First, we just need to make sure the usual BIOS setting (Wake-on-LAN, Magic Packet, etc…) is enabled. – In my case on ASRock this was actually called “PCIE Devices Power On”. I’m also on a Realtek card.

Then, the simplest form of this is ensure the NIC is configured to still idle for the magic packet while sleeping (as root, where enp5s0 is my main NIC):

$ ethtool -s enp5s0 wol g

… where ‘g’ means ‘Wake on MagicPacket™’ (see ethtool man page for more details!). This should be run every reboot to make sure the NIC is still configured as such.

To confirm settings:

$ ethtool enp5s0
Settings for enp5s0:
	Supported ports: [ TP	MII ]
	...
	...
	Wake-on: g
	Link detected: yes

Notice that ‘Wake-on’ is ‘g’. By default (at least for me), this was ’d’ for disabled.

If you are using NetworkManager though, like the default in Fedora and as such, my setup, a more elegant solution could be to have that manage it for us. This is also quite easy, but perhaps less simple:

$ nmcli connection show
NAME                      UUID                                  TYPE       DEVICE     
Wired connection 1        3.......-....-....-....-...........d  ethernet   enp5s0
...
# (My desired one is 'Wired connection 1')

$ nmcli connection modify "Wired connection 1" 802-3-ethernet.wake-on-lan magic

$ nmcli device reapply enp5s0
# (Note 'enp5s0' should be the device in the profile you edited as above 'show')

After this, you can validate using ’ethtool’ as prior simplistic approach that it all worked.

As usual (i.e. Windows), it may take your computer an extra reboot to get things to work. Always try that first if WoL doesn’t work right away! (I got stuck for a while before on an older PC because of this.)

Bonus: Windows. A similar extra config is usually also required, at least for Realtek as I’ve used. Usually you’ll need the Realtek drivers installed, then in the ‘Advanced’ section of the NIC properties, there’s a ‘Wake on Magic Packet’ setting you’ll need to enable. Then reboot once and/or twice if required and it should ‘just work’.

Bonus II: How to actually WoL? I typically have this saved in a script on my jumpbox (Rocky Linux, net-tools package, as root, where enp1s0 is the network interface on the same network as the main PC): ether-wake -i enp1s0 <main:pc:mac:address:here>

(As usual, the MAC address of the main PC can be found with e.g. ip addr show dev enp5s0.)

Probably due to an unclean shutdown and/or filesystem woes, my MariaDB setup (in an Alpine LXC, for Nextcloud) got corrupted. Unfortunately, remaining backups were also months old, given I was relying on my university storage for it (haha), and all I had was an old copy of the setup on my old ‘server’.

To be honest, the old backup was probably enough, but I decided to take the challenge on vs MySQL – I use it enough at work to warrant messing with it.

Preparation

So, the first step (after some simple attempts on the original LXC itself) was copying off the data to a more stable environment to work on (who knows how else LXC could be screwing with things).

• I decided to simply use a Rocky Linux VM that was already lying around.
• Originally, I tried using the MariaDB in the system repos, but that didn’t help, and so eventually switched to the MariaDB-official dnf repo (*more to come here :D)
  • This was to try installing the latest versions and thinking maybe a later InnoDB engine would be more kind.
  • If you’re going to do this, ensure the official mariadb-server package is removed, then replace it with MariaDB-server with the new repo in place.

Initial attempts: InnoDB force-recovery modes

So, at first…

• I had copied the data as-it-was into /root/ncsql.
• Then, just tried firing the database back up with the newer MariaDB, simply in the foreground (no need to mess with systemd/etc!) with: mysqld_safe --datadir /root/ncsql --user root.
  • The --user root in my case was simply out of laziness – I don’t care for security given this is a rescue operation, in a disposable VM, and the files were owned by root given how I copied them across
  • The dreaded ‘mysqld got signal 6’ then arrived – process in foreground just stopped, and a stackdump with the message appeared in the log file. If we follow their instructions first, we would try starting with the various InnoDB recovery modes (i.e. from my understanding, relaxing invariants to hopefully ‘just’ load things back).
• Increasingly to the mysqld_safe command line, add the --innodb-force-recovery 1 flag and value, slowly increasing until the maximum of 6.

If your database fires up OK here with one of these modes – good news! It ‘just’ worked. Jump to the dump+restore section below.

But, if you’re like me, there’s more fun to be had…

Force-recovery failed, now what…

So, after a recovery level of 2, all the way to 6, I started getting ‘mysqld got signal 11’ now, with much worse looking stack dumps.

Even MariaDB itself was thinking this could be a software bug of itself, given how corrupted things were.

(This was the point where originally, I tried copying it off to the VM, trying newer MariaDB versions, etc. Until all of that didn’t work, and I scoured around for what others could have done.)

I then stumbled across this older XAMPP related crashed MySQL StackOverflow post+answer. After a bunch more related reading, my understanding of the key data files are:

• The database you’re interested in has a bunch of *.frm and *.ibd files. These are the table metadata, and InnoDB data files respectively
• ibdata1 has very important InnoDB metadata, a must-have
• ib_logfile0, ib_logfile1... are the InnoDB redo logs, and are for recovering transactions when database crashes
  • These log files seem like in some cases, you can delete them, but risk losing those last few transactions / left in a weirder state

Recovery time

With the above key-files in hand, you may be thinking we could Frankenstein something together – and that’s of course what I tried (and spoiler, it worked!). Here’s what I did…

• Initialised a fresh MySQL data directory, simply by starting the MariaDB service: systemctl start mariadb
  • I just used the default spot because this was essentially a fresh VM; on Rocky, this is /var/lib/mysql
  • The systemd service unit has a pre-start to create these defaults, so I lazily utilised it. You could probably use mysql_install_db too.
• Confirmed things were working by just running (as root, of course): mysql - should connect just fine.
• Stopped the MariaDB service: systemctl stop mariadb
• Transplanted the aforementioned folders and files in to the fresh data location, /var/lib/mysql/data: <database folder> (in my case, nextcloud), ibdata1, ib_logfile0, ib_logfile1
• Started up MariaDB, this time in the foreground to more easily troubleshoot: mysqld_safe --user root.
• Shortly after launching, it crashed, but in the log file it said my MariaDB version was too new(!) to recover from the given files. I hadn’t seen this message before now (signs of recovery attempts! hope!), so I followed its guidance and downgraded.
  • In my case, this meant going from the latest ‘11.rolling’ repo (https://rpm.mariadb.org/11.rolling/rhel/$releasever/$basearch; repo file in yum.repos.d and contents originally installed from https://mirror.mariadb.org/yum/11.rolling/rocky9-amd64/MariaDB.repo)
  • … to the suggested highest version from the logs of ‘10.6’. I simply replaced the ‘11.rolling’ with this in the repo file, uninstalled and reinstalled MariaDB
• After starting back up (mysqld_safe), it was still unhappy with signal 6 – no worry for now, we still have the force modes to go through
• Upon starting back up with mysqld_safe --user root --innodb-force-recovery 2 (usually starting from 1 and going up like before, but this is what worked from me) – we’re in! No crashes!

It is quite interesting to me that this worked though, and how MySQL could not do this recovery itself. The files were there!

(That said, I will say: the data looks mostly there to me. But there’s no telling what could have been subtly missing.)

If this still didn’t work for you, I’m pretty sure it’s just game over.

Dump + restore

Obviously, you shouldn’t run MariaDB in this state, with the recovery modes on and probably a bunch of safety checks switched off.

The easiest and recommended way to recover is to simply take a database dump (backup), then restore. Simply, this is:

• Take the backup (in another terminal session): mysqldump --all-databases > /root/backup.sql (or if you want just dump a single database)
• Stop MariaDB (with mysqladmin shutdown)
• Move away (or if you’re confident, remove) the transplanted stuff, i.e. /var/lib/mysql
• Reinitialise the database (or in the simple case as per before, just fire up the systemd service) and start MariaDB back up
• Restore the backup: mysql < /root/backup.sql

… and that should be it! Your database should be back, with hopefully the data intact.

Ending remarks

Whilst this worked, I would not rely on this being the case at all. Take backups! Don’t be lazy like me, and keep putting it off.

This should also speak to the fragility (of the data; although it was kind of on me for the filesystem stuff – I will say I did turn off CoW for this subvolume) and opaqueness (of the error messages) of MySQL.

Going forward, I see myself switching over to PostgreSQL. The backups should also be much better, with their *.pgdump format.

(I always found it silly that MySQL’s only way of backing up was SQL queries serialised… very inefficient to the point where if you don’t need anything special, backing up to CSV and restoring that is faster, due to not having to parse queries!)

Hope this can help someone though, if it does come down to it!

I use a DualSense controller with Genshin Impact, and wanted to get it to work right. Specifically, by default, we run into Xbox controller prompts in-game, no DualSense features (such as gyro aim) and no haptics. I knew from Windows that support definitely exists for all of these, so let’s fix it up!

This guide will probably work for similar games with such native PS controller support. Tested with wine-ge-proton8-25 in Bottles at time of writing, on Fedora 39 KDE.

Enabling/allowing hidraw

By default, Proton has SDL enabled and hidraw disabled – I believe this is for Steam Input to function reliably. We don’t want this now, so let’s switch it back on.

1. Ensure Valve’s udev rules are installed: sudo dnf install steam-devices (RPMFusion package)
   • (This comes with rules for common controller/joystick devices to allow hidraw access)
   • Reload udev if not already installed + replug controller
   • sudo udevadm control --reload-rules && sudo udevadm trigger
2. Launch the registry editor in the relevant Wine prefix
   1. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\winebus
   2. Set DisableHidraw to 0

That’s it, the PS prompts and gyro controls should now work in Genshin.

Haptics support

This is (obviously) optional, but the more tricky part, with less info online around about it.

The main issue is that the PS5 controller uses its audio device for haptics (back 2 channels of the 4 channel surround), and games look for this audio device by name. The name of the device is different under Linux, so we need to trick it by renaming.

Under Fedora 39’s default config, the audio session manager is WirePlumber for PipeWire. So, in ~/.config/wireplumber/main.lua.d/60-dualsense.lua, we can create a custom rule:

rule = {
	matches = {
		{
			{ "node.name", "matches", "*Sony_Interactive_Entertainment_Wireless_Controller*" },
		},
	},
	apply_properties = {
		["node.description"] = "Wireless Controller",
	},
}

table.insert(alsa_monitor.rules,rule)

…then reboot, et voilà.

(You may also need to ensure the ‘Profile’ for the device is set to ‘Analog Surround 4.0 Output’, and volume is at 100% + unmuted. This is easiest done via pavucontrol.)

Bonus: using hidraw with any device

You can fairly easily use the same approach to use any device over hidraw even if Valve’s udev rules don’t have the device you want to use. This could be useful for certain joysticks that you don’t want going through Wine’s SDL layer.

You can create your own udev rule in a similar vain to Valve’s ones in /usr/lib/udev/rules.d/60-steam-input.rules. This will look something like e.g. /etc/udev/rules.d/60-my-device.rules (you can use lsusb to fetch ids):

# My cool device
KERNEL=="hidraw*", ATTRS{idVendor}=="<VID>", ATTRS{idProduct}=="<PID>", MODE="0660", TAG+="uaccess"

…and reload udev + replug as usual.

Under Proton, they have a whitelist for what devices it allows for hidraw (the PS5 controller is on there by default). Since this is a custom device, you will then need to modify any launch script / bottle environment variables to include PROTON_ENABLE_HIDRAW=0x<VID>/0x<PID> (all caps) and this should get it through the whitelist. (or, even better, if it’s a common device, consider upstreaming to Valve!)

References

• Controllers under Proton: https://github.com/ValveSoftware/Proton/blob/proton_8.0/docs/CONTROLLERS.md
• DualSense ‘advanced features’ work: https://github.com/ValveSoftware/Proton/issues/5900
• Renaming devices with WirePlumber: https://wiki.archlinux.org/title/WirePlumber#Changing_a_device/node_property

Background

Recently I formatted my home computer and made the jump to Linux – specifically, the lazy way and just using Fedora Workstation 39 KDE Spin. It’s been surprisingly pretty good so far!

However, I wanted to try running a Windows game via WINE which had ASIO support to get its HD audio working. After some mucking about, I got WineASIO working and thought I’d share the details on how.

Making it work

Note: I only needed it working for 64-bit so that’s all I bothered with. It also assumes you are wanting to use Pipewire JACK (although, build steps could probably be adapted to regular JACK too).

Building WineASIO

In case it works (and/or saves me time in future!), I’ve uploaded a build of v1.2.0 here: /static/upload/wineasio64-1.2.0-build.tar.gz

1. Grab a copy of WineASIO’s source code (at time of writing it was v1.2.0): https://github.com/wineasio/wineasio/releases
2. Install build dependencies (assuming you already have base ‘Development Tools’ group): sudo dnf install pipewire-jack-audio-connection-kit-devel wine-devel
3. Unpack it, then simply use make 64 to run the build, outputs into build64. Out should come a wineasio64.dll and wineasio64.dll.so
   • (A reference I saw seemed to suggest a modified Makefile was needed, but this seemed to no longer be the case)

Installing WineASIO

In my case, I was using Bottles (Flatpak) to manage my WINE prefix, so this was the part that needed to cater for it. For the purposes of these steps, I will highlight the Bottles locations. – Otherwise, the default WINE prefix lives in ~/.wine, and the default WINE libraries live in /usr/lib64/wine.

(wineasio-register could work, but to make sure the final registering works in Bottles I think it’s better to just do it manually.)

1. Ensure the Pipewire JACK connection kit is installed: sudo dnf install pipewire-jack-audio-connection-kit
2. Ensure your user is able to use realtime priorities (via the Pipewire group / security limit rule), and can access audio devices: sudo usermod -aG pipewire,audio $USER
3. Copy built WineASIO libraries into WINE libraries folder:
   • cp wineasio64.dll.so ~/.var/app/com.usebottles.bottles/data/bottles/runners/wine-ge-proton8-25/lib64/wine/x86_64-unix
   • cp wineasio64.dll ~/.var/app/com.usebottles.bottles/data/bottles/runners/wine-ge-proton8-25/lib64/wine/x86_64-windows
4. Copy built WineASIO DLL into relevant prefix folder (or, the game EXE folder should work too):
   • cp wineasio64.dll ~/.var/app/com.usebottles.bottles/data/bottles/bottles/<BOTTLE NAME>/drive_c/windows/system32
5. For Bottles Flatpak, you’ll also need to allow access to the Pipewire device:
   • flatpak override --user --filesystem=xdg-run/pipewire-0 com.usebottles.bottles
   • Restart Bottles for good measure
6. Register WineASIO DLL with the WINE system:
   • In Bottles, fire up the Command Prompt for the relevant prefix
   • C:
   • cd C:\WINDOWS\SYSTEM32
   • regsvr32 wineasio64.dll
7. A reboot is now probably required

Testing it

At this stage you may be able to just fire up whatever it is you’re trying to do. However, in my case, it was very unhelpful because at first it didn’t work right away, and the game decided to hang on startup.

1. Grab a copy of VB-Audio’s ASIO Driver Tester: https://forum.vb-audio.com/viewtopic.php?t=1204
2. Unpack it, then launch VBASIOTest64.exe
3. Click ‘Devices’ -> ‘WineASIO’
   • (At this stage, WineASIO should come up. Otherwise, review the installation steps above.)
4. You should hear a sine wave playing, and numbers should start coming up. This is how you know it all worked!
   • (Otherwise, an error message should come up below and in the terminal. In my case, the terminal output suggested it couldn’t connect to JACK, and it turned out it was the Flatpak allow step that was missed.)

The ASIO device should be ready to go, connected to Pipewire JACK! It should be simply called ‘WineASIO’, for any programs that should require its name.

References

Notably, some of these details I stumbled across were seemingly out of date in some spots, so I wanted to post my own post/guide. They did help me put this together though, so here are the references:

• https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/1495
• https://github.com/theNizo/linux_rocksmith/blob/main/guides/setup/fed-pipewire.md

Further experimentation

There’s certainly a few things more I’d like to play with in this space:

• Different kernels. I’m already running the kernel-cachyos since that was most convenient in COPR, but perhaps some other realtime ones could further improve latency/quality
  • I stumbled upon audlinux, and this is fairly intriguing
  • The kernel has definitely already improved single-core-heavy game performance, I’d suggest experimenting here for sure if you have time to waste :)
• Resampling quirks. I now have to run my system in 44.1kHz mode to match audio output from WINE (or it results in no or sped up audio)… but I’m curious if I can run it in 48kHz instead and just have the 44.1kHz resample. (or, just a way to have apps detect/forced to the right one, and no crackling/artefacts!!)

Updates after initial publishing:

• 2024-01-07: Added missing realtime/audio setup+group steps, missing C drive switch in DLL registration, and minor reordering of steps
• 2024-01-29: Moved prebuilt download into blog hosting rather than relying on Windblume filehost
• 2024-03-30: F40 or this change possibly broke this guide - updated realtime instructions to actually use pw group instead of piggybacking realtime-setup’s ’nice’ rules - those aren’t actually needed and just the pipewire group was the whole time. Also added further experimentation notes for future expansion

But why? For a few reasons, but all centred around how Cloudflare Pages felt pretty restrictive, or even prescriptive in the way they allow users to set up hosting. The two things always on my mind were: enforcing ’non-ugly’ URLs and not allowing plain HTTP.

Apart from that, I just don’t particularly like hosting my small, personal stuff on Cloudflare all too much anyway, seeing that more of the web is centralising on Cloudflare, when more of it really should be decentralised.

Why now? Well, I moved to Cloudflare Pages originally since it let me easily use Hugo, as per my original blog post here. But today I found out while playing around with GitHub’s settings, however, that Pages now supports using GitHub Actions as a builder, and publish artifacts that way, similar to GitLab’s offering.

I thought this was great and I could move back now – I never liked the ideas of pushing built artifacts as source code to the repo under a ‘docs’ folder.

So, I got started and threw together an Actions workflow file.

…

And sure enough, the build took about just as long, and it’s working as intended (if you’re able to read this post).

You can view the GitHub Actions workflow file here: https://github.com/nicholastay/personal-web/blob/master/.github/workflows/build.yaml

Simply, I took a few reference GitHub Actions files, along with Hugo’s updated guide, and stripped it down to the bare requirements. (The official given reference had so much extra crud! I don’t want your sass-jamstack-nodejs nonsense, just stitch together some static HTML, please. stares at Jekyll)

Overall, it wasn’t too bad to pick up, and was a great excuse to finally try out GitHub’s own CI. I had only used TeamCity and GitLab CI at work before, so this was another tool in the arsenal!

Now, back to your weird old browser programming, with TLS out of the way.

(no, I’m serious. – this was broken after moving to Cloudflare due to its enforcement of HTTPS/TLS)

(I’ve also done a bit of improvement work to the site in the meantime! There’s a dark theme based on your browser settings now, and the Life timeline no longer relies on JS/AJAX. Hooray!)

Last.fm is pretty cool. It allows me to use my own library (or really, any provider!) whilst keeping track of what I listen to. For some reason I like tracking things like this, so I can look back and see what I was doing at a past point (such as with TV shows, I use Trakt).

However, what if Last.fm goes away one day? Also, what if I want to run my own custom queries/insights against my data?

(Third-year uni) Me: Of course, just stash all this in my own SQL database! Then, I can run whatever query I want to pull the insights I’d like.

Well, indeed, the me who was nearing the end of his databases uni unit found a way to do that back then, and it’s pretty cool just to have. (I’m still figuring out what’s the best way to visualise, etc.)

I decided on MariaDB(/MySQL) since it was just what I had on my home server, but it really could have been anything (today, I’d probably use PostgreSQL)… anything but Oracle though (it’s what my uni used…)!

Here’s the schemas I went with:

create table music_plays (
	dt datetime,
	artist varchar(255),
	title varchar(255),
	album varchar(255)
);
alter table music_plays add primary key (dt,artist,title);

The three items are primary keys so on a reimport, if there happens to be duplicates, they will be skipped.

Then, fetching the data. Well, I found this tool allows me to easily export off Last.fm my plays into a CSV: https://mainstream.ghan.nl/scrobbles.html

From here MySQL makes it super easy to load this in, with:

load data local infile '/home/nick/scrobbles-<...>.csv'
into table music_plays
fields terminated by ','
optionally enclosed by '"'
lines terminated by '\r\n'
ignore 1 lines
(@unixts,@dummy,artist,@dummy,album,@dummy,title,@dummy)
set dt = from_unixtime(@unixts);

This can then be run for whatever subsequent updates. select UNIX_TIMESTAMP(MAX(dt)) from music_plays; might be a handy query to avoid re-scraping everything with the above tool.

As an extension, I wanted to also have my local music library’s contents in another table, to perform joins against the play data for extended metadata (for now, only ’language’). (Later, I found that this isn’t perfect since sometimes Last.fm renames around things, though!)

My music player of choice on Windows in MusicBee, and the “Additional Tagging and Reporting Tools” plugin seems to get the job done: Tools -> Additional Tagging and Reporting Tools -> Library Reports.

From here I could choose the tags I wanted and output as a CSV too, and load that into my table in MySQL:

create table music (
	artist varchar(255),
	title varchar(255),
	album varchar(255),
	album_artist varchar(255),
	lang_tag char(5)
);
alter table music add primary key (artist,title,album);

load data local infile '/home/nick/track-list.csv'
into table music
fields terminated by ','
optionally enclosed by '"'
lines terminated by '\r\n'
ignore 1 lines
(artist,title,album,album_artist,@lang_tag)
set lang_tag=nullif(@lang_tag,'');

Now, as previously mentioned, not only do I have a local save of my play data from Last.fm, but also the ability to query into the data!

For example, what prompted me to do a fresh import (and subsequently reminded me to formalise this into a blog post), was that I noticed I broke 100k scrobbles the other day. But what was my 100,000th play? Easy, with MySQL! (note, 99999 since it’s 0-indexed with offset):

MariaDB [nick]> select * from music_plays order by dt asc limit 1 offset 99999;
+---------------------+---------+--------------+--------------+
| dt                  | artist  | title        | album        |
+---------------------+---------+--------------+--------------+
| 2023-07-09 20:03:47 | YOASOBI | アイドル     | アイドル     |
+---------------------+---------+--------------+--------------+

Ah, of course it’s YOASOBI’s IDOL, the song that’s stuck in my head after watching the anime for it, just as for everyone else who did…

Anyway, I’d love to do more with the data, but I’m just not very good at this / creative. Would be curious to see what others can do with their data though!

(As a note, I’m also backing up my Trakt data, for much of the same reason. Maybe I should also load it in to a database at some point too!)

TL;DR Windows Update kept screwing with my drivers – now it will never have the privilege of doing so again on any future setup of mine. Also my best friend is DDU (and it always has been).

Group Policy Setting:

gpedit.msc -> Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update.
    - Windows 11: -> Manage updates offered from Windows Update. Do not include drivers with Windows Updates: Enabled.
    - Windows 10: Do not include drivers with Windows Update: Enabled.

One-click .reg file - content below:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"ExcludeWUDriversInQualityUpdate"=dword:00000001

(also useful if you’re unfortunate enough to be on a ‘Home’ version; thanks to this great tool ‘GPS’ for the reference key, note I tested only on W10)

So I was working from home today and switching the display configs of my monitors between ‘Extend’ and ‘Second screen only’. Until upon doing so, would black screen my whole computer until a hard reset… what?

Upon coming back up, I would be thrown back to the Microsoft Basic Display driver with no second monitor anymore. In an attempt to fix this, I tried to install the latest, fresh drivers from AMD. It would say the install finished but there was some issue…

In Device Manager the GPU was then showing as disabled. Upon trying to re-enable, it would error out and an AMD dialog would come up saying so too.

Then it was time to try DDU. This did the trick as expected, and reinstalling the AMD driver again fixed everything.

… Only to happen again, twice! Then I noticed Windows Update was doing some driver changes.

(slightly ranty)

It seems that Windows kept trying to apply some AMD GPU driver version, only to keep ****ing my computer, where when I touched display settings it would completely break to a full black screen.

Honestly, it’s pretty insane that I had to nuke the driver with DDU to un**** it all and let everything install as usual again. Even worse, it even installed weirdly on my third un****-ing of it and I had to install twice.

I suspect this kept happening on switching driver settings as Windows Update was applying the driver in the background while I’m using the PC but wasn’t fully taking effect until I changed display settings.

WTF is Microsoft doing? Don’t touch my drivers, they’re key to standard operation. Particularly if it’s going to be applied during regular operation without a restart, and potentially ending up in a bad state.

Updates after initial publishing:

• 2025-01-27: Added Windows 10 gpedit location & 1-click registry location, given I stopped using Windows 11 too

I usually use an IKEv2 VPN to get back to some of my infrastructure (I know, WireGuard is usually easier to cut through firewalls, but IKE is native on mobile). However, the connection established and logs in just fine (logs on the other end see two-way communication), but traffic just wouldn’t flow. Wi-Fi Calling(!) also wasn’t working – I am acutely aware that this feature also relies on IPsec, so what’s the problem?

Well, after hours of research and trying many various firewall rules, it turned out to just be this:

# SSH into your router...
$ vi /etc/config/firewall

config defaults
    ...
    option flow_offloading '1'
    option flow_offloading_hw '0'

Then, reboot the router for good measure (required for me); or at least run /etc/init.d/firewall reload.

What does this do? It switches off Hardware Flow Offloading (but software is fine). You can switch both off, the important one is that the hardware acceleration is off, but I found my VPNs worked fine with software one on, and the network was slightly more performant. The GL.iNet interface’s “Hardware Acceleration” setting switches both these options off.

All along, it turned out that the hardware NAT (as far as I understand) was the problem! It was probably doing something “wrong” to my packets… but I don’t fully understand why. If anyone knows better, I would love to know :)

So, context. I’m going to keep it a habit to leave the rambly context at the end to avoid becoming one of those terrible cooking websites.

I was running the travel router in Double NAT – something that most people just say not to do, but seeing as I’m plugging my router into a public network, I’d prefer all my devices to live behind my own perimeter, in case I did want to expose something. Some hotels’ firewalls also block inter-device communication, and I sometimes like to copy things over Wi-Fi, so that proves very inconvenient. If I had a Chromecast I’d also want it to behind my own borders.

So, IPsec/Wi-Fi Calling – fairly important to me since it is useful to be reachable ‘domestically’ (my travel SIM here only supports data). And, as far as I understood NAT-T should do its job, even behind a double NAT. Putting the router into bridge mode also made it work right away, so something was definitely amiss. Researching for hours yielded nothing, until I looked for potential issues with VPNs, NAT, and not specifically OpenWRT. Hopefully this posts saves someones’ time!

Switching the HW flow offloading off allowed me to connect to my personal IKEv2 VPN and verify it was working correctly right away. It was hard to verify if Wi-Fi Calling was working though, since the phone would have tried many times to establish the connection, doing something to the router already with its finicky NAT-ing – which is why restarting the router was important too – I knew my VPN was working, but Wi-Fi calling just would not establish until restarting. It caused me to think something else was also wrong, only to apply the age-old “have you turned it off and on again” and find out that was the remedy.

For the Android users, some research about Wi-Fi Calling yielded that on pfSense, the UDP timeout may also have to be adjusted for Android (I only tested on iPhone) – for those who may need it, the net.netfilter.nf_conntrack_udp_timeout_stream sysctl option raised to 900 may prove useful (please let me know if it is or isn’t).

Hope this helps (and saves someone heaps of time)!

While it can be a great tool when required, and can enable cross-talk between native-land and web-land, this actually can be a con within itself. I came across a post by Felix Krause, detailing how this JavaScript capability can be abused.

Therefore, as part of my site being a very simple one, which should not having any JavaScript executing by itself, I realised I could employ a similar technique as Felix’s proof of concept website, and play a part in making users aware of potential privacy implications.

Give it a try – visit this website via the in-built browser on iOS Facebook Messenger, Instagram, and others – and you should see a warning like so (if the apps are still being pesky):

As mentioned in the reference post, it isn’t foolproof and can be worked around – but, I still think it’s a valuable step in raising awareness (but also for myself to check if some app is being a bad boy!).

Let this be a lesson to all of us to not trust in-app browsers on iOS! Use the ‘Open in Safari’ option whenever possible!

You can find a copy of the script in the assets folder of this site, and use it as a reference for your own if you’re interested on building something similar for your site – rest assured it is licensed under the usual BSD-2-Clause.

To Apple: please implement something like ‘app-bound domains’, i.e. whitelist of sites that an app can inject into.

To iOS app developers: please just use SFSafariViewController :(

Obtaining a programmer

Originally, I wanted to try using my Raspberry Pi 4 as the programmer, but then it randomly died… I’m still hoping it will revive itself, but starting to lose hope. Then, my friend bought a cheap Chinese CH341A programmer, which when tested, only outputted 5V :( – our-hardware-mods-inadequate-selves then tried to perform the 3.3V mod to no avail, breaking the board.

He then bought another one, but this time we did some research on buying one that wouldn’t need the mod. This did actually end up working nicely, and for reference, if you don’t want to perform the mod, be sure to buy a ‘blue board’ programmer. There will then be a jumper in one of the corners that lets you switch voltages!

Building coreboot

I didn’t want to use any pre-built image, so naturally I went with building my own. The process was quite simple – I used Greg Carcia’s post and Chuck Nemeth’s page as references throughout the process, thanks to them! Note that to make the process easier, I used my Debian build VM to build the firmware. At first, I tried using my Fedora dev VM, but I couldn’t figure out how to get the cross-toolchain working properly :(

# Used 'depth 1' for faster clone since we don't need history anyway
$ git clone --depth 1 --recursive https://review.coreboot.org/coreboot.git
$ cd coreboot

$ cd util/ifdtool
$ make

Then, we need a backup of the BIOS firmware first to continue.

Backup time

The X230 is different to the X220 in that it has two halves. As far as I understand, the top one is the one with the BIOS, and the bottom one has Intel ME and other stuff. We’ll need to read and flash to both though, to install coreboot but also wipe out Intel ME.

Be sure the battery and AC adapter are detached, then try hooking up the SOIC8 clip. It took a few tries to attach, but finally we got it…

# Attach to top chip
$ sudo flashrom -p ch341a_spi -r x230-top.bin
# Some options may come up. Try to read what's on the top of the chip - a torch + macro camera came in big here!
# (You can try to read some of it, and try to match up with the only possibly candidates as given by flashrom.)
# For me, it was:
$ sudo flashrom -p ch341a_spi -r x230-top.bin -c "MX25L3206E/MX25L3208E"

# Attach to bottom chip
$ sudo flashrom -p ch341a_spi -r x230-bottom.bin
# Same drill as above (they are different!); for me, it was:
$ sudo flashrom -p ch341a_spi -r x230-bottom.bin -c "MX25L6406E/MX25L6408E"

# Make up the complete dump (the usual format seems to be 'bottom+top')
cat x230-bottom.bin x230-top.bin > x230-dump.bin

Make sure to try dumping twice, and checking they are the same, e.g. by sha512sum – this is to ensure there was no weirdness while reading.

Then, be sure to keep these files safe in case of a brick, and/or to restore back to factory.

Finish building coreboot

(I’m pretty sure me_cleaner does not need to be done separately now, given the option in the main coreboot build.)

We’ll now need to extract out the needed modules from the flash dumps, and put them in the right spot.

$ cd util/ifdtool
$ ./ifdtool -x ~/x230-dump.bin

$ cd ../../
$ mkdir -p 3rdparty/blobs/mainboard/lenovo/x230
$ cd 3rdparty/blobs/mainboard/lenovo/x220
$ cp ~/coreboot/util/ifdtool/*.bin .

$ mv flashregion_0_flashdescriptor.bin descriptor.bin
$ mv flashregion_1_bios.bin bios.bin
$ mv flashregion_2_intel_me.bin me.bin
$ mv flashregion_3_gbe.bin gbe.bin

$ cd ~/coreboot
$ make nconfig

A neat little menu should now pop up, and we can customise to our heart’s content. The settings I changed were:

• Mainboard
  • Mainboard vendor: Lenovo
  • Mainboard model: ThinkPad X230
  • Size of CBFS filesystem in ROM: 0x200000
    • NOTE: This was boosted up as I wanted to use UEFI boot via TianoCore; probably leave it as 0x100000 for SeaBIOS
• Chipset
  • Add Intel descriptor.bin file
  • Add Intel ME/TXE firmware
    • Verify the integrity of the supplied ME-TXE firmware
  • Strip down the Intel ME/TXE firmware
  • Add gigabit ethernet firmware
• Devices
  • Display
    • Framebuffer mode: Linear “high-resolution” framebuffer
• Generic Drivers
  • PS/2 keyboard init
• Payload
  • Add a payload: Tianocore payload
    • NOTE: This was for UEFI; can just use SeaBIOS for good old BIOS boot
  • Tianocore payload: CorebootPayload
    • NOTE: Be sure to choose CorebootPayload!! UEFIPayload doesn’t work.
    • I spent so long wondering why my X230 was bricked - turns out UEFIPayload does not support older devices like the X230; you have to use the older, unmaintained CorebootPayload (unfortunately) if you want UEFI.
  • Secondary Payloads
    • Load coreinfo
    • Load nvramcui

Then just Save -> Exit and make away!

Since we are dealing with the X230, after it finishes building you’ll need to split it back into the ’top’ and ‘bottom’ bits.

$ cp coreboot/build/coreboot.rom x230-coreboot.bin
$ dd if=x230-coreboot.bin of=x230-coreboot-bottom.bin bs=1M count=8
$ dd if=x230-coreboot.bin of=x230-coreboot-top.bin bs=1M skip=8

Flash time

With that out of the way, all that was left to do was to perform the flash.

# Attach to bottom chip (note chip model as before)
$ sudo flashrom -p ch341a_spi -w x230-coreboot-bottom.bin -c "MX25L6406E/MX25L6408E"
# Attach to top chip (note chip model as before)
$ sudo flashrom -p ch341a_spi -w x230-coreboot-top.bin -c "MX25L3206E/MX25L3208E"

…and if all went well, power up and it should work! (except as I mentioned above, it didn’t for me at first because of TianoCore)

Hooray!

…

At the time of flashing, I insisted on UEFI since there was discussion in the Fedora community about deprecating BIOS. However, that may not be the case for a while longer, so I might try SeaBIOS – my friend is using SeaBIOS and it just boots so damn quickly.

As an added bonus, I wanted to add in that I wanted to use my spare X220i to practice flashing first… but it had the style of BIOS chip that we didn’t know how to attach properly to (the ’legs’ were tiny).

Luckily, my friend’s X220i didn’t have this issue. If anyone knows how to attach to these easily, please do let me know! :)

Setup was pretty straight-forward in OPNsense, setting up the GIF interface as documented. However, then I faced a pretty weird issue.

The tunnel only seemed to be half working(?) – I could ping ipv6.google.com, but couldn’t ping anything else (or sometimes, it might have gone through with massive packet loss). This sort of weird behaviour is always so hard to debug…

But, after some reading, here’s the fix:

1. In OPNsense, configure the IPv6 tunnel interface MTU as something suitable, e.g. I use 1452 and it seems to work well
   • I read that the PPP header is 8 bytes, then the IPv4 header is 20 bytes, so this should be subtracted to make room
   • From my understanding, it then makes sense that the encapsulated IPv6 traffic must fit inside the transmission unit used for PPPoE. TPG’s MTU is 1480, and when checking the MTU used for HE, it was also 1480…
2. Update the MTU in the HE tunnel ‘Advanced’ area
   • I missed this step and was wondering why it still didn’t work (or rather, why it seemed to only work one way/weirdly)

Pretty simple, but it still feels like documentation/knowledge in this area is still rather hard to navigate. If I run into anything else in this space I’ll be sure to post it up here!

After this, it was all pretty smooth-sailing to complete my IPv6 certification to ‘Sage’ level on HE :D (will update on if I get that t-shirt :P)

But, I found out that you can just test your scripts/projects quite easily with your user account credentials:

1. Install the gcloud CLI: https://cloud.google.com/sdk/docs/install
2. Login to GCP in the CLI with gcloud auth application-default login
   • This will provide you with application-default credentials once authenticated, i.e. a JSON file similar to a service account’s one, but is automatically picked up by SDK libraries
3. Ensure the project ID is set…
   • export GCLOUD_PROJECT=<your GCP project ID>
   • Or, make sure it is defined in your script, e.g. new BigQuery({ projectId: '<your GCP project ID>' })
   • (You may prefer the first option if in the production environment, you just want it to pick up the project ID by default and not hard-code it in the script)
4. That’s it!
   • Node.js libraries such as @google-cloud/bigquery should authenticate with your user access
   • It also works in other languages’ libraries such as ones in Ruby

This is pretty simple to do, but the third step above had me stumped for longer than I’d like to admit. The process of signing in with ‘application-default credentials’ is also quite verbose in the official documentation and isn’t clear (at least to me) that this is what it does – hopefully this saves someone some time.

As common sense, this should not be used in production, but is very useful in testing or one-off manually executed scripts – be very careful if your regular user account has a lot of permissions though. Be sure to still test with a service account before deploying to ensure it has the right access.

Let me know if this approach is really bad and shouldn’t be used, though – I’m still a big noob at this. Otherwise, enjoy!

Indeed, it was already quite easy, with GitHub Pages doing the heavy lifting. But as I was redesigning the page, as easy Jekyll was to use, it felt a bit slow and I just didn’t feel like that was the last static site generator I would use. Hugo seemed like a good choice, with it being written in Go and highly recommended around the web.

So once that was sorted, I needed a new host, since GitHub Pages only supported Jekyll (not sure if I could’ve used GitHub’s CI, but anyway). Eventually, I landed on Cloudflare Pages. I already use Cloudflare for DNS, so I guess it made sense to just try it out. As a side bonus, they have a pretty cool subdomain if you don’t already have a domain name, in the format *.pages.dev – obviously I already have a domain name, but still pretty neat in my opinion anyway!

Once I had done the grunt work of learning the Go templating syntax and fought with Hugo for a bit to port over the site just how I wanted it, I was good to deploy. Cloudflare Pages is able to directly hook into my GitHub repo and just build the website on each push to the master branch which is quite convenient. However, I came across a problem on the first build:

Scrolling up revealed that it was running Hugo 0.54.0, and I noticed my local version was 0.88.1 – so upon setting the HUGO_VERSION environment variable to 0.92.2, the latest version, everything was fixed! Not sure why Cloudflare Pages defaults to an older version (maybe since a version after breaks older pages?), but apart from this one hurdle, it was really very easy to deploy!

Oh, and for a blog this small (only 6 posts at the time of writing), I think this command output sums up my gripes with Jekyll:

nick@angel:/d/Dev/personal-web » time hugo >/dev/null

real    0m0.202s
user    0m0.000s
sys     0m0.015s
nick@angel:/d/Dev/personal-web » git checkout 2022-jekyll
Switched to branch '2022-jekyll'
Your branch is up to date with 'origin/2022-jekyll'.
nick@angel:/d/Dev/personal-web » time bundle exec jekyll build >/dev/null

real    0m9.454s
user    0m0.000s
sys     0m0.031s

To be clear, Jekyll did report about 4 seconds to build the pages once it was actually generating (not including the time for Ruby bundle to start up). However, just for putting some HTML bits-and-pieces together, that is way too long!

Ruby also was a bit more of a pain to setup on Windows – I know, why am I still here, but I think it’s still worth mentioning. Hugo was really easy and lighter to setup, especially since I used Chocolatey. While building the website, Hugo also came with hot-reloading out-of-the-box with the hugo serve server, which was a very welcome surprise.

I’m quite happy with the results so far, let’s see how it works out in the long run!

(Apart from the keyboard, there’s a few Genshin Impact-themed items and my mouse of choice, the Logitech MX Vertical. The deskmat is a relatively new addition, and is a custom print of this deskmat graphic from Reddit – thanks /u/jeryco25 for an awesome design!)

Using the board

It took me about 2 weeks to really get comfortable, but since the keyboard basically has all the letters and numbers in a QWERTY layout, the hardest part was adjusting to the “columnar staggered” linear layout, and (to a lesser extent) the missing symbols. But after a little bit, it actually turned out to be quite comfy, with the symbols actually being easier to type since I didn’t have to reach anymore – just use a function layer!

Before using this keyboard, I used to never type properly. I learnt typing through playing games! My left hand would just hover around WASD, and I would somehow type at up to 120WPM like that. Due to the staggered layout, it feels as if this board forces me to type properly – but it’s a good thing! Feels like it’s better for my hands, and I’m able to type at the same WPM as before :D.

About building the board…

Just like this blog post, I had put off actually building the keyboard for a while… the original plan was to lube the switches, but I decided to forget that and just build the damn thing so I could use it. In hindsight, I really should have at least make the switches hotswappable so I can test other switches/lube the switches later, but what’s done is done now (resoldering time??).

This project was my first real foray into hardware and any sort of ‘proper’ soldering, and I have to say it was simultaneously easy, but hard at the same time. I really didn’t want to mess any of my components up, and despite my crappy soldering skills, I’m happy to report the keys are still working (I’m using them to type up this post!).

Tenting?

Another thing with split keyboards in terms of ergonomics that I wanted to try out was tenting, i.e. tilting the keyboard up in the centre, to have it more angled to my hands. Funnily enough, I came across this post about tenting on a budget on Reddit.

For now, it’s suprisingly effective and cheap: the keyboard is already put together with brass standoffs, so all I needed was more of them. If you look carefully at the image above, you’ll see there are more standoffs towards the centre.

The only issue with this setup is the keyboard can slide around on the desk without a deskmat. Luckily I got one just before building this keyboard, so it’s a non-issue for now. On the outer sides though, I have put some 3M rubber feet on them, and I’m yet to put some heatshrink on the inner brass standoff ‘feet’ to have more friction (as suggested by the Reddit thread OP). I believe that should stop the sliding-around problem on smoother services.

Technical setup

The keyboard comes with the amazing QMK Firmware, which basically allows limitless customisation of the keyboard through C code. However, in the initial stage where I’m trying to figure out the layout I like, this turns out to be quite the annoyance, particularly when I’m on Windows and setting up the whole toolchain is a real pain.

That’s where VIA comes in. This was such a blessing in those intial stages, as all I had to do was use the VIA utility to update bindings, rather than having to flash the microcontroller every time. All I needed was the VIA-compatible QMK firmware flashed.

A note here!: remember to backup the VIA config before flashing a new QMK firmware… otherwise it sometimes forgets the config. I’m not sure when this happens, but it seems inconsistent – better to be safe than sorry!

So talking about flashing, the easiest way I found was to just reuse a Debian VM I already had setup last time for the fresh tomatoes stuff. What’s nice, however, is I can setup a USB filter in VirtualBox for just the microcontroller DFU mode – that way, the keyboard HID device is attached to my Windows for regular typing, but when I reboot the keyboard into flashing mode, it automatically goes over to the VM, ready to be flashed! Then when flashing is done, the keyboard automagically comes back to the host.

But also as it turns out, since we still have the QMK firmware underneath, we can customise more things under the hood, such as the virtual mouse and its acceleration. The only drawback is VIA uses up quite a bit of the microcontroller ROM space – so we can’t have all the additional QMK nice things enabled. But now after 6 months, I haven’t touched my keyboard layers in ages, so I might migrate over to a static C QMK config some time (but sometimes it still is nice to customise a layer on-the-fly for games…).

A copy of my VIA config can be found here: https://gist.github.com/nicholastay/af6cf94917634ba71823f3f49223454b. My customised VIA-compatible QMK firmware can be found it my fork, here: https://github.com/nicholastay/qmk_firmware.

To be honest, I’ve been meaning to write some more posts about some of the random bits and pieces I found when working on various things, both at work and personally. I do have a list of things to write up about! But, I guess I hold myself to too high of a standard, and don’t really want to write blog posts that are too short and don’t ‘properly’ convey a point. I’ll work towards putting that aside and posting more this year – more to come (hopefully).

So, why the redesign? Well, I was always pretty unhappy with the homepage. As I was shifting more towards a simplistic, more document-like website, which is viewable as a page (not as a design piece(?)), the more I really didn’t like the vertical and horizontal centred div element. Now I’m a lot happier, and we are back to a light theme (haha). On the Jekyll side, I’ve also consolidated all of the site into one nice, neat layout – hooray! Again, I am just leveraging it as a simple templating system that works on GitHub Pages – I just need something to copy and paste repetitive elements for me.

As for the layout and design, I was inspired by David Malan’s website and Drew DeVault’s blog. Just a plain layout, with a navigation-sort-of static bit on the left, and the content on the right. I am no UX designer, so coming up with my own novel ideas is not my field, but I have to say I’m pretty happy with the result. If there are any accessibility issues though, please let me know! I would love to improve this area; it is actually a goal of mine to ensure it is so – half so more people can access the page easily, but it also is fun to remain fully compatible!

On the compatible part… this is why I love just keeping it simple. All too many times, especially for a simple portfolio*-ish* page like this, we’re pulling in React, Vue, etc. That isn’t my intention and I love quick, snappy pages that get to the point and just load. Hey, this website is perfectly usable on a text-based browser, look!:

Pretty awesome, right? Well, here it is on Windows 98 SE, Internet Explorer (not perfect, but very usable):

…and also on a Nintendo 3DS (yeah, I know this is actually decently modern, lol):

Hope you enjoyed those glimpses into my irrational obsession with keeping my website accessible on almost anything. I am looking into Gemini and/or Gopher, and will see if I can use Jekyll to auto-generate these posts on there too – I think it’d be pretty neat just as an alternative protocol, because what even is the web in 2022? (I think I’m just sick of the Wéb-Three talk everywhere… :< look I’m trying to avoid mentioning it just in case…)

Anyways, I’ll really be trying to post more this year!

Background

I’ve always wanted to try a modded firmware router, but it seemed like I never had the right model – we would always just have some random model that we got for cheap from a store, or whatever the ISP gave. When I came across a video on YouTube about custom firmwares, I got reminded of this and decided to check out the one featured in that video: FreshTomato.

When I checked out their supported routers, what interested me was that some Belkin routers were supported – I happened to have a Belkin N300 router lying around. However, it’s an old modem/router combo, from my ADSL2 days…

From a quick search around online, it seemed like usually modem/router combos weren’t supported – but I felt no reason for this, and I could just repurpose one of the ports as the WAN, given I just wanted to use this as just a router now (for fun only - I’ve got an ISP-provided ac router and even an OPNsense VM).

Fresh Tomato?

So I saw that the Belkin F7D3302v1 was supported – it looked similar, and apparently had the same Broadcom BCM4718 SoC inside.

However, upon downloading the F7D3302 firmware, it wouldn’t flash. Didn’t think it’d be this easy. The Belkin upload screen would instantly fail and not even try to flash, so it must be some sort of signature issue.

Looks like I had to get a dev environment up. I spun up a Debian VM, grabbed the MIPS repo for FreshTomato and followed the instructions as given by the dev: https://bitbucket.org/pedro311/freshtomato-mips/

First attempt

Having a quick poke around, it seemed to me the right ‘release’ to use was the src-rt one, as the TRX_MAGIC_ definitions were in src-rt/include/trxhdr.h.

Looking at the Makefile, it seemed like the ‘TRX magic’ bytes were what I needed for the F7D3402. Hmm, how to figure this one out…

Luckily, I had found an old blog post regarding some hacking being done on the F7D3402 by DDS Central. They detailed some patches they had applied to the kernel, swapping out the TRX_MAGIC value for 0x00017517. Great, this is what I needed

So I found the line for F7D3302 in the Makefile, and added in this value for another image. It also seemed like the r2f make profile was the right one as it built Belkin images, so I gave that a shot.

…and, it did flash… but then the device was stuck and bricked.

CFE to the rescue

So I tried the 30/30/30 (hold reset 30s, 30s off, 30s on with button pressed) to no avail… admittedly I should have tried this first to ensure I have a recovery mode.

But, then I decided to try the same with the WPS button on the front, and it worked! I was able to connect over HTTP to 192.168.2.1, and the CFE mini server appeared to allow me to flash a binary again.

More digging

grep --include=\*.c --include=\*.h -Ri F7D3302

My first thing to try was to check anywhere in the source that the F7D3302 could be referenced, and probably update those to be able to use the F7D3402.

After a bit of searching around on Bitbucket (to make it quicker to click around commits), I noticed there was another branch, mips-RT-AC. In the src-rt folder here, there seemed to be a specific build profile for f7d, as well as more features enabled – I decided to work on this branch instead.

Patching the code

Needless to say, this was a tedious process for me, given my inexperience here and just throwing things at the wall and seeing what sticks. This honestly took a while due to this, and it’s probably pretty self-explanatory with the patch at the end of this post.

When I flashed the first working build, had the 5 minute wait, and then the LED lit up orange… I guess that’s the moment we all do this for. But then it was identified as a Belkin F5D8235-4 v3… I must have messed up the code somewhere, and one of the ports showed up as active – must be that file with the ‘vlan ports’ set wrong.

Turns out the boardrev wasn’t the same as the F7D3302, but the F5D8235-4 v3, 1100. Once that was fixed, it identified itself properly, and everywhere which used the MODEL_F7D3402 enum value to check for the model worked properly.

Points/caveats

A few interesting things/things I haven’t been able to figure out (I’ll probably edit this as I find more):

• 4 LAN ports still show up, but I’ve reassigned one of them to be WAN.
  • WAN port is the top port, just under the RJ11 jack (I had actually got lucky when changing the vlan port settings, that ‘3’ happened to be the top one, which is what I wanted).
  • LAN0-2 are the next three, top to bottom.
• 5GHz doesn’t work. The interface doesn’t even show up in SSH.

Patch

So all my work up to now can be applied with the following patch. Note I had worked on top of commit 069046ba70465c6bb91a3b870629b9d3223419c9, and the patch file is in git format-patch format, with my working steps.

Patch: fresh-tomato-f7d3402.patch

Over the weekend I decided to play around with an old MacBook Air I still had lying around – it’s a 13" mid-2011 model. But it still does run well! It was on High Sierra (10.13) though, and unfortunately that’s the last supported version on it. Not to worry though, the Mojave Patcher exists, so I decided to give it a try and it is working pretty great so far on this model. There seems to be more issues with Catalina though, so I’m happy to just settle with 10.14 for now. I also get to use the App Store version of WireGuard which makes things easier (I use it to connect back to my homelab with personal internal services).

On to the topic in the post title: FileVault. This is my first time trying out FileVault – only fairly recently had I looked into encrypting all the things at rest, including setting up LUKS on my Linux machines. It really is great how simple it is to enable, and given you have hardware acceleration for encryption standards (which you should), there really is no real reason not to have it on, especially on a laptop that you may lose out in the wild. (Although, I’m making this point as the Celeron 847 in the ThinkPad X220i doesn’t even have AVX and LUKS can add a bit of slowdown to boot and general usage.)

Coming from this background of LUKS, I liked having a separate, stronger key to decrypt the system on boot, then have a slightly weaker password for general usage (lock screen, sudo). I know, probably not the best practice, but FileVault not having such an option and insisting on synchronising passwords with main user accounts kinda sucked. I was able to put together a workaround however, with bits and pieces of information around the webs.

So here we go, how to have a separate password for FileVault (assuming it is already enabled, and there is only one user on the system):

1. Create a “Sharing Only” user for decryption purposes. I named mine “FDE Login” with the username “fdeuser”. The password set here will be the one used when turning on the Mac.
   • Side note: We use a “Sharing Only” account so it will not show up as a user on the Mac on the login screen. On a technical level its shell is restricted and has no home directory (/dev/null).
2. Add in the account to FileVault with the terminal command: sudo fdesetup add -usertooadd fdeuser.
3. Enter your main user (’nick’ here) credentials (username, then password).
4. Then, enter in the decryption user’s password.
5. Now we will remove the main user from FileVault: sudo fdesetup remove -user nick.
   • You probably can remove more users with this step if there are more.
6. Verify the only user is the “fdeuser” with: sudo fdesetup list.
7. On a reboot, the only user that comes up on FileVault should be the new “FDE Login” user, then you should be brought to the standard login screen after entering the password.

And that’s it! As a note, the recovery key you got when enabling FileVault should still work should it ever be required.

I wanted a balance between a light, simple HTML page, but also convenience in updating this website with my hosting of choice – GitHub Pages. Conveniently, GitHub can automatically build Jekyll pages on push, so I decided to check it out, using custom layouts for the first time (I had used full-on Jekyll templates before, but it just feels a little, heavy?).

It turns out that you can simply write HTML pages, not only Markdown posts, and simply weave in those ‘moustache’ clauses to mix in dynamic content at build time, which is exactly what I wanted.

A primary goal of mine with this site is to keep it slim and usable – no heavy JavaScript frameworks, just simple ones where needed, and some CSS. Even if JavaScript is disabled, the site should still function perfectly, just with some reduced ’nice’ features, such as the translation on the front page. Heck, I’ve even made this website usable with a text-based browser (hopefully!), so feel free to give that a try!

So now we’re here! Hopefully I post more in the future… but we’ll see.