Jacob Kiers

Don't accept router advertisements on IX links

2026-06-06T00:00:00+00:00

To explore global networking, I run an IPv6-only</a> Autonomous System</a>. Like any network operator, I need routers.

One of the routers is connected to an Internet Exchange</a> LAN network. A while ago, I noticed that router was installing an extra IPv6 default route, which caused routing errors. I didn't give it much attention at that point.

Earlier this week, I decided to find out what was happening. I noticed that it only happened if the BGP LAN link was up. I also noticed that when I removed that route, it would come back after a while. So then I removed it, and it came back again. Rinse and repeat...

That led me to formulate a theory: somebody is running a router on that link which sends out Router Advertisements</a>. On an IX LAN that should not happen: it should strictly serve peer to peer BGP traffic and nothing else.

So I fired up the trusty old tcpdump</code>, let it run for a while with an RA filter, and sure enough: every fifteen minutes or so I saw an RA come in.

That led me to another question: why would my router even honour these, and install that router as a default router. Router Advertisements work by advertising a specific router so clients know where to send their traffic. But I already have a router, and it already has a correctly configured routing table.

Since I use systemd-networkd</a>, it was time to dig into its manuals. And there it was: IPv6AcceptRA</code></a>, enabled by default.

Now the picture was clear: a combination of two misconfigured routers. Mine, accepting RAs. Theirs, sending RAs.

The fix is simple and obvious. Disable IPv6 RAs on any router link, and instead manually configure addresses and routes.

[Network]</span></span>
Address</span> =</span> fe80::dead:beef/64</span></span>
IPv6AcceptRA</span> =</span> no</span></span></code></pre>



Alternating current and its relation to voltage
2023-01-05T00:00:00+00:00
Intro</h2>
For a while now I am interested in electronics. So after some false starts,
I started following a long course on it: Crash Course Electronics and PCB Design</a>.</p>
Lecture 9 was about alternating current (AC), the kind of current that
flows from a wall socket. I struggled to understand how it's voltage is
determined, so I took a lot of notes. This is the result.</p>
Warning: algebra ahead. Also: everything here may be wildly inaccurate.
Did I mention that I am just learning this stuff?</p>
What is alternating current</h2>
Alternating current measn that the supply source voltage changes as a
function of time. In general, this is a sine wave, with positive high
peak voltages and negative low peak voltages.</p>
A negative voltage means that the current flows in the opposite direction,
from minus (-) to plus (+). In the span of a full sine wave, the current
changes direction twice. So with a standard 60Hz alternating current, the
current changes direction 120 times per second.</p>
Properties of alternating current</h2>
Alternating current has a few commonly-used properties:</p>

Peak voltage: the peak voltages on both the upper peak ($V_{pmax}$) and lower peak ($V_{pmin}$).</li>
Peak to peak voltage: the voltage difference between the two peaks: $V_{pp} = V_{pmax} - V_{pmin}$.</li>
Frequency: the number of complete cycles (of $V_{pmax}$ and $V_{pmin}$) per second.</li>
Root-mean-square voltage: the voltage calculation usually associated with alternating current, e.g. 230V or 120V.</li>
</ul>
In the rest of this note, we will work with an AC voltage with the following properties:</p>
Root Mean Square Voltage</h2>
Root Mean Square (RMS, wikipedia</a>) is a formula that is often used
whencalculating the voltage over time for an alternating current circuit.</p>
Its definition is as follows:</p>
$$
f(rms) = \lim_{T \to \infty} \sqrt{\frac{1}{T} \int_0^T [f(t)]^2 dt}
$$</p>
For a pure sine wave, which is common, the formula for the peak-to-peak
amplitude can be simplified as:</p>
$$ V_{pp} = 2\sqrt{2} \cdot RMS \approx 2.828 \cdot RMS$$</p>
Alternate ways of writing</h3>
That also means that</p>

$V_{rms} = V_{pp} \div 2\sqrt{2} = \frac{V_{pp}}{2\sqrt{2}}$</li>
Written differently: $V_{rms} = V_{pp} \cdot \frac{1}{2\sqrt{2}} = V_{pp} \cdot \frac{1}{2} \cdot \frac{1}{\sqrt{2}}$</li>
This works, because we can pull out the $\frac{1}{2}$ out of $\frac{1}{2\sqrt{2}}$,
as long as we then multiply</em> by the remainder ($\frac{1}{\sqrt{2}}$), which, again,
then gives in full: $V_{rms} = V_{pp} \cdot \frac{1}{2} \cdot \frac{1}{\sqrt{2}}$.</li>
</ul>
I know, this is high school level algebra, but it's been a long time and I
struggled to get there. So I wrote it out in full.</p>
So, when calculating, one then gets:</p>

$V_{rms} = V_{pp} \cdot \frac{1}{2} \cdot \frac{1}{\sqrt{2}}$</li>
$V_{rms} \approx V_{pp} \cdot 0.5 \cdot \frac{1}{1.414}$</li>
$V_{rms} \approx V_{pp} \cdot 0.5 \cdot 0.707$</li>
$V_{rms} \approx V_{pp} \cdot 0.354$</li>
</ul>
Example calculations</h3>
With wo common voltages 120V RMS and 230V RMS, we get:</p>

For 120V RMS: $V_{pp} \approx 2.828 \cdot 120 \approx 339V$</li>
For 230V RMS: $V_{pp} \approx 2.828 \cdot 230 \approx 650V$</li>
</ul>
And when we go back:</p>

For 120V RMS: $V_{rms} \approx V_{pp} \cdot .354 \approx 339 \cdot .354 \approx 120V$</li>
For 230V RMS: $V_{rms} \approx V_{pp} \cdot .354 \approx 650 \cdot .354 \approx 230V$</li>
</ul>
Given a symmetrical sine wave with the reference point as 0V, that gives also:</p>

For 120V RMS: $V_{pp} = V_{phigh} - V_{plow} \approx 169V - (-169V) $</li>
For 230V RMS: $V_{pp} = V_{phigh} - V_{plow} \approx 325V - (-325V) $</li>
</ul>
Fin</h2>
That was it for today. If you found this useful, I highly recommend
following the course</a>.</p>


Cross compiling Rust with Drone
2022-12-30T00:00:00+00:00
Why</h2>
For a while now, I have been working on a personal project called
newsletter2web</a>, which I run on a Raspberry PI. As the title
already indicates, it is written in Rust</a>.</p>
Since compiling the project takes a while, especially on a Raspberry PI,
I decided to investigate how to make it build automatically.</p>
That sounds like a job for continuous integration solution. But these tend
to use quite a bit of resources, even when not in use. That is wasteful
and I didn't want that.</p>
So put together, I got the following requirements:</p>

A continuous integration solution, that</li>
Would use little resources when not in use,</li>
Integrates with Gitea, and</li>
Is capable of cross-compiling Rust</li>
</ul>
After a bit of digging, I found Drone CI</a> to be a nice fit: it is fairly
lightweight, and easy to get running. Making it work well enough to cross
compile Rust took a while though.</p>
This post describes the cross compilation, the Drone and Gitea setup</a> is
described in the previous post.</p>
Definitions</h2>
Since not everyone may be familiar with cross compilation, it is useful to
know some definitions.</p>


Host: the machine in which cross compilation is performed.</p>
</li>

Target: the operating system and CPU architecture for which a project is
compiled.</p>
</li>

Toolchain: the set of software required for compilation. This is at least a linker, but usually also a C compiler and target-specific source code are required.</p>
When cross compiling, this is usually a different set of software than is required to compile for the host itself.</p>
</li>
</ul>
How does it work</h2>
Rust has good support for cross compilation already out of the box.
However, in order to use it, the compilation toolchains need to be installed on the host. Also, the Rust project sometimes needs custom configuration as well, in order to be able to use this.</p>
It can be tedious to do this manually. Therefore, we use cross</a>, which
is a project that uses pre-built Docker images for each target. Cross still
needs to have the Rust</em> toolchain for each target installed though.</p>
Since cross uses Docker, and compiling source code has the possibility of
executing arbitrary code on the host, a security boundary is required as
well. For that, a Docker in Docker setup is used.</p>
Docker in docker means running the Docker service itself inside a Docker
container running on the host.</p>
Since cross needs the Rust toolchain for each target, we will use a custom
Docker image to run it.</p>
The Docker image</h2>
This Docker image will have everything installed that is required to run
cross. So it contains the Rust toolchain for each target and the Docker
service for Docker in Docker.</p>
This is the corresponding Dockerfile</code>:</p>
# Base image. Change this to use another Rust version.</span></span>
FROM</span> rust:1.66-slim</span></span>
</span>
# Install Docker (for docker-in-docker)</span></span>
RUN</span> apt-get update \</span></span>
 && apt-get install -y ca-certificates curl gnupg \</span></span>
 && mkdir -p /etc/apt/keyrings \</span></span>
 && curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \</span></span>
 && echo </span>"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian bullseye stable"</span> >> /etc/apt/sources.list.d/docker.list \</span></span>
 && apt-get update \</span></span>
 && apt-get install -y docker-ce-cli \</span></span>
 && apt-get clean</span></span>
</span>
# Install cross v0.2.4</span></span>
RUN</span> mkdir -p /usr/local/cargo/bin && curl -L https://github.com/cross-rs/cross/releases/download/v0.2.4/cross-x86_64-unknown-linux-gnu.tar.gz | tar -xz -C /usr/local/cargo/bin</span></span>
</span>
# (Optional) Pre-install rust targets</span></span>
# This significantly reduces build time, at the cost of an increased image size</span></span>
RUN</span> rustup target add \</span></span>
        aarch64-unknown-linux-gnu \</span></span>
        aarch64-unknown-linux-musl \</span></span>
        x86_64-pc-windows-gnu \</span></span>
        x86_64-unknown-linux-gnu \</span></span>
        x86_64-unknown-linux-musl \</span></span>
    && rustup component add --target aarch64-unknown-linux-gnu rust-src \</span></span>
    && rustup component add --target aarch64-unknown-linux-musl rust-src \</span></span>
    && rustup component add --target x86_64-pc-windows-gnu rust-src \</span></span>
    && rustup component add --target x86_64-unknown-linux-gnu rust-src \</span></span>
    && rustup component add --target x86_64-unknown-linux-musl rust-src</span></span></code></pre>
Don't forget to push it to a registry, so it can be used by Drone later.</p>
The Drone build pipeline</h2>
The build pipeline is where the real magic happens. I will use a
.drone.yml</code> file here. In production I use a Jsonnet</a> file to generate
this. You can find that in the newsletter-to-web repository</a>.</p>
The pipeline is long, so it can be found at the
end of this post</a>.</p>
Docker in Docker service</h3>
Before starting the builds, a running Docker agent is required. This is
handled by starting Docker in Docker as a service, and then waiting until
it is ready by a separate build step. All the cross compilation build steps
then wait for that to happen.</p>
First, a shared volume is created for the Docker socket. That way, the agent
and all build steps can find each other.</p>
# Shared volume for the Docker in Docker service and build steps.</span></span>
# Without this, cross won't be able to find a running Docker agent.</span></span>
volumes</span>:</span></span>
-</span> name</span>:</span> dockersock</span></span>
  temp</span>: {}</span></span></code></pre>
Then, the Docker in Docker service is defined. It uses the volume as
described. It will pull the Docker in Docker image and run it.</p>
This requires privileged</code> mode, because otherwise pulling images and
creating volumes fails.</p>
services</span>:</span></span>
-</span> image</span>:</span> docker:dind</span></span>
  name</span>:</span> docker</span></span>
  privileged</span>:</span> true</span>   # Docker in Docker requires this, sadly.</span></span>
  pull</span>:</span> true</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span></code></pre>
Then, in the steps</code>, the Wait for Docker</code> step is defined. This will
try to run docker image ls</code> until it succeeds. Once it is, it will print
information about the current Docker installation, and pull an image.
This is essentially a healt check.</p>
# Ensure Docker agent has started before continuing.</span></span>
steps</span>:</span></span>
-</span> name</span>:</span> Wait for Docker</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> mkdir artifacts</span></span>
  -</span> while ! docker image ls; do sleep 1; done</span></span>
  -</span> docker info</span></span>
  -</span> docker pull hello-world:latest</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span></code></pre>
All other build steps can then wait until it is ready by depending on this
build step. Like so:</p>
steps</span>:</span></span>
-</span> name</span>:</span> Build for amd64</span></span>
  depends_on</span>:</span></span>
  -</span> Wait for Docker</span></span></code></pre>Cross compilation</h3>
A cross compilation step is defined like so (under the steps</code> definition):</p>
name</span>:</span> Build for windows-amd64</span></span>
image</span>:</span> rust-dind-cross:1.66-full</span></span>
pull</span>:</span> true</span></span>
environment</span>:</span></span>
  CROSS_REMOTE</span>:</span> true</span></span>
depends_on</span>:</span></span>
-</span> Wait for Docker</span></span>
volumes</span>:</span></span>
-</span> name</span>:</span> dockersock</span></span>
  path</span>:</span> /var/run</span></span>
commands</span>:</span></span>
-</span> cross build --release --target x86_64-pc-windows-gnu</span></span>
-</span> cp target/x86_64-pc-windows-gnu/release/drone-test.exe artifacts/drone-test-windows-amd64.exe</span></span>
-</span> rm -rf target/x86_64-pc-windows-gnu/release/*</span></span></code></pre>
It starts with defining the docker image to use image: rust-dind-cross:1.66-full</code>. This is the images that was created before the section
The Docker image</em></a>.</p>
Then, it sets the environment:</p>
environment</span>:</span></span>
  CROSS_REMOTE</span>:</span> true</span></span></code></pre>
This tells cross that it is running in a remote docker, so it will copy
everything necessary for the build into the build image that it creates.</p>
As described before, it depends on the Docker in Docker agent, so that
is defined as well, together with the shared volume:</p>
depends_on</span>:</span></span>
-</span> Wait for Docker</span></span>
volumes</span>:</span></span>
-</span> name</span>:</span> dockersock</span></span>
  path</span>:</span> /var/run</span></span></code></pre>
Finally, the commands to run are listed:</p>
commands</span>:</span></span>
-</span> cross build --release --target x86_64-pc-windows-gnu</span></span>
-</span> cp target/x86_64-pc-windows-gnu/release/drone-test.exe artifacts/drone-test-windows-amd64.exe</span></span>
-</span> rm -rf target/x86_64-pc-windows-gnu/release/*</span></span></code></pre>
This will tell cross to build a release binary for the given target.
In order to do so, it will start its own Docker container, copies all
the source files into it, and then runs a normal Rust build.</p>
The container started by cross is the container that contains the
required build toolchain for the specific target, as described in
the definitions</a>.</p>
When it is finished compiling, the binary is copied to an artifacts/</code>
directory for later reference. It will now also gain a postfix with the
target it was build for. Otherwise, all binaries would be named the same
and would be overwritten.</p>
Finally, the release directory is cleaned up in order to save disk space.</p>
When all cross compilations have succeeded, the built artifacts are shown.
This step is not necessary, and you could do anything else with it.</p>
name</span>:</span> Show built artifacts</span></span>
image</span>:</span> rust-dind-cross:1.66-full</span></span>
commands</span>:</span></span>
-</span> ls -lah artifacts</span></span>
depends_on</span>:</span></span>
-</span> Build for arm64-gnu</span></span>
-</span> Build for arm64-musl</span></span>
-</span> Build for windows-amd64</span></span>
-</span> Build for amd64-gnu</span></span>
-</span> Build for amd64-musl</span></span></code></pre>
The interesting part here, is that it depends on all the cross compilation
build steps.</p>
When tagged, create a Gitea release</h3>
When the pipeline is run for a tag, than as the very last step a new draft
release is created in Gitea. This can then be edited and published.</p>
name</span>:</span> Create release on gitea</span></span>
image</span>:</span> plugins/gitea-release</span></span>
settings</span>:</span></span>
  api_key</span>:</span></span>
    from_secret</span>:</span> gitea_token</span></span>
  base_url</span>:</span> https://gitea.example.com</span></span>
  checksum</span>:</span> sha256</span></span>
  files</span>:</span> artifacts/*</span></span>
  draft</span>:</span> true</span></span>
depends_on</span>:</span></span>
-</span> Build for arm64-gnu</span></span>
-</span> Build for arm64-musl</span></span>
-</span> Build for windows-amd64</span></span>
-</span> Build for amd64-gnu</span></span>
-</span> Build for amd64-musl</span></span>
when</span>:</span></span>
  event</span>:</span></span>
  -</span> tag</span></span></code></pre>
This steps depends on a successful build of all cross compilation steps.
It uses a drone plugin called Gitea Release</a>.</p>
It will:</p>

Upload all files in the artifacts/</code> directory as assets.</li>
Calculate the SHA256 sum of all artifacts, and add that as
a sha256sum.txt</code> file to the assets.</li>
</ul>
This only happens when the pipeline runs for a git tag, which is described
like this:</p>
when</span>:</span></span>
  event</span>:</span></span>
  -</span> tag</span></span></code></pre>Full build pipeline</h3>

Contents of .drone.yml</summary>

kind</span>:</span> pipeline</span></span>
type</span>:</span> docker</span></span>
name</span>:</span> 'Rust cross compilation'</span></span>
platform</span>:</span></span>
  arch</span>:</span> amd64</span></span>
</span>
image_pull_secrets</span>:</span></span>
-</span> docker_private_repo</span></span>
</span>
# Shared volume for the Docker in Docker service and build steps.</span></span>
# Without this, cross won't be able to find a running Docker agent.</span></span>
volumes</span>:</span></span>
-</span> name</span>:</span> dockersock</span></span>
  temp</span>: {}</span></span>
</span>
services</span>:</span></span>
-</span> image</span>:</span> docker:dind</span></span>
  name</span>:</span> docker</span></span>
  privileged</span>:</span> true</span>   # Docker in Docker requires this, sadly.</span></span>
  pull</span>:</span> true</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Ensure Docker agent has started before continuing.</span></span>
steps</span>:</span></span>
-</span> name</span>:</span> Wait for Docker</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> mkdir artifacts</span></span>
  -</span> while ! docker image ls; do sleep 1; done</span></span>
  -</span> docker info</span></span>
  -</span> docker pull hello-world:latest</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Build for aarch64-unknown-linux-gnu (arm64)</span></span>
-</span> name</span>:</span> Build for arm64-gnu</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  environment</span>:</span></span>
    CROSS_REMOTE</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> cross build --release --target aarch64-unknown-linux-gnu</span></span>
  -</span> cp target/aarch64-unknown-linux-gnu/release/drone-test artifacts/drone-test-arm64-gnu</span></span>
  -</span> rm -rf target/aarch64-unknown-linux-gnu/release/*</span></span>
  depends_on</span>:</span></span>
  -</span> Wait for Docker</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Build for aarch64-unknown-linux-musl (arm64 with Alpine linux)</span></span>
-</span> name</span>:</span> Build for arm64-musl</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  environment</span>:</span></span>
    CROSS_REMOTE</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> cross build --release --target aarch64-unknown-linux-musl</span></span>
  -</span> cp target/aarch64-unknown-linux-musl/release/drone-test artifacts/drone-test-arm64-musl</span></span>
  -</span> rm -rf target/aarch64-unknown-linux-musl/release/*</span></span>
  depends_on</span>:</span></span>
  -</span> Wait for Docker</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Build for x86_64-pc-windows-gnu</span></span>
# This generates a binary that can run on Windows.</span></span>
-name</span>:</span> Build for windows-amd64</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  environment</span>:</span></span>
    CROSS_REMOTE</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> cross build --release --target x86_64-pc-windows-gnu</span></span>
  -</span> cp target/x86_64-pc-windows-gnu/release/drone-test.exe artifacts/drone-test-windows-amd64.exe</span></span>
  -</span> rm -rf target/x86_64-pc-windows-gnu/release/*</span></span>
  depends_on</span>:</span></span>
  -</span> Wait for Docker</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Build for x86_64-unknown-linux-gnu (amd64)</span></span>
-</span> name</span>:</span> Build for amd64-gnu</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  environment</span>:</span></span>
    CROSS_REMOTE</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> cross build --release --target x86_64-unknown-linux-gnu</span></span>
  -</span> cp target/x86_64-unknown-linux-gnu/release/drone-test artifacts/drone-test-amd64-gnu</span></span>
  -</span> rm -rf target/x86_64-unknown-linux-gnu/release/*</span></span>
  depends_on</span>:</span></span>
  -</span> Wait for Docker</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Build for x86_64-unknown-linux-musl (amd64 with Alpine linux)</span></span>
-</span> name</span>:</span> Build for amd64-musl</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  pull</span>:</span> true</span></span>
  environment</span>:</span></span>
    CROSS_REMOTE</span>:</span> true</span></span>
  commands</span>:</span></span>
  -</span> cross build --release --target x86_64-unknown-linux-musl</span></span>
  -</span> cp target/x86_64-unknown-linux-musl/release/drone-test artifacts/drone-test-amd64-musl</span></span>
  -</span> rm -rf target/x86_64-unknown-linux-musl/release/*</span></span>
  depends_on</span>:</span></span>
  -</span> Wait for Docker</span></span>
  volumes</span>:</span></span>
  -</span> name</span>:</span> dockersock</span></span>
    path</span>:</span> /var/run</span></span>
</span>
# Show all built artifacts</span></span>
-</span> name</span>:</span> Show built artifacts</span></span>
  image</span>:</span> rust-dind-cross:1.66-full</span></span>
  commands</span>:</span></span>
  -</span> ls -lah artifacts</span></span>
  depends_on</span>:</span></span>
  -</span> Build for arm64-gnu</span></span>
  -</span> Build for arm64-musl</span></span>
  -</span> Build for windows-amd64</span></span>
  -</span> Build for amd64-gnu</span></span>
  -</span> Build for amd64-musl</span></span>
  </span></span>
# When a tag is created, this step gets added.</span></span>
-</span> name</span>:</span> Create release on gitea</span></span>
  image</span>:</span> plugins/gitea-release</span></span>
  settings</span>:</span></span>
    api_key</span>:</span></span>
      from_secret</span>:</span> gitea_token</span></span>
    base_url</span>:</span> https://code.kiers.eu</span></span>
    checksum</span>:</span> sha256</span></span>
    files</span>:</span> artifacts/*</span></span>
  depends_on</span>:</span></span>
  -</span> Show built artifacts</span></span>
  when</span>:</span></span>
    event</span>:</span></span>
    -</span> tag</span></span></code></pre></span>
</details>
Fin</h2>
You've made it! This is the end of the pipeline!</p>
If this was useful for you, or you have comments, feel free to send me an email</a>.</p>


Automatically scaling Drone CI with Gitea
2022-12-17T00:00:00+00:00
Why</h2>
For a while now, I have been working on a personal project called
newsletter2web</a>, which I run on a Raspberry PI. As the title
already indicates, it is written in Rust</a>.</p>
Since compiling the project takes a while, especially on a Raspberry PI,
I decided to investigate how to make it build automatically.</p>
That sounds like a job for continuous integration solution. But these tend
to use quite a bit of resources, even when not in use. That is wasteful
and I didn't want that.</p>
So put together, I got the following requirements:</p>

A continuous integration solution, that</li>
Would use little resources when not in use,</li>
Integrates with Gitea, and</li>
Is capable of cross-compiling Rust</li>
</ul>
After a bit of digging, I found Drone CI</a> to be a nice fit: it is fairly
lightweight, and easy to get running. Making it work well enough to cross
compile Rust took a while though.</p>
This post describes the Drone and Gitea parts, the Rust part is in a followup post</a>.</p>
The components</h2>
In order to build everything, we need a few moving parts:</p>

Gitea</a> for hosting the code.</li>
Drone CI</a> for running the builds.</li>
Drone autoscaler</a> to ensure it only uses resources when necessary.</li>
cross</code></a>: a cross compilation solution for Rust.</li>
</ul>
Setting up Drone with Gitea</h2>
Setting up Drone is not that hard, and the installation instructions</a> are clear.</p>
Then, run it with docker using the drone/drone:2</a> image, and ensure that
all these environment variables are passed through. Take care that the Drone
API is reachable from Gitea as well.</p>
For me, the configuration came down to this:</p>
# Drone host configuration</span></span>
DRONE_SERVER_HOST</span>=</span>drone-ci.kiers.eu</span></span>
DRONE_LOGS_DEBUG</span>=</span>true</span></span>
DRONE_LOGS_PRETTY</span>=</span>true</span></span>
</span>
# RPC secret for build agents</span></span>
DRONE_RPC_SECRET</span>=<</span>redacted</span>></span></span>
</span>
# DB configuration</span></span>
DRONE_DATABASE_DATASOURCE</span>=</span>postgres://drone:drone-password@db:5432/drone-db</span></span>
DRONE_DATABASE_SECRET</span>=<</span>redacted</span>></span></span>
</span>
# Gitea integration</span></span>
DRONE_GITEA_SERVER</span>=</span>https://code.kiers.eu</span></span>
DRONE_GITEA_CLIENT_ID</span>=<</span>redacted</span>></span></span>
DRONE_GITEA_CLIENT_SECRET</span>=<</span>redacted</span>></span></span>
</span>
# Enable initial admin user</span></span>
# This needs to be the same username as in Gitea</span></span>
DRONE_USER_CREATE</span>=</span>username:my-username,admin:true</span></span>
</span>
# Enable Jsonnet support</span></span>
DRONE_JSONNET_ENABLED</span>=</span>true</span></span></code></pre>Setting up Drone autoscaler</h2>
During my research, I tried multiple approaches: first I used a simple Docker
runner on a static build server. But I wasn't happy to incur the costs of
something that is only used sporadically. Then I tried multiple different
solutions, such as the VM runner, the (deprecated) Digitalocean runner and
the autoscaler</a>. In the end, the last one was what I settled on.</p>
It works by polling the Drone server api to see whether there are builds
pending and whether there is build capacity available. Then, it will scale
up or down the numer of servers that are required to handle these builds.
Crucially for me, it is possible to set minimum number of build servers to
zero, to ensure that they will all be destroyed when there is no need for
them anymore.</p>
This does mean that one needs a place to host these build servers. Luckily,
the autoscaler has support for a number of different cloud providers. I
ended up using Digital Ocean.</p>
First, a machine user</a> with administrative credentials needs to be created.
This needs to be done with the Drone CLI. Check the documentation for how
to do so.</p>
The setup is fairly easy again, and also builds on environment variables:</p>
#!/usr/bin/bash</span></span>
</span>
# Communication with the drone server</span></span>
DRONE_RPC_HOST</span>=</span>drone-ci.kiers.eu</span></span>
DRONE_RPC_PROTO</span>=</span>https</span></span>
DRONE_AUTOSCALER_USER_TOKEN</span>=<</span>redacted</span>></span> # Machine user token</span></span>
</span>
# RPC Secret for the build agents that are installed on the build servers</span></span>
DRONE_RPC_SECRET</span>=<</span>redacted</span>></span></span>
</span>
# Digitalocean settings</span></span>
# Get these from the DO Droplet Launch UI, in the URL bar</span></span>
DRONE_DIGITALOCEAN_SIZE</span>=</span>'s-4vcpu-8gb-amd'</span> </span></span>
DRONE_DIGITALOCEAN_IMAGE</span>=</span>'docker-20-04'</span></span>
DRONE_DIGITALOCEAN_REGION</span>=</span>'fra1'</span></span>
DRONE_DIGITALOCEAN_TOKEN</span>=<</span>redacted</span>></span></span>
DRONE_DIGITALOCEAN_SSHKEY</span>=<</span>redacted</span>></span> # To log in to the build servers</span></span>
</span>
# How often should the autoscaler check whether to scale up or down</span></span>
# This then also is the time that it takes before a build server will</span></span>
# be started when none is available, and therefore has a big influence</span></span>
# on total build time. </span></span>
DRONE_INTERVAL</span>=</span>30s</span></span>
</span>
# Pool settings</span></span>
DRONE_POOL_MIN</span>=</span>0</span> # This allows the pool to turn off everything</span></span>
DRONE_POOL_MAX</span>=</span>4</span> # The maximum number of build servers to launch</span></span>
</span>
docker</span> run</span> -d \</span></span>
  --volume=$(pwd)/data:/data \</span></span>
  --env=DRONE_SERVER_PROTO=${</span>DRONE_RPC_PROTO</span>} \</span></span>
  --env=DRONE_SERVER_HOST=${</span>DRONE_RPC_HOST</span>} \</span></span>
  --env=DRONE_SERVER_TOKEN=${</span>DRONE_AUTOSCALER_USER_TOKEN</span>} \</span></span>
  --env=DRONE_AGENT_TOKEN=${</span>DRONE_RPC_SECRET</span>} \</span></span>
  --env=DRONE_POOL_MIN=${</span>DRONE_POOL_MIN</span>} \</span></span>
  --env=DRONE_POOL_MAX=${</span>DRONE_POOL_MAX</span>} \</span></span>
  --env=DRONE_DIGITALOCEAN_REGION=${</span>DRONE_DIGITALOCEAN_REGION</span>} \</span></span>
  --env=DRONE_DIGITALOCEAN_TOKEN=${</span>DRONE_DIGITALOCEAN_TOKEN</span>} \</span></span>
  --env=DRONE_DIGITALOCEAN_SIZE=${</span>DRONE_DIGITALOCEAN_SIZE</span>} \</span></span>
  --env=DRONE_DIGITALOCEAN_SSHKEY=${</span>DRONE_DIGITALOCEAN_SSHKEY</span>} \</span></span>
  --env=DRONE_DIGITALOCEAN_IMAGE=${</span>DRONE_DIGITALOCEAN_IMAGE</span>} \</span></span>
  --env=DRONE_LOGS_TRACE=true \</span></span>
  --env=DRONE_LOGS_DEBUG=true \</span></span>
  --env=DRONE_LOGS_PRETTY=true \</span></span>
  --env=DRONE_LOGS_COLOR=true \</span></span>
  --env=DRONE_INTERVAL=${</span>DRONE_INTERVAL</span>} \</span></span>
  --publish=8080:8080 \</span></span>
  --restart</span> always</span> \</span></span>
  --name</span> drone-autoscaler</span> \</span></span>
  drone/autoscaler:latest</span></span></code></pre>
And that's it. Now it will scale up and down the build servers, as new
builds come in.</p>
Also, take a look at all the possible settings</a> for the autoscaler, as
there may be some options that are beneficial as well.</p>


HTML over DNS: Serving Blog Content Over DNS
2021-08-17T00:00:00+00:00
What's up?</h2>
The past few days, I did an experiment to serve blog content over DNS (see here)</a>.
That page contains mostly the same content ast this post, but it is served in a
completely different manner.</p>
This works because of DNS over HTTPS</a> for which there is an API from
Cloudflare</a>.</p>
Comments at Hacker News</a>, apparently.</p>
How it works</h2>
The DNS over HTTP API from Cloudflare is used to load the contents of that
page, essentially like this:</p>
fetch</span>(</span>"https://cloudflare-dns.com/dns-query?ct=application/dns-json&type=TXT&name=post.hod.experiments.jacobkiers.net"</span>);</span></span></code></pre>
The content itself is served over DNS, using CoreDNS, with these contents:</p>
hod.experiments.jacobkiers.net.:53 {</span></span>
    log</span></span>
    auto hod.experiments.jacobkiers.net. {</span></span>
    directory /etc/coredns/zones/</span></span>
        reload 10s</span></span>
    }</span></span>
}</span></span></code></pre>
This feeds into a zone file, which looks like this:</p>
$TTL 5m    ; Default TTL</span></span>
@    IN    SOA    experiments.jacobkiers.net.    postmaster.jacobkiers.net. (</span></span>
    2021081612    ; serial</span></span>
    1h        ; slave refresh interval</span></span>
    15m        ; slave retry interval</span></span>
    1w        ; slave copy expire time</span></span>
    1h        ; NXDOMAIN cache time</span></span>
    )</span></span>
</span>
$ORIGIN hod.experiments.jacobkiers.net.</span></span>
</span>
;</span></span>
; domain name servers</span></span>
;</span></span>
@    IN    NS  experiments.jacobkiers.net.</span></span>
</span>
</span>
;; START BLOG RECORDS</span></span>
; posts-2021-08-17-serving-blog-content-over-dns-md</span></span>
posts-2021-08-17-serving-blog-content-over-dns-md    60    IN    TXT    "t=text/markdown;c=3;h=2fd63f0f408ad1336283999d0487ced9;m=eyJ0aXRsZSI6IlNlcnZpbmcgYmxvZyBjb250ZW50IG92ZXIgRE5TIiwiZGF0ZSI6IjIwMjEtMDgtMTUiLCJhdXRob3IiOiJKYWNvYiBLaWVycyJ9"</span></span>
0.2fd63f0f408ad1336283999d0487ced9    60    IN    TXT    "WW91IG1pZ2h0IG5vdCBiZSBhYmxlIHRvIHNlZSBpdCBpbW1lZGlhdGVseSwgYnV0IHRoZSBjb250ZW50IG9mIHRoaXMgcGFnZSBpcyB2ZXJ2ZWQgb3ZlciBETlMuCgpUaGlzIHdvcmtzIGJlY2F1c2Ugb2YgdGhlIG5ldyBETlMtb3Zlci1IVFRQIHN1cHBvcnQsIHdoaWNoLCBhdCBsZWFzdCBhdCBDbG91ZGZsYXJlLCBhbHNvIGhhcy"</span></span>
1.2fd63f0f408ad1336283999d0487ced9    60    IN    TXT    "BhbiBBUEkuCgpUaGF0IEFQSSBpcyB1c2VkIHRvIGxvYWQgdGhlIGNvbnRlbnRzIG9mIHRoaXMgcGFnZSwgZXNzZW50aWFsbHkgbGlrZSB0aGlzOgoKYGBganMKZmV0Y2goImh0dHBzOi8vY2xvdWRmbGFyZS1kbnMuY29tL2Rucy1xdWVyeT9jdD1hcHBsaWNhdGlvbi9kbnMtanNvbiZ0eXBlPVRYVCZuYW1lPXBvc3QuaG9kLmV4cGVy"</span></span>
2.2fd63f0f408ad1336283999d0487ced9    60    IN    TXT    "aW1lbnRzLmphY29ia2llcnMubmV0Iik7CmBgYAoKUGxlYXNlIHNlZSB0aGUgW3NvdXJjZSBjb2RlXSBmb3IgdGhlIGRldGFpbHMgb2YgaG93IGl0IHdvcmtzLgoKW3NvdXJjZSBjb2RlXTogaHR0cHM6Ly9naXRodWIuY29tL2phY29ia2llcnMvaHRtbC1vdmVyLWRucwo="</span></span></code></pre>
These records are base64 encoded content, so when concatenated and decoded,
they give the content of the posts.</p>
Please see the source code</a> for the details.</p>
FAQ</h2>
Why, though?</h3>
In short: just because I could. It was one of those ideas I was wondering
idly about, and I decided to just try it.</p>
Has it any practical use?</h3>
It is not intended to have any. Since DNS records are fairly small, serving
images or something would quickly start consuming 100s of requests per second.
I wouldn't want to do that to Cloudflare 😄</p>
It would be an interesting experiment to see how feasible that is though.</p>


A (mostly) IPv6-only home network
2021-04-23T00:00:00+00:00
For a while now I wanted to make my home network IPv6-only. That is a challenge, because my ISP does not enable IPv6. Therefore, I used a Hurricane Electric tunnel</a> to give my home network IPv6. Here I will describe my setup.</p>
Requirements</h2>
To ensure that my whole network is able to use IPv6 I deployed a Raspberry Pi 4</a> as a router. It is plugged into the router that I received from the ISP.</p>
This router needs access to both IPv4 and IPv6, and is the only machine that requires this1</a></sup>.</p>
Also, of course, this requires a DNS zone from the provider. In my case, I received a /48 from Hurricane Electric. Here, we will call it 2001:db8:fa12::/48</code>.</p>
Setup</h2>
Packages</h3>
To install the required packages, run:</p>
apt</span> install ufw dnsmasq dnsutils tayga</span></span></code></pre>
Tunnel configuration</h3>
In order to set up the tunnel, the ISP router needs to be configured to consider the Raspberry Pi as a DMZ, so that it will forward all unknown packets to it by default.</p>
After that, the configuration starts with creating a network device in /etc/systemd/network/50-he-ipv6.network</code>. This will create the actual tunnel.</p>
[Match]</span></span>
 </span></span>
[NetDev]</span></span>
Name</span>=</span>he-ipv6</span></span>
Kind</span>=</span>sit</span></span>
MTUBytes</span>=</span>1480</span></span>
 </span></span>
[Tunnel]</span></span>
Local</span>=</span>192.168.0.101 # RPi IPv4</span></span>
Remote</span>=</span>216.66.84.46 # HE Tunnel server</span></span>
TTL</span>=</span>255</span></span>
Independent</span>=</span>true</span></span></code></pre>
Then, we need to set up IPv6 connectivity on this device, in /etc/systemd/network/50-he-ipv6.network</code>.</p>
[Match]</span></span>
Name</span>=</span>he-ipv6</span></span>
 </span></span>
[Network]</span></span>
# HE client address</span></span>
Address</span>=</span>2001</span>:db8:1234:fedc::2/64</span></span>
</span>
# HE server address</span></span>
Gateway</span>=</span>2001</span>:db8:1234:fedc::1</span></span>
</span>
# HE DNS resolver</span></span>
DNS</span>=</span>2001</span>:470:20::2</span></span></code></pre>
Finally, it is time to set up the eth0</code> interface with IPv6 as well, in /etc/system/network/10-eth0.network</code>:</p>
[Match]</span></span>
Name</span>=</span>eth0</span></span>
</span>
[Network]</span></span>
Address</span>=</span>192.168.0.101/24 # My IPv4 address</span></span>
Gateway</span>=</span>192.168.0.1  # Router IPv4 address</span></span>
</span>
# Global address from HE /48</span></span>
Address</span>=</span>2001</span>:db8:fa12:100::1/56</span></span>
Gateway</span>=</span>2001</span>:db8:1234:fedc::1 # Same as in 50-he-ipv6.network</span></span>
</span>
# HE DNS resolver</span></span>
DNS</span>=</span>2001</span>:470:20::2</span></span></code></pre>
Now, bring the links up:</p>
ip</span> -6</span> link set he-ipv6 up</span></span>
ip</span> -6</span> link set eth0 down</span></span>
ip</span> -6</span> link set eth0 up</span></span></code></pre>
Now there should be IPv6 connectivity. Try it out by pinging an IPv6 service: ping -6 one.one.one.one</code>.</p>
CoreDNS</h3>
CoreDNS</a> is lightweight and versatile DNS server. It is used here to provide  DNS64 resolving</a>. This is used in combination with Tayga (see next section) to ensure that the IPv4 world can still be reached.</p>
So download CoreDNS and ensure that it is installed in /usr/local/bin/coredns</code>. Then add the unit file /etc/systemd/system/coredns.service</code>:</p>
[Unit]</span></span>
Description</span>=</span>CoreDNS DNS server</span></span>
Documentation</span>=</span>https://coredns.io</span></span>
After</span>=</span>network.target</span></span>
</span>
[Service]</span></span>
LimitNOFILE</span>=</span>1048576</span></span>
LimitNPROC</span>=</span>512</span></span>
CapabilityBoundingSet</span>=</span>CAP_NET_BIND_SERVICE</span></span>
AmbientCapabilities</span>=</span>CAP_NET_BIND_SERVICE</span></span>
NoNewPrivileges</span>=</span>true</span></span>
</span>
DynamicUser</span>=</span>yes</span></span>
StateDirectory</span>=</span>coredns</span></span>
</span>
ExecStart</span>=</span>/usr/local/bin/coredns -conf=/etc/coredns/Corefile</span></span>
ExecReload</span>=</span>/bin/kill -SIGUSR1 $MAINPID</span></span>
Restart</span>=</span>on-failure</span></span>
</span>
[Install]</span></span>
WantedBy</span>=</span>multi-user.target</span></span></code></pre>
And add the configuration file at /etc/coredns/Corefile</code>:</p>
.:</span>53535 {</span></span>
    acl</span> {</span></span>
        allow net </span>192.168</span>.</span>62</span>.</span>0</span>/</span>24</span> fe80</span>::/</span>10 2001</span>:</span>db8</span>:</span>fa12</span>::/</span>48</span> ::</span>1</span>/</span>128 2001</span>:</span>470</span>:</span>1f0a</span>:</span>910</span>::</span>2</span>/</span>64 127.0</span>.</span>0</span>.</span>0</span>/</span>8</span></span>
        block</span></span>
    }</span></span>
    forward </span>.</span> 1.1</span>.</span>1</span>.</span>1</span></span>
    dns64 fec0</span>:</span>64</span>::/</span>96</span></span>
    log</span> {</span></span>
        class error denial</span></span>
    }</span></span>
    cancel 1s</span></span>
}</span></span></code></pre>
Explanation of this configuration:</p>
First, and very important</em>, an access control list is configured. The acl</em> block defines which clients may use this DNS server.  This is important because without it, the DNS server is an open resolver</a>: anyone can use it, and also attack others with it using a DNS amplification attack</a>. This configuration is parsed in order. So here it shows that only RFC1918 (local IPv4) addresses and my delegated IPv6 addresses can use this server, all the rest is blocked.</p>
The forward</code> line forwards all queries (.</code>) to the DNS server at 1.1.1.1</code>. On the next line, dns64  fec0:64::/96</code> does DNS64 translation, and returns IPv6 addresses for IPv4-only services from the fec6:64::/96</code> range. See the Tayga</em> section next for an explanation.</p>
Then, we instruct CoreDNS to log error messages and access denied errors. This is very useful for debugging.</p>
Finally, CoreDNS is instructed to fail all DNS requests that take more than one second to resolve.</p>
Tayga</h3>
Tayga</a> is a NAT64</a> service. That means that it provides connectivity to IPv4 addresses through IPv6. It does so by routing IPv6 addresses in a specific /96</code> range to the IPv4 internet.</p>
A /96</code> range is used, because the full IPv4 address range fits in that. IPv6 has 128 bits of address space, and IPv4 has 32 bits of address space. Therefore, all of IPv4 fits in a 128 - 32 = 96</code> bit range, hence the /96</code> address range for NAT64.</p>
Combined with CoreDNS which does the translation of IPv4 addresses into IPv6 addresses, this provides a solution to connect to IPv4 addresses from an IPv6-only network. Of course, the gateway, where Tayga is installed, must have access to both networks in order for this to work.</p>
To set this up, configure tayga in /etc/tayga.conf</code>:</p>
# Route packets through the na64 deice</span></span>
tun</span>-</span>device nat64</span></span>
</span>
# Translate packets in the fec0:64::/96 address range.</span></span>
# Use the first address in that range for myself.</span></span>
prefix fec0</span>:</span>64</span>::/</span>96</span></span>
ipv6</span>-</span>addr fec0</span>:</span>64</span>:</span>1</span>::</span>1</span></span>
</span>
# This address pool is used as source addresses for IPv4</span></span>
# traffic. Make sure it does not collide with an actual</span></span>
# network.</span></span>
# Again, use the first address for myself.</span></span>
dynamic</span>-</span>pool </span>192.168</span>.</span>254</span>.</span>0</span>/</span>24</span></span>
ipv4</span>-</span>addr </span>192.168</span>.</span>254</span>.</span>1</span></span>
</span>
# Keep some translation state in this directory</span></span>
data</span>-</span>dir </span>/</span>var</span>/</span>spool</span>/</span>tayga</span></span></code></pre>
Also ensure that a tunnel is created in /etc/systemd/network/90-nat66.netdev</code>:</p>
[NetDev]</span></span>
Name</span>=</span>nat64</span></span>
Kind</span>=</span>tap</span></span></code></pre>
And start tayga with systemctl enable --now tayga.service</code>.</p>
dnsmasq</h3>
With these changes, the router now has IPv6 connectivity and is ready to serve it to the rest of the network as well. So now it is time to make sure that IPv6 is enabled on the rest of the network as well.</p>
For that, I use dnsmasq</a>, a great and versatile tool for setting up DHCP and DNS in a home network.</p>
So in order for it to give out IPv6 addresses, I configured it as follows:</p>
interface</span>=eth0</span></span>
port</span>=53535</span></span>
</span>
# Don't check /etc/hosts, /etc/resolv.conf, etc</span></span>
no-hosts</span></span>
no-resolv</span></span>
no-poll</span></span>
</span>
# Never forward addresses in non-routed address spage</span></span>
bogus-priv</span></span>
</span>
# Forward queries to the local CoreDNS.</span></span>
server</span>=::1</span>#53</span></span>
</span>
strict-order</span></span>
</span>
# My local-only domain is .int. Serve that also from here.</span></span>
local</span>=/int/</span></span>
domain</span>=int</span></span>
address</span>=/router.int/2001:db8:fa12:::1</span></span>
</span>
# Automatically add local domain to simple host names</span></span>
expand-hosts</span></span>
</span>
# IPv6 DHCP</span></span>
dhcp-range</span>=::1681:ff,::1681:ffff,constructor:eth0,ra-names,12h</span></span>
dhcp-option</span>=option6:dns-server,[2001:db8:fa12:::1]</span></span>
dhcp-option</span>=option6:information-refresh-time,1h</span></span>
dhcp-option</span>=option6:domain-search,int</span></span>
</span>
# Set the DHCP server to authoritative mode to </span></span>
# speed up lease acquisition.</span></span>
dhcp-authoritative</span></span>
</span>
enable-ra</span></span>
quiet-ra</span></span></code></pre>Current issues</h2>
In the end, I could not use IPv6 only the Windows machine I got from work, because the Windows Subsystem for Linux v2 does not route IPv6 connectivity to the VMs.</p>
Credits</h2>
A lot of the credits for this setup go to Dirk Hillbrecht</a>'s amazing IPv6-first network guide</a>.</p>



In the end, that didn't fully work out, due to the Windows issue described at the end of this post. ↩</a></p>
</li>
</ol>
</section>


Mockery: returning values and throwing exceptions
2015-01-24T00:00:00+00:00
Last week, I had to write a piece of code that contains retry logic. Naturally, I want to test it. That proved trickier than expected.</p>
The application code looks like this:</p>
<?</span>php</span></span>
class</span> Sender</span></span>
{</span></span>
    protected</span> $connection;</span></span>
</span>
    public function</span> send</span>()</span></span>
    {</span></span>
        $success</span> =</span> false</span>;</span></span>
</span>
        $i</span> =</span> 0</span>;</span></span>
        do</span> {</span></span>
            $i</span>++</span>;</span></span>
</span>
            try</span> {</span></span>
                $success</span> =</span> $this</span>-></span>doSend</span>($i);</span></span>
            }</span> catch</span> (</span>SenderException</span> $e) {</span></span>
                $success</span> =</span> false</span>;</span></span>
            }</span></span>
</span>
        }</span> while</span> (</span>!</span>$success</span> &&</span> $i</span> <</span> 3</span>);</span></span>
</span>
        return</span> $success;</span></span>
    }</span></span>
</span>
    protected function</span> doSend</span>($data)</span></span>
    {</span></span>
        // Can throw SenderException</span></span>
        $response</span> =</span> $this</span>-></span>connection</span>-></span>send</span>($data);</span></span>
</span>
        if</span> (</span>'OK'</span> ===</span> $response) {</span></span>
            return</span> true</span>;</span></span>
        }</span></span>
</span>
        return</span> false</span>;</span></span>
    }</span></span>
}</span></span></code></pre>
I specifically want to test the retry logic, so I have to mock the ::doSend() method. Then I can simulate the different outcomes (returning true or false, or throwing a SenderException).</p>
I use Mockery</a> to do the real work. It is a great library. If you don't know it yet, please check it out. I will wait right here...</p>
Now, since ::doSend() is a protected method, Mockery must be instructed to allow that.</p>
So after the first try, I ended up with:</p>
<?</span>php</span></span>
public function</span> testItWillRetrySending</span>()</span></span>
{</span></span>
    $sender</span> =</span> M</span>::</span>mock</span>(</span>'Sender'</span>);</span></span>
    $sender</span>-></span>shouldAllowMockingProtectedMethods</span>()</span></span>
</span>
    $sender</span>-></span>shouldReceive</span>(</span>'doSend'</span>)</span></span>
        -></span>andReturn</span>(</span>false</span>,</span> new</span> Exception</span>());</span></span>
}</span></span></code></pre>
To my surprise, this did not work. Instead of throwing the exception, Mockery returns it. So my next try was this:</p>
<?</span>php</span></span>
$sender</span>-></span>shouldReceive</span>(</span>'doSend'</span>)</span></span>
    -></span>andReturn</span>(</span>false</span>)</span></span>
    -></span>andThrow</span>(</span>new</span> Exception</span>());</span></span></code></pre>
Another surprise: with this code, Mockery will always throw the exception, and ignore the first return value (false). After some debugging, I found out that Mockery just overwrites the return values in this case.</p>
Fortunately, there is another way to return multiple return values: the ::andReturnUsing() method. It gives full control over the return values.</p>
So I ended up with this testing code:</p>
<?</span>php</span></span>
$return_value_generator</span> = function</span> () {</span></span>
    static</span> $counter</span> =</span> 0</span>;</span></span>
</span>
    $counter</span>++</span>;</span></span>
</span>
    switch</span> ($counter) {</span></span>
        case</span> 1</span>:</span> return</span> false</span>;</span></span>
        case</span> 2</span>:</span> throw new</span> SenderException</span>();</span></span>
        case</span> 3</span>:</span> return</span> true</span>;</span></span>
        default</span>:</span> throw new</span> Exception</span>(</span>"Should never reach this."</span>); </span></span>
    }</span></span>
};</span></span>
</span>
$sender</span> =</span> M</span>::</span>mock</span>(</span>'Sender'</span>);</span></span>
</span>
$sender</span>-></span>shouldAllowMockingProtectedMethods</span>()</span></span>
    -></span>shouldReceive</span>(</span>'doSend'</span>)</span></span>
    -></span>andReturnUsing</span>($return_value_generator);</span></span></code></pre>
This works perfectly. It feels a bit like a hack though. So if you know a better way or have any other remarks, please let me know.</p>


Configure nginx with SSL and SPDY on Ubuntu 12.04 Precise
2014-01-17T00:00:00+00:00
As an experiment, last night I decided to configure nginx with SSL and SPDY.
Finding information on how to get it working with Ubuntu 12.04 wasn't that
easy, so I decided to write the process down.</p>
I will assume here that you already have a certificate. If you don’t, you can
get them from many vendors.</p>
Add the repository</h2>
First, you need to have version 1.4 or higher of nginx. You can get that on Ubuntu 12.04 by installing the nginx/stable ppa:</p>
sudo</span> add-apt-repository ppa:nginx/stable`</span></span></code></pre>Install nginx</h2>
Then, you will have to update apt and install nginx. If you already have
installed nginx, you will have to do a dist-upgrade.</p>
So, when nginx is not yet installed:</p>
sudo</span> apt-get update</span></span>
sudo</span> apt-get install nginx</span></span></code></pre>
If nginx is already installed:</p>
sudo</span> apt-get update</span></span>
sudo</span> apt-get dist-upgrade</span></span></code></pre>Install certificates</h2>
Now that the right version of nginx is installed, you first need to install
your certificate.</p>
Put your private certificate into /etc/ssl/private/</code>, and chmod it to 0400</code>:</p>
sudo</span> chmod</span> 400</span> /etc/ssl/private/jacobkiers.net.key`</span></span></code></pre>
Then, put your public certificate into /etc/ssl/certs/</code>. In many cases, you
have to establish a certificate chain. That means that your web server sends
multiple certificates to the browser. Please check the documentation of the
certificate authority where you got your certificate.</p>
You can do that as follows:</p>
sudo</span> sh</span> -c</span> 'cat /path/to/ca/certificate >> /etc/ssl/certs/your-certificate'`</span></span></code></pre>Update site configuration</h2>
Good, we’re almost done. The last thing you need to do is updating the nginx
site configuration. You just have to tell nginx that you want SSL and SPDY,
and where it can find the certificates.</p>
Put this in the server block of your domain:</p>
server</span> {</span></span>
    listen</span> 443</span> ssl spdy;</span></span>
</span>
    ssl_certificate</span> /etc/ssl/certs/jacobkiers.net.crt;</span></span>
    ssl_certificate_key</span> /etc/ssl/private/jacobkiers.net.key;</span></span>
</span>
    server_name</span> jacobkiers.net;</span></span>
</span>
    ####</span></span>
    # All</span></span>
    # other</span></span>
    # configuration</span></span>
    ####</span></span>
}</span></span></code></pre>
And that’s it!</p>
Let’s check the configuration:</p>
    sudo</span> /etc/init.d/nginx configtest</span></span></code></pre>
and when nginx indicates that everything is OK, restart it:</p>
    sudo</span> service nginx stop</span></span>
    sudo</span> service nginx start</span></span></code></pre>
Your website should now be serving SSL over SPDY!</p>
Bonus: Serving Only SSL</h2>
As I want to only serve my domain over SSL and only use the top-level domain, I had to add a little more configuration: two extra server blocks.</p>
server</span> {</span></span>
    # Rewrite non-https domains.</span></span>
    listen</span> 80</span>;</span></span>
</span>
    server_name</span> jacobkiers.net www.jacobkiers.net;</span></span>
    return</span> 301</span> https://jacobkiers.net$request_uri;</span></span>
}</span></span>
</span>
server</span> {</span></span>
    # Rewrite https://www.jacobkiers.net/</span></span>
    # to      https://jacobkiers.net/</span></span>
    listen</span> 443</span> ssl spdy;</span></span>
</span>
    ssl_certificate</span> /etc/ssl/certs/jacobkiers.net.crt;</span></span>
    ssl_certificate_key</span> /etc/ssl/private/jacobkiers.net.key;</span></span>
</span>
    server_name</span> www.jacobkiers.net;</span></span>
    return</span> 301</span> https://jacobkiers.net$request_uri;</span></span>
}</span></span></code></pre>
And that is all.</p>


How to Dynamically Instantiate Classes in PHP
2009-03-10T00:00:00+00:00
For Annabel (the name of the product that I currently work on), I need to
be able to dynamically instantiate classes, based on options in a
configuration file (Zend_Config_Ini). However, some of these classes have
constructors (some with required options), others don’t even have a constructor.
I first tried to instantiate them with call_user_func_array, like this:</p>
<?</span>php</span></span>
$datatype_options</span> =</span> explode</span>(</span>','</span>, $global_config</span>-></span>customer</span>-></span>data</span>-></span>field</span>-></span>$key</span>-></span>type);</span></span>
$datatype_class</span> =</span> array_shift</span>($datatype_options);</span></span>
$class</span> =</span> call_user_func_array</span>(</span>array</span>($datatype_class,</span> '__construct'</span>), $datatype_options);</span></span></code></pre>
This didn’t work, since some classes don’t have a constructor, and they were
not static. Then, I came up with another solution: use a generic static
method getInstance() to do it, like this:</p>
<?</span>php</span></span>
class</span> Test</span> {</span></span>
    public static function</span> getInstance</span>($classname)</span></span>
    {</span></span>
        return new</span> $classname();</span></span>
    }</span></span>
}</span></span>
</span>
$datatype_options</span> =</span> explode</span>(</span>','</span>, $global_config</span>-></span>customer</span>-></span>data</span>-></span>field</span>-></span>$key</span>-></span>type);</span></span>
$datatype_class</span> =</span> array_shift</span>($datatype_options);</span></span>
$class</span> =</span> call_user_func_array</span>(</span>array</span>(</span>'Test'</span>,</span> 'getInstance'</span>), $datatype_options);</span></span></code></pre>
This worked, as long as I don’t need any constructor parameters. But for
some classes, I do</em> need them. So I thought some more, and came to the
conclusion that I would need the Reflection API to do what I want. Finally,
I implemented the following solution, which works perfectly. It could
probably be cleaned up a little, but it basically works:</p>
<?</span>php</span></span>
class</span> Annabel_Data</span></span>
{</span></span>
    /**</span></span>
     * Creates instances of classes in the Annabel_Data package.</span></span>
     * </span></span>
     * To use this, provide arguments in the order you would need them</span></span>
     * in the instantiated classes, with as the first argument the name</span></span>
     * of the class to instantiate.</span></span>
     * </span></span>
     * </span>@param</span> $arguments An array with arguments</span></span>
     * </span></span>
     * </span>@return</span> Annabel_Data_Abstract</span></span>
     */</span></span>
    public static function</span> factory</span>($arguments)</span></span>
    {</span></span>
        $class_name</span> =</span> array_shift</span>($arguments);</span></span>
        $class_name</span> =</span> 'Annabel_Data_'</span> .</span> ucfirst</span>($class_name);</span></span>
        Zend_Loader</span>::</span>loadClass</span>($class_name);</span></span>
        $reflector</span> = new</span> ReflectionClass</span>($class_name);</span></span>
        if</span> ($reflector</span>-></span>isInstantiable</span>()) {</span></span>
            $constructor</span> =</span> $reflector</span>-></span>getConstructor</span>();</span></span>
            if</span> (</span>is_null</span>($constructor)) {</span></span>
                return</span> $reflector</span>-></span>newInstance</span>();</span></span>
            }</span></span>
            $params</span> =</span> $constructor</span>-></span>getNumberOfParameters</span>();</span></span>
            $req_params</span> =</span> $constructor</span>-></span>getNumberOfRequiredParameters</span>();</span></span>
            if</span> (</span>count</span>($arguments)</span> ></span> $req_params) {</span></span>
                throw new</span> Annabel_Data_Exception</span>(</span>'Please provide '</span> .</span> $req_params</span> .</span> ' parameters to instantiate class '</span> .</span> $class_name);</span></span>
            }</span></span>
            if</span> (</span>0</span> ></span> $params) {</span></span>
                return</span> $reflector</span>-></span>newInstanceArgs</span>($arguments);</span></span>
            }</span> else</span> {</span></span>
                return</span> $reflector</span>-></span>newInstance</span>();</span></span>
            }</span></span>
        }</span> else</span> {</span></span>
            throw new</span> Annabel_Data_Exception</span>(</span>"Could not instantiate a class of type '"</span> .</span> $class_name</span> .</span> "'"</span>);</span></span>
        }</span></span>
    }</span></span>
}</span></span>
</span>
$datatype_options</span> =</span> explode</span>(</span>','</span>, $global_config</span>-></span>customer</span>-></span>data</span>-></span>field</span>-></span>$key</span>-></span>type);</span></span>
$class</span> =</span> Annabel_Data</span>::</span>factory</span>($datatype_options);</span></span></code></pre>
This works perfectly, for each case I need it (and tested it 😉). I should
add some more exception checking and things like that, but those are minor
details. Overall, I'm pretty happy with the solution!</p>


40x Speedup With iconv And PHP
2009-03-03T00:00:00+00:00
For our product Annabel, we have to clean up the data our customers provide
us. Because this is a fully automated process, we are unable to give direct
feedback and have them fix their input. Therefore, I need a means to clean
the data on our end, so we can process it.</p>
Since we don’t need to support any unicode stuff, we can stick with just
plain ASCII. That’s a very safe approach, which will reduce the chances of
failure greatly. To convert the UTF-8 (Unicode) input into ASCII data, we use
the iconv method from the GNU C Library</a> in combination with PHP.</p>
The default iconv implementation in PHP has two caveats: it stops when a
string cannot be converted, and it prints a question mark when it does not
have an equivalent (or transliterated) character in the destination character
set. To overcome this problem, I used to just convert every single character
with the PHP iconv function</a>, which gave me a throughput of about 250KiB/sec,
using the following code:</p>
<?</span>php</span></span>
/**</span></span>
*  Replaces special characters with their ASCII equivalents.</span></span>
*</span></span>
* This function uses iconv to replace each seperate character with its</span></span>
* ASCII equivalent, using the ASCII//TRANSLIT option. However, this makes</span></span>
* the function very slow: max throughput is about 150KiB/sec.</span></span>
*</span></span>
* </span>@param string</span> $line</span></span>
* </span>@return string</span></span>
*/</span></span>
protected function</span> _convertSpecialChars</span>($line) {</span></span>
    if</span> (</span>empty</span>($line))</span> return</span> ''</span>;</span></span>
</span>
    $new_line</span> =</span> ""</span>;</span></span>
</span>
    /*</span></span>
    * This potentially could be a very long string, so don't split the line</span></span>
    * in separate tokens, for that would tak way too much memory.</span></span>
    */</span></span>
    $line_length</span> =</span> strlen</span>($line);</span></span>
    </span></span>
    for</span> ($x</span> =</span> 0</span>; $x</span> ></span> $line_length; $x</span>++</span>) {</span></span>
        $old_char</span> =</span> substr</span>($line, $x,</span> 1</span>);</span></span>
</span>
        /*</span></span>
        * Use iconv to replace the other special characters.</span></span>
        * If iconv can't convert it (and so returns '?'), just skip</span></span>
        * the character, for it probably is something malicious and</span></span>
        * there's probably no need to keep it anyway.</span></span>
        *</span></span>
        * Beware of the edge case if the original character is a</span></span>
         * question mark itself.</span></span>
        */</span></span>
        $char</span> =</span> iconv</span>(</span>'UTF-8'</span>,</span> 'ASCII//TRANSLIT'</span>, $old_char);</span></span>
        if</span> ( (</span>'?'</span> !=</span> $char)</span> &&</span> (</span>'?'</span> !=</span> $old_char) ) $new_line</span> .=</span> $char;</span></span>
    }</span></span>
    </span></span>
    return</span> $new_line;</span></span>
}</span></span></code></pre>
However, I was not satisfied with this, so I looked up the man page of the iconv
version of GNU C Library. I supposed PHP was internally using this one, so that
seemed a natural action. In that man-page I found the IGNORE option, which just
skips any character which cannot be converted or transliterated. That was exactly
what I wanted. So I tried that with the PHP function as well, and it worked.</p>
Instead of converting every single character, I can now convert a whole file at
once, which gave me a throughput of 11MiB/sec. The caveat, of course, is that I
have to use the GNU C Library iconv, with a version the same (or greater than)
the current one, to avoid compatibility problems. However, that’s a price I’m
surely willing to pay. The new code is like this:</p>
<?</span>php</span></span>
/**</span></span>
*  Replaces special characters with their ASCII equivalents.</span></span>
*</span></span>
* This function uses iconv to replace each seperate character with its</span></span>
* ASCII equivalent, using the ASCII//TRANSLIT,IGNORE option. Throughput</span></span>
* is measured at about 11MiB/sec.</span></span>
*</span></span>
* WARNING: Using the extra IGNORE option only works with a recent</span></span>
* GNU libc iconv, so be very picky about which iconv to use! This is an</span></span>
* undocumented feature, which is not supported by default and is not</span></span>
* listed in the PHP manual!</span></span>
*</span></span>
* </span>@param string</span> $line</span></span>
* </span>@return string</span></span>
*/</span></span>
protected function</span> _convertSpecialChars</span>($line)</span></span>
{</span></span>
    /*</span></span>
    * Check whether we have the right version of iconv</span></span>
    */</span></span>
    if</span> ( (</span>'glibc'</span> !==</span> ICONV_IMPL</span>)</span> ||</span> (</span>true</span> ==</span> version_compare</span>(</span>ICONV_VERSION</span>,</span> '2.8.90'</span>,</span> '>'</span>)) ) {</span></span>
        throw new</span> Exception</span>(</span>'Please use the glibc iconv, version 2.8.90 or higher'</span>);</span></span>
    }</span></span>
</span>
    /*</span></span>
    * Use iconv for speed and glory</span></span>
    * We use the ASCII//TRANSLIT,IGNORE option to replace the string</span></span>
    * with its ASCII transliterated equivalent. If there's no ASCII</span></span>
    * equivalent, the IGNORE option makes sure the character is just</span></span>
    * thrown away, which is exactly what I want.</span></span>
    *</span></span>
    */</span></span>
    $new_line</span> =</span> iconv</span>(</span>'UTF-8'</span>,</span> 'ASCII//TRANSLIT,IGNORE'</span>, $line);</span></span>
</span>
    return</span> $new_line;</span></span>
}</span></span></code></pre>
I guess I don’t need to give further comments on this code example 😉</p>
If you have questions or comments, you could drop me a line</a>.</p>


The law of God: is it still relevant?
2009-03-02T00:00:00+00:00
Sometimes one might think: are the laws which God had given to Israel still
relevant to us, or shall we just skip them? Did the Lord Jesus not fulfill
the complete law when He died on that tree at Golgotha? Does that not mean
that we do not need to keep these laws throughout our lives?</p>
Let us open up our Bibles and see what God has to say about this.</p>
The law is not passed away, for the first chapter of the Sermon of The Mount
is wholly written about the way we should practise the law in our daily lives.
Paul, the Apostle, also says he delights in the law of God. (Romans 7:22).
That does not mean the law can save us (Romans 3:20), for salvation is only
by faith in Jesus Christ (Romans 8:1-4). I personally think we can say that
law in the New Testament is less like ‘rules’ and more like ‘doing the will
of God’. His will is found in the Bible, which is revealed by Himself
(2 Timothy 3:16).</p>
The foundation of His will is love for God and for our neighbours (Matthew
22:40). Flowing from that love for God and because we are grateful for what
He did for us, we (should?) want to do his will. Then it is easy to
understand why Paul says he delights in the law.</p>
Summarizing: the law has been fulfilled by Jesus, and we don’t need to
fulfill it anymore to get saved. However, because He did this much for
us, we want to do what He wants us to do.</p>
Which brings us back at the law. In this case, the law of Christ,
consisting of love for God and all other people. So you might wonder how to
show your love towards God. You can do so by doing His will, which is given
in Scripture, especially in the first five books (Genesis till Deuteronomy).</p>
Many of these books are filled with guidance and precepts which we are still
able to apply. Many parts of it seem to be quite obsolete for everyday life,
though, for example the sacrificial laws. I think it is good to apply many of
these laws in a practical way, useful in our everyday life. Joshua 1:7-8 also
seems to point that out.</p>
Many times I’m struggling with applying these laws as a general rule in my
life. It certainly isn’t easy to take 3000+ years-old laws and give them an
application in the 21st century. However, it really is worth a try.</p>
Are you in?</p>
Feel free to comment</a>.</p>


PHP daemon with fork howto part 3: Creating a Hello World daemon with fork
2008-12-24T00:00:00+00:00
Well, it took some time, but now I’m back again with part 3 of the series
on creating a PHP daemon with fork. In part 1, the introduction</a>
I talked about why I would write this series and gave an outline of it.
In part 2 we talked about the way UNIX processes work, what forking is</a>
and so on. In this part, we will see how to create daemon in PHP</a>
which launches processes saying the famous Hello World!</p>
Let’s first create a basic Hello World script. And no, I’m not going to
explain that 😏</p>
<?</span>php</span></span>
echo</span> "Hello World</span>\n</span>"</span>;</span></span></code></pre>
Okay, we’ve covered the basics. Next thing is to create a daemon. This can
be done with pcntl_fork()</code></a>.</p>
 1</span><?</span>php</span></span>
 2</span>$newpid</span> =</span> pcntl_fork</span>();</span></span>
 3</span></span>
 4</span>if</span> ($newpid</span> === -</span>1</span>) {</span></span>
 5</span>    die</span>(</span>"Couldn't fork()!"</span>);</span></span>
 6</span>}</span> else if</span> ($newpid) {</span></span>
 7</span>    // I'm the parent, and I'm going to self-destruct</span></span>
 8</span>    exit</span>(</span>0</span>);</span></span>
 9</span>}</span></span>
10</span></span>
11</span>// Become the session leader</span></span>
12</span>posix_setsid</span>();</span></span>
13</span>usleep</span>(</span>100000</span>);</span></span>
14</span></span>
15</span>// Fork again, but now as session leader.</span></span>
16</span>$newpid</span> =</span> pcntl_fork</span>();</span></span>
17</span></span>
18</span>if</span> ($newpid</span> === -</span>1</span>) {</span></span>
19</span>    die</span>(</span>"Couldn't fork()!"</span>);</span></span>
20</span>}</span> else if</span> ($newpid) {</span></span>
21</span>    // I'm the parent, and I'm going to self-destruct</span></span>
22</span>    exit</span>(</span>0</span>);</span></span>
23</span>}</span></span>
24</span></span>
25</span>echo</span> "Master started with pid "</span> .</span> posix_getpid</span>()</span> .</span> "</span>\n</span>"</span>;</span></span>
26</span></span>
27</span>for</span>($i</span> =</span> 0</span>; $i</span> ></span> 10</span>; $i</span>++</span>) {</span></span>
28</span>    $pid</span> =</span> pcntl_fork</span>();</span></span>
29</span>    if</span> (</span>-</span>1</span> ==</span> $pid) {</span></span>
30</span>        echo</span> "Couldn't fork!</span>\n</span>"</span>;</span></span>
31</span>    }</span> elseif</span> ($pid</span> ===</span> 0</span>) {</span></span>
32</span>        // I'm the child, and I'm going to say hello world!</span></span>
33</span>        echo</span> "Hello world! from child with pid "</span> .</span> posix_getpid</span>()</span> .</span> "</span>\n</span>"</span>;</span></span>
34</span>        exit</span>(</span>0</span>);</span></span>
35</span>    }</span> else</span> {</span></span>
36</span>        // I'm the parent, do nothing</span></span>
37</span>    }</span></span>
38</span>}</span></span>
39</span></span>
40</span>exit</span>(</span>0</span>);</span></span></code></pre>
Well, this is all of it. Let’s explain the various parts.</p>
In the first nine lines we fork. The actual forking is done with:</p>
$newpid = pcntl_fork();</code>.</p>
This function spawns a new process, and then continues both in the parent
and the child process at the first line after the fork (line 4). Usually,
that will be an if-else clause. This if-else clause checks whether the
forking was successful. If it was not, the return value will be -1</code>.</p>
If it was successful, the parent process kills itself (lines 6-9). Note
that after that there is no check whether the child process is running.
That is not necessary: if the current process is not the parent, and
forking did not fail, then by default it is the child. So the next part of
this script runs as the child process.</p>
After forking, the script detaches from the console, and become the session
leader. This means that a new process group is created, and that all child
processes that might be started from now on will become part of this new
process group, and not of the process group that started the script.</p>
When a process is started on the command line, then the shell is the session
leader of that command. That is not very useful for a deamon, because when the
session leaders stops, then all the child processes will be killed as well.
Therefore, a new process group is created, with the daemon itself as the
session leader.</p>
After that, we sleep for 0.1 seconds. This is all done on lines 12 and 13:</p>
posix_setsid</span>();</span></span>
usleep</span>(</span>100000</span>);</span></span></code></pre>
At this point, the executing script is now the session leader of its own
process group. So it is time to start the real parent process of the daemon.
This is just basic forking again, as you can see in lines 15-23. After that,
the current process id is printed on line 25.</p>
By forking again, the script becomes totally detached from the context from
which it was called, in this case probably the shell. This is a technique
called double-forking, and it is necessary to make a long-running daemon
completely independent.</p>
Next comes the Hello World!</code> part. First a loop is started with 10 iterations.
In that loop, the script is fork()</code>ed again, but now we do nothing in the
parent (it just keeps running). So the else statement for checking the parent
could safely be left out; I kept it here for the sake of clarity.</p>
In the child process the famous Hello World!</code> is printed, along with the
new process id. After printing, we stop the child, for there’s no need to
keep it around any longer. When all child processes are done running, then
parent process (the daemon) also stops. This can all be seen in lines 27-40.</p>
<?</span>php</span></span>
for</span>($i</span> =</span> 0</span>; $i</span> ></span> 10</span>; $i</span>++</span>) {</span></span>
    $pid</span> =</span> pcntl_fork</span>();</span></span>
    if</span> (</span>-</span>1</span> ==</span> $pid) {</span></span>
        echo</span> "Couldn't fork!</span>\n</span>"</span>;</span></span>
    }</span> elseif</span> ($pid</span> ===</span> 0</span>) {</span></span>
        // I'm the child, and I'm going to say hello world!</span></span>
        echo</span> "Hello world! from child with pid "</span> .</span> posix_getpid</span>()</span> .</span> "</span>\n</span>"</span>;</span></span>
        exit</span>(</span>0</span>);</span></span>
    }</span> else</span> {</span></span>
        // I'm the parent, do nothing</span></span>
    }</span></span>
}</span></span>
</span>
exit</span>(</span>0</span>);</span></span></code></pre>
Congratulations! This is all there is to it. At this point you created your first fully functional PHP
daemon 🚀</p>
In the next part, we will add some communication between the parent and the child processes.</p>


Automatically add user to Ubuntu Linux and set password
2008-12-23T00:00:00+00:00
I was wondering how to create a user on my system without requiring a
prompt or CLI access. The following script is the result:</p>
#!/bin/bash</span></span>
UADD</span>=</span>/usr/sbin/useradd</span></span>
OPENSSL</span>=</span>/usr/bin/openssl</span></span>
SHELL</span>=</span>/bin/bash</span></span>
</span>
# Generate 12 characters long password and print it.</span></span>
PASS</span>=</span>`</span>$OPENSSL</span> rand -base64 12`</span></span>
echo</span> $PASS</span></span>
</span>
# Make the password usable for the useradd utility</span></span>
PASS</span>=</span>`</span>mkpasswd</span> $PASS</span>`</span></span>
</span>
# Create the user</span></span>
$UADD -s $SHELL -m </span>$1</span> -p $PASS</span></span></code></pre>


PHP daemon with fork howto part 2: About UNIX processes and PHP
2008-10-17T00:00:00+00:00
As promised in part 1, the introduction</a> of this series on PHP fork,
now we will talk about the way processes work in UNIX and Linux, and how we
can use these from PHP.</p>
Much of the information in this article is based on the IBM Developerworks
article on UNIX Processes</a>. I added this part for
your convenience and for completeness, but I won’t go into detail about
UNIX processes. If you want to know more, read the aforementioned article.</p>
Any program in UNIX is a process, except for the kernel. A program is in
fact a bunch of data, with some instructions to do something with that data.
A process tells when and how these instructions should be executed.</p>
Each process has its own and unique (at that point in time) process id. It
is impossible for two processes to have the same process id at the same time.
It is, however, possible that some process id is assigned to another process.
This only happens when the counter for process id’s runs out of space, and is
reset, so that it starts with process id 2 (for process id 1 one never ever
stops as long as the system is running).</p>
So, when a new process is launched, that process will get its own, unique
process id, which is an identifier in the whole system. Furthermore, the
process id is used to identify all resources in use by that process. A
resource can be defined as anything which is needed to run, such as memory,
disk space, a network socket, open files such as logfiles or input/output
files and anything else you can think of.</p>
This also means that each PHP program or script you are running, has its own
process id, with the possible exception of the PHP scripts running inside a
webserver process, like Apache httpd sometimes does.</p>
Spawning a new process is done by calling the fork(1)</code> system call, which
returns one of three values:</p>

In the calling process, when successful, the process id of the child.</li>
In the calling process, -1</code> when something went wrong.</li>
In the child process: always 0</code>.</li>
</ul>
Using this knowledge, we can check whether we are in the parent or in the
child process, and act appropriately.</p>
More on that in the next part</a> of this series. There we will create a PHP
daemon</a>, which will start processes for the sole purpose of saying Hello
World multiple times.</p>


PHP daemon with fork howto part 1: Introduction
2008-10-16T00:00:00+00:00
In the past weeks, I have been writing a daemon in PHP for my work at Alphacomm.
It now is quite finished, and I decided to share this knowledge with you in a tutorial.</p>
Another reason for writing this tutorial, is the lack of information
available at the web on this subject. Generally, it’s very scattered
and not really accessible. Also, most information I found about it,
talked about a specific solution, rather than taking a more general
approach. So, I decided to write a howto in a series of articles on
PHP fork()</code>-ing and daemons. I expect to add another part each week.</p>
In this series, I will cover the following subjects:</p>

Part 1: An introduction to this series, links to all parts</a></li>
Part 2: About UNIX processes and PHP</a></li>
Part 3: Creating a Hello World daemon with fork()</a></li>
Part 4: Adding IPC (Inter Process Communication) with PHP sockets</li>
Part 5: Talking to the outer world (also with PHP sockets)</li>
Part 6: Errata and other stuff (not sure of this one)</li>
</ol>
Disclaimer: these can change ;)</p>
At last, I’d like to thank the guys who wrote Nanoweb</a>, which really helped me to understand the whole process of creating and managing processes with PHP fork(). However, if you ever plan to actually read that sourcecode yourself, be warned. It is not for the faint-hearted.</p>


Grace alone
2008-06-26T00:00:00+00:00
Did someone ever want to give you something of a very, very great value? Then you know how hard it can be to just accept it. It is nearly impossible to take it, and if you take it, you nearly drop it.</p>
An even greater value has the grace which our Saviour, Jesus Christ, achieved for us. To give us this, Hes had to die.</p>
Is the grace which He gives to us a consequence of our goodness towards Him? No way! If his grace depends on that, we will immediately and definitely go to hell, But luckely it doesn’t depend on that. It only depends on Him.</p>
He knows us better than we know ourselves, nevertheless, he wants to give us His grace, which the apostle Paul calls an immeasurable richness. This is about the strongest expression I know to use when I want to show the greatness of something. And this grace, this richness, we can get from Him for free.</p>
At last, in the sixth verse the apostle states that we are now, at this moment, with the Lord in heaven, due to his resurrection.</p>
If I think about this, I can’t do anything but say: “how little do I think about my future”.</p>
Do you show in your life His grace?</p>
Based on Ephesians 2:6-9</p>


PHP subversion post-commit hook
2008-06-11T00:00:00+00:00
Some time ago I’ve written a post-commit hook for Subversion in PHP, to make it easier to track code changes via email.</p>
I based it on another hook</a>, written in Ruby. Because it had no license attached to it, and because I had to rewrite it myself, I decided to license it under the new BSD license.</p>
You can find the hook here: commit-email-color.php</a>. It has the new BSD license attached to it.</p>
Enjoy it!</p>
2009-06-17: fixed a bug: now displays the full commit message instead of just the first line.</span></span>
2008-06-13: added an option to disable color-code the diffs.</span></span></code></pre>

Jacob Kiers

Don't accept router advertisements on IX links

Alternating current and its relation to voltage

Properties of alternating current</h2> Alternating current has a few commonly-used properties:</p>

Alternate ways of writing</h3> That also means that</p> $V_{rms} = V_{pp} \div 2\sqrt{2} = \frac{V_{pp}}{2\sqrt{2}}$</li> Written differently: $V_{rms} = V_{pp} \cdot \frac{1}{2\sqrt{2}} = V_{pp} \cdot \frac{1}{2} \cdot \frac{1}{\sqrt{2}}$</li>

Example calculations</h3> With wo common voltages 120V RMS and 230V RMS, we get:</p>

Fin</h2> That was it for today. If you found this useful, I highly recommend following the course</a>.</p>

Cross compiling Rust with Drone

Definitions</h2> Since not everyone may be familiar with cross compilation, it is useful to know some definitions.</p> Host: the machine in which cross compilation is performed.</p> </li> Target: the operating system and CPU architecture for which a project is compiled.</p> </li>

How does it work</h2> Rust has good support for cross compilation already out of the box. However, in order to use it, the compilation toolchains need to be installed on the host. Also, the Rust project sometimes needs custom configuration as well, in order to be able to use this.</p>

Cross compilation</h3> A cross compilation step is defined like so (under the steps</code> definition):</p>

When tagged, create a Gitea release</h3> When the pipeline is run for a tag, than as the very last step a new draft release is created in Gitea. This can then be edited and published.</p>

Fin</h2> You've made it! This is the end of the pipeline!</p>

Automatically scaling Drone CI with Gitea

HTML over DNS: Serving Blog Content Over DNS

Why, though?</h3> In short: just because I could. It was one of those ideas I was wondering idly about, and I decided to just try it.</p>

A (mostly) IPv6-only home network

Setup</h2> Packages</h3> To install the required packages, run:</p>

Packages</h3> To install the required packages, run:</p>

Current issues</h2> In the end, I could not use IPv6 only the Windows machine I got from work, because the Windows Subsystem for Linux v2 does not route IPv6 connectivity to the VMs.</p>

Mockery: returning values and throwing exceptions

Configure nginx with SSL and SPDY on Ubuntu 12.04 Precise

How to Dynamically Instantiate Classes in PHP

40x Speedup With iconv And PHP

The law of God: is it still relevant?

PHP daemon with fork howto part 3: Creating a Hello World daemon with fork

Automatically add user to Ubuntu Linux and set password

PHP daemon with fork howto part 2: About UNIX processes and PHP

PHP daemon with fork howto part 1: Introduction

Grace alone

PHP subversion post-commit hook

Fin</h2>
That was it for today. If you found this useful, I highly recommend following the course</a>.</p>

Fin</h2>
You've made it! This is the end of the pipeline!</p>
If this was useful for you, or you have comments, feel free to send me an email</a>.</p>

Why, though?</h3>
In short: just because I could. It was one of those ideas I was wondering idly about, and I decided to just try it.</p>

Current issues</h2>
In the end, I could not use IPv6 only the Windows machine I got from work, because the Windows Subsystem for Linux v2 does not route IPv6 connectivity to the VMs.</p>