From fa835c3eb6700b6913d2782efc68b0b4ff1ffca1 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 24 Dec 2022 23:18:12 +0200 Subject: merge --- gemfeed/atom.xml | 6161 ------------------------------------------------------ 1 file changed, 6161 deletions(-) (limited to 'gemfeed') diff --git a/gemfeed/atom.xml b/gemfeed/atom.xml index 77cfa8e9..257cc564 100644 --- a/gemfeed/atom.xml +++ b/gemfeed/atom.xml @@ -1,6162 +1 @@ - - - 2022-12-08T11:10:37+02:00 - foo.zone feed - To be in the .zone! - - - https://foo.zone/ - - I tried Doom Emacs, but I switched back to (Neo)Vim - - https://foo.zone/gemfeed/2022-11-24-i-tried-emacs-but-i-switched-back-to-neovim.html - 2022-11-24T11:17:15+02:00 - - Paul C. Buetow - comments@mx.buetow.org - - As a long-lasting user of Vim (and NeoVim), I always wondered what GNU Emacs is really about, so I decided to try it. I didn't try vanilla GNU Emacs, but Doom Emacs. I chose Doom Emacs as it is a neat distribution of Emacs with Evil mode enabled by default. Evil mode allows Vi(m) key bindings (so to speak, it's emulating Vim within Emacs), and I am pretty sure I won't be ready to give up all the muscle memory I have built over more than a decade.. .....to read on please visit my site. - -
-

I tried (Doom) Emacs, but I switched back to (Neo)Vim

-

Published by Paul at 2022-11-24 11:17:15 EET, last updated at 2022-11-26

-
-             _/  \    _(\(o
-             /     \  /  _  ^^^o
-            /   !   \/  ! '!!!v'
-           !  !  \ _' ( \____
-           ! . \ _!\   \===^\)
-Art by      \ \_!  / __!
- Gunnar Z.   \!   /    \    <--- Emacs is a giant dragon
-       (\_      _/   _\ )
-        \ ^^--^^ __-^ /(__ 
-         ^^----^^    "^--v'
-

-

As a long-lasting user of Vim (and NeoVim), I always wondered what GNU Emacs is really about, so I decided to try it. I didn't try vanilla GNU Emacs, but Doom Emacs. I chose Doom Emacs as it is a neat distribution of Emacs with Evil mode enabled by default. Evil mode allows Vi(m) key bindings (so to speak, it's emulating Vim within Emacs), and I am pretty sure I won't be ready to give up all the muscle memory I have built over more than a decade.

-GNU Emacs
-Doom Emacs
-

I used Doom Emacs for around two months. Still, ultimately I decided to switch back to NeoVim as my primary editor and IDE and Vim (usually pre-installed on Linux-based systems) and Nvi (usually pre-installed on *BSD systems) as my "always available editor" for quick edits. (It is worth mentioning that I don't have a high opinion on whether Vim or NeoVim is the better editor, I prefer NeoVim as it comes with better defaults out of the box, but there is no real blocker to use Vim instead).

-Vim
-NeoVim
-

So why did I switch back to the Vi-family?

-

Emacs is a giant dragon

-

Emacs feels like a giant dragon as it is much more than an editor or an integrated development environment. Emacs is a whole platform on its own. There's an E-Mail client, an IRC client, or even games you can run within Emacs. And you can also change Emacs within Emacs using its own Lisp dialect, Emacs Lisp (Emacs is programmed in Emacs Lisp). Therefore, Emacs is also its own programming language. You can change every aspect of Emacs within Emacs itself. People jokingly state Emacs is an operating system and that you should directly use it as the init 1 process (if you don't know what the init 1 process is: Under UNIX and similar operating systems, it's the very first userland processed launched. That's usually systemd on Linux-based systems, launchd on macOS, or any other init script or init system used by the OS)!

-

In many aspects, Emacs is like shooting at everything with a bazooka! However, I prefer it simple. I only wanted Emacs to be a good editor (which it is, too), but there's too much other stuff in Emacs that I don't need to care about! Vim and NeoVim do one thing excellent: Being great text editors and, when loaded with plugins, decent IDEs, too.

-

Magit love

-

I almost fell in love with Magit, an integrated Git client for Emacs. But I think the best way to interact with Git is to use the git command line directly. I don't worry about typing out all the commands, as the most commonly used commands are in my shell history. Other useful Git programs I use frequently are bit and tig. Also, get a mechanical keyboard that makes hammering whole commands into the terminal even more enjoyable.

-Magit
-Tig
-

Magit is pretty neat for basic Git operations, but I found myself searching the internet for the correct sub-commands to do the things I wanted to do in Git. Mainly, the way how branches are managed is confusing. Often, I fell back to the command line to fix up the mess I produced with Magit (e.g. accidentally pushing to the wrong remote branch, so I found myself fixing things manually on the terminal with the git command with forced pushes....). Magit is hotkey driven, and common commands are quickly explorable through built-in hotkey menus. Still, I found it challenging to navigate to more advanced Git sub-commands that way which was much easier accomplished by using the git command directly.

-

Graphical UI

-

If there is one thing I envy about Emacs is that it's a graphical program, whereas the Vi-family of editors are purely terminal-based. I see the benefits of being a graphical program as this enables the use of multiple fonts simultaneously to embed pictures and graphs (that would be neat as a Markdown preview, for example). There's also GVim (Vim with GTK UI), but that's more of an afterthought.

-

There are now graphical front-end clients for NeoVim, but I still need to dig into them. Let me know your experience if you have one. Luckily, I don't rely on something graphical in my text editor, but it would improve how the editor looks and feels. UTF8 can already do a lot in the terminal, and terminal emulators also allow you to use TrueType fonts. Still, you will always be limited to one TTF font for the whole terminal, and it isn't possible to have, for example, a different font for headings, paragraphs, etc... you get the idea. TTF+UTF8 can't beat authentic graphics.

-

Scripting it

-

It is possible to customize every aspect of Emacs through Emacs Lisp. I have done some Elk Scheme programming in the past (a dialect of Lisp), but that was a long time ago, and I am not willing to dive here again to customize my environment. I would instead take the pragmatic approach and script what I need in VimScript (a terrible language, but it gets the job done!). I watched Damian Conway's VimScript course on O'Reilly Safari Books Online, which I greatly recommend. Yes, VimScript feels clunky, funky and weird and is far less elegant than Lisp, but it gets its job done - in most cases! (That reminds me that the Vim team has announced a new major version of VimScript with improvements and language changes made - I haven't gotten to it yet - but I assume that VimScript will always stay VimScript).

-Emacs Lisp
-Elk Scheme
-VimScript
-Scripting Vim by Damian Conway
-

NeoVim is also programmable with Lua, which seems to be a step up and Vim comes with a Perl plugin API (which was removed from NeoVim, but that is a different story - why would someone remove the most potent mature text manipulation programming language from one of the most powerful text editors?).

-NeoVim Lua API
-

One example is my workflow of how I compose my blog articles (e.g. this one you are currently reading): I am writing everything in NeoVim, but I also want to have every paragraph checked against Grammarly (as English is not my first language). So I write a whole paragraph, then I select the entire paragraph via visual selection with SHIFT+v, and then I press ,y to yank the paragraph to the systems clipboard, then I paste the paragraph to Grammarly's browser window with CTRL+v, let Grammarly suggest the improvements, and then I copy the result back with CTRL+c to the system clipboard and in NeoVim I type ,i to insert the result back overriding the old paragraph (which is still selected in visual mode) with the new content. That all sounds a bit complicated, but it's surprisingly natural and efficient.

-

To come back to the example, for the clipboard integration, I use this small VimScript snippet, and I didn't have to dig into any Lisp or Perl for this:

-
-" Clipboard
-vnoremap ,y !pbcopy<CR>ugv
-vnoremap ,i !pbpaste<CR>
-nmap ,i !wpbpaste<CR>
-

-

That's only a very few lines and does precisely what I want. It's quick and dirty but get's the job done! If VimScript becomes too cumbersome, I can use Lua for NeoVim scripting.

-

The famous Emacs Org mode

-

Org-mode is an Emacs mode for keeping notes, authoring documents, computational notebooks, literate programming, maintaining to-do lists, planning projects, and more — in a fast and effective plain-text system. There's even a dedicated website for it:

-https://orgmode.org/
-

In short, Org-mode is an "interactive markup language" that helps you organize everything mentioned above. I rarely touched the surface during my two-month experiment with Emacs, and I am impressed by it, so I see the benefits of having that. But it's not for me.

-

I use "Dead Tree Mode" to organize my work and notes. Dead tree? Yeah, I use an actual pen and a real paper journal (Leuchtturm or a Moleskine and a set of coloured 0.5 Muji Pens are excellent choices). That's far more immersive and flexible than a computer program can ever be. Yes, some automation and interaction with the computer (like calendar scheduling etc.) are missing. Still, an actual paper journal forces you to stay simple and focus on the actual work rather than tinkering with your computer program. (But I could not resist, and I wrote a VimScript which parses a table of contents page in Markdown format of my scanned paper journals, and NeoVim allows me to select a topic so that the corresponding PDF scan on the right journal page gets opened in an external PDF viewer (the PDF viewer is zathura, it uses Vi-keybindings, of course) :-). (See the appendix of this blog post for that script).

-Zathura
-

On the road, I also write some of my notes in Markdown format to NextCloud Notes, which is editable from my phone and via NeoVim on my computers. Markdown is much less powerful than Org-mode, but I prefer it the simple way. There's a neat terminal application, ranger, which I use to browse my NextCloud Notes when they are synced to a local folder on my machine. ranger is a file manager inspired by Vim and therefore makes use of Vim keybindings and it feels just natural to me.

-Ranger - A Vim inspired file manager
-

Did I mention that I also use my zsh (my default shell) and my tmux (terminal multiplexer) in Vi-mode?

-Z shell
-tmux terminal multiplexer
-

Seeking simplicity

-

I am not ready to dive deep into the whole world of Emacs. I prefer small and simple tools as opposed to complex tools. Emacs comes with many features out of the box, whereas in Vim/NeoVim, you would need to install many plugins to replicate some of the behaviour. Yes, I need to invest time managing all the Vim/NeoVim plugins I use, but I feel more in control compared to Doom Emacs, where a framework around vanilla Emacs manages all the plugins. I could use vanilla Emacs and manage all my plugins the vanilla way, but for me, it's not worth the effort to learn and dive into that as all that I want to do I can already do with Vim/NeoVim.

-

I am not saying that Vim/NeoVim are simple programs, but they are much simpler than Emacs with much smaller footprints; furthermore, they appear to be more straightforward as I am used to them. I only need Vim/NeoVim to be an editor, an IDE (through some plugins), and nothing more.

-

Conclusion

-

I understand the Emacs users now. Emacs is an incredibly powerful platform for almost everything, not just text editing. With Emacs, you can do nearly everything (Writing, editing, programming, calendar scheduling and note taking, Jira integration, playing games, listening to music, reading/writing emails, browsing the web, using as a calculator, generating HTML pages, configuring interactive menus, jumping around between every feature and every file within one single session, chat on IRC, surf the Gopherspace, ... the options are endless....). If you want to have one piece of software which rules it all and you are happy to invest a large part of your time in your platform: Pick Emacs, and over time Emacs will become "your" Emacs, customized to your own needs and change the way it works, which makes the Emacs users stick even more to it.

-

Vim/NeoVim also comes with a very high degree of customization options, but to a lesser extreme than Emacs (but still, a much higher degree than most other editors out there). If you want the best text editor in the world, which can also be tweaked to be a decent IDE, you are only looking for: Pick Vim or NeoVim! You would also need to invest a lot of time in learning, tweaking and customizing Vim/NeoVim, but that's a little more straightforward, and the result is much more lightweight once you get used to the "Vi way of doing things" you never would want to change back. I haven't tried the Emacs vanilla keystrokes, but they are terrible (that's probably one of the reasons why Doom Emacs uses Vim keybindings by default).

-

Update: One reader recommended to have a look at NvChad. NvChad is a NeoVim config written in Lua aiming to provide a base configuration with very beautiful UI and blazing fast startuptime (around 0.02 secs ~ 0.07 secs). They tweak UI plugins such as telescope, nvim-tree, bufferline etc well to provide an aesthetic UI experience. That sounds interesting!

-https://github.com/NvChad/NvChad
-

E-Mail your comments to paul at buetow dot org! :-)

-

Appendix

-

This is the VimScript I mentioned earlier, which parses a table of contents index of my scanned paper journals and opens the corresponding PDF at the right page in zathura:

-
-function! ReadJournalPageNumber()
-    let page = expand("<cword>")
-    if page !~# '^\d\+$'
-        for str in split(getline("."), "[ ,]")
-            if str =~# '^\d\+$'
-                let page = str
-                break
-            end
-        endfor
-    endif
-    return page
-endfunction
-
-function! ReadJournalMeta()
-    normal! mj
-
-    1/MetaFilePath:/
-    normal! 3w
-    let s:metaFilePath = expand("<cWORD>")
-    echom s:metaFilePath
-
-    1/MetaOffset:/
-    normal! 3w
-    let s:metaOffset = expand("<cword>")
-    echom s:metaOffset
-
-    1/MetaPageAtOffset:/
-    normal! 3w
-    let s:metaPageAtOffset = expand("<cword>")
-    echom s:metaPageAtOffset
-
-    1/MetaPagesPerScan:/
-    normal! 3w
-    let s:metaPagesPerScan = expand("<cword>")
-    echom s:metaPagesPerScan
-
-    normal! `j
-endfunction
-
-function! GetPdfPage(page)
-    return s:metaOffset + (a:page - s:metaPageAtOffset) / s:metaPagesPerScan
-endfunction
-
-function! OpenJournalPage()
-    let page = ReadJournalPageNumber()
-    if page !~# '^\d\+$'
-        echoerr "Could not identify Journal page number"
-    end
-    call ReadJournalMeta()
-    let pdfPage = GetPdfPage(page)
-    echon "Location is " . s:metaFilePath . ":" . pdfPage
-    call system("zathura --mode fullscreen -P " . pdfPage . " " . s:metaFilePath)
-    " call system("evince -p " . pdfPage . " " . s:metaFilePath)
-endfunction
-
-nmap ,j :call OpenJournalPage()<CR>
-

-
-
-
- - Installing DTail on OpenBSD - - https://foo.zone/gemfeed/2022-10-30-installing-dtail-on-openbsd.html - 2022-10-30T11:03:19+02:00 - - Paul C. Buetow - comments@mx.buetow.org - - This will be a quick blog post, as I am busy with my personal life now. I have relocated to a different country and am still busy arranging things. So bear with me :-). .....to read on please visit my site. - -
-

Installing DTail on OpenBSD

-

Published by Paul at 2022-10-30 11:03:19 EET

-
-       ,_---~~~~~----._
- _,,_,*^____      _____``*g*\"*,
-/ __/ /'     ^.  /      \ ^@q   f
- @f   |       |  |       |  0 _/
-\`/   \~__((@/ __ \__((@/    \
- |           _l__l_           I    <--- The Go Gopher
- }          [______]           I
- ]            | | |            |
- ]             ~ ~             |
- |                            |
-  |                           |
-  |                           |       A       ;
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~~~,--,-/ \---,-/|~~,~~~~~~~~~~~~~~~~~~~~~~~~~~~
-                           _|\,'. /|      /|   `/|-.
-                       \`.'    /|      ,            `;.
-                      ,'\   A     A         A   A _ /| `.;
-                    ,/  _              A       _  / _   /|  ;
-                   /\  / \   ,  ,           A  /    /     `/|
-                  /_| | _ \         ,     ,             ,/  \
-                 // | |/ `.\  ,-      ,       ,   ,/ ,/      \/
-                 / @| |@  / /'   \  \      ,              >  /|    ,--.
-                |\_/   \_/ /      |  |           ,  ,/        \  ./' __:..
-                |  __ __  |       |  | .--.  ,         >  >   |-'   /     `
-              ,/| /  '  \ |       |  |     \      ,           |    /
-             /  |<--.__,->|       |  | .    `.        >  >    /   (
-            /_,' \\  ^  /  \     /  /   `.    >--            /^\   |
-                  \\___/    \   /  /      \__'     \   \   \/   \  |
-                   `.   |/          ,  ,                  /`\    \  )
-                     \  '  |/    ,       V    \          /        `-\
- OpenBSD Puffy --->   `|/  '  V      V           \    \.'            \_
-                       '`-.       V       V        \./'\
-                           `|/-.      \ /   \ /,---`\         kat
-                            /   `._____V_____V'
-                                       '     '
-

-

This will be a quick blog post, as I am busy with my personal life now. I have relocated to a different country and am still busy arranging things. So bear with me :-)

-

In this post, I want to give a quick overview (or how-to) about installing DTail on OpenBSD, as the official documentation only covers Red Hat and Fedora Linux! And this blog post will also be used as my reference!

-https://dtail.dev
-

I am using Rexify for my OpenBSD automation. Check out the following article covering my Rex setup in a little bit more detail:

-Let's Encrypt with OpenBSD and Rex
-

I will also mention some relevant Rexfile snippets in this post!

-

Compile it

-

First of all, DTail needs to be downloaded and compiled. For that, git, go, and gmake are required:

-
-$ doas pkg_add git go gmake
-

-

I am happy that the Go Programming Language is readily available in the OpenBSD packaging system. Once the dependencies got installed, clone DTail and compile it:

-
-$ mkdir git
-$ cd git
-$ git clone https://github.com/mimecast/dtail
-$ cd dtail
-$ gmake 
-

-

You can verify the version by running the following command:

-
-$ ./dtail --version
- DTail  4.1.0  Protocol 4.1  Have a lot of fun!
-$ file dtail
- dtail: ELF 64-bit LSB executable, x86-64, version 1
-

-

Now, there isn't any need anymore to keep git, go and gmake, so they can be deinstalled now:

-
-$ doas pkg_delete git go gmake
-

-

One day I shall create an official OpenBSD port for DTail.

-

Install it

-

Installing the binaries is now just a matter of copying them to /usr/local/bin as follows:

-
-$ for bin in dserver dcat dgrep dmap dtail dtailhealth; do
-  doas cp -p $bin /usr/local/bin/$bin
-  doas chown root:wheel /usr/local/bin/$bin
-done
-

-

Also, we will be creating the _dserver service user:

-
-$ doas adduser -class nologin -group _dserver -batch _dserver
-$ doas usermod -d /var/run/dserver/ _dserver
-

-

The OpenBSD init script is created from scratch (not part of the official DTail project). Run the following to install the bespoke script:

-
-$ cat <<'END' | doas tee /etc/rc.d/dserver
-#!/bin/ksh
-
-daemon="/usr/local/bin/dserver"
-daemon_flags="-cfg /etc/dserver/dtail.json"
-daemon_user="_dserver"
-
-. /etc/rc.d/rc.subr
-
-rc_reload=NO
-
-rc_pre() {
-    install -d -o _dserver /var/log/dserver
-    install -d -o _dserver /var/run/dserver/cache
-}
-
-rc_cmd $1 &
-END
-$ doas chmod 755 /etc/rc.d/dserver
-

-

Rexification

-

This is the task for setting it up via Rex. Note the . . . ., that's a placeholder which we will fill up more and more during this blog post:

-
-desc 'Setup DTail';
-task 'dtail', group => 'frontends',
-   sub {
-      my $restart = FALSE;
-
-      file '/etc/rc.d/dserver':
-        content => template('./etc/rc.d/dserver.tpl'),
-        owner => 'root',
-        group => 'wheel',
-        mode => '755',
-        on_change => sub { $restart = TRUE };
-
-        .
-        .
-        .
-        .
-
-      service 'dserver' => 'restart' if $restart;
-      service 'dserver', ensure => 'started';
-   };
-

-

Configure it

-

Now, DTail is fully installed but still needs to be configured. Grab the default config file from GitHub ...

-
-$ doas mkdir /etc/dserver
-$ curl https://raw.githubusercontent.com/mimecast/dtail/master/samples/dtail.json.sample |
-    doas tee /etc/dserver/dtail.json
-

-

... and then edit it and adjust LogDir in the Common section to /var/log/dserver. The result will look like this:

-
-  "Common": {
-    "LogDir": "/var/log/dserver",
-    "Logger": "Fout",
-    "LogRotation": "Daily",
-    "CacheDir": "cache",
-    "SSHPort": 2222,
-    "LogLevel": "Info"
-  }
-

-

Rexification

-

That's as simple as adding the following to the Rex task:

-
-file '/etc/dserver',
-  ensure => 'directory';
-
-file '/etc/dserver/dtail.json',
-  content => template('./etc/dserver/dtail.json.tpl'),
-  owner => 'root',
-  group => 'wheel',
-  mode => '755',
-  on_change => sub { $restart = TRUE };
-

-

Update the key cache for it

-

DTail relies on SSH for secure authentication and communication. However, the system user _dserver has no permission to read the SSH public keys from the user's home directories, so the DTail server also checks for available public keys in an alternative path /var/run/dserver/cache.

-

The following script, populating the DTail server key cache, can be run periodically via CRON:

-
-$ cat <<'END' | doas tee /usr/local/bin/dserver-update-key-cache.sh
-#!/bin/ksh
-
-CACHEDIR=/var/run/dserver/cache
-DSERVER_USER=_dserver
-DSERVER_GROUP=_dserver
-
-echo 'Updating SSH key cache'
-
-ls /home/ | while read remoteuser; do
-    keysfile=/home/$remoteuser/.ssh/authorized_keys
-
-    if [ -f $keysfile ]; then
-        cachefile=$CACHEDIR/$remoteuser.authorized_keys
-        echo "Caching $keysfile -> $cachefile"
-
-        cp $keysfile $cachefile
-        chown $DSERVER_USER:$DSERVER_GROUP $cachefile
-        chmod 600 $cachefile
-    fi
-done
-
-# Cleanup obsolete public SSH keys
-find $CACHEDIR -name \*.authorized_keys -type f |
-while read cachefile; do
-    remoteuser=$(basename $cachefile | cut -d. -f1)
-    keysfile=/home/$remoteuser/.ssh/authorized_keys
-
-    if [ ! -f $keysfile ]; then
-        echo 'Deleting obsolete cache file $cachefile'
-        rm $cachefile
-    fi
-done
-
-echo 'All set...'
-END
-$ doas chmod 500 /usr/local/bin/dserver-update-key-cache.sh
-

-

Note that the script above is a slight variation of the official DTail script. The official DTail one is a bash script, but on OpenBSD, there's ksh. I run it once daily by adding it to the daily.local:

-
-$ echo /usr/local/bin/dserver-update-key-cache.sh | doas tee -a /etc/daily.local
-/usr/local/bin/dserver-update-key-cache.sh
-

-

Rexification

-

That's done by adding ...

-
-file '/usr/local/bin/dserver-update-key-cache.sh',
-  content => template('./scripts/dserver-update-key-cache.sh.tpl'),
-  owner => 'root',
-  group => 'wheel',
-  mode => '500';
-
-append_if_no_such_line '/etc/daily.local', '/usr/local/bin/dserver-update-key-cache.sh';
-

-

... to the Rex task!

-

Start it

-

Now, it's time to enable and start the DTail server:

-
-$ sudo rcctl enable dserver
-$ sudo rcctl start dserver
-$ tail -f /var/log/dserver/*.log
-INFO|1022-090634|Starting scheduled job runner after 2s
-INFO|1022-090634|Starting continuous job runner after 2s
-INFO|1022-090644|24204|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnections=0
-INFO|1022-090654|24204|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnections=0
-INFO|1022-090719|Starting server|DTail 4.1.0 Protocol 4.1 Have a lot of fun!
-INFO|1022-090719|Generating private server RSA host key
-INFO|1022-090719|Starting server
-INFO|1022-090719|Binding server|0.0.0.0:2222
-INFO|1022-090719|Starting scheduled job runner after 2s
-INFO|1022-090719|Starting continuous job runner after 2s
-INFO|1022-090729|86050|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnections=0
-INFO|1022-090739|86050|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0|lifetimeConnect
-.
-.
-.
-Ctr+C
-

-

As we don't want to wait until tomorrow, let's populate the key cache manually:

-
-$ doas /usr/local/bin/dserver-update-key-cache.sh
-Updating SSH key cache
-Caching /home/_dserver/.ssh/authorized_keys -> /var/cache/dserver/_dserver.authorized_keys
-Caching /home/admin/.ssh/authorized_keys -> /var/cache/dserver/admin.authorized_keys
-Caching /home/failunderd/.ssh/authorized_keys -> /var/cache/dserver/failunderd.authorized_keys
-Caching /home/git/.ssh/authorized_keys -> /var/cache/dserver/git.authorized_keys
-Caching /home/paul/.ssh/authorized_keys -> /var/cache/dserver/paul.authorized_keys
-Caching /home/rex/.ssh/authorized_keys -> /var/cache/dserver/rex.authorized_keys
-All set...
-

-

Use it

-

The DTail server is now ready to serve connections. You can use any DTail commands, such as dtail, dgrep, dmap, dcat, dtailhealth, to do so. Checkout out all the usage examples on the official DTail page.

-

I have installed DTail server this way on my personal OpenBSD frontends blowfish, and fishfinger, and the following command connects as user rex to both machines and greps the file /etc/fstab for the string local:

-
-❯ ./dgrep -user rex -servers blowfish.buetow.org,fishfinger.buetow.org --regex local /etc/fstab
-CLIENT|earth|WARN|Encountered unknown host|{blowfish.buetow.org:2222 0xc0000a00f0 0xc0000a61e0 [blowfish.buetow.org]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ZnF/LAk14SgqCzk38yENVTNfqibcluMTuKx1u53cKSp2xwHWzy0Ni5smFPpJDIQQljQEJl14ZdXvhhjp1kKHxJ79ubqRtIXBlC0PhlnP8Kd+mVLLHYpH9VO4rnaSfHE1kBjWkI7U6lLc6ks4flgAgGTS5Bb7pLAjwdWg794GWcnRh6kSUEQd3SftANqQLgCunDcP2Vc4KR9R78zBmEzXH/OPzl/ANgNA6wWO2OoKKy2VrjwVAab6FW15h3Lr6rYIw3KztpG+UMmEj5ReexIjXi/jUptdnUFWspvAmzIl6kwzzF8ExVyT9D75JRuHvmxXKKjyJRxqb8UnSh2JD4JN [23.88.35.144]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ZnF/LAk14SgqCzk38yENVTNfqibcluMTuKx1u53cKSp2xwHWzy0Ni5smFPpJDIQQljQEJl14ZdXvhhjp1kKHxJ79ubqRtIXBlC0PhlnP8Kd+mVLLHYpH9VO4rnaSfHE1kBjWkI7U6lLc6ks4flgAgGTS5Bb7pLAjwdWg794GWcnRh6kSUEQd3SftANqQLgCunDcP2Vc4KR9R78zBmEzXH/OPzl/ANgNA6wWO2OoKKy2VrjwVAab6FW15h3Lr6rYIw3KztpG+UMmEj5ReexIjXi/jUptdnUFWspvAmzIl6kwzzF8ExVyT9D75JRuHvmxXKKjyJRxqb8UnSh2JD4JN 0xc0000a2180}
-CLIENT|earth|WARN|Encountered unknown host|{fishfinger.buetow.org:2222 0xc0000a0150 0xc000460110 [fishfinger.buetow.org]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNiikdL7+tWSN0rCaw1tOd9aQgeUFgb830V9ejkyJ5h93PKLCWZSMMCtiabc1aUeUZR//rZjcPHFLuLq/YC+Y3naYtGd6j8qVrcfG8jy3gCbs4tV9SZ9qd5E24mtYqYdGlee6JN6kEWhJxFkEwPfNlG+YAr3KC8lvEAE2JdWvaZavqsqMvHZtAX3b25WCBf2HGkyLZ+d9cnimRUOt+/+353BQFCEct/2mhMVlkr4I23CY6Tsufx0vtxx25nbFdZias6wmhxaE9p3LiWXygPWGU5iZ4RSQSImQz4zyOc9rnJeP1rwGk0OWDJhdKNXuf0kIPdzMfwxv2otgY32/DJj6L [46.23.94.99]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNiikdL7+tWSN0rCaw1tOd9aQgeUFgb830V9ejkyJ5h93PKLCWZSMMCtiabc1aUeUZR//rZjcPHFLuLq/YC+Y3naYtGd6j8qVrcfG8jy3gCbs4tV9SZ9qd5E24mtYqYdGlee6JN6kEWhJxFkEwPfNlG+YAr3KC8lvEAE2JdWvaZavqsqMvHZtAX3b25WCBf2HGkyLZ+d9cnimRUOt+/+353BQFCEct/2mhMVlkr4I23CY6Tsufx0vtxx25nbFdZias6wmhxaE9p3LiWXygPWGU5iZ4RSQSImQz4zyOc9rnJeP1rwGk0OWDJhdKNXuf0kIPdzMfwxv2otgY32/DJj6L 0xc0000a2240}
-Encountered 2 unknown hosts: 'blowfish.buetow.org:2222,fishfinger.buetow.org:2222'
-Do you want to trust these hosts?? (y=yes,a=all,n=no,d=details): a
-CLIENT|earth|INFO|STATS:STATS|cgocalls=11|cpu=8|connected=2|servers=2|connected%=100|new=2|throttle=0|goroutines=19
-CLIENT|earth|INFO|Added hosts to known hosts file|/home/paul/.ssh/known_hosts
-REMOTE|blowfish|100|7|fstab|31bfd9d9a6788844.h /usr/local ffs rw,wxallowed,nodev 1 2
-REMOTE|fishfinger|100|7|fstab|093f510ec5c0f512.h /usr/local ffs rw,wxallowed,nodev 1 2
-

-

Running it the second time, and given that you trusted the keys the first time, it won't prompt you for the host keys anymore:

-
-❯ ./dgrep -user rex -servers blowfish.buetow.org,fishfinger.buetow.org --regex local /etc/fstab
-REMOTE|blowfish|100|7|fstab|31bfd9d9a6788844.h /usr/local ffs rw,wxallowed,nodev 1 2
-REMOTE|fishfinger|100|7|fstab|093f510ec5c0f512.h /usr/local ffs rw,wxallowed,nodev 1 2
-

-

Conclusions

-

It's a bit of manual work, but it's ok on this small scale! I shall invest time in creating an official OpenBSD port, though. That would render most of the manual steps obsolete, as outlined in this post!

-

Check out the following for more information:

-https://dtail.dev
-https://github.com/mimecast/dtail
-https://www.rexify.org
-

E-Mail your comments to paul at buetow dot org! :-)

-
-
-
- - After a bad night's sleep - - https://foo.zone/gemfeed/2022-09-30-after-a-bad-nights-sleep.html - 2022-09-30T09:53:23+03:00 - - Paul C. Buetow - comments@mx.buetow.org - - Everyone has it once a while: A bad night's sleep. Here I attempt to list useful tips how to deal with it.. .....to read on please visit my site. - -
-

After a bad night's sleep

-

Published by Paul at 2022-09-30 09:53:23 EEST, last updated at 2022-10-12

-
-               z
-                z
-                 Z
-       .--.  Z Z
-      / _(c\   .-.     __
-     | / /  '-;   \'-'`  `\______
-     \_\/'/ __/ )  /  )   |      \--,
-     | \`""`__-/ .'--/   /--------\  \
-      \\`  ///-\/   /   /---;-.    '-'
-jgs                (________\  \
-                             '-'
-

-

Everyone has it once in a while: A bad night's sleep. Here I attempt to list valuable tips on how to deal with it.

-

Don't take the day off.

-

Don't take a day off after not sleeping enough the previous night. That would be wasting the holiday allowance. It wouldn't be possible to enjoy my free time anyway, so why not just work? There's still a way for an IT Engineer to be productive (sometimes even more) with half or less of the concentration power available!

-

Start work early

-

Probably I am already awake early and am unable to fall asleep again. My strategy here is to "attack" the day: Start work early and finish early. The early bird will also encounter fewer distractions from colleagues.

-

Sweat the small stuff

-

There's never a shortage of small items to hook off my list. Most of these items don't require my full concentration power, and I will be happy to get them off my list so that the next day, after a good night's sleep, I can immerse myself again in focused, deep work with all concentration powers at hand.

-

Examples of "small work items" are:

-
    -
  • Tidying up the workspace.
  • -
  • Installing pending computer software updates.
  • -
  • Going through the work backlog: Create new tickets, close obsolete ones, and roughly pre-plan upcoming work.
  • -
  • Finishing off the easy tickets from the current sprint.
  • -
  • Going through any tedious paperwork.
  • -
  • Catch up with the journal and mark off all trivial action items.
  • -
-

Enter the flow state

-

I find it easy to enter the "flow state" after a bad night's sleep. All I need to do is to put on some ambient music (preferably instrumental chill house) and start to work on a not-too-difficult ticket.

-

Usually, the "flow state" is associated with deep-focused work, but deep-focused work isn't easily possible under sleep deprivation. It's still possible to be in the flow by working on more manageable tasks and leaving the difficult ones for the next day.

-

Reschedule meetings

-

I find engaging in discussions and demanding meetings challenging after a lousy night's sleep. I still attend the sessions I am invited to as "only" a participant, but I prefer to reschedule all meetings I am the primary driver of.

-

This, unfortunately, also includes interviews. Interviews require full concentration power. So for interviews, I would find a colleague to step in for me or ask to reschedule the interview altogether. Everything else wouldn't make it justice and would waste everyone's time!

-

Invent

-

The mind works differently under sleep deprivation: It's easier to invent new stuff as it's easier to have a look at things from different perspectives. Until an hour ago, I didn't know yet what I would be blogging about for this month, and then I just started writing this, and it took me only half an hour to write the first draft of this blog post!

-

Fast

-

I don't eat breakfast, and I don't eat lunch on these days. I only have dinner. Not eating means my mind doesn't get foggy, and I keep up the work momentum. This is called intermittent fasting, which not only generally helps to keep the weight under control and boosts the concentration power. Furthermore, intermittent fasting is healthy. You should include it in your routine, even after a good night's sleep.

-

Stretch

-

I won't have enough energy for strenuous physical exercise on those days, but a 30 to a 60-minute stretching session can make the day. Stretching will even hurt less under sleep deprivation! The stretching could also be substituted with a light Yoga session.

-

Walk

-

Walking is healthy, and the time can be used to listen to interesting podcasts. The available concentration power might not be enough for more sophisticated audio literature. I will have enough energy for one or two daily walks (~10k steps for the day in total). Sometimes, I listen to music during walks. I also try to catch the bright sunlight.

-

Red Bull

-

I don't think that Red Bull is a healthy drink. But once in a while, a can in the early afternoon brings wonders, and productivity will skyrocket. Other than Red Bull, drink a lot of water throughout the day. Don't forget to drink the sugar-free version; otherwise, your intermittent fast will be broken.

-

Power nap

-

I don't know how to "enforce" a nap, but sometimes I manage to power nap, and it helps wonders. A 30-minute nap sometimes brings me back to normal. If you don't tend to fast as you are too hungry, it helps to try to nap approximately 30 minutes after eating something.

-

Don't take anything personally.

-

It's much more challenging to keep the mind "under control" in this state. Every annoyance can potentially upset, which could reflect on the work colleagues. It is wise to attempt to go with a positive attitude into the day, always smile and be polite to the family and colleagues at work. Don't let anything drop out to the people next; they don't deserve it as they didn't do anything wrong! Also, remember, it can't be controlled at all. It's time to let go of the annoyances for the day.

-

Meditate

-

To keep the good vibe, it helps to meditate for 10 minutes. Meditation must nothing be fancy. It can be just lying on the sofa and observing your thoughts as they come and go. Don't judge your thoughts, as that could put you in a negative mood. It's not necessary to sit in an uncomfortable Yoga pose, and it is not required to chant "Ohhmmmmm".

-

Write things down

-

Sometimes something requiring more concentration power demands time. This is where it helps to write a note in a journal and return to it another day. This doesn't mean slacking off but managing the rarely available concentration power for the day. I might repeat myself: Today, sweat all the small stuff. Tomorrow, do the deep-focused work on that crucial project again.

-

It's easier to forget things on those days, so everything should be written down so that it can be worked off later. Things written down will not be overlooked!

-

Social media

-

I wouldn't say I like checking social media, as it can consume a lot of time and can become addictive. But once in a while, I want to catch up with my "networks". After a bad night's sleep, it's the perfect time to check your social media. Once done, you don't have to do it anymore for the next couple of days!

-

E-Mail your comments to paul at buetow dot org! :-)

-
-
-
- - Gemtexter 1.1.0 - Let's Gemtext again - - https://foo.zone/gemfeed/2022-08-27-gemtexter-1.1.0-lets-gemtext-again.html - 2022-08-27T18:25:57+01:00 - - Paul C. Buetow - comments@mx.buetow.org - - I am proud to announce that I've released Gemtexter version `1.1.0`. What is Gemtexter? It's my static site generator written in GNU Bash:. .....to read on please visit my site. - -
-

Gemtexter 1.1.0 - Let's Gemtext again

-

Published by Paul at 2022-08-27 20:25:57 EEST

-
--=[ typewriter ]=-  1/98
-
-       .-------.
-      _|~~ ~~  |_
-    =(_|_______|_)=
-      |:::::::::|
-      |:::::::[]|
-      |o=======.|
- jgs  `"""""""""`
-

-

I am proud to announce that I've released Gemtexter version 1.1.0. What is Gemtexter? It's my static site generator written in GNU Bash:

-Gemtexter - One Bash script to rule it all
-https://codeberg.org/snonux/gemtexter
-

It has been around a year since I released the first version 1.0.0. Although, there aren't any groundbreaking changes, there have been a couple of smaller commits and adjustments. I was quite surprised that I received a bunch of feedback and requests about Gemtexter so it means that I am not the only person in the universe actually using it.

-

What's new?

-

Automatic check for GNU version requirements

-

Gemtexter relies on the GNU versions of the tools grep, sed and date and it also requires the Bash shell in version 5 at least. That's now done in the check_dependencies() function:

-
-check_dependencies () {
-    # At least, Bash 5 is required
-    local -i required_version=5
-    IFS=. read -ra version <<< "$BASH_VERSION"
-    if [ "${version[0]}" -lt $required_version ]; then
-        log ERROR "ERROR, \"bash\" must be at least at major version $required_version!"
-        exit 2
-    fi
-
-    # These must be the GNU versions of the commands
-    for tool in $DATE $SED $GREP; do
-        if ! $tool --version | grep -q GNU; then
-            log ERROR "ERROR, \"$tool\" command is not the GNU version, please install!"
-            exit 2
-        fi
-    done
-}
-

-

Especially macOS users didn't read the README carefully enough to install GNU Grep, GNU Sed and GNU Date before using Gemtexter.

-

Backticks now produce inline code blocks in the HTML output

-

The Gemtext format doesn't support inline code blocks, but Gemtexter now produces inline code blocks (means, small code fragments can be placed in the middle of a paragraph) in the HTML output when the code block is enclosed with Backticks. There were no adjustments required for the Markdown output format, because Markdown supports it already out of the box.

-

Cache for Atom feed generation

-

The Bash is not the most performant language. Gemtexter already takes a couple of seconds only to generate the Atom feed for around two hand full of articles on my slightly underpowered Surface Go 2 Linux tablet. Therefore, I introduced a cache, so that subsequent Atom feed generation runs finish much quicker. The cache uses a checksum of the Gemtext .html file to decide whether anything of the content has changed or not.

-

Input filter support

-

Once your capsule reaches a certain size, it can become annoying to re-generate everything if you only want to preview the HTML or Markdown output of one single content file. The following will add a filter to only generate the files matching a regular expression:

-
-./gemtexter --generate '.*hello.*'
-

-

Revamped git support

-

The Git support has been completely rewritten. It's now more reliable and faster too. Have a look at the README for more information.

-

Addition of htmlextras and web font support

-

The htmlextras folder now contains all extra files required for the HTML output format such as cascading style sheet (CSS) files and web fonts.

-

Sub-section support

-

It's now possible to define sub-sections within a Gemtexter capsule. For the HTML output, each sub-section can use its own CSS and web font definitions. E.g.:

-The foo.zone main site
-The notes sub-section (with different fonts)
-

More

-

Additionally, there were a couple of bug fixes, refactorings and overall improvements in the documentation made.

-

Overall I think it's a pretty solid 1.1.0 release without anything groundbreaking (therefore no major version jump). But I am happy about it.

-

E-Mail your comments to paul at buetow dot org! :-)

-
-
-
- - Let's Encrypt with OpenBSD and Rex - - https://foo.zone/gemfeed/2022-07-30-lets-encrypt-with-openbsd-and-rex.html - 2022-07-30T12:14:31+01:00 - - Paul C. Buetow - comments@mx.buetow.org - - I was amazed how easy it is to automatically generate and update Let's Encrypt certificates with OpenBSD.. .....to read on please visit my site. - -
-

Let's Encrypt with OpenBSD and Rex

-

Published by Paul at 2022-07-30 14:14:31 EEST

-
-                                               /    _    \
-  The Hebern Machine                            \ ." ". /
-                                  ___            /     \
-                              ..""   ""..       |   O   |
-                             /           \      |       |
-                            /             \     |       |
-                          ---------------------------------
-                        _/  o     (O)     o   _            |
-                      _/                    ." ".          |
-                    I/    _________________/     \         |
-                  _/I   ."                        |        |
-          =====  /  I  /                         /         |
-     =====  | | |   \ |       _________________."          |
-=====  | |  | | |   /  \     /  _|_|__|_|_          __     |
-  | |  | |  | | |   \   "._."  /  o    o  \       ."  ".   |
-  |  --|  --|  -|   /          \         _/      /      \  |
-   \____\____\__|   \  ______   |       /       |        | |
-               --------      ---       /        |        | |
-              ( )        (O)          /          \      /  |
-               -----------------------            ".__."   |
-               _|__________________________________________|_
-              /                                              \
-             /________________________________________________\
-                                 ASCII Art by John Savard
-

-

I was amazed at how easy it is to automatically generate and update Let's Encrypt certificates with OpenBSD.

-

What's Let's Encrypt?

-

Let's Encrypt is a non-profit certificate authority run by Internet Security Research Group that provides X.509 certificates for Transport Layer Security (TLS) encryption at no charge. It is the world's largest certificate authority, used by more than 265 million websites, with the goal of all websites being secure and using HTTPS.

-Source: Wikipedia
-

In short, it gives away TLS certificates for your website - for free! The catch is, that the certificates are only valid for three months. So it is better to automate certificate generation and renewals.

-

Meet acme-client

-

acme-client is the default Automatic Certifcate Management Environment (ACME) client on OpenBSD and part of the OpenBSD base system.

-

When invoked, the client first checks whether certificates actually require to be generated.

-
    -
  • It first checks whether a certificate already exists; if not, it will attempt to generate a new one.
  • -
  • If the certificate already exists but expires within the next 30 days, it will renew it.
  • -
  • Otherwise, acme-client won't do anything.
  • -
-

Oversimplified, the following steps are undertaken by acme-client for generating a new certificate:

-
    -
  • Reading its config file /etc/acme-client.conf for a list of hosts (and their alternative names) to generate certificates. So it means you can also have certificates for arbitrary subdomains!
  • -
  • Automatic generation of the private certificate part (the certificate key) and the certificate signing request (CSR) to /etc/ssl/....
  • -
  • Requesting Let's Encrypt to sign the certificate. This also includes providing a set of temporary files requested by Let's Encrypt in the next step for verification.
  • -
  • Let's Encrypt then will contact the hostname for the certificate through a particular URL (e.g. http://foo.zone/.well-known/acme-challenge/...) to verify that the requester is the valid owner of the host.
  • -
  • Let's Encrypt generates a certificate, which then is downloaded to /etc/ssl/....
  • -
-

Configuration

-

There is some (but easy) configuration required to make that all work on OpenBSD.

-

acme-client.conf

-

This is how my /etc/acme-client.conf looks like (I copied a template from /etc/examples/acme-client.conf to /etc/acme-client.conf and added my domains to the bottom:

-
-#
-# $OpenBSD: acme-client.conf,v 1.4 2020/09/17 09:13:06 florian Exp $
-#
-authority letsencrypt {
-    api url "https://acme-v02.api.letsencrypt.org/directory"
-    account key "/etc/acme/letsencrypt-privkey.pem"
-}
-
-authority letsencrypt-staging {
-    api url "https://acme-staging-v02.api.letsencrypt.org/directory"
-    account key "/etc/acme/letsencrypt-staging-privkey.pem"
-}
-
-authority buypass {
-    api url "https://api.buypass.com/acme/directory"
-    account key "/etc/acme/buypass-privkey.pem"
-    contact "mailto:me@example.com"
-}
-
-authority buypass-test {
-    api url "https://api.test4.buypass.no/acme/directory"
-    account key "/etc/acme/buypass-test-privkey.pem"
-    contact "mailto:me@example.com"
-}
-
-domain buetow.org {
-    alternative names { www.buetow.org paul.buetow.org }
-    domain key "/etc/ssl/private/buetow.org.key"
-    domain full chain certificate "/etc/ssl/buetow.org.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain dtail.dev {
-    alternative names { www.dtail.dev }
-    domain key "/etc/ssl/private/dtail.dev.key"
-    domain full chain certificate "/etc/ssl/dtail.dev.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain foo.zone {
-    alternative names { www.foo.zone }
-    domain key "/etc/ssl/private/foo.zone.key"
-    domain full chain certificate "/etc/ssl/foo.zone.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain irregular.ninja {
-    alternative names { www.irregular.ninja }
-    domain key "/etc/ssl/private/irregular.ninja.key"
-    domain full chain certificate "/etc/ssl/irregular.ninja.fullchain.pem"
-    sign with letsencrypt
-}
-
-domain snonux.land {
-    alternative names { www.snonux.land }
-    domain key "/etc/ssl/private/snonux.land.key"
-    domain full chain certificate "/etc/ssl/snonux.land.fullchain.pem"
-    sign with letsencrypt
-}
-

-

httpd.conf

-

For ACME to work, you will need to configure the HTTP daemon so that the "special" ACME requests from Let's Encrypt are served correctly. I am using the standard OpenBSD httpd here. These are the snippets I use for the foo.zone host in /etc/httpd.conf (of course, you need a similar setup for all other hosts as well):

-
-server "foo.zone" {
-  listen on * port 80
-  location "/.well-known/acme-challenge/*" {
-    root "/acme"
-    request strip 2
-  }
-  location * {
-    block return 302 "https://$HTTP_HOST$REQUEST_URI"
-  }
-}
-
-server "foo.zone" {
-  listen on * tls port 443
-  tls {
-    certificate "/etc/ssl/foo.zone.fullchain.pem"
-    key "/etc/ssl/private/foo.zone.key"
-  }
-  location * {
-    root "/htdocs/gemtexter/foo.zone"
-    directory auto index
-  }
-}
-

-

As you see, plain HTTP only serves the ACME challenge path. Otherwise, it redirects the requests to TLS. The TLS section then attempts to use the Let's Encrypt certificates.

-

It is worth noticing that httpd will start without the certificates being present. This will cause a certificate error when you try to reach the HTTPS endpoint, but it helps to bootstrap Let's Encrypt. As you saw in the config snippet above, Let's Encrypt only requests the plain HTTP endpoint for the verification process, so HTTPS doesn't need to be operational yet at this stage. But once the certificates are generated, you will have to reload or restart httpd to use any new certificate.

-

CRON job

-

You could now run doas acme-client foo.zone to generate the certificate or to renew it. Or you could automate it with CRON.

-

I have created a script /usr/local/bin/acme.sh for that for all of my domains:

-
-#!/bin/sh
-
-function handle_cert {
-    host=$1
-    # Create symlink, so that relayd also can read it.
-    crt_path=/etc/ssl/$host
-    if [ -e $crt_path.crt ]; then
-        rm $crt_path.crt
-    fi
-    ln -s $crt_path.fullchain.pem $crt_path.crt
-    # Requesting and renewing certificate.
-    /usr/sbin/acme-client -v $host
-}
-
-has_update=no
-handle_cert www.buetow.org
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.paul.buetow.org
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.tmp.buetow.org
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.dtail.dev
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.foo.zone
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.irregular.ninja
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-handle_cert www.snonux.land
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-
-# Pick up the new certs.
-if [ $has_update = yes ]; then
-    /usr/sbin/rcctl reload httpd
-    /usr/sbin/rcctl reload relayd
-    /usr/sbin/rcctl restart smtpd
-fi
-

-

And added the following line to /etc/daily.local to run the script once daily so that certificates will be renewed fully automatically:

-
-/usr/local/bin/acme.sh
-

-

I am receiving a daily output via E-Mail like this now:

-
-Running daily.local:
-acme-client: /etc/ssl/buetow.org.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/paul.buetow.org.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/tmp.buetow.org.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/dtail.dev.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/foo.zone.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/irregular.ninja.fullchain.pem: certificate valid: 80 days left
-acme-client: /etc/ssl/snonux.land.fullchain.pem: certificate valid: 79 days left
-

-

relayd.conf and smtpd.conf

-

Besides httpd, relayd (mainly for Gemini) and smtpd (for mail, of course) also use TLS certificates. And as you can see in acme.sh, the services are reloaded or restarted (smtpd doesn't support reload) whenever a certificate is generated or updated.

-

Rexification

-

I didn't write all these configuration files by hand. As a matter of fact, everything is automated with the Rex configuration management system.

-https://www.rexify.org
-

At the top of the Rexfile I define all my hosts:

-
-our @acme_hosts = qw/buetow.org paul.buetow.org tmp.buetow.org dtail.dev foo.zone irregular.ninja snonux.land/;
-

-

General ACME client configuration

-

ACME will be installed into the frontend group of hosts. Here, blowfish is the primary, and twofish is the secondary OpenBSD box.

-
-group frontends => 'blowfish.buetow.org', 'twofish.buetow.org';
-

-

This is my Rex task for the general ACME configuration:

-
-desc 'Configure ACME client';
-task 'acme', group => 'frontends',
-  sub {
-    file '/etc/acme-client.conf',
-      content => template('./etc/acme-client.conf.tpl',
-        acme_hosts => \@acme_hosts,
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '644';
-
-    file '/usr/local/bin/acme.sh',
-      content => template('./scripts/acme.sh.tpl',
-        acme_hosts => \@acme_hosts,
-        is_primary => $is_primary),
-      owner => 'root',
-      group => 'wheel',
-      mode => '744';
-
-    file '/etc/daily.local',
-      ensure => 'present',
-      owner => 'root',
-      group => 'wheel',
-      mode => '644';
-
-    append_if_no_such_line '/etc/daily.local', '/usr/local/bin/acme.sh';
-  };
-

-

And there is also a Rex task just to run the ACME script remotely:

-
-desc 'Invoke ACME client';
-task 'acme_invoke', group => 'frontends',
-  sub {
-    say run '/usr/local/bin/acme.sh';
-  };
-
-

-

Furthermore, this snippet (also at the top of the Rexfile) helps to determine whether the current server is the primary server (all hosts will be without the www. prefix) or the secondary server (all hosts will be with the www. prefix):

-
-# Bootstrapping the FQDN based on the server IP as the hostname and domain
-# facts aren't set yet due to the myname file in the first place.
-our $fqdns = sub {
-  my $ipv4 = shift;
-  return 'blowfish.buetow.org' if $ipv4 eq '23.88.35.144';
-  return 'twofish.buetow.org' if $ipv4 eq '108.160.134.135';
-  Rex::Logger::info("Unable to determine hostname for $ipv4", 'error');
-  return 'HOSTNAME-UNKNOWN.buetow.org';
-};
-
-# To determine whether the server is the primary or the secondary.
-our $is_primary = sub {
-  my $ipv4 = shift;
-  $fqdns->($ipv4) eq 'blowfish.buetow.org';
-};
-

-

The following is the acme-client.conf.tpl Rex template file used for the automation. You see that the www. prefix isn't sent for the primary server. E.g. foo.zone will be served by the primary server (in my case, a server located in Germany) and www.foo.zone by the secondary server (in my case, a server located in Japan):

-
-#
-# $OpenBSD: acme-client.conf,v 1.4 2020/09/17 09:13:06 florian Exp $
-#
-authority letsencrypt {
-	api url "https://acme-v02.api.letsencrypt.org/directory"
-	account key "/etc/acme/letsencrypt-privkey.pem"
-}
-
-authority letsencrypt-staging {
-	api url "https://acme-staging-v02.api.letsencrypt.org/directory"
-	account key "/etc/acme/letsencrypt-staging-privkey.pem"
-}
-
-authority buypass {
-	api url "https://api.buypass.com/acme/directory"
-	account key "/etc/acme/buypass-privkey.pem"
-	contact "mailto:me@example.com"
-}
-
-authority buypass-test {
-	api url "https://api.test4.buypass.no/acme/directory"
-	account key "/etc/acme/buypass-test-privkey.pem"
-	contact "mailto:me@example.com"
-}
-
-<%
-  our $primary = $is_primary->($vio0_ip);
-  our $prefix = $primary ? '' : 'www.';
-%>
-
-<% for my $host (@$acme_hosts) { %>
-domain <%= $prefix.$host %> {
-	domain key "/etc/ssl/private/<%= $prefix.$host %>.key"
-	domain full chain certificate "/etc/ssl/<%= $prefix.$host %>.fullchain.pem"
-	sign with letsencrypt
-}
-<% } %>
-
-

-

And this is the acme.sh.tpl:

-
-#!/bin/sh
-
-<%
-  our $primary = $is_primary->($vio0_ip);
-  our $prefix = $primary ? '' : 'www.';
--%>
-
-function handle_cert {
-    host=$1
-    # Create symlink, so that relayd also can read it.
-    crt_path=/etc/ssl/$host
-    if [ -e $crt_path.crt ]; then
-        rm $crt_path.crt
-    fi
-    ln -s $crt_path.fullchain.pem $crt_path.crt
-    # Requesting and renewing certificate.
-    /usr/sbin/acme-client -v $host
-}
-
-has_update=no
-<% for my $host (@$acme_hosts) { -%>
-handle_cert <%= $prefix.$host %>
-if [ $? -eq 0 ]; then
-    has_update=yes
-fi
-<% } -%>
-
-# Pick up the new certs.
-if [ $has_update = yes ]; then
-    /usr/sbin/rcctl reload httpd
-    /usr/sbin/rcctl reload relayd
-    /usr/sbin/rcctl restart smtpd
-fi
-

-

Service rexification

-

These are the Rex tasks setting up httpd, relayd and smtpd service