/pages/recipes.[slug].astro and src/pages/recipes/index.astro. You can skip the index page if you do not want a listing page.

In [slug].astro, you need to export a getStaticPaths function that will first fetch the ContentCollection, then fetch the recipes from Mealie and augment the data. If you are only using the external data, skip the getCollection call and just fetch your data.

export async function getStaticPaths() {
	// fetch all the recipes async. If the number of recipes grows we may need to rate limit this.
	const merged = await Promise.all((await getCollection('recipes')).map(async (recipe) => {
		// we just brute force the data together, but you could cherry-pick your data. I also ensured recipe is last so I could override values from Mealie if wanted.
	const from_mealie = await fetchRecipe(recipe.data.recipe_slug);
		return Object.assign({}, from_mealie, recipe)
	}))
	// sort by the blog publish date
	const recipes = merged.sort(
		(b, a) => a.data.pubDate.valueOf() - b.data.pubDate.valueOf()
	).filter((recipe) => {
		return recipe.data.is_draft !== true
	});
	// this is tells Astro how to build the paths for the pages. 
	return recipes.map( (recipe) => ({
		params: { slug: recipe.data.recipe_slug },
		props: recipe,
	}));
	
	async function fetchRecipe(slug: string) {
		const response = await fetch(\`https://yourmealieurl/api/recipes/\${slug}\`, {
		method: 'GET',
		headers: {
			'Authorization': \`Bearer \${import.meta.env.PUBLIC_MEALIE_API_KEY} \`
		}
	})

		const recipe = await response.json();
		return recipe
    }
}

This code gets all the .md files under /src/content/recipes, then for each recipe we fetch the data from Mealie with the slug. Once fetched we merge the data from the content collection with the data from the Mealie API. Then we pass the merged object to a Recipe Component.

type Props = RecipeType;

const recipe = Astro.props;
const { Content } = await recipe.render();
---

<Recipe {...recipe}>
	<Content />
</Recipe>

And my Recipe component.


---
import BaseHead from '../components/BaseHead.astro';
import Header from '../components/Header.astro';
import Footer from '../components/Footer.astro';
import FormattedDate from '../components/FormattedDate.astro';
import Ingredient from '../components/Ingredient.astro';
import { SITE_TITLE } from '../consts';
import Instruction from '../components/Instruction.astro';
import { Image } from 'astro:assets';
import type RecipeType from '../lib/content/recipes'

type Props = RecipeType;
const { data, name, updateAt, description, recipeYield, recipeIngredient, recipeInstructions} = Astro.props;
---
<html lang="en">
	<head>
		<BaseHead title={\`\${name} | \${SITE_TITLE}\`} description={description} />
		<link rel="author" href="https://connermccall.com" />
		</style>
	</head>

	<body>
		<Header />
		<main class="full h-entry">
			<article>
				
				<div class="flex hero-image pb-4 justify-center">
					{data.heroImage && <Image src={data.heroImage} alt="" />}
				</div>
				<div>
					<div class="title max-w-prose mx-auto">
						<div class="date text-center text-lg">
							<FormattedDate date={data.pubDate} />
							{
								updateAt && (
									<div class="last-updated-on dt-published">
										Last updated on <FormattedDate date={new Date(updateAt)} />
									</div>
								)
							}
						</div>
						<h1 class="center py-4 text-center p-name"><a class="u-url text-black hover:text-black" href={\`/blog/\${Astro.props.slug}/\`}>{name}</a></h1>
						<hr class="pb-4"/>
					</div>
					<div class="prose mx-auto e-content">
						<slot />
						<h2>Description</h2>
                        <p>{description}</p>
                        <h2>Makes</h2>
						<p>{recipeYield}</p>
                        <div>
                            <h2>Ingredients</h2>
                            <ul class=" bg-gray-100 py-3  ">
                                
                            {
                                recipeIngredient.map((ingredient) => (
                                <li><Ingredient ingredient={ingredient} /></li>
                                ))
                            }
                            </ul>
                        </div>
                        <div>
                            <h2>Instructions</h2>
                                {
                                    recipeInstructions.map((instruction) => (
                                    <Instruction instruction={instruction} />
                                    ))
                                }
                                
                        </div>
				    </div>
				</div>
			</article>
		</main>
		<Footer />
	</body>
</html>

You do almost the same thing in index.astro. Fetch the data, merge the properties, then you can just loop through the recipe and show the details you want on your landing page.

const merged = await Promise.all((await getCollection('recipes')).map(async (recipe) => {
	const from_mealie = await fetchRecipe(recipe.data.recipe_slug);
	return Object.assign({}, from_mealie, recipe.data)
}))
const recipes = merged.sort(
	(b, a) => a.pubDate.valueOf() - b.pubDate.valueOf()
).filter((recipe) => {
	return recipe.is_draft !== true
});
...
{
	recipes.map((data) => (
		
	<li class=" max-w-[444px] md:max-w-none">
			<a href={\`/recipes/\${data.slug}/\`}>
				<Image alt="" height="300" src={data.heroImage} />
				<h4 class="title text-xl pt-4">{data.name}</h4>
				<p class="date text-sm text-gray-600">
					<FormattedDate date={data.pubDate} />
				</p>
			</a>
		</li>
	
	))
}

I explored an alternative approach where I tagged recipes in Mealie with a ‘blog’ tag and then queried for all recipes with that tag. Doing this I could avoid the need to use a Content Collection and only use data from the api. I decided that using a Content Collection gave me the benefit of ensuring that this codebase controlled what recipes appeared, I could add additional context to the recipe that I do not need in Mealie, and I can control the image show alongside the recipe while taking advantage of Astro’s image processing.

Look for my post about Mealie in a few days.

You can see the code in context in my demo github repository.

Masked email has become my Fastmail killer feature

Thu, 29 Feb 2024 00:00:00 UTC

I migrated my email away from Gmail a little over 10 years ago. I gave running my own email server a go. It went okay, but within a year, I got sick of dealing with upgrades, undelivered mail, and my mail being marked as spam. So, I made the switch to FastMail. My first invoice was in December of 2014. I have been a satisfied customer ever since.

FastMail is always reliable, has a “good enough” interface, and costs less than a dollar a day. They do not introduce a ton of features, which I actually consider a feature. But a while ago, they added Masked Emails to their feature list. This is a killer feature for me.

Masked Emails are not a new feature. Apple introduced Hide My Email in iOS 15, and I am sure it existed before Apple. The main idea is that you can create a new and unique email address to give to anyone at any time. That new email address is directed to your main Inbox just like your primary emails.

What makes FastMail’s version interesting to me is that they allow you to bring your own domain. Their default version generates emails with a fastmail owned domain. But with a bit of effort, you can use any domain you own. So, for example, on this site, I have the email address gritty.frog3468@cafm.me listed as my “indieweb” email. This is the only place I plan on using that email. If someone emails me at that address, it goes to my main Inbox and is labeled however I want, in this case, “rel-me”. If that address starts accumulating spam, it is easy enough to swap it out with a new address.

Since I started using Masked Emails, I use them almost everywhere. Anytime I sign up for a new service, I use a new masked email, and often when updating accounts, I will change my old email address to a new masked email. I even use masked emails when setting up services I host myself.

There are multiple ways to generate a masked email. I use three:

You can use FastMail’s interface; it is a bit of a chore, though easier on mobile.
I use 1Password, and they have an integration and can generate an email and store it in the login automatically, which is slick.
Use the API.

The API use case is something I started using because I was sick of trying to tell people my email address in person. I use either an address which includes my full name, or a short email with the .cafm.me domain. I have found that if you do not use Gmail, Yahoo, or Apple, people tend to be confused. The other problem is that when I had to give an email out in person, it was never a masked email, defeating the purpose of using masked emails.

To solve this, I built a little website. It allows me to put in a description, click generate, and get a masked email. This is much faster than the FastMail interface, plus I have the email displayed at a size large enough that I can just show someone my phone instead of telling them the address. It makes their life easier and streamlines mine.

There are several benefits to using masked emails. Here are the three I enjoy:

You know when someone has sold, given away, or had your email address stolen. If you give your email to your local medical provider and a year later get emails from another party with that address, you know they are the root cause and can decide what to do about it.
If the unsubscribe button does not work, you can just turn off that masked email, either block it and send them directly to trash, or delete it and have it bounce.
Annoying form validation that might have blocked + addresses have no way of rejecting your masked email since it is no different from other email addresses.
Email addresses are short and sometimes hilarious.

You could do a lot more with them with filters and rules, but I tend to keep my email flow simple.

If the Fastmail team is reading this, I do have one request, allow me to quickly manage the masked email of the message I have opened in the web interface. Having a block or delete feature right there would be super useful when I get a new email from a newsletter I have unsubscribed from.

Fixing Broken Images in Mastodon

Wed, 28 Feb 2024 00:00:00 UTC

In my post about joining the small web, I discussed integrating this site with the IndieWeb network. Another community I’ve been eager to join is the Fediverse.

I went ahead and added Mastodon to my services and set up a personal network. I found a few users to follow, but encountered a persistent issue: images from posts outside my server displayed only as ‘placeholders’.

A temporary fix was to execute tootctl media refresh --days=2, which worked for existing posts but not for new ones. I read through forums and issues trying to find a similar issue, but anything that looked the same ended up being slightly different. My frustration was growing and honestly without images the experience of Mastodon was poor enough I might have just scrapped the whole idea.

Then it hit me(while in the shower, where all great ideas are formed), I recalled an initial setup error related to /opt/mastodon/public/system/cache permissions. The resolution was mounting this directory as a volume not only for the Mastodon web instance but also for the sidekiq container.

Here’s how the volumes are now configured:

volumes {
	container_path = "/mastodon/public/system"
	host_path = "/var/docker-service/mastodon/public/system"
}

volumes {
	container_path = "/opt/mastodon/public/system/cache"
	host_path = "/var/docker-service/mastodon/cache"
}

Curiously, there are two distinct system and cache directories. The official docker-compose.yml only references /mastodon/public/system. I need to investigate more to determine whether this was an error on my part or an issue worth reporting.

Hopefully, this post aids another soul looking to venture into the Fediverse.

Joining the Indieweb

Tue, 27 Feb 2024 00:00:00 UTC

I started this blog for a couple of key reasons: to share my thoughts and to become part of the “small web.” Writing my first post ticked the first box instantly. The second goal is more of a journey. Lately, my focus has shifted towards integrating my site with the Indie Web, a concept that’s easier said than done, as solid resources are scarce. However, I’m making headway through the steps on Indiewebify.me.

Steps

Here’s what I’m tackling, based on the Indie Web site’s guidance:

[ ✅ ] Purchase a domain name.
- I have owned this domain for 16 years and see no reason to change.
[ ✅ ] Publish content to your domain.
- I have a webserver and publish my content with Astro.
[ ✅ ] Setup web sign in.
- This requires adding rel=me links to your homepage. In my case I added links to my profiles with Github, Twitter, and Threads. I also added a masked email address.

		<link rel="me" href="https://github.com/sloped" />
		<link rel="me" href="https://twitter.com/sloped" />
		<link rel="me" href="mailto:gritty.frog3468@cafm.me" />
		<link rel="me" href="https://www.threads.net/@sloped" />

[ ✅ ] Add h-card
- This requires some html modifications. I added the h-card class to my homepage, along with p-name, p-category, and some other identifiers. You can see this at https://indiewebify.me/validate-h-card/?url=http://connermccall.com
- One key is that you do not need to use a tags, you can use span or any other tag as long as it has the correct classes. It was not super clear in the documentation that that was possible.
[ ✅ ] Add h-entry to posts
- I edited my Blog post layout to include h-entry, e-content, and other markup to match the h-entry spec.
[ ✅ ] Allow Webmentions.
- This looks a bit more involved since I deploy this site as a static website. I have a few ideas on how to accomplish this, and have read at least one post with some ideas. It will be fun to send a webmention to that site when I have implemented my solution.
- I managed to add this in March
[ ] Automatic Post Syndication (POSSE)
- This is called Publish Own Site Syndicate Elsewhere. Which means that when you publish a post you share a link to your post on other sites, such as Twitter, Threads, or Discord. You can include all the content if the platform supports it, but you can also just include a link back to your primary source.
- I am not really sure how I want to approach this. I already have an RSS feed, so I am part way there. But resurrecting my Twitter account and posting to Threads, Bluesky, and maybe Discord could be a way to start engaging a wider audience.
- The second part of this is adding syndication links. These are links back to the syndicated post. So for example when I shared a recent post on Bluesky it would look like <a rel="syndication" class="u-syndication" href="https://bsky.app/profile/sloped.me/post/3kmdmhr2h5e2q">Bluesky</a>

Embracing Indie Web is about owning your content, a powerful concept. Implementing this was a great excersise, but I did not find it simple, which is a bit of a let down. I do not have any great solutions, other than hopefully those of us that can do this start building tooling and tutorials to make things simpler for those with less experience and expertise.

The Joy of Elden Ring

Mon, 26 Feb 2024 00:00:00 UTC

I bought Elden Ring during a Steam sale after it won all the awards in 2022. Historically, I avoided Soulslike games. My gaming as an adult has leaned heavily on Easy Mode and approached games more as interactive stories than challenges of skill. But, given the noise around this game, I decided that a $40 splurge was worth the risk.

I kind of remember the first few hours being a frustrating slog, but once I had gotten my head around the controls, pacing, and the surprising number of risk levers you could use, I was hooked. I spent hours exploring Limgrave(the starting area), and then by chance found the shortcut to Liurnia(typically your second area). I explored that land far and wide until one day I went back to Limgrave and discovered I had never entered Stormveil. Somehow I had managed to unintentionally avoid the first major dungeon in the game, which was a surprise.

I kept moving forward, tackling mini bosses, delving into caves, exploring, and dying over and over again in the Royal Capital. Then after reaching Crumbling Farum Azula, I got stuck. Life elsewhere got interesting, house projects started looking enjoyable again, and gaming basically stopped.

Then this February, the trailer for the expansion was announced. I started thinking about Elden Ring again. I was worried that the loss of muscle memory and timing would make it too frustrating to return to, but then I watched the trailer. I decided I wanted to get back into things, not really because of the expansion, but mostly because it reminded me of how much fun it was to be challenged in a game.

I fired up the game and immediately took a few passes through some easier areas to get my timing back. Then, as I was thinking I was almost ready to head back to Azula, I noticed a path that I had never taken. It turns out I had ignored a whole region of the map. This highlighted two things I love about this game. One, the game world is so vast and well-designed that not only can you skip an entire dungeon, but you can also stumble upon hours of content that you just randomly missed. The second thing is that the challenges do not scale as you level up. There is pride in defeating bosses that are extremely tough, but there is also a lot of joy to be found in romping through an area you either left intentionally and come back to 20 levels later or discover further down the line than expected. It was kind of the perfect return.

Of course, the other joy is how the game reminds you to never relax. If you take lowly enemies lightly, you will die. If you challenge an enemy that is your equal, you will probably die die; in fact, it is almost inevitable you will die each time you fire up the game. And I found that surprisingly, I was ok with that.

Before I played it, the story I told myself about Elden Ring was that constantly losing would be annoying, but instead, the game is built so that even when you “die” you learn something. You learn the timing of a boss’s attack, the location of an ambush, or the fact that that hole is deeper than you anticipated. So you can come back to it and try again, armed with just enough knowledge to get just a bit further. It’s a blast and I highly recommend giving it a try.

Logging Made Easy: Docker, Syslog, and Privacy-Focused Analytics

Wed, 21 Feb 2024 00:00:00 UTC

In my previous home lab post I noted that I use Docker to run most of my services. That now includes this site in a container I am building, pushing, and deploying automatically whenever I push a commit. (I will need to write a post about that too)

I also set up Goatcounter * to do some anonymous tracking of visitors to this site. I mostly want to know about referrers and what content people were finding interesting. I decided I wanted to forgo the JS tracking script in favor of just using server counts.

Goatcounter supports this out of the box. It expects to either import data occasionally or it can be set to tail a log file. Since by default Docker does not create standard log formats, I had to learn a bit about how to get Docker to send logs to a text file.

I ended up using rsyslog and some tweaks to my container configuration. The result is a log file for my container, the ability to easily add this same sort of logging to any other container on the host machine, and a Goatcounter service that is sending anonymized data to goatcounter.

First, you need to setup the logging mechanism in rsyslog.

Create the file /etc/rsyslog.d/30-docker.conf

$FileCreateMode 0644
$template DockerDaemonLogFileName,"/var/log/docker/docker.log"
$template DockerContainerLogFileName,"/var/log/docker/%SYSLOGTAG:R,ERE,1,FIELD:docker/(.*)\[--end:secpath-replace%.log"
if $programname == 'dockerd' then {
?DockerDaemonLogFileName
stop
}
if $programname == 'containerd' then {
?DockerDaemonLogFileName
stop
}
if $programname == 'docker' then {
if $syslogtag contains 'docker/' then {
?DockerContainerLogFileName
stop
}
}
$FileCreateMode 0600

You will want to reload rsyslog after creating that file sudo systemctl restart rsyslog

The file creates a new docker.log file for system log messages. It will also create a file [field].log where [field] is replaced by the second part of the log_opts tag.

In terraform you get this by adding log_opts to your container, along with setting the log_driver as syslog

resource "docker_container" "containername" {
  name  = "containername"
  image = "registry.me/imagename:latest"

...

  log_opts = {
    tag = "docker/containername"
  }

  log_driver = "syslog"

...
}

Or on the command line

docker run -d \
  --name containername \
  --log-driver=syslog \
  --log-opt tag=docker/containername \
  registry.me/imagename:latest

Now when this container starts, any log messages it sends to stdout or stderr are logged to /var/log/docker/containername.log

I also recommend setting up some log rotation for those files so you do not fill your filesystem if you have noisy containers.

Now create /etc/logrotate.d/rsyslog-docker to have logrotate monitor and rotate my logs.

/var/log/docker/*.log
{
weekly
rotate 10
minsize 200M
missingok
notifempty
compress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}

Finally, I downloaded the goatcounter binary and told it to tail the log. /etc/systemd/system/goatcounter-blog.service.

[Unit]
Description=GoatCounter Import Service
After=network.target

[Service]
Environment=GOATCOUNTER_API_KEY=[your key]
User=[user]
WorkingDirectory=/home/[user]
ExecStart=/home/[user]/goatcounter import -follow -format=combined -exclude=static -exclude='path:glob:/fonts/**' -site='https://goatcounter.com' /var/log/docker/containername.log
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

You will need to enable this service with

sudo systemctl enable goatcounter-blog.service
sudo systemctl start goatcounter-blog.service

Now, assuming the log files created by the container match the Combined Log Format, you will see visits added to your Goatcounter statistics.

One caveat to this approach is that Docker does not give you an easy way to differentiate between stderr and stdout so all messages go to your single log file. Ideally there would be a way to differentiate between the two messages types and send them to a .log or a .error file, but that does not appear to be possible today.

*If you want to self host Goatcounter yourself, take a look at my Docker container

Signing Git Commits with SSH

Tue, 13 Feb 2024 00:00:00 UTC

I was recently playing around with 1Password’s SSH key features. I have a few keys saved in my vault, but normally I use keys that were generated on the host and have never left the host. My curiosity led me to add a new key and utilize it as a login key for another system. (This works great, by the way!)

Once I had created that key, 1Password prompted me to use it to sign my git commits. What??

I have used GPG signing in the past, but the setup experience was painful enough that I mostly avoided it. I sign most everything on my main machine with a GPG key, but other hosts do not have signing enabled. Since I already have SSH keys created for those hosts, being able to just use those keys would be a nice little win.

[!note] Git introduced SSH signing in 2.34.0, so you will need to ensure your version of Git is that version or newer. Ubuntu Focal does not have that version yet, so I ended up adding the Git ppa.

If you are wondering why you might want to sign your commits, this post has a decent summary

If you are using standard Git your ~/.gitconfig file will look like this

[user]
	name = [Your name]
	email = [Your email]
	signingkey = [Path to your public key]
[gpg]
	format = ssh
[commit]
	gpgsign = true
[core]
	editor = vim
[gpg "ssh"]
	allowedSignersFile = [Path to an allowed signers file]

If you want to use 1Password, it is a bit different. You point to the 1Password SSH binary and will authorize with 1Password when you need to sign.

[user]
	name = [Your name]
	email = [Your email]
	signingkey = [Path to your public key]
[gpg]
	format = ssh
[gpg "ssh"]
	  program = "/opt/1Password/op-ssh-sign"
[commit]
	gpgsign = true
[core]
	editor = vim
[gpg "ssh"]
	allowedSignersFile = [Path to an allowed signers file]

The final step is setting up an allowedSignersFile so you can actually verify commits.

The format for this file is an identifier + key. So mine looks like

conner@fungi ssh-ed25519 [Public key on host fungi]
conner@connermccall.com ssh-ed25519 [Public key on current host]

Now if you run git log --show-signature you should see info on the signed commits. Notice the Good "git" signature contains a SHA and the identifier. You can make the identifier be anything in your Allowed Signers File. Emails work great, but if you want use a collaborators nickname or full name go right ahead.

commit 612beb7b61b0137d50b5570f4b4c0514235ea4c4 (HEAD -> main, origin/main, origin/HEAD)
Good "git" signature for conner@fungi with ED25519 key SHA256:+YIFq85xEaWEk31Ri4Df83sk8
Author: Conner McCall <conner@connermccall.com>
Date:   Tue Feb 13 17:30:55 2024 +0000

    remove unnecessary env file

commit 793a53ee44471034fbfb0d4eafc3c67467ffa2fe
Good "git" signature for conner@connermccall.com with ED25519 key SHA256:5GYdL9pT2jFdLC7TJiZzJgtcXcBNEBSIX8
Author: Conner McCall <conner@connermccall.com>
Date:   Tue Feb 13 10:58:26 2024 -0600

    feat: add home dns entry

You can also enable verification of your keys on GitHub and other providers as well. This lets others see that you have signed your commits and that the provider has verified the signature. This can help improve trust between users.

Some resources I used when setting this up:

Another URL shortner

Fri, 26 Jan 2024 00:00:00 UTC

I recently focused on bringing a “URL shortening” service in-house. While I don’t frequently use URL shorteners, they come in handy for sharing things like NextCloud links or article URLs with friends and family. Having my own system avoids tracking and allows me to control the lifespan of the URLs.

Previously, I used Netlify for this purpose, which conveniently manages redirects through a single config file (Netlify Redirects Documentation). This setup was efficient: I simply updated a Git repository linked to a Netlify site. Adding a new redirect was as easy as committing and pushing changes, or editing the file directly in the web IDE.

To achieve similar functionality on my own server, I developed go-redirector. My prior experience with Go, building a personal API for various tasks (similar to IFTTT, but self-coded), assured me it was a suitable choice.

Go-redirector is straightforward. It stores redirects in the same format as Netlify and, upon startup, the server reads this file, registering each line as a separate route. It’s a lean solution, with an image size of around 15MB, focused solely on redirecting from a path to a URL.

For more details on its usage, you can check the repository.

Moving to OpenTofu

Tue, 09 Jan 2024 00:00:00 UTC

I recently decided to migrate some of my services from Terraform to OpenTofu. This was driven by HashiCorp’s licensing decisions and by curiousity. Since this change currently only impacts my personal projects, the risk seems minimal, and tackling it now rather than later should be simpler.

The instruction provided by OpenTofu are straightfoward. I run PopOS so I used the instruction provided for Debian to install. Once that was done upgrading was mostly a non-event.

First, I ran a terraform plan to ensure there were no pending changes.

terraform plan

Next, I backed up the current state:

tofu state pull > backup-before-tofu.tfstate

I recommend a quick review of that file to ensure nothing looks odd.

Then run init to install the correct tofu providers.

tofu init

Once you have completed this, ideally you can create a plan and nothing will need to change

tofu plan

In my case, it turns out that the docker provider, kreuzwerker/terraform-provider-docker had release a major version since I last upgraded providers. This added a little bit of fun. If you run into this the only thing I really had to change was removing the latest data reference on your docker_image migration guide. I initially used the suggestion of repo_digest, but for some reason that meant it tried to replace my container on every run of tofu plan. I ended up switching to id for now. Not sure how that will impact upgrades, but I will deal with that when we get there.

The other issue I ran into is that the new version picked up a /etc/docker/daemon.json change to push docker logs to loki. Since I did not have this in the container definitions, it was forcing a container replacement on every plan as well. I added the following to each container to prevent the replacements.

log_opts = {
    "loki-batch-size" = "400",
    "loki-url" = "http://localhost:3100/loki/api/v1/push"
  }

Once you resolve any issues, making a small change to validate OpenTofu can make updates is a good idea. I just added a nonsense environment change to one of my containers.

I have a few other states to switch over, so I will update this post if I run into any more issues.

Updating Terraform configuration

Mon, 08 Jan 2024 00:00:00 UTC

I recently encountered an issue with an outdated Terraform configuration. When I attempted to run terraform plan, I was notified of the need to upgrade my configuration. The challenge was that the Terraform version I have installed on my desktop no longer supported the 0.13upgrade command. Thankfully, Docker came to the rescue. After some experimentation, I successfully executed the upgrade using this command:

docker run -v $(pwd):/ -i -t hashicorp/terraform:0.13.0 0.13upgrade

Feeling confident, I proceeded to update a CNAME entry. However, I encountered an error due to an outdated attribute from my AWS provider. The error message indicated an unsupported attribute vpc_id.

My solution involved a few steps. First, I retrieved the state file from my S3 remote backend:

docker run -e AWS_ACCESS_KEY_ID=xxx -e AWS_SECRET_ACCESS_KEY=xxx -v $(pwd):/src -w /src -i -t hashicorp/terraform:0.13.0 state pull > state.json

Next, I edited the JSON file. For me, this meant removing a vpc_id from a Route53 zone and incrementing the top-level serial value to avoid push failures.

After fixing the JSON file, I pushed the updated state back:

docker run -e AWS_ACCESS_KEY_ID=xxx -e AWS_SECRET_ACCESS_KEY=xxx -v $(pwd):/src -w /src -i -t hashicorp/terraform:0.13.0 state push state.json

Success

Initially, I continued using Terraform 0.13 via Docker to plan and apply my updates:

docker run -e AWS_ACCESS_KEY_ID=xxx -e AWS_SECRET_ACCESS_KEY=xxx -v $(pwd):/src -w /src -i -t hashicorp/terraform:0.13.0 plan --out new.tfplan
docker run -e AWS_ACCESS_KEY_ID=xxx -e AWS_SECRET_ACCESS_KEY=xxx -v $(pwd):/src -w /src -i -t hashicorp/terraform:0.13.0 apply new.tfplan

Eventually, I was able to revert to using my locally installed Terraform. While updating another CNAME, I confirmed that everything was functioning correctly.

This experience highlighted one of the potential drawbacks of infrastructure as code. Had I used AWS tooling or the console directly, this update would have taken significantly less time. However, I still believe the benefits of using Terraform justify its use in certain scenarios and using it for simpler tasks help pressure test it and keep my knowledge a bit fresher.

My Homelab

Fri, 05 Jan 2024 00:00:00 UTC

For many years, I’ve been transitioning my digital life onto servers (mostly) under my control. I manage two servers: a Droplet on Digital Ocean and another hosted in my basement.

When I began my self-hosting journey, my home internet was cable with slow upload speeds. This led me to set up a Droplet on Digital Ocean. I used the old standard of a single Nginx/Apache server with various virtual hosts. Keeping things updated and configuration managed was a pain.

I discovered Terraform at work and really fell for infrastructure as code. I did some digging and discovered that you could manage Docker with Terraform. I messed around with things a bit and then spent a weekend moving all my services into separate containers, all managed by Terraform. Adding a new one, updating a current service, or removing a service is all done in configuration files that I can keep locally. I really like this setup for several reasons.

Better Service Isolation: Each service runs in its own container, allowing for precise resource allocation.
Easier Updates: Updates are streamlined; I just change the image tag in Terraform and apply the update. Rollbacks are nearly as simple.
Version Control for System Decisions: Enables tracking changes and decision history.
Centralized Configuration Files: I keep each service’s configuration in a single zfs dataset, backing this up is trivial.
Auto Provisioning of Certificates: Utilizes the nginx LetsEncrypt proxy companion for hassle-free certificate management.

The installation of Fiber internet a year ago allowed me to migrate a bunch of services to my in-home server. I simply updated the Route53 Terraform entry, transferred the data, and replicated the Terraform configurations from Digital Ocean. Running identical Docker images meant most things worked seamlessly.

Here’s a rundown of most of the services I currently run on each server:

In-Home Server

Frigate - A ML enhanced NVR. This collects the video streams from multiple cameras and does object and motion detection.
Home Assistant - Home automation software.
Kimai - Time tracking software.
Nextcloud - Data hub, primarily used as a Dropbox alternative.
Node Red - Programming tool for IoT devices.
A Personal API - A little go service I randomly add to.
Photoprism - A ML photo collection service. Slowly replacing Google Photos with this.
PiHole - DNS with ad and malicious site blocking.
Plex - TV, Movie, and Music library.
Christmas Community - A little wishlist site that I set up for my family.
Linkding - A link collection service.
Syncthing - Makes syncing data easy. I use this on my desktop, laptop, and phone as well.
Stirling PDF - A collection of PDF tools. Self-hosted so I can use it on things with PII.

Digital Ocean

Gitea - Self-hosted GitHub alternative.
Grafana - Metrics and Dashboards. Not using this much lately.
Monica CRM - A personal CRM. The goal is to keep track of personal relationships. I am still not good at using this.
Nextcloud - This was my original location, slowly migrating to my home server.
One-Time Secret - Secret Sharing. Self-hosting this mostly for fun. I mostly trust the official version.
Syncthing

Pasta Quest

Thu, 04 Jan 2024 00:00:00 UTC

I was scrolling through Instagram the other day and came across a post about resolutions. It argued that resolutions shouldn’t be dreaded tasks. I wish I could find it again because it had some great examples that really drove the point home.

The one example I remember was eating as many different pasta shapes as you can in a year, dubbed the Pasta Quest.

I loved the idea. I’m a big pasta fan and eat more than I probably should, but I haven’t put a concerted effort into trying different shapes. So, 2024 is the year of Pasta Quest. I haven’t set a specific target for the number of shapes, but I’m hoping to try at least a dozen new ones along with a bunch of classics.

So far in 2024, I’ve tried one shape: Rotelle. More to come. I might put up a page once I’ve made more progress.

Restoring an SVN Backup

Tue, 02 Jan 2024 00:00:00 UTC

One of the projects I’m currently involved with requires taking over a technical infrastructure that was built over the past 15 years. It includes numerous tools, some of which haven’t been updated or used in years. Depending on our client’s needs, we might need to use these tools at some point. Documentation is often missing or scattered across many locations.

Recently, while trying to get one of these tools running, I suspected that the solution to a problem might be documented in some old code. The more recent code is hosted on a GitLab instance, but much of the older code was never migrated from SVN. Fortunately, I had access to an SVN backup output.

I ended up with a .svn file that was 33GB. A bit of research revealed that such files are typically created by running svnadmin dump and can be imported using the same tool.

After some digging, I found several Docker images suitable for running an SVN server. I opted for krisdavison/svn-server. I ran this image while mounting the backup and a /home/svn directory to store the restored data.

docker run -v $(pwd)/svn:/home/svn -v $(pwd):/backup -p 80:80 krisdavison/svn-server:v3.0

Once this was running, I had to create a new SVN repository with svnadmin create /home/svn/breeze, which creates a new blank repository. Then, I imported the backup using svn admin load /home/svn/breeze < svndump.svn.

The restore process took a lot longer than I expected. I leanred that svn admin replays the commits insquence over the repository. It was fascinating to watch the file system evolve in real-time. I particularly noticed the moment the repository transitioned from a flat repository into a trunk-branch-tag structure.

Interestingly, the loaded SVN repository was only 17GB, while the dump file was 33GB. This initially caused me some concern, but further research clarified that svndump by default includes entire files for each revision, whereas SVN stores deltas with occasional snapshots. Considering the 2478 revisions, this size difference seems reasonable.