From c79890d66e79566ab71e3221679b0689eefe50bc Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 17 Jul 2023 20:24:53 +0300 Subject: Update content for gemtext --- .../2022-05-27-perl-is-still-a-great-choice.gmi | 2 +- gemfeed/atom.xml.tmp | 6754 +------------------- index.gmi | 2 +- uptime-stats.gmi | 2 +- 4 files changed, 4 insertions(+), 6756 deletions(-) diff --git a/gemfeed/2022-05-27-perl-is-still-a-great-choice.gmi b/gemfeed/2022-05-27-perl-is-still-a-great-choice.gmi index 5859f42b..ecb2a9c3 100644 --- a/gemfeed/2022-05-27-perl-is-still-a-great-choice.gmi +++ b/gemfeed/2022-05-27-perl-is-still-a-great-choice.gmi @@ -103,7 +103,7 @@ About the first point, using Perl for better "shell" scripts was actually the or Here are some reasons why not to chose Perl and look for "better" alternatives: -* If performance is your main objectives, then Perl might not be the language to use. Perl is a dynamic interpreted language, and it will generally never be as fast as statically typed languages compiled to native binaries (e.g. C/C++/Rust/Haskell) or statically typed languages run in a VM with JIT (e.g. Java) or gradually typed languages run in a VM (e.g. Raku) or languages like Golang (statically typed, compiled to a binary but still with a runtime in the binary). Perl might be still faster than the other language listed here in certain circumstances (e.g. faster startup time than Java or faster regular expressions engine), but usually it's not. It's not a problem of Perl, it's a problem of all dynamic scripting languages including Python, Ruby, .... +* If performance is your main objectives, then Perl might not be the language to use. Perl is a dynamic interpreted language, and it will generally never be as fast as statically typed languages compiled to native binaries (e.g. C/C++/Rust/Haskell) or statically typed languages run in a VM with JIT (e.g. Java) or languages like Golang (statically typed, compiled to a binary but still with a runtime in the binary). Perl might be still faster than the other language listed here in certain circumstances (e.g. faster startup time than Java or faster regular expressions engine), but usually it's not. It's not a problem of Perl, it's a problem of all dynamic scripting languages including Python, Ruby, .... * Don't use Perl (just yet) if you want to code object-oriented. Perl supports OOP, but it feels clunky and odd to use (blessed references to any data types are objects) and doesn't support real encapsulation out of the box. There are many (many) extensions available on CPAN to make OOP better, but that's totally fragmented. The most popular extension, Moose, comes with a huge dependency tree. But wait for Perl 7. It will maybe come with a new object system (an object system inspired by Raku). * It's possible to write large programs in Perl (make difficult things possible), but it might not be the best choice here. This also leads back to the clunky object system Perl has. You could write your projects in a procedural or functional style (Perl perfectly fits here), but OOP seems to be the gold standard for large projects nowadays. Functional programming requires a different mindset, and pure procedural programming lacks abstractions. * Apply common sense. What is the skill set your team has? What's already widely used and supported at work? Which languages comes with the best modules for the things you want to work on? Maybe Python is the answer (better machine learning modules). Maybe Perl is the better choice (better Bioinformatic modules). Perhaps Ruby is already the de-facto standard at work and everyone knows at least a little Ruby (as it happened to be at my workplace) and Ruby is "good enough" for all the tasks already. But that's not a hindrance to throw in a Perl one-liner once in a while :P. diff --git a/gemfeed/atom.xml.tmp b/gemfeed/atom.xml.tmp index 9702c301..20cb849d 100644 --- a/gemfeed/atom.xml.tmp +++ b/gemfeed/atom.xml.tmp @@ -1,6 +1,6 @@ - 2023-07-17T05:18:04+03:00 + 2023-07-17T20:24:46+03:00 foo.zone feed To be in the .zone! @@ -2184,6755 +2184,3 @@ nmap ,j :call - - Installing DTail on OpenBSD - - gemini://foo.zone/gemfeed/2022-10-30-installing-dtail-on-openbsd.gmi - 2022-10-30T11:03:19+02:00 - - Paul Buetow - paul@dev.buetow.org - - This will be a quick blog post, as I am busy with my personal life now. I have relocated to a different country and am still busy arranging things. So bear with me :-) - -
-

Installing DTail on OpenBSD


-
-Published at 2022-10-30T11:03:19+02:00
-
-
-       ,_---~~~~~----._
- _,,_,*^____      _____``*g*\"*,
-/ __/ /'     ^.  /      \ ^@q   f
- @f   |       |  |       |  0 _/
-\`/   \~__((@/ __ \__((@/    \
- |           _l__l_           I    <--- The Go Gopher
- }          [______]           I
- ]            | | |            |
- ]             ~ ~             |
- |                            |
-  |                           |
-  |                           |       A       ;
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~~~,--,-/ \---,-/|~~,~~~~~~~~~~~~~~~~~~~~~~~~~~~
-                           _|\,'. /|      /|   `/|-.
-                       \`.'    /|      ,            `;.
-                      ,'\   A     A         A   A _ /| `.;
-                    ,/  _              A       _  / _   /|  ;
-                   /\  / \   ,  ,           A  /    /     `/|
-                  /_| | _ \         ,     ,             ,/  \
-                 // | |/ `.\  ,-      ,       ,   ,/ ,/      \/
-                 / @| |@  / /'   \  \      ,              >  /|    ,--.
-                |\_/   \_/ /      |  |           ,  ,/        \  ./' __:..
-                |  __ __  |       |  | .--.  ,         >  >   |-'   /     `
-              ,/| /  '  \ |       |  |     \      ,           |    /
-             /  |<--.__,->|       |  | .    `.        >  >    /   (
-            /_,' \\  ^  /  \     /  /   `.    >--            /^\   |
-                  \\___/    \   /  /      \__'     \   \   \/   \  |
-                   `.   |/          ,  ,                  /`\    \  )
-                     \  '  |/    ,       V    \          /        `-\
- OpenBSD Puffy --->   `|/  '  V      V           \    \.'            \_
-                       '`-.       V       V        \./'\
-                           `|/-.      \ /   \ /,---`\         kat
-                            /   `._____V_____V'
-                                       '     '
-
-
-This will be a quick blog post, as I am busy with my personal life now. I have relocated to a different country and am still busy arranging things. So bear with me :-)
-
- In this post, I want to give a quick overview (or how-to) about installing DTail on OpenBSD, as the official documentation only covers Red Hat and Fedora Linux! And this blog post will also be used as my reference!
-
-https://dtail.dev
-
-I am using Rexify for my OpenBSD automation. Check out the following article covering my Rex setup in a little bit more detail:
-
-Let's Encrypt with OpenBSD and Rex
-
-I will also mention some relevant Rexfile snippets in this post!
-
-

Compile it


-
-First of all, DTail needs to be downloaded and compiled. For that, git, go, and gmake are required:
-
-
-$ doas pkg_add git go gmake
-
-
-I am happy that the Go Programming Language is readily available in the OpenBSD packaging system. Once the dependencies got installed, clone DTail and compile it:
-
-
-$ mkdir git
-$ cd git
-$ git clone https://github.com/mimecast/dtail
-$ cd dtail
-$ gmake 
-
-
-You can verify the version by running the following command:
-
-
-$ ./dtail --version
- DTail  4.1.0  Protocol 4.1  Have a lot of fun!
-$ file dtail
- dtail: ELF 64-bit LSB executable, x86-64, version 1
-
-
-Now, there isn't any need anymore to keep git, go and gmake, so they can be deinstalled now:
-
-
-$ doas pkg_delete git go gmake
-
-
-One day I shall create an official OpenBSD port for DTail.
-
-

Install it


-
-Installing the binaries is now just a matter of copying them to /usr/local/bin as follows:
-
-
-$ for bin in dserver dcat dgrep dmap dtail dtailhealth; do
-  doas cp -p $bin /usr/local/bin/$bin
-  doas chown root:wheel /usr/local/bin/$bin
-done
-
-
-Also, we will be creating the _dserver service user:
-
-
-$ doas adduser -class nologin -group _dserver -batch _dserver
-$ doas usermod -d /var/run/dserver/ _dserver
-
-
-The OpenBSD init script is created from scratch (not part of the official DTail project). Run the following to install the bespoke script:
-
-
-$ cat <<'END' | doas tee /etc/rc.d/dserver
-#!/bin/ksh
-
-daemon="/usr/local/bin/dserver"
-daemon_flags="-cfg /etc/dserver/dtail.json"
-daemon_user="_dserver"
-
-. /etc/rc.d/rc.subr
-
-rc_reload=NO
-
-rc_pre() {
-    install -d -o _dserver /var/log/dserver
-    install -d -o _dserver /var/run/dserver/cache
-}
-
-rc_cmd $1 &
-END
-$ doas chmod 755 /etc/rc.d/dserver
-
-
-

Rexification


-
-This is the task for setting it up via Rex. Note the . . . ., that's a placeholder which we will fill up more and more during this blog post:
-
-
-desc 'Setup DTail';
-task 'dtail', group => 'frontends',
-   sub {
-      my $restart = FALSE;
-
-      file '/etc/rc.d/dserver':
-        content => template('./etc/rc.d/dserver.tpl'),
-        owner => 'root',
-        group => 'wheel',
-        mode => '755',
-        on_change => sub { $restart = TRUE };
-
-        .
-        .
-        .
-        .
-
-      service 'dserver' => 'restart' if $restart;
-      service 'dserver', ensure => 'started';
-   };
-
-
-

Configure it


-
-Now, DTail is fully installed but still needs to be configured. Grab the default config file from GitHub ...
-
-
-$ doas mkdir /etc/dserver
-$ curl https://raw.githubusercontent.com/mimecast/dtail/master/examples/dtail.json.examples |
-    doas tee /etc/dserver/dtail.json
-
-
-... and then edit it and adjust LogDir in the Common section to /var/log/dserver. The result will look like this:
-
-
-  "Common": {
-    "LogDir": "/var/log/dserver",
-    "Logger": "Fout",
-    "LogRotation": "Daily",
-    "CacheDir": "cache",
-    "SSHPort": 2222,
-    "LogLevel": "Info"
-  }
-
-
-

Rexification


-
-That's as simple as adding the following to the Rex task:
-
-
-file '/etc/dserver',
-  ensure => 'directory';
-
-file '/etc/dserver/dtail.json',
-  content => template('./etc/dserver/dtail.json.tpl'),
-  owner => 'root',
-  group => 'wheel',
-  mode => '755',
-  on_change => sub { $restart = TRUE };
-
-
-

Update the key cache for it


-
-DTail relies on SSH for secure authentication and communication. However, the system user _dserver has no permission to read the SSH public keys from the user's home directories, so the DTail server also checks for available public keys in an alternative path /var/run/dserver/cache.
-
-The following script, populating the DTail server key cache, can be run periodically via CRON:
-
-
-$ cat <<'END' | doas tee /usr/local/bin/dserver-update-key-cache.sh
-#!/bin/ksh
-
-CACHEDIR=/var/run/dserver/cache
-DSERVER_USER=_dserver
-DSERVER_GROUP=_dserver
-
-echo 'Updating SSH key cache'
-
-ls /home/ | while read remoteuser; do
-    keysfile=/home/$remoteuser/.ssh/authorized_keys
-
-    if [ -f $keysfile ]; then
-        cachefile=$CACHEDIR/$remoteuser.authorized_keys
-        echo "Caching $keysfile -> $cachefile"
-
-        cp $keysfile $cachefile
-        chown $DSERVER_USER:$DSERVER_GROUP $cachefile
-        chmod 600 $cachefile
-    fi
-done
-
-# Cleanup obsolete public SSH keys
-find $CACHEDIR -name \*.authorized_keys -type f |
-while read cachefile; do
-    remoteuser=$(basename $cachefile | cut -d. -f1)
-    keysfile=/home/$remoteuser/.ssh/authorized_keys
-
-    if [ ! -f $keysfile ]; then
-        echo 'Deleting obsolete cache file $cachefile'
-        rm $cachefile
-    fi
-done
-
-echo 'All set...'
-END
-$ doas chmod 500 /usr/local/bin/dserver-update-key-cache.sh
-
-
-Note that the script above is a slight variation of the official DTail script. The official DTail one is a bash script, but on OpenBSD, there's ksh. I run it once daily by adding it to the daily.local:
-
-
-$ echo /usr/local/bin/dserver-update-key-cache.sh | doas tee -a /etc/daily.local
-/usr/local/bin/dserver-update-key-cache.sh
-
-
-

Rexification


-
-That's done by adding ...
-
-
-file '/usr/local/bin/dserver-update-key-cache.sh',
-  content => template('./scripts/dserver-update-key-cache.sh.tpl'),
-  owner => 'root',
-  group => 'wheel',
-  mode => '500';
-
-append_if_no_such_line '/etc/daily.local', '/usr/local/bin/dserver-update-key-cache.sh';
-
-
-... to the Rex task!
-
-

Start it


-
-Now, it's time to enable and start the DTail server:
-
-
-$ sudo rcctl enable dserver
-$ sudo rcctl start dserver
-$ tail -f /var/log/dserver/*.log
-INFO|1022-090634|Starting scheduled job runner after 2s
-INFO|1022-090634|Starting continuous job runner after 2s
-INFO|1022-090644|24204|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnections=0
-INFO|1022-090654|24204|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnections=0
-INFO|1022-090719|Starting server|DTail 4.1.0 Protocol 4.1 Have a lot of fun!
-INFO|1022-090719|Generating private server RSA host key
-INFO|1022-090719|Starting server
-INFO|1022-090719|Binding server|0.0.0.0:2222
-INFO|1022-090719|Starting scheduled job runner after 2s
-INFO|1022-090719|Starting continuous job runner after 2s
-INFO|1022-090729|86050|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnections=0
-INFO|1022-090739|86050|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnect
-.
-.
-.
-Ctr+C
-
-
-As we don't want to wait until tomorrow, let's populate the key cache manually:
-
-
-$ doas /usr/local/bin/dserver-update-key-cache.sh
-Updating SSH key cache
-Caching /home/_dserver/.ssh/authorized_keys -> /var/cache/dserver/_dserver.authorized_keys
-Caching /home/admin/.ssh/authorized_keys -> /var/cache/dserver/admin.authorized_keys
-Caching /home/failunderd/.ssh/authorized_keys -> /var/cache/dserver/failunderd.authorized_keys
-Caching /home/git/.ssh/authorized_keys -> /var/cache/dserver/git.authorized_keys
-Caching /home/paul/.ssh/authorized_keys -> /var/cache/dserver/paul.authorized_keys
-Caching /home/rex/.ssh/authorized_keys -> /var/cache/dserver/rex.authorized_keys
-All set...
-
-
-

Use it


-
-The DTail server is now ready to serve connections. You can use any DTail commands, such as dtail, dgrep, dmap, dcat, dtailhealth, to do so. Checkout out all the usage examples on the official DTail page.
-
-I have installed DTail server this way on my personal OpenBSD frontends blowfish, and fishfinger, and the following command connects as user rex to both machines and greps the file /etc/fstab for the string local:
-
-
-❯ ./dgrep -user rex -servers blowfish.buetow.org,fishfinger.buetow.org --regex local /etc/fstab
-CLIENT|earth|WARN|Encountered unknown host|{blowfish.buetow.org:2222 0xc0000a00f0 0xc0000a61e0 [blowfish.buetow.org]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ZnF/LAk14SgqCzk38yENVTNfqibcluMTuKx1u53cKSp2xwHWzy0Ni5smFPpJDIQQljQEJl14ZdXvhhjp1kKHxJ79ubqRtIXBlC0PhlnP8Kd+mVLLHYpH9VO4rnaSfHE1kBjWkI7U6lLc6ks4flgAgGTS5Bb7pLAjwdWg794GWcnRh6kSUEQd3SftANqQLgCunDcP2Vc4KR9R78zBmEzXH/OPzl/ANgNA6wWO2OoKKy2VrjwVAab6FW15h3Lr6rYIw3KztpG+UMmEj5ReexIjXi/jUptdnUFWspvAmzIl6kwzzF8ExVyT9D75JRuHvmxXKKjyJRxqb8UnSh2JD4JN [23.88.35.144]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ZnF/LAk14SgqCzk38yENVTNfqibcluMTuKx1u53cKSp2xwHWzy0Ni5smFPpJDIQQljQEJl14ZdXvhhjp1kKHxJ79ubqRtIXBlC0PhlnP8Kd+mVLLHYpH9VO4rnaSfHE1kBjWkI7U6lLc6ks4flgAgGTS5Bb7pLAjwdWg794GWcnRh6kSUEQd3SftANqQLgCunDcP2Vc4KR9R78zBmEzXH/OPzl/ANgNA6wWO2OoKKy2VrjwVAab6FW15h3Lr6rYIw3KztpG+UMmEj5ReexIjXi/jUptdnUFWspvAmzIl6kwzzF8ExVyT9D75JRuHvmxXKKjyJRxqb8UnSh2JD4JN 0xc0000a2180}
-CLIENT|earth|WARN|Encountered unknown host|{fishfinger.buetow.org:2222 0xc0000a0150 0xc000460110 [fishfinger.buetow.org]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNiikdL7+tWSN0rCaw1tOd9aQgeUFgb830V9ejkyJ5h93PKLCWZSMMCtiabc1aUeUZR//rZjcPHFLuLq/YC+Y3naYtGd6j8qVrcfG8jy3gCbs4tV9SZ9qd5E24mtYqYdGlee6JN6kEWhJxFkEwPfNlG+YAr3KC8lvEAE2JdWvaZavqsqMvHZtAX3b25WCBf2HGkyLZ+d9cnimRUOt+/+353BQFCEct/2mhMVlkr4I23CY6Tsufx0vtxx25nbFdZias6wmhxaE9p3LiWXygPWGU5iZ4RSQSImQz4zyOc9rnJeP1rwGk0OWDJhdKNXuf0kIPdzMfwxv2otgY32/DJj6L [46.23.94.99]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNiikdL7+tWSN0rCaw1tOd9aQgeUFgb830V9ejkyJ5h93PKLCWZSMMCtiabc1aUeUZR//rZjcPHFLuLq/YC+Y3naYtGd6j8qVrcfG8jy3gCbs4tV9SZ9qd5E24mtYqYdGlee6JN6kEWhJxFkEwPfNlG+YAr3KC8lvEAE2JdWvaZavqsqMvHZtAX3b25WCBf2HGkyLZ+d9cnimRUOt+/+353BQFCEct/2mhMVlkr4I23CY6Tsufx0vtxx25nbFdZias6wmhxaE9p3LiWXygPWGU5iZ4RSQSImQz4zyOc9rnJeP1rwGk0OWDJhdKNXuf0kIPdzMfwxv2otgY32/DJj6L 0xc0000a2240}
-Encountered 2 unknown hosts: 'blowfish.buetow.org:2222,fishfinger.buetow.org:2222'
-Do you want to trust these hosts?? (y=yes,a=all,n=no,d=details): a
-CLIENT|earth|INFO|STATS:STATS|cgocalls=11|cpu=8|connected=2|servers=2|connected%=100|new=2|throttle=0|goroutines=19
-CLIENT|earth|INFO|Added hosts to known hosts file|/home/paul/.ssh/known_hosts
-REMOTE|blowfish|100|7|fstab|31bfd9d9a6788844.h /usr/local ffs rw,wxallowed,nodev 1 2
-REMOTE|fishfinger|100|7|fstab|093f510ec5c0f512.h /usr/local ffs rw,wxallowed,nodev 1 2
-
-
-Running it the second time, and given that you trusted the keys the first time, it won't prompt you for the host keys anymore:
-
-
-❯ ./dgrep -user rex -servers blowfish.buetow.org,fishfinger.buetow.org --regex local /etc/fstab
-REMOTE|blowfish|100|7|fstab|31bfd9d9a6788844.h /usr/local ffs rw,wxallowed,nodev 1 2
-REMOTE|fishfinger|100|7|fstab|093f510ec5c0f512.h /usr/local ffs rw,wxallowed,nodev 1 2
-
-
-

Conclusions


-
-It's a bit of manual work, but it's ok on this small scale! I shall invest time in creating an official OpenBSD port, though. That would render most of the manual steps obsolete, as outlined in this post!
-
-Check out the following for more information:
-
-https://dtail.dev
-https://github.com/mimecast/dtail
-https://www.rexify.org
-
-Other related posts are:
-
-2022-10-30 Installing DTail on OpenBSD (You are currently reading this)
-2022-03-06 The release of DTail 4.0.0
-2021-04-22 DTail - The distributed log tail program
-
-E-Mail your comments to paul at buetow.org :-)
-
-Back to the main site
-
- - - - After a bad night's sleep - - gemini://foo.zone/gemfeed/2022-09-30-after-a-bad-nights-sleep.gmi - 2022-09-30T09:53:23+03:00 - - Paul Buetow - paul@dev.buetow.org - - Everyone has it once in a while: A bad night's sleep. Here I attempt to list valuable tips on how to deal with it. - -
-

After a bad night's sleep


-
-Published at 2022-09-30T09:53:23+03:00; Updated at 2022-10-12
-
-
-               z
-                z
-                 Z
-       .--.  Z Z
-      / _(c\   .-.     __
-     | / /  '-;   \'-'`  `\______
-     \_\/'/ __/ )  /  )   |      \--,
-     | \`""`__-/ .'--/   /--------\  \
-      \\`  ///-\/   /   /---;-.    '-'
-jgs                (________\  \
-                             '-'
-
-
-Everyone has it once in a while: A bad night's sleep. Here I attempt to list valuable tips on how to deal with it.
-
-

Don't take the day off.


-
-Don't take a day off after not sleeping enough the previous night. That would be wasting the holiday allowance. It wouldn't be possible to enjoy my free time anyway, so why not just work? There's still a way for an IT Engineer to be productive (sometimes even more) with half or less of the concentration power available!
-
-

Start work early


-
-Probably I am already awake early and am unable to fall asleep again. My strategy here is to "attack" the day: Start work early and finish early. The early bird will also encounter fewer distractions from colleagues.
-
-

Sweat the small stuff


-
-There's never a shortage of small items to hook off my list. Most of these items don't require my full concentration power, and I will be happy to get them off my list so that the next day, after a good night's sleep, I can immerse myself again in focused, deep work with all concentration powers at hand.
-
-Examples of "small work items" are:
-
-
    -
  • Tidying up the workspace.
    • -
  • Installing pending computer software updates.
    • -
  • Going through the work backlog: Create new tickets, close obsolete ones, and roughly pre-plan upcoming work.
    • -
  • Finishing off the easy tickets from the current sprint.
    • -
  • Going through any tedious paperwork.
    • -
  • Catch up with the journal and mark off all trivial action items.
    • -

-

Enter the flow state


-
-I find it easy to enter the "flow state" after a bad night's sleep. All I need to do is to put on some ambient music (preferably instrumental chill house) and start to work on a not-too-difficult ticket.
-
-Usually, the "flow state" is associated with deep-focused work, but deep-focused work isn't easily possible under sleep deprivation. It's still possible to be in the flow by working on more manageable tasks and leaving the difficult ones for the next day.
-
-

Reschedule meetings


-
-I find engaging in discussions and demanding meetings challenging after a lousy night's sleep. I still attend the sessions I am invited to as "only" a participant, but I prefer to reschedule all meetings I am the primary driver of.
-
-This, unfortunately, also includes interviews. Interviews require full concentration power. So for interviews, I would find a colleague to step in for me or ask to reschedule the interview altogether. Everything else wouldn't make it justice and would waste everyone's time!
-
-

Invent


-
-The mind works differently under sleep deprivation: It's easier to invent new stuff as it's easier to have a look at things from different perspectives. Until an hour ago, I didn't know yet what I would be blogging about for this month, and then I just started writing this, and it took me only half an hour to write the first draft of this blog post!
-
-

Fast


-
-I don't eat breakfast, and I don't eat lunch on these days. I only have dinner. Not eating means my mind doesn't get foggy, and I keep up the work momentum. This is called intermittent fasting, which not only generally helps to keep the weight under control and boosts the concentration power. Furthermore, intermittent fasting is healthy. You should include it in your routine, even after a good night's sleep.
-
-

Stretch


-
-I won't have enough energy for strenuous physical exercise on those days, but a 30 to a 60-minute stretching session can make the day. Stretching will even hurt less under sleep deprivation! The stretching could also be substituted with a light Yoga session.
-
-

Walk


-
-Walking is healthy, and the time can be used to listen to interesting podcasts. The available concentration power might not be enough for more sophisticated audio literature. I will have enough energy for one or two daily walks (~10k steps for the day in total). Sometimes, I listen to music during walks. I also try to catch the bright sunlight.
-
-

Red Bull


-
-I don't think that Red Bull is a healthy drink. But once in a while, a can in the early afternoon brings wonders, and productivity will skyrocket. Other than Red Bull, drink a lot of water throughout the day. Don't forget to drink the sugar-free version; otherwise, your intermittent fast will be broken.
-
-

Power nap


-
-I don't know how to "enforce" a nap, but sometimes I manage to power nap, and it helps wonders. A 30-minute nap sometimes brings me back to normal. If you don't tend to fast as you are too hungry, it helps to try to nap approximately 30 minutes after eating something.
-
-

Don't take anything personally.


-
-It's much more challenging to keep the mind "under control" in this state. Every annoyance can potentially upset, which could reflect on the work colleagues. It is wise to attempt to go with a positive attitude into the day, always smile and be polite to the family and colleagues at work. Don't let anything drop out to the people next; they don't deserve it as they didn't do anything wrong! Also, remember, it can't be controlled at all. It's time to let go of the annoyances for the day.
-
-

Meditate


-
-To keep the good vibe, it helps to meditate for 10 minutes. Meditation must nothing be fancy. It can be just lying on the sofa and observing your thoughts as they come and go. Don't judge your thoughts, as that could put you in a negative mood. It's not necessary to sit in an uncomfortable Yoga pose, and it is not required to chant "Ohhmmmmm".
-
-

Write things down


-
-Sometimes something requiring more concentration power demands time. This is where it helps to write a note in a journal and return to it another day. This doesn't mean slacking off but managing the rarely available concentration power for the day. I might repeat myself: Today, sweat all the small stuff. Tomorrow, do the deep-focused work on that crucial project again.
-
-It's easier to forget things on those days, so everything should be written down so that it can be worked off later. Things written down will not be overlooked!
-
-

Social media


-
-I wouldn't say I like checking social media, as it can consume a lot of time and can become addictive. But once in a while, I want to catch up with my "networks". After a bad night's sleep, it's the perfect time to check your social media. Once done, you don't have to do it anymore for the next couple of days!
-
-E-Mail your comments to paul at buetow.org :-)
-
-Back to the main site
-
- - - - Gemtexter 1.1.0 - Let's Gemtext again - - gemini://foo.zone/gemfeed/2022-08-27-gemtexter-1.1.0-lets-gemtext-again.gmi - 2022-08-27T18:25:57+01:00 - - Paul Buetow - paul@dev.buetow.org - - I proudly announce that I've released Gemtexter version `1.1.0`. What is Gemtexter? It's my minimalist static site generator for Gemini Gemtext, HTML and Markdown written in GNU Bash. - -
-

Gemtexter 1.1.0 - Let's Gemtext again


-
-Published at 2022-08-27T18:25:57+01:00
-
-
--=[ typewriter ]=-  1/98
-
-       .-------.
-      _|~~ ~~  |_
-    =(_|_______|_)=
-      |:::::::::|
-      |:::::::[]|
-      |o=======.|
- jgs  `"""""""""`
-
-
-I proudly announce that I've released Gemtexter version 1.1.0. What is Gemtexter? It's my minimalist static site generator for Gemini Gemtext, HTML and Markdown written in GNU Bash.
-
-https://codeberg.org/snonux/gemtexter
-
-It has been around a year since I released the first version 1.0.0. Although, there aren't any groundbreaking changes, there have been a couple of smaller commits and adjustments. I was quite surprised that I received a bunch of feedback and requests about Gemtexter so it means that I am not the only person in the universe actually using it.
-
-

What's new?


-
-

Automatic check for GNU version requirements


-
-Gemtexter relies on the GNU versions of the tools grep, sed and date and it also requires the Bash shell in version 5 at least. That's now done in the check_dependencies() function:
-
- -
check_dependencies () {
-    # At least, Bash 5 is required
-    local -i required_version=5
-    IFS=. read -ra version <<< "$BASH_VERSION"
-    if [ "${version[0]}" -lt $required_version ]; then
-        log ERROR "ERROR, \"bash\" must be at least at major version $required_version!"
-        exit 2
-    fi
-
-    # These must be the GNU versions of the commands
-    for tool in $DATE $SED $GREP; do
-        if ! $tool --version | grep -q GNU; then
-            log ERROR "ERROR, \"$tool\" command is not the GNU version, please install!"
-            exit 2
-        fi
-    done
-}
-
-
-Especially macOS users didn't read the README carefully enough to install GNU Grep, GNU Sed and GNU Date before using Gemtexter.
-
-

Backticks now produce inline code blocks in the HTML output


-
-The Gemtext format doesn't support inline code blocks, but Gemtexter now produces inline code blocks (means, small code fragments can be placed in the middle of a paragraph) in the HTML output when the code block is enclosed with Backticks. There were no adjustments required for the Markdown output format, because Markdown supports it already out of the box.
-
-

Cache for Atom feed generation


-
-The Bash is not the most performant language. Gemtexter already takes a couple of seconds only to generate the Atom feed for around two hand full of articles on my slightly underpowered Surface Go 2 Linux tablet. Therefore, I introduced a cache, so that subsequent Atom feed generation runs finish much quicker. The cache uses a checksum of the Gemtext .gmi file to decide whether anything of the content has changed or not.
-
-

Input filter support


-
-Once your capsule reaches a certain size, it can become annoying to re-generate everything if you only want to preview the HTML or Markdown output of one single content file. The following will add a filter to only generate the files matching a regular expression:
-
- -
./gemtexter --generate '.*hello.*'
-
-
-

Revamped git support


-
-The Git support has been completely rewritten. It's now more reliable and faster too. Have a look at the README for more information.
-
-

Addition of htmlextras and web font support


-
-The htmlextras folder now contains all extra files required for the HTML output format such as cascading style sheet (CSS) files and web fonts.
-
-

Sub-section support


-
-It's now possible to define sub-sections within a Gemtexter capsule. For the HTML output, each sub-section can use its own CSS and web font definitions. E.g.:
-
-The foo.zone main site
-The notes sub-section (with different fonts)
-
-

More


-
-Additionally, there were a couple of bug fixes, refactorings and overall improvements in the documentation made.
-
-Overall I think it's a pretty solid 1.1.0 release without anything groundbreaking (therefore no major version jump). But I am happy about it.
-
-Other related posts are:
-
-2023-03-25 Gemtexter 2.0.0 - Let's Gemtext again²
-2022-08-27 Gemtexter 1.1.0 - Let's Gemtext again (You are currently reading this)
-2021-06-05 Gemtexter - One Bash script to rule it all
-2021-04-24 Welcome to the Geminispace
-
-E-Mail your comments to paul at buetow.org :-)
-
-Back to the main site
-
- - - - Let's Encrypt with OpenBSD and Rex - - gemini://foo.zone/gemfeed/2022-07-30-lets-encrypt-with-openbsd-and-rex.gmi - 2022-07-30T12:14:31+01:00 - - Paul Buetow - paul@dev.buetow.org - - I was amazed at how easy it is to automatically generate and update Let's Encrypt certificates with OpenBSD. - -
-

Let's Encrypt with OpenBSD and Rex


-
-Published at 2022-07-30T12:14:31+01:00
-
-
-                                               /    _    \
-  The Hebern Machine                            \ ." ". /
-                                  ___            /     \
-                              ..""   ""..       |   O   |
-                             /           \      |       |
-                            /             \     |       |
-                          ---------------------------------
-                        _/  o     (O)     o   _            |
-                      _/                    ." ".          |
-                    I/    _________________/     \         |
-                  _/I   ."                        |        |
-          =====  /  I  /                         /         |
-     =====  | | |   \ |       _________________."          |
-=====  | |  | | |   /  \     /  _|_|__|_|_          __     |
-  | |  | |  | | |   \   "._."  /  o    o  \       ."  ".   |
-  |  --|  --|  -|   /          \         _/      /      \  |
-   \____\____\__|   \  ______   |       /       |        | |
-               --------      ---       /        |        | |
-              ( )        (O)          /          \      /  |
-               -----------------------            ".__."   |
-               _|__________________________________________|_
-              /                                              \
-             /________________________________________________\
-                                 ASCII Art by John Savard
-
-
-I was amazed at how easy it is to automatically generate and update Let's Encrypt certificates with OpenBSD.
-
-

What's Let's Encrypt?


-
-Let's Encrypt is a non-profit certificate authority run by Internet Security Research Group that provides X.509 certificates for Transport Layer Security (TLS) encryption at no charge. It is the world's largest certificate authority, used by more than 265 million websites, with the goal of all websites being secure and using HTTPS.
-
-Source: Wikipedia
-
-In short, it gives away TLS certificates for your website - for free! The catch is, that the certificates are only valid for three months. So it is better to automate certificate generation and renewals.
-
-

Meet acme-client


-
-acme-client is the default Automatic Certifcate Management Environment (ACME) client on OpenBSD and part of the OpenBSD base system.
-
-When invoked, the client first checks whether certificates actually require to be generated.
-
-
    -
  • It first checks whether a certificate already exists; if not, it will attempt to generate a new one.
    • -
  • If the certificate already exists but expires within the next 30 days, it will renew it.
    • -
  • Otherwise, acme-client won't do anything.
    • -

-Oversimplified, the following steps are undertaken by acme-client for generating a new certificate:
-
-
    -
  • Reading its config file /etc/acme-client.conf for a list of hosts (and their alternative names) to generate certificates. So it means you can also have certificates for arbitrary subdomains!
    • -
  • Automatic generation of the private certificate part (the certificate key) and the certificate signing request (CSR) to /etc/ssl/....
    • -
  • Requesting Let's Encrypt to sign the certificate. This also includes providing a set of temporary files requested by Let's Encrypt in the next step for verification.
    • -
  • Let's Encrypt then will contact the hostname for the certificate through a particular URL (e.g. http://foo.zone/.well-known/acme-challenge/...) to verify that the requester is the valid owner of the host.
    • -
  • Let's Encrypt generates a certificate, which then is downloaded to /etc/ssl/....
    • -

-

Configuration


-
-There is some (but easy) configuration required to make that all work on OpenBSD.
-
-

acme-client.conf


-
-This is how my /etc/acme-client.conf looks like (I copied a template from /etc/examples/acme-client.conf to /etc/acme-client.conf and added my domains to the bottom:
-
-
-#
-# $OpenBSD: acme-client.conf,v 1.4 2020/09/17 09:13:06 florian Exp $
-#
-authority letsencrypt {
-    api url "https://acme-v02.api.letsencrypt.org/directory"
-    account key "/etc/acme/letsencrypt-privkey.pem"
-}
-
-authority letsencrypt-staging {
-    api url "https://acme-staging-v02.api.letsencrypt.org/directory"
-    account key "/etc/acme/letsencrypt-staging-privkey.pem"
-}
-
-authority buypass {
-    api url "https://api.buypass.com/acme/directory"
-    account key "/etc/acme/buypass-privkey.pem"
-    contact "mailto:me@example.com"
-}
-
-authority buypass-test {
-    api url "https://api.test4.buypass.no/acme/directory"
-    account key "/etc/acme/buypass-test-privkey.pem"
-    contact "mailto:me@example.com"
-}
-
-domain buetow.org {
-    alternative names { www.buetow.org paul.buetow.org }
-    domain key "/etc/ssl/private/buetow.org.key"
-    domain full chain certificate "/etc/ssl/buetow.org.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain dtail.dev {
-    alternative names { www.dtail.dev }
-    domain key "/etc/ssl/private/dtail.dev.key"
-    domain full chain certificate "/etc/ssl/dtail.dev.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain foo.zone {
-    alternative names { www.foo.zone }
-    domain key "/etc/ssl/private/foo.zone.key"
-    domain full chain certificate "/etc/ssl/foo.zone.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain irregular.ninja {
-    alternative names { www.irregular.ninja }
-    domain key "/etc/ssl/private/irregular.ninja.key"
-    domain full chain certificate "/etc/ssl/irregular.ninja.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain snonux.land {
-    alternative names { www.snonux.land }
-    domain key "/etc/ssl/private/snonux.land.key"
-    domain full chain certificate "/etc/ssl/snonux.land.fullchain.pem"
-    sign with letsencrypt
-}
-
-
-

httpd.conf


-
-For ACME to work, you will need to configure the HTTP daemon so that the "special" ACME requests from Let's Encrypt are served correctly. I am using the standard OpenBSD httpd here. These are the snippets I use for the foo.zone host in /etc/httpd.conf (of course, you need a similar setup for all other hosts as well):
-
-
-server "foo.zone" {
-  listen on * port 80
-  location "/.well-known/acme-challenge/*" {
-    root "/acme"
-    request strip 2
-  }
-  location * {
-    block return 302 "https://$HTTP_HOST$REQUEST_URI"
-  }
-}
-
-server "foo.zone" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/foo.zone.fullchain.pem"
-    key "/etc/ssl/private/foo.zone.key"
-  }
-  location * {
-    root "/htdocs/gemtexter/foo.zone"
-    directory auto index
-  }
-}
-
-
-As you see, plain HTTP only serves the ACME challenge path. Otherwise, it redirects the requests to TLS. The TLS section then attempts to use the Let's Encrypt certificates.
-
-It is worth noticing that httpd will start without the certificates being present. This will cause a certificate error when you try to reach the HTTPS endpoint, but it helps to bootstrap Let's Encrypt. As you saw in the config snippet above, Let's Encrypt only requests the plain HTTP endpoint for the verification process, so HTTPS doesn't need to be operational yet at this stage. But once the certificates are generated, you will have to reload or restart httpd to use any new certificate.
-
-

CRON job


-
-You could now run doas acme-client foo.zone to generate the certificate or to renew it. Or you could automate it with CRON.
-
-I have created a script /usr/local/bin/acme.sh for that for all of my domains:
-
-
-#!/bin/sh
-
-function handle_cert {
-    host=$1
-    # Create symlink, so that relayd also can read it.
-    crt_path=/etc/ssl/$host
-    if [ -e $crt_path.crt ]; then
-        rm $crt_path.crt
-    fi
-    ln -s $crt_path.fullchain.pem $crt_path.crt
-    # Requesting and renewing certificate.
-    /usr/sbin/acme-client -v $host
-}
-
-has_update=no
-handle_cert www.buetow.org
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.paul.buetow.org
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.tmp.buetow.org
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.dtail.dev
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.foo.zone
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.irregular.ninja
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.snonux.land
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-
-# Pick up the new certs.
-if [ $has_update = yes ]; then
-    /usr/sbin/rcctl reload httpd
-    /usr/sbin/rcctl reload relayd
-    /usr/sbin/rcctl restart smtpd
-fi
-
-
-And added the following line to /etc/daily.local to run the script once daily so that certificates will be renewed fully automatically:
-
-
-/usr/local/bin/acme.sh
-
-
-I am receiving a daily output via E-Mail like this now:
-
-
-Running daily.local:
-acme-client: /etc/ssl/buetow.org.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/paul.buetow.org.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/tmp.buetow.org.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/dtail.dev.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/foo.zone.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/irregular.ninja.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/snonux.land.fullchain.pem: certificate valid: 79 days left
-
-
-

relayd.conf and smtpd.conf


-
-Besides httpd, relayd (mainly for Gemini) and smtpd (for mail, of course) also use TLS certificates. And as you can see in acme.sh, the services are reloaded or restarted (smtpd doesn't support reload) whenever a certificate is generated or updated.
-
-

Rexification


-
-I didn't write all these configuration files by hand. As a matter of fact, everything is automated with the Rex configuration management system.
-
-https://www.rexify.org
-
-At the top of the Rexfile I define all my hosts:
-
-
-our @acme_hosts = qw/buetow.org paul.buetow.org tmp.buetow.org dtail.dev foo.zone irregular.ninja snonux.land/;
-
-
-

General ACME client configuration


-
-ACME will be installed into the frontend group of hosts. Here, blowfish is the primary, and twofish is the secondary OpenBSD box.
-
-
-group frontends => 'blowfish.buetow.org', 'twofish.buetow.org';
-
-
-This is my Rex task for the general ACME configuration:
-
-
-desc 'Configure ACME client';
-task 'acme', group => 'frontends',
-  sub {
-    file '/etc/acme-client.conf',
-      content => template('./etc/acme-client.conf.tpl',
-        acme_hosts => \@acme_hosts,
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '644';
-
-    file '/usr/local/bin/acme.sh',
-      content => template('./scripts/acme.sh.tpl',
-        acme_hosts => \@acme_hosts,
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '744';
-
-    file '/etc/daily.local',
-      ensure => 'present',
-      owner => 'root',
-      group => 'wheel',
-      mode => '644';
-
-    append_if_no_such_line '/etc/daily.local', '/usr/local/bin/acme.sh';
-  };
-
-
-And there is also a Rex task just to run the ACME script remotely:
-
-
-desc 'Invoke ACME client';
-task 'acme_invoke', group => 'frontends',
-  sub {
-    say run '/usr/local/bin/acme.sh';
-  };
-
-
-
-Furthermore, this snippet (also at the top of the Rexfile) helps to determine whether the current server is the primary server (all hosts will be without the www. prefix) or the secondary server (all hosts will be with the www. prefix):
-
-
-# Bootstrapping the FQDN based on the server IP as the hostname and domain
-# facts aren't set yet due to the myname file in the first place.
-our $fqdns = sub {
-  my $ipv4 = shift;
-  return 'blowfish.buetow.org' if $ipv4 eq '23.88.35.144';
-  return 'twofish.buetow.org' if $ipv4 eq '108.160.134.135';
-  Rex::Logger::info("Unable to determine hostname for $ipv4", 'error');
-  return 'HOSTNAME-UNKNOWN.buetow.org';
-};
-
-# To determine whether the server is the primary or the secondary.
-our $is_primary = sub {
-  my $ipv4 = shift;
-  $fqdns->($ipv4) eq 'blowfish.buetow.org';
-};
-
-
-The following is the acme-client.conf.tpl Rex template file used for the automation. You see that the www. prefix isn't sent for the primary server. E.g. foo.zone will be served by the primary server (in my case, a server located in Germany) and www.foo.zone by the secondary server (in my case, a server located in Japan):
-
-
-#
-# $OpenBSD: acme-client.conf,v 1.4 2020/09/17 09:13:06 florian Exp $
-#
-authority letsencrypt {
-	api url "https://acme-v02.api.letsencrypt.org/directory"
-	account key "/etc/acme/letsencrypt-privkey.pem"
-}
-
-authority letsencrypt-staging {
-	api url "https://acme-staging-v02.api.letsencrypt.org/directory"
-	account key "/etc/acme/letsencrypt-staging-privkey.pem"
-}
-
-authority buypass {
-	api url "https://api.buypass.com/acme/directory"
-	account key "/etc/acme/buypass-privkey.pem"
-	contact "mailto:me@example.com"
-}
-
-authority buypass-test {
-	api url "https://api.test4.buypass.no/acme/directory"
-	account key "/etc/acme/buypass-test-privkey.pem"
-	contact "mailto:me@example.com"
-}
-
-<%
-  our $primary = $is_primary->($vio0_ip);
-  our $prefix = $primary ? '' : 'www.';
-%>
-
-<% for my $host (@$acme_hosts) { %>
-domain <%= $prefix.$host %> {
-	domain key "/etc/ssl/private/<%= $prefix.$host %>.key"
-	domain full chain certificate "/etc/ssl/<%= $prefix.$host %>.fullchain.pem"
-	sign with letsencrypt
-}
-<% } %>
-
-
-
-And this is the acme.sh.tpl:
-
-
-#!/bin/sh
-
-<%
-  our $primary = $is_primary->($vio0_ip);
-  our $prefix = $primary ? '' : 'www.';
--%>
-
-function handle_cert {
-    host=$1
-    # Create symlink, so that relayd also can read it.
-    crt_path=/etc/ssl/$host
-    if [ -e $crt_path.crt ]; then
-        rm $crt_path.crt
-    fi
-    ln -s $crt_path.fullchain.pem $crt_path.crt
-    # Requesting and renewing certificate.
-    /usr/sbin/acme-client -v $host
-}
-
-has_update=no
-<% for my $host (@$acme_hosts) { -%>
-handle_cert <%= $prefix.$host %>
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-<% } -%>
-
-# Pick up the new certs.
-if [ $has_update = yes ]; then
-    /usr/sbin/rcctl reload httpd
-    /usr/sbin/rcctl reload relayd
-    /usr/sbin/rcctl restart smtpd
-fi
-
-
-

Service rexification


-
-These are the Rex tasks setting up httpd, relayd and smtpd services:
-
-
-desc 'Setup httpd';
-task 'httpd', group => 'frontends',
-  sub {
-    append_if_no_such_line '/etc/rc.conf.local', 'httpd_flags=';
-
-    file '/etc/httpd.conf',
-      content => template('./etc/httpd.conf.tpl',
-        acme_hosts => \@acme_hosts,
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '644',
-      on_change => sub { service 'httpd' => 'restart' };
-
-    service 'httpd', ensure => 'started';
-  };
-
-desc 'Setup relayd';
-task 'relayd', group => 'frontends',
-  sub {
-    append_if_no_such_line '/etc/rc.conf.local', 'relayd_flags=';
-
-    file '/etc/relayd.conf',
-      content => template('./etc/relayd.conf.tpl',
-        ipv6address => $ipv6address,
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '600',
-      on_change => sub { service 'relayd' => 'restart' };
-
-    service 'relayd', ensure => 'started';
-  };
-
-desc 'Setup OpenSMTPD';
-task 'smtpd', group => 'frontends',
-  sub {
-    Rex::Logger::info('Dealing with mail aliases');
-    file '/etc/mail/aliases',
-      source => './etc/mail/aliases',
-      owner => 'root',
-      group => 'wheel',
-      mode => '644',
-      on_change => sub { say run 'newaliases' };
-
-    Rex::Logger::info('Dealing with mail virtual domains');
-    file '/etc/mail/virtualdomains',
-      source => './etc/mail/virtualdomains',
-      owner => 'root',
-      group => 'wheel',
-      mode => '644',
-      on_change => sub { service 'smtpd' => 'restart' };
-
-    Rex::Logger::info('Dealing with mail virtual users');
-    file '/etc/mail/virtualusers',
-      source => './etc/mail/virtualusers',
-      owner => 'root',
-      group => 'wheel',
-      mode => '644',
-      on_change => sub { service 'smtpd' => 'restart' };
-
-    Rex::Logger::info('Dealing with smtpd.conf');
-    file '/etc/mail/smtpd.conf',
-      content => template('./etc/mail/smtpd.conf.tpl',
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '644',
-      on_change => sub { service 'smtpd' => 'restart' };
-
-    service 'smtpd', ensure => 'started';
-  };
-
-
-
-This is the httpd.conf.tpl:
-
-
-<%
-  our $primary = $is_primary->($vio0_ip);
-  our $prefix = $primary ? '' : 'www.';
-%>
-
-# Plain HTTP for ACME and HTTPS redirect
-<% for my $host (@$acme_hosts) { %>
-server "<%= $prefix.$host %>" {
-  listen on * port 80
-  location "/.well-known/acme-challenge/*" {
-    root "/acme"
-    request strip 2
-  }
-  location * {
-    block return 302 "https://$HTTP_HOST$REQUEST_URI"
-  }
-}
-<% } %>
-
-# Gemtexter hosts
-<% for my $host (qw/foo.zone snonux.land/) { %>
-server "<%= $prefix.$host %>" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/<%= $prefix.$host %>.fullchain.pem"
-    key "/etc/ssl/private/<%= $prefix.$host %>.key"
-  }
-  location * {
-    root "/htdocs/gemtexter/<%= $host %>"
-    directory auto index
-  }
-}
-<% } %>
-
-# DTail special host
-server "<%= $prefix %>dtail.dev" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/<%= $prefix %>dtail.dev.fullchain.pem"
-    key "/etc/ssl/private/<%= $prefix %>dtail.dev.key"
-  }
-  location * {
-    block return 302 "https://github.dtail.dev$REQUEST_URI"
-  }
-}
-
-# Irregular Ninja special host
-server "<%= $prefix %>irregular.ninja" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/<%= $prefix %>irregular.ninja.fullchain.pem"
-    key "/etc/ssl/private/<%= $prefix %>irregular.ninja.key"
-  }
-  location * {
-    root "/htdocs/irregular.ninja"
-    directory auto index
-  }
-}
-
-# buetow.org special host.
-server "<%= $prefix %>buetow.org" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/<%= $prefix %>buetow.org.fullchain.pem"
-    key "/etc/ssl/private/<%= $prefix %>buetow.org.key"
-  }
-  block return 302 "https://paul.buetow.org"
-}
-
-server "<%= $prefix %>paul.buetow.org" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/<%= $prefix %>paul.buetow.org.fullchain.pem"
-    key "/etc/ssl/private/<%= $prefix %>paul.buetow.org.key"
-  }
-  block return 302 "https://foo.zone/contact-information.html"
-}
-
-server "<%= $prefix %>tmp.buetow.org" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/<%= $prefix %>tmp.buetow.org.fullchain.pem"
-    key "/etc/ssl/private/<%= $prefix %>tmp.buetow.org.key"
-  }
-  root "/htdocs/buetow.org/tmp"
-  directory auto index
-}
-
-
-and this the relayd.conf.tpl:
-
-
-<%
-  our $primary = $is_primary->($vio0_ip);
-  our $prefix = $primary ? '' : 'www.';
-%>
-
-log connection
-
-tcp protocol "gemini" {
-    tls keypair <%= $prefix %>foo.zone
-    tls keypair <%= $prefix %>buetow.org
-}
-
-relay "gemini4" {
-    listen on <%= $vio0_ip %> port 1965 tls
-    protocol "gemini"
-    forward to 127.0.0.1 port 11965
-}
-
-relay "gemini6" {
-    listen on <%= $ipv6address->($hostname) %> port 1965 tls
-    protocol "gemini"
-    forward to 127.0.0.1 port 11965
-}
-
-
-And last but not least