This is a 3 port router. Each port handles 1 Gigabits of traffic. It’s perfect for connecting your ISP with your LAN with a spare port left over. This is a router for technical people, it’s not for others as the setup is tricky. The Web UI is very dated but functional. It’s good enough to get things going. For more exotic things like say a VPN you need to use the command line and use the custom configuration tool.

Internally the CPU is a dual MIPS64 Cavium Octeon with 512Mb RAM and more importantly a removable USB drive which houses the OS. Which means we can put any OS on we want :) I had a lot of fun working on NetBSD with this, making things tick for MIPS64 and the exotic 64-bit kernel with 32-bit userland compat gunk.

But as a performance router, anything other than the stock OS is a bad choice as you then forgo Hardware Offloading which is a massive hit. I get 200mbs down with my ISP, but with NetBSD I was only getting about 80mbs. You have been warned.

So anyway, it died. I was sad. No shop sold a new ERLite either! I replaced it with a Unify Security Gateway which ironically enough is the same hardware as the ERLite, just in a different casing.

The USG is the one with the bright blue square at the top. And yes, my cable management is lacking!

The big difference between the ERLite and the USG is the software. The ERLite runs EdgeOS you need to configure it on the router directly. The USG needs to be setup by a Unify Controller which is a Java application that can be hosted anywhere. I of course host mine on my NetBSD server! You can also use a smartphone application as a controller or even better - talk to your existing one so you don’t leave the sofa. Now, you only need the controller for setup, you don’t need to leave it running all the time unless you’re interested in collecting metrics of your network over time.

I already used the controller to manage my UAP-AC-Pro for quite a while so I’m quite used to it. The Web UI is always being improved and it’s the most reliable Wireless Access Point I’ve ever had. Once you use this, nothing else will simply do! For reliable home use anyway. I can play football with the kids on the common land next to my house and still enjoy good wireless!

Anyway, the USG integrates with this. First off the bat, don’t use the beta interface. Unlike the UAP, the USG setup is poor here as the firewall setup is in two places which is odd. Also, there is an issue setting up IPv6 with a tunnel related to the firewall. Using the classic setup with the v6 controller you can do pretty much all this aside from the tunnel.

As on the ERLite, my IPv6 tunnel needs to be setup on the commandline. This time around, I used a provisioning script to setup the tunnel AND the needed parts in the firewall for it just incase I use the beta screens again.

Coupling the USG with the Unify 8-Port Managed Gigabit Switch and my UAP-AC-Pro wireless point I get nice metrics on the Unify Controller about the state of my network. And I do like a good network :)

But what about the performance? Well, here’s the interesting part. Even though it’s the same hardware I consistently hit my ISP limits a lot more than with the ERLite. I would like to think it’s due the the software it runs as it’s different, but it’s also likely to be some configuration issue on my part. Or it could have been a sign that the ERLite was already failing somehow. Either way, I’m very very happy with this!

Now, this is not a cheap setup. However, because I self host, I cannot use my ISP’s router. So this is my solution, mainly due to being burned with useless access poinst over the years and I just went with Ubiquiti from there. The company itself basically sells near enterprise level devices at SOHO prices making itself very attractive to people like me.

Why change?

Well, don’t get me wrong, vuepress is a great product for what it is. I generally like the Vue.js framework over the others. If you recall, I changed from Grav to vuepress back at the start of last year

However, the vuepress blog plugin is not really that easy to setup, configure and get going. It’s also not easy to maintain when the tree of plugins breaks. That’s the thing with complex stuff - one small part breaks and it all falls down.

And this is the reason - a plugin the plugin used broke. It didn’t upgrade. My fault for using NetBSD I know. I did sort of manage to get it working, but the site on my mobile phone showed the desktop view which made me mad. Tried to upgrade it, no dice. A this point, I figured I should look around and see if there’s anything easier and voila. Here we are.

What makes this better?

Well, unlike vuepress, Hugo is in pkgsrc which makes it a snap to install on NetBSD. Yes, there is sometimes a large lag between updates in pkgsrc to Hugo which is why I ruled it out when I changed to vuepress a few years ago as the pkgsrc version was too old for the themes I wanted. Technically this was because the pkgsrc golang infrastructure was quite new and not up to it I think.

It’s also a lot faster to build the site on my server, by several orders of magnitude. Speed is always important.

Are you done yet?

I’m an engineer! It’s never done, it can always be improved! There are some things I don’t like about Geekblog and Geekdoc. Both seem to get frequent changes, so hopefully they can be resolved soon. The Projects and About Me links are temporary as they don’t belong in the tag cloud.

I also need to edit my old blog posts and fix the links where I can. If you see a broken link, please let me know!

Sadly, I seem to have lost a lot of pictures from Grav. I thought I had them all backed up, but I’ve since re-used the disk. Also, a lot date to before I used a smart phone to take pictures which are now auto magically backed up to the cloud. A real shame, good memories lost.

I’ve recently purchased an AMD 2600x which I’ve fitted out with 32GB RAM. This will be my new developer machine (not to self, NOT to use for gaming), but I need the 512GB SSD from the old server for this one. As I have a few spare 120GB SSDs, I decided to downgrade!

In the process I decided to try out ZFS as it was recently improved quite a bit in NetBSD. Turned out there were still a few bugs to iron out, but I worked out a way to have Root On ZFS. With lz4 compression enabled, the space savings for my usage are huge! I’m really pleased with ZFS, it seems a lot better than using LVM + FFS + WAPBL.

Taking advantage of a new disk, all the software is very uptodate as well, and required some curses changes so I could try a few other things out…. but more on that later!

Internally, Grav uses markdown files to store the user pages using frontmatter to store meta-data such as tags, publication date, etc. It seems that a log of blog and cms systems use this of late as it entirely removes the need for a database and isn’t that hard to pickup.

What went wrong?

Well, every time you login to the Grav admin page it checks for updates and casually lets you know there’s an upgrade via a popup. It also checks all installed modules as well. It makes upgrading painless ….. except when it goes wrong. Basically Grav complained about the gateway timing out via a popup.

Oh dear!

Refresh the page and boom, presented with a Please run bin/grav install banner on a white screen.

Okay…. this might have been a harmless timeout. So I login via ssh, goto the needed directory and run the installer and I see many errors like so: tls_process_server_certificate:certificate verify failed.

This is because, like all systems today, Grav uses many 3rd party things and downloads them from other sites. Why this suddenly started happening recently I don’t know- I’ve not updated my server at all.

To be clear, this isn’t Grav’s fault or error- the failure is somewhere in PHP, OpenSSL or the website in questions HTTPS configuration.

What can be done about it?

It’s possible to fix it for sure, but maybe this is the wrong approach. The vast majority of my site does not accept any data and Static Site Generators have come a long way since I last looked at them. The idea being that a static site has zero runtime dependencies so it’s always working. The downside being it can still go wrong as can any other application but you, the end user, does not see this. The other downside is that they build a lot of files and this takes time.

All of them seem to use Markdown and Frontmatter like Grav as their data storage so in theory it should be fairly simple to install some and try them out.

I settled on VuePress mainly because I use Vue.js on a side project I’m working on. VuePress is mainly for documentation though (ie, perfect for my open source projects) but as it turns out isn’t that great for blogs! Luckily there is a blog plugin, but the the downside is that you need to set it up as a different site. Thanks to too much cleverness in VuePress, my blog link looks like an external site which I’m not overly keen on. Also, the blog insits on using the date in URLs which I’m not too sure about either.

But it’s a start, it’s up and working and renders really well on mobile devices. Let’s see how long this lasts :)

The Good

Phabricator is written in PHP which means I don’t have to install Yet Another Framework. I use quite a few things that depend on PHP on this site already, such as Grav and RoundCube. So of course, it allows me to self host. Or you can rent a Phabricator VPS @ Phacility.

The sign up process (to my Phabricator instance, not somewhere else) is very straight-forward, allowing email/password with ReCaptha or use a OAuth2 provider such as Google. So this is very socially acceptable and should be secure from spambots.

The core work is based around the ease of code auditing and review of patches. There is even a pastebin so users can upload config files and logs for analysis. Doing all this in a mailing list over the years results in things being here, there and everywhere …. and then expiring. Having it all centralised means nothing is lost. But more importantly, it’s much easier to look at and work with, so this is a massive quality of life improvement.

Tickets (or tasks in Phabricator) very user friendly, showing a collapsable history with full links to related objects such as commits, reviews, logs, etc. Infact the linking is extremely easy, one can reference some more of the popular objects by using a single letter follows by the id. Such as T1. Tickets can be related to one or more Projects and in turn Projects can display Tasks on a KanBan Board.

Phabricator can host your code in your SCM of choice for you and defaults to not allowing destructive changesets by default which saves me from messing around with custom hooks. This allows the same feature as Fossil’s immutable history on the server- you can do what you like to your own clone still.

It’s fast! No, it’s not as fast as Fossil, but it’s still more than fast enough especially when you consider the extra toys you get- syntax highlighting, desktop notifications (on supported browsers, which is most recent ones), user icons, in-depth tooltips. It’s certainly faster than other solutions I’ve looked at recently and bar Fossil, probably the fastest.

You get a chat room (does require a NodeJS server on the host for automatic updates though it seems) and a wiki. I still use IRC on FreeNode, but the advantage here is that this is web based and persistent so you don’t loose anything if you get disconnected. Still, unsure how useful either be as I don’t recall users editing any publically editable wiki pages I’ve had over the years- are my man pages really that good? Heh.

The Bad

Phabricator is written in PHP. Now I did say that was a good thing earlier, but it’s a double edged sword. PHP does have a bad reputation for both security and language structure. I would argue that this is no different from how C is today. This is also bad, because my site ran on PHP-7.0 and that was soooo much faster than earlier versions it was silly. But Phabricator didn’t support PHP-7 until PHP-7.1 in early Feb this year. Something to think about for long term support, but this equally applies to other languages, especially the Python-2 vs Python-3 issue as my box has two Python versions due mainly to certbot needing Python-2.7

Phabricator requires MySQL (I installed MariaDB, the fork from MySql). I was very happy with PostgreSQL but my box does not have the resources to run both. Pretty much all other software I use allows the choice of DB, so this actually took me by surprise. And just like the PHP reaction others have, I was concerned by using MySQL, but as I’m not really into being a DBA I’m quite happy with MySQL so far.

The linking is really bad for DHCP, because we always talk about T1 and T2 as timers. This is important, because my main product is of course dhcpcd. In Phabricator T1 and T2 are shorthand to link to Task 1 and Task 2. You can fix this by stopping Phabricator from linking via a matchig regex, but I quite like the ease of use and solved the problem via changing the AUTO_INCREMENT value in some tables from 1 to 101. This reduces the potential collision with other things, such as Z1 and allows the same workflow. Upstream rejected my change and even went as far as to remove me posting my fix if anyone else has the same issue claiming this would make support hard. As it turns out, something with my change isn’t quite right- either Phabricator or MySQL resets the AUTO_INCREMENT value. I don’t know which one, or what action I did or if it’s a general Garbage Collection going on. This could be why they didn’t like the change, but heh ho most of the important tables now have values in at 101 and higher so it shouldn’t be a problem anymore.

The Continuous Integration support is limiting, but it is there. Apparently you can at least call out to Jenkins or BuildBot.

Because Phabricator is based on and developed in a DevOps fashion, there is practically no support for managed releases or milestones. This isn’t a problem for me as such, but I would like a feature to track important things that went into a release better.

The Ugly

Phabricator is NOT ugly. It’s quite visually appealing. However, it is quite possibly the most complex installation I’ve ever done as it uses many databases and as many configuration options as sysctl on a good BSD. This wasn’t helped by running on NetBSD-current and a gcc built PHP with Phabricator just didn’t work and I spent a long time working out why. My fix was to build everthing with clang which required a lot of personal effort from me at the time due to the recent UEFI booting support breaking the build and a the new clang-4 compiler not working with the NetBSD build knobs I was using. On the plus side, the Phabricator docmentation is good and about 95% of the issues I had were easily searchable on StackOverflow or the (mostly) friendly Phabricator community helped me out in their chat channel- which oddly enough is also a Phabricator application.

Phabricator workflow with more than one dev, or the best way of submitting patches, is to use the Arcanist tool. They admit it’s not great and things should be manageable directly through the SCM. We’ll see how that progresses. In the meantime, posting patches to the Differential application is quite easy and allows easy patch review.

I had to stop using Fossil because Fossil is more than just a SCM, it strives to be a complete one stop solution. Obviously that won’t work for the desire to use Phabricator for all the good reasons, so I needed to pick a SCM to use. Luckily Phabricator quite a few- GIT, Mercurial and SVN.

But what about the source code control?

It’s importance cannot be understated- the code is everything, the history of the code is everything. This has been known since the dawn of time. At this point though, the SCM just becomes a tool in the box, just like sed.

Eh what?

Every SCM solution out there has pretty much the same set of basic features you need- atomic checkins (ok, CVS lacks this), changesets, branching, tagging. That’s all you pretty much need at a basic level- the rest of the features are predominently driven by workflow.

Tools exist to export data from one to the other, and tools are being created to allow a more transparent bridge again making the choice of SCM even less important than it was before. The only real issue is the importance of meta data that has no place-holder in the other SCM you want to use. A good example of this would git the Author vs Commiter git attribute on the commit.

Then, you need to understand that the SCM is only for developers. End users don’t care a hoot about it. What they do care about is an easy to use system which handles the lifetime of their issue where dicussion, patches, logs, reviews and audits can happen. Hopefully they can even get a fixed build at the end. This is basically part of Application Lifecycle Management.

So, I can ping the router but nothing else as I don’t have a public IPv6 IP address. No address via RA, no reply from my DHCPv6 solicitations- which is odd as the router says I can get a managed address and other information. Maybe they have yet to turn that part on? Please, turn it on soon Virgin!

So I shopped around and found Rspamd. For my needs it sounded wonderful- no more need for MySQL (it’s a hard dependency of OpenDMARC) as I much prefer PostgreSQL. SPF, DKIM and DMARC all integrated. Written in C and LUA which is a massive improvement over Perl and Python. Also sports a shiny Web UI to monitor the server and do basic config. Speaking of config, it’s still not entirely easy, but it’s much easier than configuring the stack I used to have! I did have to patch the build so that it works with OpenSSL-1.1 which is now in pkgsrc. All in all, I anticpated a nice memory reduction once I had it all configured. So far it’s using about 200Mb less memory, but it’s early days. How much better or worse than SA it is at actual spam filtering remains to be seem, but I have high hopes.

While here, I also replaced procmail with PigeonHole. I didn’t really need to do this, but I thought “As I’m here…..”. Actually the end result is much nicer as I now only have one Spam folder instead of another two Spam folders for training ham and spam. I just need to hook this final part into how I manage spam on my mlmmj email lists.

Nice error. Googling for it doesn’t reveal much on how to fix it. The good news is that I only use MySQL for Phabricator and PostreSQL for everything else. The bad news is that my Phabricator instance is no longer working. The worse news is that I get the same error when trying to use backups, so there must be something else in play here.

Ideas on how to resolve this are welcome!

• BSD license.
• One binary, easy installation, very low maintainence cost.
• Integrated CGI web front end.
• Integrated Wiki, Tickets- which are also distributed.
• Sane command line UI.
• Stores everything in a SQLite database.
• Repository is not joined to the checkout, supports different checkout from the same cloned repository.
• I have had a Fossil commit bit - my change allows a near perfect Fossil <> GIT bridge.

And naturally, after many years of use, there are some negative points:

• The ticketing system is very basic and has no email support- you’re expected to use each tickets RSS feed, but this is not clear.
• It’s not extendable.
• It’s possible for an admin in the upstream repo to wipe out parts or the whole of your cloned repo.
• It’s not social.

That’s actually a very small list of negative points. It shows that Fossil is a great product, with a great team behind it. Let’s address these these negatives in more detail though.

The ticketing system is is poor

Yes, the tickets are distributed, but that’s the only good point. The UI to progress the ticket needs a lot of work and is not intuitive to use. Tickets don’t support markdown. It’s not clear to the end user that the only feedback they get is a RSS feed. My initial attempt to fix this was about 3 years ago but was met with silence. I could try and improve this by creating a fossil branch just to add RSS icons to the ticket UI.

Fossil is not extendable

This isn’t actually that bad, what it does have works well enough (aside from the ticketing). And to be fair, there is a 3rd party library to extend fossil but it doesn’t seem to be used by anything I can find. However, based on recent experiences at my day job (where I don’t use Fossil), code reviews are turning out to be quite critical and the tools we were using suck. Well, Fossil doesn’t have any code review feature nor any easy way of hooking it into an automated build system for continuous integration So we’re left reviewing changes via pastebin where links expire or diffs via email. Now diffs via email have been standard on many open source projects, and still are in many. Most of the time I can read them fine, but sometimes they are hard to review in an email. Sometimes I end up using a code review tool, loading the dhcpcd source code, copy and paste the diff into it, reviewing and then copying my review comments back into the email. This is hardly ideal and quite time consuming.

Fossil history can be wiped out

Fossil has an ability to delete anything from your cloned repo - it’s called shunning. While this is an awesome feature for corporations (I work for one, I understand the problems and wish my day job had this feature), but equally I believe it’s entirely un-suitable for open source use. This is my PC, it contains my contributions to a project which could wipe out my copy of said project and published contributions. History, gone. Now, it’s entirely likely that this will never happen, I like to believe in the good in people, but the possibilty remains someone could push the button. OK, there’s a bit more to it than that- the default fossil setting is to auto-sync the shun list. However, the code is disabled for auto-sync (ie sync on commit) but is enabled for the manual pull/push commands. While that removes the item from your checkout (if it’s there), it won’t actually remove it from the repository itself until the repository is rebuilt, which is sometimes forced on you when upgrading fossil. Yes, this is probably a knee-jerk reaction to a none-issue, but it still grates. This is also a reason why I love to self host and would never consider having GitHub or similar being the one sole place where I publish my work. I have always, and always will do, self host.

Fossil is not social

By it’s very nature, you can’t contribue to the club unless you’re in the club- at least not using just Fossil. It’s designed (from my perspective anyway) to be a distributed CVS/SVN + wiki + tickets. By this, I mean there is one master repository everyone clones from and pushes to. This makes it impossible to have my own branch outside of the main repo and publish it to others (equivalent of GIT Fork and Pull). It can also be argued that this is a good thing because it encourages people to work together and just like the prior point, this is a good feature for corporate setups. But equally sometimes someone needs to maintain a patchset unsuitable for upstream for valid reasons. This is rare, but it has happened. And I hate losing users for any reason. Could they have a branch they maintain in my repo? Quite possibly, but Fossil’s security isn’t that granular AFAIK and I would dislike someone messing around in the other branches. Maybe that’s anti-social of me, but equally no-one has ever asked for commit access to my repos either.

EDIT: Dr Richard Hipp pointed out privately that this is The Cathedral and the Bazaar. Fossil is the pre-eminent solution for The Cathedral, while others are more suited to the Bazaar.

In summary

Taking the above into account, I can no longer justify the use of Fossil in my Open Source projects. For other projects, Fossil is still an awesome tool if that’s all you need.

So, to get myself on GitHub (as a mirror only), there needs to be a bridge between Fossil and Git. Fossil documentation implies this is quite easy. Sadly, this isn’t the case as the <=Fossil-1.37 releases (note there is no guaranntee that future versions of follow will not have these flaws- my branch may not be comitted to trunk) have the following flaws:

• Branch and Tag name mangling (dhcpcd-6 becomes dhcpcd_6)
• Silent master branch renaming into trunk on inport, but not on export
• No tag comments (Fossil lacks the feature) which means syncing tags back and forth results in tag conflict due to signature change

I submitted some initial patches the the Fossil mailing list and I now have a Fossil commit bit! You can find my branch here to fix the Fossil Git bridge.

But that’s not the end of the story. A bridge has two ends. With my initial setup, the Git end was bare bones repository which I pushed to GitHub. This is no longer the case- I now need a staging repository to pull both ends. And this requires a script because Git needs a little more hand-holding to completely track a remote. The below script is tailored for my needs, yours may differ. It also reflects the above initial design and the subsequent change- as such it it may need editing if you need to create a git clone from fossil. This comes with no support, just as an idea of how you might implement such a bridge.

#!/bin/sh

fossildir=/var/fossil
# Cannot be a bare directory for git as we cannot write to the host directly.
# So we have a staging directory instead.
# This requires a bit of hand-holding to track all the branches.
gitdir=/var/git-staging

marksdir=/var/scm-marks

# Respect default naming at either end
fossil_export_opts="--rename-trunk master"
fossil_import_opts="--rename-master trunk"

# Only used when creating a git bare bones repo from Fossil.
export_fossil_to_git_new()
{

        rm-f "$fossilmarks" "$gitmarks"
        git init
        fossil export--git \
--export-marks "$fossilmarks" \
                $fossil_export_opts "$fossildir/$fossilrepo" | \
                git fast-import \
--export-marks="$gitmarks"
}

export_fossil_to_git()
{

        fossil export--git \
--import-marks "$fossilmarks"--export-marks "$fossilmarks" \
                $fossil_export_opts "$fossildir/$fossilrepo" | \
                git fast-import \
--import-marks="$gitmarks"--export-marks="$gitmarks"
}

export_git_to_fossil()
{

        git fast-export--all \
--import-marks="$gitmarks"--export-marks="$gitmarks" | \
                fossil import--git--incremental \
--import-marks "$fossilmarks"--export-marks "$fossilmarks" \
                $fossil_import_opts "$fossildir/$fossilrepo"
}

pull_git()
{
        local remote

        git fetch--all
        # Track all remote branches
        git branch-r | grep-v '\->' | while read remote; do
                if [-z "$(git branch--list "${remote#origin/}")" ]; then
                        git branch--track "${remote#origin/}" "$remote"
                fi
        done
        git branch--list | sed-e 's/^\* //' | while read branch; do
                git checkout "$branch"
                git merge--ff-only
        done
}

push_git()
{

        git push--all
        git push--tags
        # Reset the current branch checkout.
        # If we don't, the next run will complain about unstashed changes.
        # This maybe a bug in git, but maybe not because the live checkout
        # *is* behind at this point as we just fast-imported.
        git reset--hard
}

echo "Syncing git and fossil."
for repo in "$fossildir"/*.fossil; do
        fossilrepo=${repo#${fossildir}/*}
        repo=${fossilrepo%.fossil}
        gitrepo="$repo"
        fossilmarks="$marksdir/$repo.fossil.marks"
        gitmarks="$marksdir/$repo.git.marks"

        # We just sync old fossil repos to new phab clones
        if [-d "$gitdir/$gitrepo" ]; then
                cd "$gitdir/$gitrepo"
                pull_git # staging only
                export_git_to_fossil
                export_fossil_to_git
                push_git # staging only
# Enable the below if pusing to a bare git repo from fossil
#       else
#               export_fossil_to_git_new
        fi
done

Direct download to script

• gcc toolchain is broken for some packages which affected running any PHP build
• clang toolchain was broken for my config (USE_SSP= yes and CPUFLAGS+=-march=core2)
• clang compiles as a whole were broken due to a recent efiboot import

In hind-sight, I could have had the box up and running a lot sooner if I used NetBSD-7 guests (or maybe just a NetBSD-7 build box), but no, I just had to get-current running. It offers more than-7 and prior exerience told me that tracking-7 was very problematic … but that could have been due to my settings and wanting to compile everything with clang. I’ve currently got 3-current images there now … the Xen DOM0, the actual server itself as Xen DomU (without any compiler or tools) and another Xen DomU which just builds stuff for other guests to use.

Anyway, the box itself is now up and running and all relevant services have been moved to it. During this move, I decided to modernise things a little and setup HTTP/2. If you’re reading this then it’s working :) As such, I’ve re-directed all basic HTTP traffic to HTTPS and it does seem to load a lot faster. One side effect of this is that I’ve stoped using my own self signed certificates and I’m now using the nice Let’s Encrypt service. pkgsrc users should use the py-certbot package and don’t bother searching for any letsencrypt package as it’s been renamed. I found this quite confusing as there was no reference to the rename in pkgsrc I could find and wasted a little time on it.

But now it’s live I can finally look into bringing online some other development utilities to play around with as the server has a lot more room to grow :)

In truth, although I had a nice new server upgrade it seems that Trac just keeps on using resource after resource. Now, having the site entirely python powered isn’t entirely possible- thus far I have yet to find a reasonable email web interface other than RoundCube Also, my PostgreSQL interface of choice uses PHP. Speaking of PostgreSQL, that kind of limits my blogging software choices as most of them only want to use MySQL, which I have no wish to use. Here’s a list of blogging software which can use PostgreSQL:

• Trac
• Drupal
• Serendipity

So seeing as I’m moving a way from Trac and I had a bad experience managing my prior Drupal install many years ago, it’s no surprise that I’ve migrated my blog over to Serendipity :) As with the prior migration I’ve preserved comment history and my image gallery. However, I still need to edit all prior posts and correct their links. At this point you maybe wondering what now powers my projects? Well, they recently converted from GIT to Fossil

All of this effort and not much blogging? Well, lets see if I can blog more here as it’s my content which I own entirely on my self hosted site. I think I’ve been giving to much content hosting to Facebook and Twitter. I’ll not stop using them, but I expect to post more here :)

I’ve also ditched OpenID for the time being as some spammers were still getting through. I still have trouble getting the AccountManager trac plugin to work well, so I’ve gone back to the trac spam filter plugin, with captcha support enabled. We’ll see how this works.

I’m now using nsd as my public authoritative name server and unbound as my private recursive name server. This results in config files much easier to setup and hopefully more security as nsd is very small leaving less room for public exploits. Also, the total memory used after a few days production is 40meg lighter than BIND which is good as my server is really starved for memory right now.

So what’s the catch? Well, there is no way of integrating Dynamic DNS with unbound that I can see. I could use dnsmasq as a DHCP server as that can run a script per lease, which means I can use unbound-control to update DNS. But I dislike this as dnsmasq isn’t entirely the right tool for the job. So I will probably write dhcpsd, a small portable and entirely new DHCP server that can be used to integrate with DNS via scripts. Watch this space!

There are quite a few OpenID Providers, so it should be quite easy. You may already have an OpenID! However, due to how the OpenID plugin works with Trac your username will look a little odd. This is because your OpenID is basically a FQDN, just like a web address. So it’s best to use a provider like !http://.provider.com or !http://provider.com/username- in other words, avoid Google for OpenID unless you want a really long username here. This not that bad though, as the plugin strips the !http:// part and the trailing slash.

You can see from this post that my OpenID is roy.marples.name, which shows that having your own domain and OpenID server is important if you want to look good ;)

We’ll see how it goes :)

This led to an interesting debtate about my internet connection. In a nutshell my Drayetk Vigor 100 is broken, but apparently by design. The problem is this- for IPv4 goes through my NAT whose public IP has an MTU of 1492 so Path MTU Discovery works fine. However IPv6 does not need NAT and the PPPoE interface does not have a public IPv6 and nor do the internal clients use it even it there was one. So the path MTU is 1500, which is too big for the PPPoE to handle.

The correct solution is to obviously terminate the IPv6 on a PPPoA connection, but only the Cisco 877 router does this and that’s outside of my price range, even on eBay. One solution is to clamp the MSS on the router to 1430 so that all clients work. But this is a hack. The best solution with my hardware is to force the MTU to 1492 for all nodes inside my network, so they share the same MTU as the PPPoE so that Path MTU Discovery works.

You can see this working for yourself on IPv6 now, as this site is IPv6 enabled and sits behind the PPPoE link. You’ll need to query IPv4 servers for the address though as I don’t yet have a glue record for IPv6, but as I’m changing registrar that should change in a few weeks :)

Because of this, I’ve made the dhcpcd default to request and use the MTU value if offered by the DHCP server. You’ll be seeing this in dhcpcd-5.0.5 (now out). dhcpcd-5.0.6 will feature restoring the MTU correctly between leases.

There maybe some more downtime in the near future as I may change registrar as I’ll be getting native IPv6 later today (yay, no more tunnel!) and my current one (1&1)don’t appear to support IPv6 in their domain / dns setup.

So I’m changing to Goscomb Technologies because they are slightly cheaper than Demon, have a 24Mb service NOW and offer native IPv6. I did have cause to phone Goscomb up, and it was nice to hear a native English speaker at the other end on a good quality line instead of a non native speaker on a poor quality line due to the customer services section being out sourced. Another plus.

What does this mean for you? Well, on the 29th of this month, the switch should be made, so there will be some downtime and delay whilst the DNS updates. So this is also a heads up :)

Initial reaction is that it is lighter on memory and also faster, but time will tell. What I did like is that installation is very simple and well documented, unlike fastcgi or fcgid. Sadly I still need to use fcgid for the non python parts of my site.

If you have any issues with this and it’s really not spam, then email me or get it in touch via IRC. You will probably need to at least enable cookies and store your email address in the preferences.

All blog posts and comments have been retained, as has my image gallery. There are a few errors in the migration, but they are acceptable.

So welcome to new the site and enjoy :)