moonpiedumplings

@ moonpiedumplings @programming.dev

Posts

21
Comments

418
Joined

3 yr. ago

moonpiedumplings @programming.dev 1w ago

Could it be that rubygems does not support ipv6?

Some sites, even big sites don't support it: https://areweipv6yet.com/

According to the above, Github doesn't properly support it yet.

1w ago

Writing Toy Software Is A Joy

moonpiedumplings @programming.dev 1w ago

There is the excellent chess programming wiki, but unfortunately it does error 503 for me right now.

Here is the archive: https://web.archive.org/web/20250302091125/https://www.chessprogramming.org/Main_Page

Main site: https://www.chessprogramming.org/Main_Page

It has some pretty good resources to get started, and all the techniques being used.

1w ago

Please weigh in: Transfer of Docker stacks to Debian

moonpiedumplings @programming.dev 1w ago

Debian has a policy of only cherry picking security updates, or critical bugfixes, in order to ensure maximum system stability. In general, they don't do entire program updates or additional features. For the 4 year lifecycle of a Debian release, it will behave the same as it did yesterday.

As of today, current version of rsync in Debian's stable's packages is 3.4.1: https://packages.debian.org/stable/rsync (archive).

The versions with significant LLM assistance are 3.4.3 and later.

2w ago

Questions about Fedora

Debian has old software and doesn’t support some newer hardware. Even the latest version, Trixie, is still very far behind. I realize this now.

Debian has backports, which enable you to get select versions of newer software. Relevant to your case, you can get a newer version of the kernel, drivers, and other things relevant to hardware support.

2w ago

Centralized SSL certificate management?

https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins

Certbot?

It can automate provisioning of certificates using DNS-01 challenges, which have wildcard certificates.

Example tutorial: https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot

Once you do that it puts the cert in /etc/letsencrypt/live/ so you can then do whatever you want with it. You would have to handle distribution manually.

If you want to automate stuff across of a bunch of machines at once, I recommend Ansible: https://docs.ansible.com/projects/ansible/latest/index.html

2w ago

Selfhosting as a Linux newbie - Ubuntu Server LTS or Debian 13?

One thing I read about is that Ubuntu provides unattended updates, so it can automatically update packages and restart the server (that seems a bit too far ;) ). It’s probably possible on Debian but not out of the box.

Ubuntu automatically has unattended upgrades, which makes I think makes it a popular choice for VPS providers to push (beyond being popular in corporate/institutions overall), since they don't have to worry about users forgetting security updates. However, it doesn't enable automatic reboots. But, it does look like automatic restarts of services updated via unattended upgrades is done, but only as of Ubuntu 24.

Another thing to note is that Ubuntu has updates that are explicitly for security, and then everything else, including more general bugfixes and program updates with additional features. By default, unattended upgrades on Ubuntu only do security updates.

Of course, both a unattended upgrades and automatic reboots are possible on Debian (same software, Ubuntu just preconfigures it), although default configurations can vary. I wouldn't be suprised if a VPS provider was shipping a default Debian configuration that enabled automatic upgrades.

On Debian, for the most part, ALL updates are only for security issues or severe bugfixes (program crashes or the like). Debian, for the most part, doesn't do minor bugfixes at all, or do program feature updates. I prefer this model, since it's easier to manage than having separate types of package updates. It ensures absolute stability, a guarantee that the system tomorrow will behave the same as it did yesterday, while still enabling automatic security updates. This model is ideal for a server I don't want to babysit, or for your grandpa who loses his mind when the button he is supposed to click was moved one spot over.

In addition to that, I like the policy of automatic reboots. With the stable, slow moving nature of both distros, it's safe to automatically reboot to ensure that kernel vulnerabilities, or vulnerabilities in other critical systems are fixed. Automatic updates and reboots can be the difference between someone being able to escape a docker container or someone not being able to.

There is one thing to note, is that adding additional repos (or PPA's which technically you aren't supposed to work on Debian), can be dangerous, and you have to be careful: https://wiki.debian.org/DontBreakDebian/#Don.27t_make_a_FrankenDebian

The main problem is that if a third party repo and Debian provide the same package, and the system is configured to prefer the third party repo, then you can be installing a potential dependency to the rest of your system that isn't actually tested against your system, or compatible.

You have to be really careful to ensure that the programs in the repo are actually built and designed for your system, and also that the your system does not default to installing them.

Third party repos also break the guarantee of stability that automatic updates depend on. Third party repos don't have a separate security channel, so Ubuntu will probably avoid touching them, even if critical security fixes are needed. Debian will update them, but unlike Debian's packages, the overall program updates won't be guaranteed to be behave the same due to potential major/minor version changes.

For example, if you get Docker from docker's repo instead of Debian's/Ubuntu's, now your version of docker can no longer auto update and receive potential security fixes safely.

Overall, I prefer Debian but Ubuntu is fine. If I was in an environment that used Ubuntu already, I would also just use Ubuntu. If you are already using Debian, then Debian is probably preferable.

2w ago

Looking for a solution for training videos/courses (+ big list of LMS software)

What made moodle frustrating?

I have also heard the opposite take, that canvas sucks and moodle is great.

Did you use it as a student/user, or as an administrator?

2w ago

Looking for a solution for training videos/courses (+ big list of LMS software)

There is also moodle.

Canvas and moodle are really popular in schools and universities.

2w ago

Codeberg voted to disallow projects consisting mostly by "generative AI"-tools

what if someone just sloppily hand-coded an insecure docker container, should you be able to kick that off too?

I can talk to them and have them fix it without them being weird about it. But if they don't understand the poor design decisions in the first place then I have no confidence won't be able to actually fix it, and keep it fixed in the future.

It's fuzzy, and many generalizations are gonna be made.

Ultimately, it really comes down to human judgement and not your instance not your rules. They are hosting for free. They don't have any obligation to host your projects. The rules and everything are nice conventions, and a good attempt at transparency, but at the end of the day, there is someone with access to the admin panel who is going to make the decisions, and you're not really going to be able to do anything about them.

It's the same thing with lemmy tbh, although it's less annoying because it's much easier to self host and migrate to Forgejo, as opposed to hosting Lemmy. That's why I phrased it as "I would feel uncomfortable hosting this content" rather than trying to address the fuzzier arguments about the necessity of human judgement, the difficulty of detecting LLM generated code, or the possibility of incorrectness.

2w ago

home-manager now has a built in option to wrap packages with NixGL, for non-nixos systems

Ah. You're on Void. Indeed, it does look like Void doesn't have an implementation of systemd-tmpfiles. Here is the file from my system, it's only creating a single symlink, which is basically the same thing you are doing:

    
[moonpie@nefertem home-manager]$ cat /etc/tmpfiles.d/non-nixos-gpu.conf 
L+ /run/opengl-driver - - - - /nix/store/2r6vmqh1vkivsrmr6n1vh1862i2qndqz-non-nixos-gpu

Oops, the below is for artix. I was nosy but not nosy enough and I saw a comment where you mentioning you used void after you wrote all of this. I'm gonna leave it here since it was an enjoyable rabbit hole.

I did some digging, and it looks like it is possible to use systemd-tmpfiles outside of systemd. It's just a binary that creates files/directories/symlinks based on a format, so it's pretty easy to extract, or reimplement entirely.

Artix has their own, an extraction from the systemd package: https://packages.artixlinux.org/packages/system/x86_64/etmpfiles/

It looks like that package is required by the base package, which is the core package set declaring the minimal dependencies needed to have a working system, so it's highly likely you have it installed.

I think it automatically starts too, but I can't find a hard source for this. Based on this page: https://wiki.artixlinux.org/Main/Migration#Download_the_Artix_packages it looks like etmpfiles is needed before you select/install the init system, which suggests that. This reddit post, where a user has an issue where etmpfiles isn't installed, so their service manager complains and dies.

If you have a service named something related, like tmpfile or the like, then it does autostart.

2w ago

Codeberg voted to disallow projects consisting mostly by "generative AI"-tools

Yeah, this makes sense. They won't be able to kick every vibecoded project off, but it gives them a rule to point to when they do find and remove slop.

Some of the commenters on the Codeberg issue are expressing concerns about copyright status, but my main concern is security issues with these projects, which I have expressed before. Somebody vibecoded a script to sort files? I don't really care.

Someone vibecoded a network facing application, shipping a docker container, and is trying to encourage people to deploy it? If I investigate, and see the bad security practices common to vibecoding, I wouldn't want to be providing that for people to download. Even though I'm technically not responsible for it, it just doesn't feel right to host something that could explode later. I would want to be able to take it down, and having a rule to point to prevents complaints when Codeberg does so.

2w ago

Debian Testing as a daily driver - can anyone share their experience?

Depending on how desperate you are, and if you are willing to delve into the dark arts, there are ways to get new KDE on stable distros. It's probably way more effort than it's worth, however, and I wouldn't really recommend them to most users, due to the steep learning curve and various limitations. However, if I were to ever build a Linux distro, then I might consider them, as a way to mix and match older and newer packages.

I will also preface that KDE Plasma is one the more unreliable and prone to breakages part of my Linux system (Arch). People like to joke about krashes, but it's kinda true. The bottom bar likes to crash sometimes, and I then I have to run systemctl --user restart plasma-plasmashell (the fact that I have that memorized scares me). KDE never really stops working overall, but various papercuts appear which I find workarounds for. Gnome is better though, and is much more reliable, IF you aren't using extensions that aren't officially supported, which often break on major Gnome updates. It's probably because of that that Arch Linux sat on the Gnome update for a bit, to wait for the extensions to update and become compatible, whereas Fedora just said YOLO and pulled the trigger lmao. However, Gnome's harder dependency on systemd might make it tough to drag a newer version onto another distro using the methods mentioned below.

The 3 ways I can think of (in order of how much I prefer them):

The Nix package manager can install recent packages from Nixos's rolling release or more up to date stable distro on other distros.

Nixos is both a distro and a package manager, and their repos include things like desktop environments, that wouldn't normally be included in solutions like brew. In fact [Hyprland's wiki has a guide on using Nix to install Hyperland on non Nixos distros](https://wiki.hypr.land/Nix/Hyprland-on-other-distros/. This will not work for KDE however. By default, Nix packages on other distros don't have GPU hardware acceleration, which is kinda needed for a DE. You would have to wrap these packages via Nixgl. The best way is to use home manager and use that to wrap the packages.

Wait, it looks like the docs have been updated: https://home-manager.dev/manual/unstable/usage/gpu-non-nixos.html#sec-usage-gpu-non-nixos . If you are using home manager, it looks like GPU wrapping is automatically enabled if you set targets.genericLinux.enable to true, although this requires root.

Then you would have to do some stuff to setup the login manager so that it can detect the Nix/home-manger version of KDE.

Bedrock Linux let's you install multiple Linux distros at once, next to eachother, mixing and matching packages and utilities.

With bedrock, you could use a Debian base system, using the Debian bootloader, kernel, and systemd, but you could be getting your DE components from Arch. Unfortunately, it doesn't support many things or distros (see pre installation checks), and some of the things like grub + btrfs would suck to lose.

Distroxbox can run an entire desktop environment from within another docker container.

The main limitations with this setup, is that you are now inside the container by default. If you execute bash, or a terminal, or whatever, it's actually the container's version, and not the hosts. You can configure it to automatically find and execute the host's version of the program if it's not found in the container. But, I would prefer just cherrypicking the DE from another distro, in order to use only that component, which is why this one is third and my least favored. But it does technically work.

2w ago

home-manager now has a built in option to wrap packages with NixGL, for non-nixos systems

Coming back to these docs a year later, it looks like something like it's possible to enable it for everything by default by setting targets.genericLinux.enable to true. Seems the docs have been updated: https://home-manager.dev/manual/unstable/usage/gpu-non-nixos.html#sec-usage-gpu-non-nixos

2w ago

home-manager now has a built in option to wrap packages with NixGL, for non-nixos systems

Huh. The page was updated, reviewing it a year later. It does look like there is an option to automatically give GPU to all Nix/home-manager programs now. If you set targets.genericLinux.enable to true, then it should work.

3w ago

Does any self host Meilisearch?

Paperless ngx seems to support fulltext search of PDF's, in addition to other document types.

3w ago

Debian Testing as a daily driver - can anyone share their experience?

https://packages.debian.org/trixie/nvidia-driver-full

Firstly, please don't use Debian testing. It doesn't receive security updates in a timely manner: https://programming.dev/post/20084040

Secondly, it looks like the versions of Nvidia drivers provided in Debian testing and Debian stable are the same:

https://packages.debian.org/forky/nvidia-driver-full

3w ago

Debian Testing as a daily driver - can anyone share their experience?

PSA: You should know that Debian Testing does not receive security updates in a timely manner, and is not intended for production use.

Please don't use Debian Testing. It doesn't receive security updates in a timely manner. I previously made a post about it:

Unlike Debian Unstable or Debian Stable, there is no fast track for vulnerability fixes needed into Debian testing. In my post above, I note that Debian stable and unstable received a fix for a very severe vulnerability. However, Debian testing was left to dry for almost a week, for a known critical vulnerability.

If you want more updated applications, you can use tools like flatpak, distrobox, appimage, or nix to layer newer applications onto a system of any Linux distro.

If you want newer base packages and underlying utilities, like a newer desktop environment, you can get stable distros that provide this, like Fedora, or Opensuse Leap.

Unfortunately it is still in Beta, but Opensuse Slowroll is OpenSuse's solution, a rolling release that delays package updates to test and iron out bugs before pushing updated versions out. It's somewhat of an in between a rolling release and a stable distro, and a very promising model.

You can also just directly use a rolling release distro. Debian Unstable isn't as bad as it sounds. Unstable doesn't mean unreliable or prone to breakages. Unstable just means that the bugs deal with will constantly be changing, instead of dealing with the same bugs all the time.

But please don't use Debian Testing. It's in the name, it's only for testing purposes.

3w ago

How can I correctly sandbox iamb with nixpak?

Firstly, did you get it working? I notice your latest commit seems to mention that you got it working

One thing I would recommend is to declare the iamb package separately in a let... in statement.

    
let
   iamb = (mknixpak blah blah blah)

....
....

in

 userconfig.programs.iamb = {
      enable = true;
      # By using "iamb", instead of pkgs.iamb, it means we are using the nixpak wrapped version here
      package = iamb
      settings = {
        profiles.user.user_id = "@username:instance.com";
        settings = {
          image_preview = { };
          username_display = "displayname";
          user_gutter_width = 15;
        };
      };
    };

This make it so that iamb is the nixpak wrapped version instead, in the userconfig. This would probably also make it so that you don't need to declare it explicitly in your systemPackages.

3w ago

what's the simple way to map services to subdomains instead of specifying the port number?