💾 Archived View for sylvaindurand.org › rss.xml captured on 2022-04-28 at 17:56:08.

View Raw

More Information

-=-=-=-=-=-=-

<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Sylvain Durand</title>
    <link>https://sylvaindurand.org/</link>
    <atom:link href="https://sylvaindurand.org/rss.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>Personal finance with Beancount</title>
      <link>https://sylvaindurand.org/personal-finance-with-beancount/</link>
      <pubDate>Sun, 20 Mar 2022 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/personal-finance-with-beancount/</guid>
      <description>&lt;p&gt;When I was 7 years old, my parents gave me pocket money for the first time: 10 F per week (about €2 today) accompanied by a small notebook in which I had to do my accounting. I suppose it was a way to monitor what I was going to do with that fortune, but I kept track of my finance.&lt;/p&gt;
&lt;p&gt;Since my first debit card 15 years ago, I&amp;rsquo;ve tracked every expense I&amp;rsquo;ve made. The goal is pretty simple: to know where my money comes from and where it goes, and how my lifestyle is changing. Over the years, these accounts have also become a very special form of diary: they note each of my outings, each activity, bar, restaurant, cinema or theater.&lt;/p&gt;
&lt;h2 id=&#34;how-ive-tracked-my-finances-in-the-past&#34;&gt;How I&amp;rsquo;ve tracked my finances in the past&lt;/h2&gt;
&lt;p&gt;Despite a few attempts with software like HomeBank, I used a simple Excel sheet for almost twelve years. One line per transaction, with a column for the date, a category, a label, and the amount (one column per account).&lt;/p&gt;
&lt;p&gt;This approach has many flaws:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;each account requires a different column, which makes things hard to read and change after a few years;
the whole is based on formulas that must be maintained, with a risk of errors;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;an excel file only tracks cash flow and does not allow you to keep track of your debts (&amp;ldquo;how much do I owe Bob?&amp;rdquo;), the money you are owed (&amp;ldquo;how much money does Alice owe me?&amp;rdquo;), or your scheduled payments (&amp;ldquo;how much do I still have to pay for my car?&amp;rdquo;);&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;unless specific formulas are created, it does not allow you to create reports to answer questions like &amp;ldquo;how have my restaurant expenses evolved over the last few years?&amp;rdquo;, &amp;ldquo;how much did I spend on my last vacation?&amp;rdquo; or &amp;ldquo;how much is left in my shopping budget this month?&amp;rdquo;;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;this system is not easy to evolve, and involves more and more formulas and sheets that are difficult to maintain over time;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;let&amp;rsquo;s not talk about the follow-up of investments or expenses sharing;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;an excel sheet is not easy to version and modify from several devices;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;I don&amp;rsquo;t like to depend on proprietary software.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;plain-text-accounting-with-beancount&#34;&gt;Plain text accounting with Beancount&lt;/h2&gt;
&lt;p&gt;In 2019, I discovered a concept that has changed the way I track my personal finances: plain text accounting. Basically, it&amp;rsquo;s very simple: all transactions are written on a simple text file, with a particular syntax. The software reads them and is able to make all kinds of reports, presentation, either from the command line or in a nice web interface.&lt;/p&gt;
&lt;p&gt;Above all, the whole thing is based on a logic of double-entry bookkeeping: I didn&amp;rsquo;t know what it brought, but I couldn&amp;rsquo;t do without it today!&lt;/p&gt;
&lt;p&gt;Several softwares exist, notably &lt;code&gt;ledger&lt;/code&gt; who invented the concept, &lt;code&gt;hledger&lt;/code&gt;, and &lt;code&gt;beancount&lt;/code&gt; which is the one I use to take advantage of the excellent &lt;code&gt;fava&lt;/code&gt; web interface.&lt;/p&gt;
&lt;h3 id=&#34;why-double-entry-bookkeeping&#34;&gt;Why double-entry bookkeeping?&lt;/h3&gt;
&lt;p&gt;For a long time, the interest of double-entry bookkeeping seemed to me to be limited to the corporate world, and at best useless for an individual. That was before I tried it!&lt;/p&gt;
&lt;p&gt;There are two types of things you want to track:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;Accounts: assets (owned) or liability (owed);&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;Transactions: income (inflows) and expenses (outflows).&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Income and expenses affect your accounts as follows:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Revenues (+)  ⇾  (Assets - Liabilities)  ⇾  Expenses (-)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Each transaction requires at least two balanced transactions involving assets (or liabilities), revenues and expenses. Let&amp;rsquo;s say I want to buy a good video game. The syntax is as follows:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;2022-03-21 * &amp;#34;Steam&amp;#34; &amp;#34;Buying Stardew Valley&amp;#34;
  Assets:Checking                 -13.99 EUR
  Expenses:Games                   13.99 EUR
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Here I buy using my checkings account (which is an asset), which will therefore decrease by €13.99. I&amp;rsquo;m also increasing my expenses, in a subaccount named &amp;ldquo;games&amp;rdquo; where, in the future, I will be able to find in it all the games I bought and for how much. The sum of all operations must necessarily be zero (nothing is lost, nothing is created)!&lt;/p&gt;
&lt;p&gt;Now let&amp;rsquo;s imagine that I invite Bob at the restaurant, pay partly with cash, and that I complete it with my bank card:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;2022-03-21 * &amp;#34;Susama Sushi&amp;#34; &amp;#34;Lunch with Bob&amp;#34;
  Assets:Cash                     -20.00 EUR
  Assets:Checking                 -15.50 EUR
  Expenses:Restaurant              35.00 EUR
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;What if Bob promised to pay me back for his meal?&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;2022-03-21 * &amp;#34;Susama Sushi&amp;#34; &amp;#34;Lunch with Bob&amp;#34;
  Assets:Cash                     -20.00 EUR
  Assets:Checking                 -15.50 EUR
  Assets:Debts:Bob                 17.50 EUR
  Expenses:Restaurant              17.50 EUR
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;And when Bob pays us back with a bank transfer:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;2022-03-23 * &amp;#34;Susama Sushi&amp;#34; &amp;#34;Bob refund&amp;#34;
  Assets:Checking                  17.50 EUR
  Assets:Debts:Bob                -17.50 EUR
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Want to know how much you spend on restaurants? Check out the &lt;code&gt;Expenses:Restaurant&lt;/code&gt; account balance. Need to know how much you have left on your checking account? This is the balance of &lt;code&gt;Assets:Checking&lt;/code&gt;. Does Bob still owe you money? Just look at &lt;code&gt;Assets:Debts:Bob&lt;/code&gt; balance.&lt;/p&gt;
&lt;p&gt;There are no constraints on the accounts you can create, and you can have longer depths (&lt;code&gt;Expenses:Home:Phone&lt;/code&gt; and &lt;code&gt;Expenses:Home:Internet&lt;/code&gt; for example, allowing you to simply see a &lt;code&gt;Expenses:Home&lt;/code&gt; total).&lt;/p&gt;
&lt;h2 id=&#34;other-instructions&#34;&gt;Other instructions&lt;/h2&gt;
&lt;p&gt;Beancount file read by beancount consists essentially of a series of transactions as indicated above. You can also open or close accounts, indicate a balance (allowing Beancount to return an error if something does not match), comments, attachments&amp;hellip;&lt;/p&gt;
&lt;p&gt;You can also make currency conversion, stock market transactions, allowing you to track costs, prices, realized and unrealized capital gains.&lt;/p&gt;
&lt;p&gt;For example, I buy here 3 Apple shares at a $163.98 price per unit, with 0.5% fees, so a $164.80 cost per unit:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;2022-03-17 * &amp;#34;Buying 3 AAPL&amp;#34;
  Assets:Stocks:Cash             -494.40 USD
  Assets:Stocks:AAPL      3 AAPL {164.80 USD} @ 163.98 USD
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Basically, you can count something else than financial values: days off, worked hours&amp;hellip;&lt;/p&gt;
&lt;h3 id=&#34;accounts&#34;&gt;Accounts&lt;/h3&gt;
&lt;p&gt;Through the years, my income and expense accounts have become the following (of course, this hierarchy works well for me, but will depend on your needs):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code class=&#34;language-raw&#34; data-lang=&#34;raw&#34;&gt;Incomes
│
├─── Scholarships
├─── Gifts
├─── Classes
├─── Pensions
└─── Salaries
     ├─── Gross
     └─── Taxes

Expenses
│
├─── Subscriptions
│    ├─── Banks
│    ├─── Internet
│    ├─── Telephone
│    └─── Newspapers
│
├─── Housing
│    ├─── Rent
│    ├─── Insurances
│    ├─── Electricity
│    └─── Gas
│
├─── Purchases
│    ├─── Books
│    ├─── Clothing
│    ├─── Cash
│    ├─── Gifs
│    ├─── Electronics
│    ├─── Games
│    └─── Misc
│
├─── Needs
│    ├─── Groceries
│    ├─── Health
│    └─── Care
│
├─── Leisure
│    ├─── Bars
│    ├─── Coffee
│    ├─── Cinemas
│    ├─── Concerts
│    ├─── Outings
│    ├─── Sports
│    └─── Theaters
│
├─── Meals
│    ├─── Bakeries
│    ├─── Deliveries
│    └─── Restaurants
│
├─── Transportation
│    ├─── Subway
│    ├─── Cabs
│    └─── Trains
│
├─── Travel
└─── Exceptional

Assets
│
├─── Checkings
│    ├─── Bank1
│    ├─── Bank2
│    └─── Bank3
│
├─── Deposits
│
└─── Savings
     ├─── LDDS
     ├─── PEL
     └─── PEA
          ├─── Cash
          ├─── Unit1
          └─── Unit2
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;command-line-usage&#34;&gt;Command line usage&lt;/h2&gt;
&lt;p&gt;Beancount offers several commands to generate reports on your accounts:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p&gt;&lt;code&gt;bean-report&lt;/code&gt; extract reports to the console;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;code&gt;bean-query&lt;/code&gt; allows to execute precise queries very similar to SQL;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;code&gt;bean-check&lt;/code&gt; verify that your syntax and transactions work correctly;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;code&gt;bean-format&lt;/code&gt; reformat the bean file to right-align all the numbers;&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p&gt;&lt;code&gt;bean-web&lt;/code&gt; provide a small web interface.&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Beancount can easily be augmented with plugins written in Python. These allow you to easily modify or add transactions or accounts automatically. It becomes easy to make automatic depreciations, to split transactions, to share expenses or to follow a budget.&lt;/p&gt;
&lt;p&gt;The Beancount documentation is particularly complete and allows you to discover the concepts, the most common use cases, but also the most advanced needs:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://beancount.github.io/docs/index.html&#34;&gt;Beancount documentation&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;web-interface-with-fava&#34;&gt;Web interface with Fava&lt;/h2&gt;
&lt;p&gt;However, one of the strengths of Beancount is also the Fava web interface. Fava proposes to display simply all the accounts, expenses, incomes, assets, with different graphs which allow easily to change views, to filter or to observe only different time steps.&lt;/p&gt;
&lt;p&gt;Fava also offers a system of plugins that allows you to build your own personalized report pages, in a very efficient way.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://beancount.github.io/fava/&#34;&gt;Fava homepage&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://fava.pythonanywhere.com/example-beancount-file/&#34;&gt;Fava demo&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;stats&#34;&gt;Stats&lt;/h2&gt;
&lt;p&gt;As of today, my file has 30.058 lines, 7259 directives (15.622 postings in 6902 transactions) and includes all my transactions since mid 2007!&lt;/p&gt;
&lt;p&gt;The report of the balances is executed in 0.3 seconds. Even if these performances suit me perfectly, the next version of Beancount, planned in C++ against Python today, should largely improve them.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Setting up a VPN with Wireguard</title>
      <link>https://sylvaindurand.org/setting-up-a-vpn-with-wireguard/</link>
      <pubDate>Sun, 20 Mar 2022 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/setting-up-a-vpn-with-wireguard/</guid>
      <description>&lt;p&gt;VPNs are very practical tools that allow you to secure the connection between two machines, to secure your connection to the Internet when you connect in public places or to bypass geographical access restrictions. When you have a personal server and you don&amp;rsquo;t want to expose it to the public, a VPN is ideal to reduce the attack surface and access your tools.&lt;/p&gt;
&lt;p&gt;For a long time, I used OpenVPN, which was quite heavy to configure and set up, and not always easy to maintain&amp;hellip; until the arrival of Wireguard.&lt;/p&gt;
&lt;p&gt;Wireguard is a more recent tool, completely open source, very light, simple to set up, which claims to comply with the latest encryption standards and is particularly efficient. It has recently been integrated into the Linux kernel and has clients for Windows, Mac, iOS or Android.&lt;/p&gt;
&lt;p&gt;For this example, we will connect a &amp;ldquo;server&amp;rdquo; with a &amp;ldquo;client&amp;rdquo;. In reality, all the devices connected through Wireguard are perfectly equivalent, and it is possible to configure the data transfers as you wish.&lt;/p&gt;
&lt;h2 id=&#34;installation&#34;&gt;Installation&lt;/h2&gt;
&lt;p&gt;Under Arch Linux, Wireguard is already integrated in the Linux kernel, but installing &lt;code&gt;wireguard-tools&lt;/code&gt; allows to get simple configuration tools.&lt;/p&gt;
&lt;h2 id=&#34;keys-creation&#34;&gt;Keys creation&lt;/h2&gt;
&lt;p&gt;To communicate, each device will need a public key and an associated private key. The public key must be shared with each machine with which we wish to communicate, and we must benefit in return from their public keys.&lt;/p&gt;
&lt;p&gt;Thus, for this example,  we will create a private key &lt;code&gt;wg.key&lt;/code&gt; with the right permissions, and the corresponding public key &lt;code&gt;wg.pub&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd .ssh
(umask 0077; wg genkey &amp;gt; server.key)
wg pubkey &amp;lt; server.key &amp;gt; server.pub
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We do the same by creating a set of keys for the client:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd .ssh
(umask 0077; wg genkey &amp;gt; client.key)
wg pubkey &amp;lt; client.key &amp;gt; client.pub
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, although it is not mandatory, you can create pre-shared keys that will be used on both devices to strengthen security:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;(umask 0077; wg genpsk &amp;gt; preshared.pub)
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;server-configuration&#34;&gt;Server configuration&lt;/h2&gt;
&lt;p&gt;The configuration is done in the &lt;code&gt;/etc/wireguard/wg0.conf&lt;/code&gt; file where we will start by declaring our interface. Specify the contents of the private key &lt;code&gt;server.key&lt;/code&gt; in &lt;code&gt;PrivateKey&lt;/code&gt; and the port in &lt;code&gt;ListenPort&lt;/code&gt;. The &lt;code&gt;PostUp&lt;/code&gt; and &lt;code&gt;PostDown&lt;/code&gt; lines designate the commands to be run when activating or deactivating the Wireguard network respectively. These indicate that we have to reroute everything that is requested from or to our client. Your server will have the address &lt;code&gt;10.0.0.1&lt;/code&gt; on the Wireguard network.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[Interface]
PrivateKey = ...
Address = 10.0.0.1/24
ListenPort = 51871
PostUp = sysctl -w net.ipv4.ip_forward=1 ; iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp3s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp3s0 -j MASQUERADE
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The next step is to specify which clients can connect to the VPN. For each of them, we add in the same file a peer section. Specify the contents of the client&amp;rsquo;s public key &lt;code&gt;client.pub&lt;/code&gt; in &lt;code&gt;PublicKey&lt;/code&gt;, and always the pre-shared key in &lt;code&gt;PreSharedKey&lt;/code&gt;. Your client will have the address &lt;code&gt;10.0.0.2&lt;/code&gt; on the Wireguard network.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[Peer]
PublicKey = ...
PreSharedKey = ...
AllowedIPs = 10.0.0.2/32
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;client-configuration&#34;&gt;Client configuration&lt;/h2&gt;
&lt;p&gt;On the client side, the configuration will also written in &lt;code&gt;/etc/wireguard/wg0.conf&lt;/code&gt;. This time we give it the address &lt;code&gt;10.0.0.2&lt;/code&gt; and we indicate the private key contained in &lt;code&gt;client.key&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[Interface]
PrivateKey = ...
Address = 10.0.0.2/24
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp3s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp3s0 -j MASQUERADE
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is also given the server as peer, the server&amp;rsquo;s public key contained in &lt;code&gt;server.pub&lt;/code&gt;, and the pre-shared key. The &lt;code&gt;EndPoint&lt;/code&gt; field must indicate the domain name or external IP where the server will be reachable, as well as the port (which must, of course, be externally accessible and routed if necessary). The &lt;code&gt;PersistentKeepalive&lt;/code&gt; field is not mandatory but allows to solve connectivity problems when connecting through a NAT router.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[Peer]
PublicKey = ...
PreSharedKey = ...
AllowedIPs = 0.0.0.0/0
Endpoint = vpn.domain.tld:51871
PersistentKeepalive = 25
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The &lt;code&gt;AllowedIPs&lt;/code&gt; field indicates which IPs will be passed through the VPN. With &lt;code&gt;0.0.0.0/0&lt;/code&gt;, all client IPs will be passed through the VPN. If you want to limit the use of the VPN to local services on the server (e.g. self-hosted apps), you can use &lt;code&gt;10.0.0.0/24&lt;/code&gt; for example.&lt;/p&gt;
&lt;h2 id=&#34;activation&#34;&gt;Activation&lt;/h2&gt;
&lt;p&gt;To start the VPN, you can run &lt;code&gt;wg-quick up wg0&lt;/code&gt; with root rights, both on the client and on the server. To turn it off, a simple &lt;code&gt;wg-quick down wg0&lt;/code&gt; is enough. It is also possible to use a service to start the VPN automatically at startup:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo systemctl enable --now wg-quick@wg0
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;wireguard-on-your-phone&#34;&gt;Wireguard on your phone&lt;/h2&gt;
&lt;p&gt;Wireguard has the advantage of being easily available on both iOS and Android, allowing you to access your local network and applications from any wifi network or with cellular data.&lt;/p&gt;
&lt;p&gt;In both cases, the application allows you to enter all the fields in the same way as &lt;code&gt;wg0.conf&lt;/code&gt;, but of course, entering the certificates by hand would be very tedious.&lt;/p&gt;
&lt;p&gt;Fortunately, it is also possible to proceed with a QR code!&lt;/p&gt;
&lt;p&gt;Create a public key and a shared key for your phone, as described above, as well as a pre-shared key if necessary. Declare them as a peer on your server, and create a &lt;code&gt;wg0-phone.conf&lt;/code&gt; file on your computer.&lt;/p&gt;
&lt;p&gt;Once this is done, we can then use &lt;code&gt;qrencode&lt;/code&gt; to transform this configuration file into a QR code directly readable (and importable) by the phone, which will be displayed in the terminal:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;qrencode -t ansiutf8 &amp;lt; wg0-iphone.conf
&lt;/code&gt;&lt;/pre&gt;&lt;pre tabindex=&#34;0&#34;&gt;&lt;code class=&#34;language-raw&#34; data-lang=&#34;raw&#34;&gt;█████████████████████████████████████████████████████
█████████████████████████████████████████████████████
████ ▄▄▄▄▄ █  ▄██▄▄▄ ▀▄  ▄▄█ ▄ █▀▄▄ ▀▀█▀▄█ ▄▄▄▄▄ ████
████ █   █ █  █▀ █▀▀▀▀▀▄█ █  ▄  █▀▄▀▀██ ▀█ █   █ ████
████ █▄▄▄█ █▀ ▄██ ▀▄▀▀ ▀ ▄▄▄ ▀ ▀▀█▀█▄█▄▄▄█ █▄▄▄█ ████
████▄▄▄▄▄▄▄█▄▀ █▄▀▄█▄█ █ █▄█ ▀▄▀▄█▄▀ █ █▄█▄▄▄▄▄▄▄████
████  █▀▄ ▄▀█  █▀▄ ▄███▄▄  ▄▄▀ █▄  ▀  █▀▀▀▀ █▄ ▄▄████
████ ▄▄▄█▄▄▄█▄█ ▄█ ▀ █▄█  ▄██▀▀  █ ▄▀▄ ▄██▀▀▀██▄▀████
████▄█▀  ▀▄▀  █▄▄▀▄███▄▄▄▀ ██▄▀█▀█▀ ▀█▄█ ▀ █▄▀ ▀█████
████▀▄▄█▀█▄ █▀  ▀▄  █▀██  ▄█▀█  ▀ ██  ▄▄▄█ █▀▄█▀ ████
████ ▀▀█▀█▄▀ █▄  ▀▀▀▀█ ▄█▀ █▀▄  █ ▀▀  ▄ ▀▄▀ ███▀▄████
█████▀█▄▄▀▄▄▀ ▀   ▄▄█▀▄▀▀ ▄   ▀▀ █ ▄█▄▀▀█▄▀▀▄ █ █████
████ █▀▀ ▄▄▄ ▄▄▄█  ▀█▄▄▄ ▄▄▄ ▀  █ ▄█  ▀█ ▄▄▄ ▀▀ ▀████
████▄ █  █▄█   ▀ ▀█▀ ▀▀  █▄█ █▄   ▄█▀▄   █▄█ ████████
██████ █▄ ▄  █▄▀▄▄ ▄█▄   ▄  ▄ ▄▀█▄▀█  ██▄ ▄▄  █▀ ████
████ ██▄▄█▄▄▄▀█▄ ▄▄▀ ▄▄▀█▀█▄█  ▀▄▄ ███▀▄▀██▄▄▀▀ ▀████
██████  ▄ ▄█▄ ▄▀▀ ▄█ ▄▄█ ██▄ ▄▀▀ ▄  ▄█▄▀▄  ▀▄█  █████
████ ▄▄ █▀▄▄▄▀ ▀▀▄ █▀▀▀█ ▀█▄▀▀ █  ▄▄█ ▄▄█ ▀▀▀▄▄▀▀████
████ ▀█   ▄██▀█▄ ▀▀▀▀██▀▄▄█ ▄ ▄▄▀█ ▀▄▄█ █▀█▀ ▀██▀████
█████▀▀▀ █▄▄▀ ▀▀█▄ ▄█▀▄█▄▀▀▄█▀▀▀ █ █ ▄▀▄ ▄▀▄█▀▀▄▀████
████▄██▄▄█▄▄▀ ██▄▀ ████  ▄▄▄  ███ ▄█▀ ▀▀ ▄▄▄ ▀  ▄████
████ ▄▄▄▄▄ █▀██▄▀▀█▄ ▄██ █▄█ █▀▀▄▄▀▄█    █▄█ ▄▄█▄████
████ █   █ █▄█ ▀▄▄ ██▄ █ ▄▄  ██▄█▄ ▄ ██▄   ▄ ▀█▀█████
████ █▄▄▄█ █▀▄ ▄ ▄▄  █ ▄  █ ▀▀   ▄ ▄▄█▀ █▀▄█ █▀██████
████▄▄▄▄▄▄▄█▄▄▄██▄██▄█▄▄█▄▄██▄▄█▄██▄▄█▄▄▄▄██████▄████
█████████████████████████████████████████████████████
█████████████████████████████████████████████████████
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Remote backups with Borg and Rclone</title>
      <link>https://sylvaindurand.org/remote-backups-with-borg-and-rclone/</link>
      <pubDate>Sat, 19 Mar 2022 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/remote-backups-with-borg-and-rclone/</guid>
      <description>&lt;p&gt;For a long time, my backup methods were very&amp;hellip; questionable. A few times a year, I would manually copy the files I wanted to download to an external hard drive. Of course, this raised a lot of problems: the backups were irregular and rare (up to six months between two backups, so it was not unusual for me to lose the previous day&amp;rsquo;s work because of a mistake). Moreover, they were done by hand, which was not only painful, but also risked forgetting files or making mistakes. Lastly, the hard disk was stored at my place, which ran the risk of losing everything in case of theft or fire.&lt;/p&gt;
&lt;p&gt;So it was time to use a much more serious backup method. My goal is to create a script to automatically back up the files of several folders in an archive, and to synchronize it on a remote server. This archive should :&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;deduplicate the files, i.e. store only the changes from one date to another (but have the possibility to extract the complete backup from any date) so as not to take up a considerable amount of space;&lt;/li&gt;
&lt;li&gt;compress the files, to limit the space taken up as well;&lt;/li&gt;
&lt;li&gt;encrypt the backup, so that the data cannot be decoded by someone and store it safely in the cloud.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;archiving-data-with-borg&#34;&gt;Archiving data with Borg&lt;/h2&gt;
&lt;p&gt;Borg is a deduplicating backup program which supports compression and authenticated encryption. After several tries, I ended up preferring it for its simplicity and performance over its many competitors, such as Restic, Duplicacy or Duplicati.&lt;/p&gt;
&lt;h3 id=&#34;initialize-the-archive&#34;&gt;Initialize the archive&lt;/h3&gt;
&lt;p&gt;First, a Borg directory must be initialized. To do this, we use the following command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;borg init --encryption=repokey /path/to/repo
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;A password is required to encrypt the archive. To avoid having to type it (to be used in a script for example), it is possible to store it in a &lt;code&gt;~/.borg-passphrase&lt;/code&gt; file and pass it as an environment variable:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;export BORG_PASSCOMMAND=&amp;#34;cat $HOME/.borg-passphrase&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;adding-files&#34;&gt;Adding files&lt;/h3&gt;
&lt;p&gt;Let&amp;rsquo;s imagine that we want to create a &amp;ldquo;Monday&amp;rdquo; archive containing two folders:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;borg create /path/to/repo::Monday ~/folder1 ~/folder2
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Since the files stored by Borg are &lt;em&gt;compressed&lt;/em&gt;, the archive will be smaller than the original files.&lt;/p&gt;
&lt;p&gt;The next day, you can create a new &amp;ldquo;Tuesday&amp;rdquo; archive with the same files:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;borg create /path/to/repo::Tuesday ~/folder1 ~/folder2
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Thanks to deduplication, Borg will only store new data: files that have not been modified are not added a second time, which greatly limits the size of the archive.&lt;/p&gt;
&lt;p&gt;Of course, in the case of a script that automates the backup, for example on a daily basis, it is easiest to enter the date as the name of the archive:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;DATE=$(date +%Y-%m-%d)
borg create /path/to/repo::$DATE
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;manipulate-data&#34;&gt;Manipulate data&lt;/h3&gt;
&lt;p&gt;The manipulation of the data is relatively simple. &lt;code&gt;borg list repo&lt;/code&gt; allows to list the existing archives (dates). &lt;code&gt;borg list repo::Monday&lt;/code&gt; allows you to list the existing files in an archive, and &lt;code&gt;borg extract repo::Monday&lt;/code&gt; allows you to extract it into a directory. It is even possible to use &lt;code&gt;borg mount repo::Monday mnt&lt;/code&gt; to mount an image and directly browse the archive.&lt;/p&gt;
&lt;h2 id=&#34;cloud-storage-with-rclone-and-scaleway&#34;&gt;Cloud storage with Rclone and Scaleway&lt;/h2&gt;
&lt;p&gt;A good backup should be replicated to a remote site. I decided to use a cloud service, which I don&amp;rsquo;t mind since the data is encrypted.&lt;/p&gt;
&lt;p&gt;My choice was Scaleway which offers a Glacier type service: C14 Cold Storage. Its price is really low: €0.002 per GB per month with 75 GB of free storage. Incoming and outgoing transfer, archiving and restoration are free.&lt;/p&gt;
&lt;p&gt;For 350 GB, it costs me €0.5 per month, against €3.5 on OVH or Amazon Glacier which in addition charge for the outgoing transfer or extraction.&lt;/p&gt;
&lt;p&gt;Last but not least, it is a French service and allows me to store the files in France, without having to trust foreign laws.&lt;/p&gt;
&lt;h3 id=&#34;configuring-rclone-with-scaleway&#34;&gt;Configuring Rclone with Scaleway&lt;/h3&gt;
&lt;p&gt;Rclone is, like Rsync with SSH servers, a command line program that allows you to manage or synchronize files in the cloud. It can be used with a lot of cloud providers.&lt;/p&gt;
&lt;p&gt;The configuration is simple, and is done through the file &lt;code&gt;.config/rclone/rclone.conf&lt;/code&gt; (where &lt;code&gt;access_key_id&lt;/code&gt;, &lt;code&gt;secret_access_key&lt;/code&gt;, &lt;code&gt;region&lt;/code&gt; et &lt;code&gt;endpoint&lt;/code&gt; are given by Scaleway):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[scaleway]
type = s3
provider = Scaleway
access_key_id = xxxxx
secret_access_key = xxxxx
region = fr-par
endpoint = s3.fr-par.scw.cloud
acl = private
storage_class = GLACIER
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Once your bucket is created, you can then simply synchronize your Borg archive (or, really, any folder) with it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;rclone sync -v /path/to/repo scaleway:my-bucket
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Access the logs of a shared OVH server</title>
      <link>https://sylvaindurand.org/access-the-logs-of-a-shared-ovh-server/</link>
      <pubDate>Sun, 24 Oct 2021 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/access-the-logs-of-a-shared-ovh-server/</guid>
      <description>&lt;p&gt;As it only weighs a few megabytes, does not generate any income and only has a few hundred visitors each day, I wanted to host this site on a free platform.&lt;/p&gt;
&lt;p&gt;The advantage of static sites is that a lot of platforms actually offer free hosting: GitHub Pages, Netlify, Cloudflare, Render all offer a continuous integration that allows to generate and host a static site.&lt;/p&gt;
&lt;p&gt;But I had another constraint : to be able to access the server logs, to be able to follow the number of visitors directly from the dedicated script of Matomo, without imposing a tracker to the visitors.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://github.com/matomo-org/&#34;&gt;Matomo Log Analytics script&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;I chose OVH, where I register my domain names, which &amp;ldquo;offers&amp;rdquo; with them a free shared hosting including a very generous storage space of&amp;hellip; 10 megabytes. In my case, minimalism pays: it&amp;rsquo;s more than enough for me!&lt;/p&gt;
&lt;p&gt;However, I found that the automated access to the logs was particularly badly documented, hence this short article!&lt;/p&gt;
&lt;h3 id=&#34;creating-an-account-to-access-the-logs&#34;&gt;Creating an account to access the logs&lt;/h3&gt;
&lt;p&gt;First of all, OVH requires the creation of a &amp;ldquo;user/password&amp;rdquo; pair to allow access to the logs. To do this, from the customer area, in &lt;code&gt;Web Cloud&lt;/code&gt;, &lt;code&gt;Hostings&lt;/code&gt;, select your domain name, then go to the &lt;code&gt;Statistics and logs&lt;/code&gt; tab. In the &lt;code&gt;User Administration&lt;/code&gt; section, create a username and password to access the logs.&lt;/p&gt;
&lt;p&gt;Take the opportunity to note the log server access address, which is indicated in the &amp;ldquo;View logs&amp;rdquo; link, such as &lt;code&gt;logs.clusterxxx.hosting.ovh.net&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id=&#34;accessing-the-logs&#34;&gt;Accessing the logs&lt;/h3&gt;
&lt;p&gt;To access the logs, a simple wget is enough with the right parameters. The following code retrieves the logs of the day before (to be then analyzed by Matomo for example):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;LOG_SERVER=&amp;#34;https://logs.clusterxxx.hosting.ovh.net/&amp;#34;
USER=&amp;#34;youruser&amp;#34;
PASS=&amp;#34;yourpassword&amp;#34;
SITE=&amp;#34;domain.tdl&amp;#34;
MONTH=`date -d &amp;#39;yesterday 13:00&amp;#39; &amp;#39;+%m-%Y&amp;#39;`
DATE=`date -d &amp;#39;yesterday 13:00&amp;#39; &amp;#39;+%d-%m-%Y&amp;#39;`

wget --http-user=$USER --http-password=$PASS \
  $LOG_SERVER$SITE&amp;#34;/logs/logs-$MONTH/$SITE-$DATE.gz&amp;#34;
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Deploy a static website with FTP</title>
      <link>https://sylvaindurand.org/deploying-a-static-website-with-ftp/</link>
      <pubDate>Sun, 24 Oct 2021 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/deploying-a-static-website-with-ftp/</guid>
      <description>&lt;p&gt;Until now, I was used to exporting static sites with a simple &lt;code&gt;rsync&lt;/code&gt;, which synchronizes the locally generated directory with the files on the server. However, I had to deal with a shared server only accessible through FTP. For me, it was a tool I hadn&amp;rsquo;t used since the 2000s, with CuteFTP and then FileZilla, dragging and dropping files&amp;hellip; Fortunately, the command line tool &lt;code&gt;lftp&lt;/code&gt; simply allows to maintain a remote copy &amp;ldquo;in mirror&amp;rdquo; with a local directory.&lt;/p&gt;
&lt;h3 id=&#34;connection&#34;&gt;Connection&lt;/h3&gt;
&lt;p&gt;To avoid typing your login credentials in the terminal or logging in automatically, let&amp;rsquo;s create a &lt;code&gt;~/.netrc&lt;/code&gt; file containing :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# ~/.netrc
machine yourserver login youruser password yourpassword
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can then connect via FTP with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;lftp user@domain.tld
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is also possible to connect with SFTP, which is more secure, by specifying the protocol and port with the following command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;lftp sftp://user@domain.tld:22
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is possible that the first time you type a command, you will get the error &lt;code&gt;Fatal error: Host key verification failed&lt;/code&gt;. This is because the RSA key fingerprint is missing from the list of known servers. To fix this, a simple &lt;code&gt;ssh user@domain.tld&lt;/code&gt; followed by the &lt;code&gt;yes&lt;/code&gt; response when asked if you accept the server.&lt;/p&gt;
&lt;h3 id=&#34;commands&#34;&gt;Commands&lt;/h3&gt;
&lt;p&gt;To get a remote copy in a &lt;code&gt;www&lt;/code&gt; directory that is exactly the same as a local &lt;code&gt;public&lt;/code&gt; directory, use :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mirror -R public www --delete
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I also use the options &lt;code&gt;--ignore-time&lt;/code&gt; (to send only the necessary sites), &lt;code&gt;--parallel 5&lt;/code&gt; to have several simultaneous connections, which speeds up the sending substantially (the possible number depends on your connection and your host), and &lt;code&gt;-v&lt;/code&gt; to see the actions performed.&lt;/p&gt;
&lt;h3 id=&#34;automated-script&#34;&gt;Automated script&lt;/h3&gt;
&lt;p&gt;To automatically execute these commands in a script, just use &lt;code&gt;EOF&lt;/code&gt; and the &lt;code&gt;quit 0&lt;/code&gt; command at the end. For example, with FTP (without a secure connection):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;lftp user@domain.tld &amp;lt;&amp;lt; EOF
  mirror -R public www --delete --ignore-time --parallel 5 -v
  quit 0
EOF
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;And with SFTP (connection via SSH):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;lftp sftp://user@domain.tld:22 &amp;lt;&amp;lt; EOF
  mirror -R public www --delete --ignore-time --parallel 5 -v
  quit 0
EOF
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Decrypt multiple drives at boot</title>
      <link>https://sylvaindurand.org/decrypt-several-drives-at-boot/</link>
      <pubDate>Sat, 23 Oct 2021 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/decrypt-several-drives-at-boot/</guid>
      <description>&lt;p&gt;The previous articles showed how to use a fully encrypted system which could be remotely unlocked if necessary. In any case, a simple password is enough to decrypt the main disk and start the system:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/arch-linux-with-full-encryption/&#34;&gt;Arch Linux with full encryption&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/remotely-unlock-an-encrypted-system/&#34;&gt;Remotely unlock an encrypted system&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;In my case, however, several other hard disks are also encrypted, not necessarily with the same passwords: here we will see how to decrypt them all at once, with a single password.&lt;/p&gt;
&lt;p&gt;To do this, I create a random key, which will be stored on my main (encrypted) disk:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;head -c 64 /dev/urandom &amp;gt; /root/.data.key
chmod 600 /root/.data.key
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Assuming that the disk to be decrypted is &lt;code&gt;/dev/sda1&lt;/code&gt;, I can then tell &lt;code&gt;cryptsetup&lt;/code&gt; to add this file to it as the encryption key (the current password will be retained):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cryptsetup -v luksAddKey -i 1 /dev/sda1 /root/.data.key
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;In order for the disk to be decrypted at boot time, I edit &lt;code&gt;/etc/crypttab&lt;/code&gt; to add :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/crypttab
data UUID=$(blkid /dev/sda1 -o value -s UUID) /root/.data.key
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;And &lt;code&gt;/etc/fstab&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/fstab
/dev/mapper/data /media/data ext4 rw,noatime 0 2
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;At boot time, as soon as the system is decrypted and started, &lt;code&gt;/etc/fstab&lt;/code&gt; and &lt;code&gt;/etc/crypttab&lt;/code&gt; will then automatically mount the disk and decrypt it using the newly created file.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Remotely unlock an encrypted system</title>
      <link>https://sylvaindurand.org/remotely-unlock-an-encrypted-system/</link>
      <pubDate>Tue, 05 Oct 2021 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/remotely-unlock-an-encrypted-system/</guid>
      <description>&lt;p&gt;I self-host a server under Arch Linux on which are stored various personal data: documents, photos, music, videos&amp;hellip; Its data are fully encrypted, including the main system, to avoid any risk &amp;ndash; in case of burglary for example.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/arch-linux-with-full-encryption/&#34;&gt;Arch Linux with full encryption&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;However, encrypting the whole system raises a difficulty: a password is needed at every reboot. This means that it is necessary to connect a keyboard and a screen to the server, which is not necessarily practical if it is only intended to be accessed only by SSH.&lt;/p&gt;
&lt;p&gt;Above all, this server must remain constantly available: in case of power failure or malfunction, it must be able to be restarted without me necessarily being on site.&lt;/p&gt;
&lt;p&gt;The solution is simple: when the password prompt appears, launch a minimal SSH session that allows to enter the password.&lt;/p&gt;
&lt;p&gt;This article is directly inspired by the dm-crypt/Specialties page from the Arch Linux wiki, which shows different ways to do this. It assumes that you already have a fully functioning encrypted system.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://wiki.archlinux.org/title/Dm-crypt/Specialties&#34;&gt;Arch Wiki: dm-crypt/Specialties&lt;/a&gt;&lt;/p&gt;
&lt;h3 id=&#34;packages&#34;&gt;Packages&lt;/h3&gt;
&lt;p&gt;We will use &lt;code&gt;mkinitcpio-netconf&lt;/code&gt;, which allows network access during the early boot phase, &lt;code&gt;mkinitcpio-tinyssh&lt;/code&gt; and &lt;code&gt;tinyssh-convert&lt;/code&gt; to initiate SSH access, and &lt;code&gt;mkinitcpio-utils&lt;/code&gt; to get a session:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo pacman -Syu mkinitcpio-netconf \
                 mkinitcpio-tinyssh \
                 tinyssh-convert \
                 mkinitcpio-utils
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;network&#34;&gt;Network&lt;/h3&gt;
&lt;p&gt;To get network access, it is necessary to pass connection information with the &lt;code&gt;ip&lt;/code&gt; option to the kernel at boot time. My server connects directly with DHCP on the eth0 interface, so I use :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ip=:::::eth0:dhcp
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If your router connects without DHCP to a static IP, we can use :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ip=192.168.1.1:::::eth0:none
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If you need to connect via wifi, the AUR package &lt;code&gt;mkinitcpio_wifi&lt;/code&gt;: the documentation is detailed here:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlock_via_wifi&#34;&gt;Arch Wiki: Remote unlock via wifi&lt;/a&gt;.&lt;/p&gt;
&lt;h3 id=&#34;key&#34;&gt;Key&lt;/h3&gt;
&lt;p&gt;To connect at startup, it is necessary to send your public key. TinySSH only accepts Ed25519 or ECDSA keys; I use the first type with &lt;code&gt;ssh-keygen -t ed25519 -a 100&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;This public key must be placed in the &lt;code&gt;/etc/tinyssh/root_key&lt;/code&gt; file.&lt;/p&gt;
&lt;p&gt;To use the same key that you already use to SSH into the server, just copy it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cp ~/.ssh/authorized_keys /etc/tinyssh/root_key
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;launching-in-the-boot-sequence&#34;&gt;Launching in the boot sequence&lt;/h3&gt;
&lt;p&gt;Finally, we modify the &lt;code&gt;/etc/mkinitcpio.conf&lt;/code&gt; file to replace &lt;code&gt;encrypt&lt;/code&gt; with &lt;code&gt;netconf tinyssh encryptssh&lt;/code&gt; in the line that starts with &lt;code&gt;HOOKS&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;Finally, we incorporate the changes with &lt;code&gt;sudo mkinitcpio -P&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id=&#34;locally&#34;&gt;Locally&lt;/h3&gt;
&lt;p&gt;All that remains is to create a simple configuration, locally, to unlock your server. We modify &lt;code&gt;~/.ssh/config&lt;/code&gt; with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Host unlock
  Hostname domain.tld
  User root
  IdentityFile ~/.ssh/key
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, when the machine is waiting for the password at startup, you just have to run &lt;code&gt;ssh unlock&lt;/code&gt; to be able to type the password!&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Setting up a dynamic DNS with OVH</title>
      <link>https://sylvaindurand.org/setting-up-a-dynamic-dns-with-ovh/</link>
      <pubDate>Mon, 06 Sep 2021 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/setting-up-a-dynamic-dns-with-ovh/</guid>
      <description>&lt;p&gt;My ISP, like most of the others in France, only assigns dynamic IP addresses to its customers: this means that the IP address is likely to change at any time, especially when my box is updated or rebooted. Most of the time, the possibility to have a fixed IP address is an option, reserved for expensive offers.&lt;/p&gt;
&lt;p&gt;For most users, this does not present any practical problems. However, the situation becomes more complicated when you want to self-host sites or services that are intended to be accessible from the outside: how can you associate a domain name with a machine whose IP address can change at any time?&lt;/p&gt;
&lt;p&gt;This is the principle of dynamic DNS: you install on your machine a small software that regularly checks the current IP address, and as soon as it changes, sends it to your provider to update the DNS zone accordingly.&lt;/p&gt;
&lt;p&gt;This article shows how to do this with OVH and a Raspberry Pi running Raspbian.&lt;/p&gt;
&lt;h2 id=&#34;configuration-on-the-ovh-side&#34;&gt;Configuration on the OVH side&lt;/h2&gt;
&lt;p&gt;This part assumes that the domain name is managed by OVH, and that no record exists in the DNS zone for the domain name or subdomain that will point to our machine.&lt;/p&gt;
&lt;h3 id=&#34;creation-of-a-dynhost-identifier&#34;&gt;Creation of a DynHost identifier.&lt;/h3&gt;
&lt;p&gt;The first step is to create a DynHost ID, which will automatically update the DNS record.&lt;/p&gt;
&lt;p&gt;To do this, go to &lt;code&gt;Web Cloud&lt;/code&gt;, &lt;code&gt;Domain name&lt;/code&gt;, select your domain name (we will use &lt;code&gt;domain.tld&lt;/code&gt; for the rest of this article), then the &lt;code&gt;DynHost&lt;/code&gt; tab. Then select &lt;code&gt;Manage accesses&lt;/code&gt; and &lt;code&gt;Create a login&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;We indicate the login suffix (in my case, &lt;code&gt;domain.tld-pi&lt;/code&gt; for a Raspberry Pi), the subdomain concerned (&lt;code&gt;*&lt;/code&gt; to manage all domains with this login) and a password. This account will allow us to identify ourselves to update the zone.&lt;/p&gt;
&lt;p&gt;Once the DNS zone is propagated, your server should now be accessible from the chosen domain name.&lt;/p&gt;
&lt;h3 id=&#34;setting-up-the-dynamic-recording&#34;&gt;Setting up the dynamic recording&lt;/h3&gt;
&lt;p&gt;Once the identifier has been created, we can now create the DNS record. Still in the &lt;code&gt;DynHost&lt;/code&gt; tab, we select &lt;code&gt;Add a DynHost&lt;/code&gt;, then we indicate the domain name concerned, and the current IP address. It is this last one which will be updated automatically.&lt;/p&gt;
&lt;h2 id=&#34;automate-the-dns-change&#34;&gt;Automate the DNS change&lt;/h2&gt;
&lt;p&gt;Our server must now be able to update the DNS zone when it detects an IP change. We will use &lt;code&gt;ddclient&lt;/code&gt; for this:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt install ddclient
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Let&amp;rsquo;s skip the questions that are asked. Once finished, we directly modify the configuration file as follows (with, of course, your login, your password and your domain):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/ddclient.conf

protocol=dyndns2
use=web, web=checkip.dyndns.com, web-skip=&amp;#39;Current IP Address&amp;#39;
server=www.ovh.com
login=domain.tld-user
password=&amp;#39;password&amp;#39;
subdomain.domain.tld
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we restart the service:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo systemctl restart ddclient
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Your server will now communicate to OVH the new IP address when it changes!&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Arch Linux with full encryption</title>
      <link>https://sylvaindurand.org/arch-linux-with-full-encryption/</link>
      <pubDate>Tue, 16 Mar 2021 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/arch-linux-with-full-encryption/</guid>
      <description>&lt;p&gt;Over the past years, I have installed Arch Linux several dozen times on different devices. This article allows me to easily find the steps to install the distribution on a Dell XPS 9300, with UEFI and full encryption of the whole computer.&lt;/p&gt;
&lt;p&gt;Warning: the Arch Linux installation guide should remain your reference if you try to install on your own machine. Not only can the instructions evolve over time, but it alone will allow you to adapt the steps to your needs. It is, finally, something very instructive!&lt;/p&gt;
&lt;h3 id=&#34;creating-the-installation-disk&#34;&gt;Creating the installation disk&lt;/h3&gt;
&lt;p&gt;Download the installation image from the Arch Linux website.&lt;/p&gt;
&lt;p&gt;Then, insert a USB stick or micro SD card, find its address with &lt;code&gt;fdisk -l&lt;/code&gt;. You can then copy the image of the key (every data on it will be lost) with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo dd bs=4M if=&amp;lt;image.iso&amp;gt; of=/dev/&amp;lt;sdx&amp;gt; oflag=sync
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;booting-from-the-installation-disk&#34;&gt;Booting from the installation disk&lt;/h3&gt;
&lt;p&gt;After making sure you have disabled Secure Boot from the BIOS for the most recent computers, you turn on the computer from the USB key: once launched, the installer consists of a simple terminal.&lt;/p&gt;
&lt;h3 id=&#34;keyboard-layout&#34;&gt;Keyboard layout&lt;/h3&gt;
&lt;p&gt;The keyboard uses an American layout by default. Being French, I use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;loadkeys fr-latin9
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;network&#34;&gt;Network&lt;/h3&gt;
&lt;p&gt;For the rest of the installation, we will need the Internet to retrieve the packages. To connect to a wifi network, we use (where [ssid] is the name of your access point):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;iwctl station wlan0 connect [ssid]
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;clock&#34;&gt;Clock&lt;/h3&gt;
&lt;p&gt;To avoid any synchronization problems, we will also update the computer&amp;rsquo;s clock with it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;timedatectl set-ntp true
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;partitioning&#34;&gt;Partitioning&lt;/h3&gt;
&lt;p&gt;I choose to format the computer to create two partitions: a 100 MB boot partition, and a second one containing the system filling the rest of the space. Of course, all data will be deleted!&lt;/p&gt;
&lt;p&gt;You can see which disks and partitions exist with &lt;code&gt;parted -l&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;First of all, in my case, I delete the previous UEFI entry:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;efibootmgr -b 0 -B
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;In my case, the name of the main disk is &lt;code&gt;/dev/nvme0n1&lt;/code&gt;. To partition it, I run:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;wipefs -af /dev/nvme0n1
parted -s /dev/nvme0n1 mklabel gpt
parted -s /dev/nvme0n1 mkpart primary fat32 1MiB 100MiB
parted -s /dev/nvme0n1 set 1 esp on
parted -s /dev/nvme0n1 mkpart primary ext4 100MiB 100%
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;formatting&#34;&gt;Formatting&lt;/h3&gt;
&lt;p&gt;These two partitions are then formatted, creating an encrypted space on the second one:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mkfs.fat -F32 /dev/nvme0n1p1
cryptsetup -y -v luksFormat --iter-time 100 /dev/nvme0n1p2
cryptsetup open /dev/nvme0n1p2 cryptroot
mkfs.ext4 /dev/mapper/cryptroot
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, we mount these partitions with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mount /dev/mapper/cryptroot /mnt
mkdir /mnt/boot
mount /dev/nvme0n1p1 /mnt/boot
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installation&#34;&gt;Installation&lt;/h3&gt;
&lt;p&gt;We use &lt;code&gt;pacstrap&lt;/code&gt; to install the minimal system on our partition, and create the &lt;code&gt;fstab&lt;/code&gt; file. I add &lt;code&gt;iwd&lt;/code&gt; to have wifi on reboot, and &lt;code&gt;intel-ucode&lt;/code&gt; for Intel processors:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacstrap /mnt base linux linux-firmware iwd intel-ucode
genfstab -U /mnt &amp;gt;&amp;gt; /mnt/etc/fstab
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You then enter the newly created system with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;arch-chroot /mnt
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;localization&#34;&gt;Localization&lt;/h3&gt;
&lt;p&gt;You choose your time zone, language, and keyboard with commands like this:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ln -sf /usr/share/zoneinfo/Europe/Paris /etc/localtime
hwclock --systohc
echo &amp;#34;LANG=fr_FR.UTF-8&amp;#34; &amp;gt; /etc/locale.conf
echo &amp;#34;KEYMAP=fr-latin9&amp;#34; &amp;gt; /etc/vconsole.conf
echo &amp;#34;en_US.UTF-8 UTF-8
fr_FR.UTF-8 UTF-8&amp;#34; &amp;gt;&amp;gt; /etc/locale.gen
locale-gen
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;network-1&#34;&gt;Network&lt;/h3&gt;
&lt;p&gt;We then activate the different services to benefit from wifi and DNS at startup:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl enable systemd-networkd systemd-resolved iwd
echo &amp;#34;[General]
EnableNetworkConfiguration=True&amp;#34; &amp;gt;&amp;gt; /etc/iwd/main.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We also need to specify our hostname:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;echo &amp;#34;xps&amp;#34; &amp;gt; /etc/hostname
echo &amp;#34;127.0.0.1 localhost
::1             localhost
127.0.1.1       xps.localdomain&amp;gt;xps&amp;#34; &amp;gt;&amp;gt; /etc/hosts
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;initramfs&#34;&gt;Initramfs&lt;/h3&gt;
&lt;p&gt;The following instructions are added to request the password at startup:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sed -i &amp;#39;s/keyboard/keyboard keymap encrypt/&amp;#39; /etc/mkinitcpio.conf
mkinitcpio -P
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;root-password&#34;&gt;Root password&lt;/h3&gt;
&lt;p&gt;Create a root password with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;passwd
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;bootloader&#34;&gt;Bootloader&lt;/h3&gt;
&lt;p&gt;We simply use &lt;code&gt;efibootmgr&lt;/code&gt; to create a simple UEFI boot entry without any bootloader:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;UUID1=$(blkid /dev/nvme0n1p2 -o value -s UUID)
UUID2=$(blkid /dev/mapper/cryptroot -o value -s UUID)
efibootmgr -d /dev/nvme0n1 -p 1 -c -L &amp;#34;Arch Linux&amp;#34; \
  -l /vmlinuz-linux -u &amp;#34;cryptdevice=UUID=${UUID1}:cryptroot \
  root=UUID=${UUID2} rw quiet \
  initrd=\intel-ucode.img initrd=\initramfs-linux.img&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;the-end-&#34;&gt;The end !&lt;/h3&gt;
&lt;p&gt;You can leave the installation and reboot with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;exit
reboot
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>From cron tasks to systemd timers</title>
      <link>https://sylvaindurand.org/from-cron-tasks-to-systemd-timers/</link>
      <pubDate>Tue, 08 Dec 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/from-cron-tasks-to-systemd-timers/</guid>
      <description>&lt;p&gt;Like the vast majority of users of Linux systems, I have long used cron tasks when it came to running tasks at regular intervals.&lt;/p&gt;
&lt;p&gt;The tasks to be performed are to be entered in a text file, accessible from &lt;code&gt;crontab -e&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# m h dom mon dow command

	
* * * * /path/to/script.sh  # each minutes

@reboot   /path/to/script.sh  # on startup
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The disadvantages are multiple. The smallest unit of time is the minute. It is not possible to easily activate, deactivate, start or stop a command. Finally, it is very hard to see or simulate what is really happening.&lt;/p&gt;
&lt;p&gt;Nowadays, many Linux distributions embed &lt;code&gt;systemd&lt;/code&gt;, which makes it easy to perform this kind of operations.&lt;/p&gt;
&lt;h2 id=&#34;creating-a-service&#34;&gt;Creating a service&lt;/h2&gt;
&lt;p&gt;With &lt;code&gt;systemd&lt;/code&gt;, it&amp;rsquo;s all about services. Here is an example to create a very simple service:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/systemd/system/myservice.service

[Service]
Type=oneshot
ExecStart=path/to/script.sh
# WorkingDirectory=/home/user/path/
# User=user
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It indicates that the script must be started only once, and its address. But it is also possible to indicate the working directory, the user who launches it&amp;hellip; And even more if other services are needed, when to launch it, etc.&lt;/p&gt;
&lt;p&gt;You can check that everything works fine with &lt;code&gt;systemctl start myservice&lt;/code&gt;.&lt;/p&gt;
&lt;h2 id=&#34;creating-the-timer&#34;&gt;Creating the timer&lt;/h2&gt;
&lt;p&gt;The timer will have the same name, but will end with &lt;code&gt;.timer&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/systemd/system/myservice.timer

[Timer]
OnCalendar=*:*:0/10
[Install]
WantedBy=timers.target
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The &lt;code&gt;OnCalendar&lt;/code&gt; line allows you to specify the frequency, or the activation date. The most frequent synthesis is &lt;code&gt;*-*-* *:*:*&lt;/code&gt;, with the date and time. In the example above, the script is launched every 10 seconds.&lt;/p&gt;
&lt;p&gt;In order for our changes to be taken into account, we need to run the following command, the files being cached:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl daemon-reload
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, the timer is launched, making sure that it restarts at startup:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl enable --now myservice.timer
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Real-time log analytics with Matomo</title>
      <link>https://sylvaindurand.org/real-time-log-analytics-with-matomo/</link>
      <pubDate>Sun, 06 Dec 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/real-time-log-analytics-with-matomo/</guid>
      <description>&lt;p&gt;I must admit, I like to know how many people visit my site. However, I hate trackers, and I won&amp;rsquo;t consider using Google Analytics which would retrieve much more private information about my users for its own account.&lt;/p&gt;
&lt;p&gt;I really appreciate Matomo (formerly Piwik), which is open source, offers a quality interface and plenty options.&lt;/p&gt;
&lt;p&gt;By default, Matomo uses a javascript tracker, but it also has a script to import server logs. This makes it possible to have statistics without any tracker, impossible to block and therefore reliable, with a very low load for the server.&lt;/p&gt;
&lt;p&gt;Most of the time, these scripts work once a day, but it is possible to implement it almost in real time without the need of a rsyslog or syslog-ng setup. We will see here how to read Nginx logs in real time under Matomo.&lt;/p&gt;
&lt;h2 id=&#34;nginx-configuration&#34;&gt;Nginx configuration&lt;/h2&gt;
&lt;p&gt;First of all, we&amp;rsquo;re going to use a more readable and parsable json log format in nginx. In &lt;code&gt;/etc/nginx.conf&lt;/code&gt;, we declare a new log format named  matomo:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/nginx.conf

log_format matomo &amp;#39;{&amp;#39;
  &amp;#39;&amp;#34;ip&amp;#34;: &amp;#34;$remote_addr&amp;#34;,&amp;#39;
  &amp;#39;&amp;#34;host&amp;#34;: &amp;#34;$host&amp;#34;,&amp;#39;
  &amp;#39;&amp;#34;path&amp;#34;: &amp;#34;$request_uri&amp;#34;,&amp;#39;
  &amp;#39;&amp;#34;status&amp;#34;: &amp;#34;$status&amp;#34;,&amp;#39;
  &amp;#39;&amp;#34;referrer&amp;#34;: &amp;#34;$http_referer&amp;#34;,&amp;#39;
  &amp;#39;&amp;#34;user_agent&amp;#34;: &amp;#34;$http_user_agent&amp;#34;,&amp;#39;
  &amp;#39;&amp;#34;length&amp;#34;: $bytes_sent,&amp;#39;
  &amp;#39;&amp;#34;generation_time_milli&amp;#34;: $request_time,&amp;#39;
  &amp;#39;&amp;#34;date&amp;#34;: &amp;#34;$time_iso8601&amp;#34;}&amp;#39;;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, in the &lt;code&gt;server { }&lt;/code&gt; tag which contains the configuration of your site, indicate the location and format where your logs will be stored:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;access_log /var/log/nginx/access.log matomo;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, after restarting nginx, the logs should then start in the specified file.&lt;/p&gt;
&lt;h2 id=&#34;matomo-log-importation&#34;&gt;Matomo log importation&lt;/h2&gt;
&lt;p&gt;Matomo comes with a small python script, very efficient, to read the logs and import them: &lt;code&gt;log-analytics/import_logs.py&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;We will use &lt;code&gt;logtail&lt;/code&gt;, which allows, at each use, to read only the new lines added to the logs since the last time it has been launched. This avoids double counting.&lt;/p&gt;
&lt;p&gt;We can then pass the result to the Python script:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;/usr/sbin/logtail /var/log/nginx/access.log \
     | /usr/bin/python \
          path/to/matomo/misc/log-analytics/import_logs.py
          --url=https://&amp;lt;your-matomo-url&amp;gt; \
          --enable-http-errors \
          --enable-http-redirects \
          --log-format-name=nginx_json -
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To be recognized, the host must be correctly filled in the Matomo parameters. If you have several sites, it allows to distribute them automatically.&lt;/p&gt;
&lt;p&gt;This code can be launched with a &lt;code&gt;timer systemd&lt;/code&gt; or &lt;code&gt;cron&lt;/code&gt;, for example every minute. This makes it possible to update in real time the last visits and the visitor map on Matomo.&lt;/p&gt;
&lt;p&gt;However, in order to update the graphs and store long-term data, it is necessary to archive them.&lt;/p&gt;
&lt;p&gt;By default, this is done automatically by browsing the site from the browser.&lt;/p&gt;
&lt;p&gt;However, it is also possible to disable this possibility, and launch it from a cron task. The command is:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;php path/to/matomo/console core:archive \
    --url=&amp;lt;your-matomo-url&amp;gt; \
    --force-all-websites \
    --force-date-last-n=2
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Gemini and Hugo</title>
      <link>https://sylvaindurand.org/gemini-and-hugo/</link>
      <pubDate>Fri, 04 Dec 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/gemini-and-hugo/</guid>
      <description>&lt;p&gt;For a few years, I have been using Hugo, a static site generator, to produce these pages. At the same time very fast and corresponding perfectly to my needs, it is above all very modular.&lt;/p&gt;
&lt;p&gt;I was therefore not surprised to see that it was quite easy to convert, with little effort, my site for the Gemini protocol. This was not done without some tricks. Let&amp;rsquo;s see how!&lt;/p&gt;
&lt;h2 id=&#34;declaring-gemini-as-an-output-format&#34;&gt;Declaring Gemini as an output format&lt;/h2&gt;
&lt;p&gt;Hugo can output content in multiple formats: most of them are already predefined, but it is also possible to create your own. This is what we are going to do for Gemini.&lt;/p&gt;
&lt;p&gt;First, in the configuration file &lt;code&gt;config.yml&lt;/code&gt; we will declare a new type &lt;code&gt;text/gemini&lt;/code&gt; with the file suffix &lt;code&gt;.gmi&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mediaTypes:
  text/gemini:
    suffixes:
      - &amp;#34;gmi&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Once this is done, we declare a new output format, which uses this type, which is given the name &lt;code&gt;GEMINI&lt;/code&gt;.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;outputFormats:
  GEMINI:
    name: GEMINI
    isPlainText: true
    isHTML: false
    mediaType: text/gemini
    protocol: &amp;#34;gemini://&amp;#34;
    permalinkable: true
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, it only remains to ask Hugo to generate pages for the different contents. For example, in my case:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;outputs:
  home: [&amp;#34;HTML&amp;#34;, &amp;#34;RSS&amp;#34;, &amp;#34;GEMINI&amp;#34;]
  page: [&amp;#34;HTML&amp;#34;, &amp;#34;GEMINI&amp;#34;]
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To be able to generate the files, it is now necessary to create layouts to see how to display them!&lt;/p&gt;
&lt;h2 id=&#34;index-page&#34;&gt;Index page&lt;/h2&gt;
&lt;p&gt;To start with the index, we can start with &lt;code&gt;layout/index.gmi&lt;/code&gt;. For example, here is a simple text, followed by a list of posts:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;## List of posts

{{ range .RegularPages }}
=&amp;gt; {{ .RelPermalink }} {{ .Title }}
{{- end }}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Here, I sort the articles in descending chronological order, grouping them by date. This gives the following code:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;## Posts grouped by year

{{ range .RegularPages.GroupByDate &amp;#34;2006&amp;#34; }}
### {{ .Key }}
{{ range .Pages.ByDate.Reverse }}
=&amp;gt; {{ .RelPermalink }} {{ .Title }}
{{- end }}
{{ end }}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;posts&#34;&gt;Posts&lt;/h2&gt;
&lt;p&gt;For posts, we can create a &lt;code&gt;layout/_default/single.gmi&lt;/code&gt;. Basically, it would suffice to display the title and content:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# {{ .Title }}

{{ .RawContent }}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;images&#34;&gt;Images&lt;/h3&gt;
&lt;p&gt;For images, I extract them with a simple regex and show them as a link:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{{- $content := .RawContent -}}
{{- $content = $content | replaceRE `\!\[(.+?)\]\((.+?)\)` &amp;#34;=&amp;gt; $2 Image: $1&amp;#34; }}
{{ $content }}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;links&#34;&gt;Links&lt;/h3&gt;
&lt;p&gt;For the links, I decided to simply not use inline links on the site, but only put the links on a single paragraph. This allows me, as before, a very simple regex:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{{- range findRE `\[.+?\]\(.+?\)` $content }}
    {{- $content = $content | replaceRE `\[(.+?)\]\((.+?)\)(.+)` &amp;#34;$1$3\n\n=&amp;gt; $2 $1 &amp;#34; }}
{{- end }}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;However, this is not a very satisfactory method when you have a site that has a lot of links online. A solution, proposed by the site Brain Baking, allows you to reference each link with a number ([1], [2]&amp;hellip;) and then to put the links underneath, automatically, thanks to a clever code:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://brainbaking.com/post/2021/04/using-hugo-to-launch-a-gemini-capsule/&#34;&gt;Using Hugo to Launch a Gemini Capsule&lt;/a&gt;&lt;/p&gt;
&lt;h3 id=&#34;navigation-to-other-pages&#34;&gt;Navigation to other pages&lt;/h3&gt;
&lt;p&gt;If you want to add links for previous and next articles with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{{ if .Next }}=&amp;gt; {{ .Next.RelPermalink }} ← Newer: {{ .Next.Title }}{{ end }}
{{ if .Prev -}}=&amp;gt; {{ .Prev.RelPermalink }} → Older: {{ .Prev.Title }}{{- end }}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;feeds&#34;&gt;Feeds&lt;/h2&gt;
&lt;p&gt;To create RSS feeds, we can create a new output format, then define its layout.&lt;/p&gt;
&lt;h3 id=&#34;rss&#34;&gt;RSS&lt;/h3&gt;
&lt;p&gt;We will do the same here! In &lt;code&gt;config.yml&lt;/code&gt;, we define:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;outputFormats:
  GEMINI_RSS:
    baseName: &amp;#34;feed&amp;#34;
    mediaType: &amp;#34;application/rss+xml&amp;#34;
    isPlainText: false

outputs:
  home: [&amp;#34;HTML&amp;#34;, &amp;#34;GEMINI&amp;#34;, ..., &amp;#34;GEMINI_RSS&amp;#34;]
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we create &lt;code&gt;layouts/index.gemini_rss.xml&lt;/code&gt; with the following content:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;rss version=&amp;#34;2.0&amp;#34; xmlns:atom=&amp;#34;http://www.w3.org/2005/Atom&amp;#34;&amp;gt;
  &amp;lt;channel&amp;gt;
    &amp;lt;title&amp;gt;{{ .Site.Title }}&amp;lt;/title&amp;gt;
    &amp;lt;description&amp;gt;{{ i18n &amp;#34;description&amp;#34; }}&amp;lt;/description&amp;gt;
    &amp;lt;link&amp;gt;{{ (replace .Permalink &amp;#34;https://&amp;#34; &amp;#34;gemini://&amp;#34;) | safeURL }}&amp;lt;/link&amp;gt;
    &amp;lt;atom:link href=&amp;#34;{{ .Permalink | safeURL }}feed.xml&amp;#34; rel=&amp;#34;self&amp;#34; type=&amp;#34;application/rss+xml&amp;#34; /&amp;gt;
    {{- range .RegularPages }}
    &amp;lt;item&amp;gt;
      &amp;lt;title&amp;gt;{{ .Title }}&amp;lt;/title&amp;gt;
      &amp;lt;link&amp;gt;{{ (replace .Permalink &amp;#34;https://&amp;#34; &amp;#34;gemini://&amp;#34;) | safeURL }}&amp;lt;/link&amp;gt;
      &amp;lt;pubDate&amp;gt;{{ .Date.Format &amp;#34;Mon, 02 Jan 2006 15:04:05 -0700&amp;#34; | safeHTML }}&amp;lt;/pubDate&amp;gt;
      &amp;lt;guid&amp;gt;{{ (replace .Permalink &amp;#34;https://&amp;#34; &amp;#34;gemini://&amp;#34;) | safeURL }}&amp;lt;/guid&amp;gt;
    &amp;lt;/item&amp;gt;
    {{ end }}
  &amp;lt;/channel&amp;gt;
&amp;lt;/rss&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The RSS feed is now available on &lt;code&gt;/feed.xml&lt;/code&gt;.&lt;/p&gt;
&lt;h2 id=&#34;export&#34;&gt;Export&lt;/h2&gt;
&lt;p&gt;I use &lt;code&gt;rsync&lt;/code&gt; to easily export my files to the server:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;hugo

rsync -avz --no-perms --no-owner --no-group \
      --no-times --delete public/ vps:/var/gemini

rm -rf public
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This last folder is then read by a gemini server, as explained in the previous article:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/discovering-the-gemini-protocol/&#34;&gt;Discovering the Gemini protocol&lt;/a&gt;&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Discovering the Gemini protocol</title>
      <link>https://sylvaindurand.org/discovering-the-gemini-protocol/</link>
      <pubDate>Thu, 03 Dec 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/discovering-the-gemini-protocol/</guid>
      <description>&lt;p&gt;Recently, I made the discovery of the Gemini protocol, developed earlier this year, and I must say I was immediately quite excited about it.&lt;/p&gt;
&lt;p&gt;I miss the web of 20 years ago: simpler, open, where you used to browse directories to find some small websites, often made by passionate amateurs. All the content was available, there were no barriers, no social networks, no tracking. The pages did not exceed a few tens of kilobytes.&lt;/p&gt;
&lt;p&gt;Above all, we used to meet people there: small personal sites, forums and IRC chats were meeting places where one could share and exchange a lot of things.&lt;/p&gt;
&lt;p&gt;Internet has been privatized. The small web still exists, but is buried and hardly appears in search engines anymore. There is more content and people than ever before, and yet one quickly locks oneself into the same routines and circles. Web languages have become so complex that building a new browser has become impossible. We have built an oligopoly.&lt;/p&gt;
&lt;p&gt;Gemini takes the daring step of starting from scratch: rather than starting from scratch with HTTP and HTML, it reinvents them, in a deliberately minimalist and non-extensible way.&lt;/p&gt;
&lt;h2 id=&#34;gemini-server-with-agate&#34;&gt;Gemini server with Agate&lt;/h2&gt;
&lt;p&gt;It is said that Gemini is designed so that a server or client can be designed in less than 24 hours. In fact, there are already a large number of alternatives! I finally chose Agate.&lt;/p&gt;
&lt;p&gt;On my server under Debian, I directly install the binaries from Github.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;gunzip agate.x86_64-unknown-linux-gnu.gz
mv agate.x86_64-unknown-linux-gnu agate
chmod +x agate
sudo mv agate /usr/local/bin/agate
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I gives the correct writes to &lt;code&gt;/var/gemini&lt;/code&gt; (assuming the user is part of &lt;code&gt;www-data&lt;/code&gt; group):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mkdir /var/gemini
sudo chown -R www-data:www-data /var/gemini
sudo chmod -R g+rwX /var/gemini
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The server is then simply started with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;agate --content /var/gemini/ --hostname domain.tld
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The space will then be available at &lt;code&gt;gemini://domain.tld&lt;/code&gt;. To start it at boot, I use &lt;code&gt;systemd&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# /etc/systemd/system/agate.service
[Unit]
Description=Agate

[Service]
Type=simple
Restart=always
RestartSec=5
Environment=&amp;#34;PYTHONUNBUFFERED=1&amp;#34;
ExecStart=agate --content /var/gemini/ --hostname domain.tld
StandardOutput=file:/var/log/gemini.log
StandardError=file:/var/log/gemini_error.log

[Install]
WantedBy=default.target
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can then start it with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo systemctl start agate
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To activate it on reboot:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo systemctl enable agate
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;first-page&#34;&gt;First page&lt;/h2&gt;
&lt;p&gt;Gemini uses simple text files, with the extension &lt;code&gt;.gmi&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;The specification is particularly simple! Text, without any formating. Possibility to make headings, codes and quotations with a markdown-like language. The links have original syntax with &amp;ldquo;=&amp;gt;&amp;rdquo;.&lt;/p&gt;
&lt;p&gt;An &lt;code&gt;index.gmi&lt;/code&gt; located in &lt;code&gt;/var/gemini&lt;/code&gt; should now be available with a Gemini client.&lt;/p&gt;
&lt;h2 id=&#34;gemini-client&#34;&gt;Gemini client&lt;/h2&gt;
&lt;p&gt;As with servers, there are many possible clients. I chose Amfora, which I find very pleasant to use, and which has the taste of being directly available with &lt;code&gt;pacman&lt;/code&gt;.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo pacman -Syu amfora
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;first-impressions&#34;&gt;First impressions&lt;/h2&gt;
&lt;p&gt;Of course, this minimalist tool will only be of interest to a very few. The world on Gemini is very small. A few pages allow to list the servers, and a small search engine is active. A few hundred sites exist, not all of them are active.&lt;/p&gt;
&lt;p&gt;On the other hand, browsing these pages allowed me to discover many individuals, with their blogs (or rather their gemlog), and I took the time to read artisanal content that I hadn&amp;rsquo;t chosen (or that hadn&amp;rsquo;t been chosen for me), which hadn&amp;rsquo;t happened for a long time!&lt;/p&gt;
&lt;p&gt;Obviously, this protocol will not supplant the web, and it does not pretend to do so. I don&amp;rsquo;t know if it will gather a sufficient community to live by itself (even if some interesting names, including one of the creators of Sway are there!). But I wish it to find his niche.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Dynamic wallpapers with Sway</title>
      <link>https://sylvaindurand.org/dynamic-wallpapers-with-sway/</link>
      <pubDate>Wed, 02 Dec 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/dynamic-wallpapers-with-sway/</guid>
      <description>&lt;p&gt;During the last few months, I fell in love with Sway, a tiling window manager modeled on i3 that runs natively under Wayland. I found there all the efficiency and all my habits acquired under i3, but with a much smoother and more responsive display.&lt;/p&gt;
&lt;p&gt;All the applications I use run very smoothly, and I am discovering the joy of a responsive display without tearing. Firefox in particular has an incredibly smooth scroll with a touchpad, which until now only existed under macOS.&lt;/p&gt;
&lt;p&gt;On a daily basis, I use &lt;code&gt;waybar&lt;/code&gt; for displaying workspaces and status bar, &lt;code&gt;kitty&lt;/code&gt; for the  terminal emulator and &lt;code&gt;wofi&lt;/code&gt; as an launcher. All the applications I use every day are Wayland native, with the exception of &lt;code&gt;steam&lt;/code&gt; and &lt;code&gt;gimp&lt;/code&gt;: for these, &lt;code&gt;xwayland&lt;/code&gt; makes the gateway with unfortunately a lack of HiDPI support for the moment which results in pixelized applications.&lt;/p&gt;
&lt;p&gt;The only thing I regretted however, although useless and fancy, is to be able to automate a wallpaper change. It is managed by &lt;code&gt;swaybg&lt;/code&gt; which, when restarted, displays a grey screen for a moment.&lt;/p&gt;
&lt;h2 id=&#34;reloading-the-wallpaper-without-a-grey-blink&#34;&gt;Reloading the wallpaper without a grey blink&lt;/h2&gt;
&lt;p&gt;The trick is not to relaunch &lt;code&gt;swaybg&lt;/code&gt;, but to create a new instance and then kill the old one.&lt;/p&gt;
&lt;p&gt;Let&amp;rsquo;s say you launch your wallpaper with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;swaybg -i image1.png -m fill &amp;amp;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The process identifier (PID) of the last command is automatically stored in &lt;code&gt;$!&lt;/code&gt;. We record it in a variable:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;PID=$!
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;When desired, we can launch a second instance with a second wallpaper. This one will not appear at the moment because the first instance is still running:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;swaybg -i image2.png -m fill &amp;amp;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The wallpaper will then refresh, without a gray screen, as soon as the first instance is killed:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;kill $PID
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;random-wallpaper-change&#34;&gt;Random wallpaper change&lt;/h2&gt;
&lt;p&gt;Suppose we have a folder &lt;code&gt;img/&lt;/code&gt; containing several images. It is possible to select one of them randomly with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;find img/. -type f | shuf -n1
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To randomly change the wallpaper, you can then use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;swaybg -i $(find img/. -type f | shuf -n1) -m fill &amp;amp;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;One can then create, on this basis, a small script that changes the wallpaper, for example every ten minutes (600 seconds):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
swaybg -i $(find img/. -type f | shuf -n1) -m fill &amp;amp;
OLD_PID=$!
while true; do
    sleep 600
    swaybg -i $(find img/. -type f | shuf -n1) -m fill &amp;amp;
    NEXT_PID=$!
    sleep 5
    kill $OLD_PID
    OLD_PID=$NEXT_PID
done
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Make it executable with &lt;code&gt;chmod +x&lt;/code&gt;, then you can load it automatically with Sway by adding, in your sway config:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;exec &amp;#34;cd your_script_folder &amp;amp;&amp;amp; ./your_script.sh&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;A better way would be to use &lt;code&gt;pidof swaybg&lt;/code&gt;, then &lt;code&gt;kill&lt;/code&gt;: it is illustrated in the next section.&lt;/p&gt;
&lt;h2 id=&#34;dynamic-wallpaper-depending-of-the-hour-of-the-day&#34;&gt;Dynamic wallpaper depending of the hour of the day&lt;/h2&gt;
&lt;p&gt;I recently made a dynamic wallpaper, based on the following animation:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://louie.co.nz/25th_hour/&#34;&gt;Louis Coyle&amp;rsquo;s 25th hour&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;The animation was recorded and transformed into 144 images, 6 images per hour, making it possible to obtain a wallpaper that changes every 10 minutes.&lt;/p&gt;
&lt;p&gt;The script uses this command to round the current time to ten minutes:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
#!/bin/sh
cd projets/lakeside
while true; do
    PID=`pidof swaybg`
    swaybg -i ./img/$(date -u -d @$((($(date -u +%s) / 600) * 600)) &amp;#34;+%Hh%M&amp;#34;).png -m fill &amp;amp;
    sleep 1
    kill $PID
    sleep 599
done
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Update notifications with libnotify</title>
      <link>https://sylvaindurand.org/update-notifications-with-libnotify/</link>
      <pubDate>Sun, 18 Oct 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/update-notifications-with-libnotify/</guid>
      <description>&lt;p&gt;The libnotify library allows you to send desktop notifications to a notification daemon commonly used under Linux. Here we will see how to successfully update notifications already displayed.&lt;/p&gt;
&lt;h2 id=&#34;with-notify-send&#34;&gt;With notify-send?&lt;/h2&gt;
&lt;p&gt;This library offers the &lt;code&gt;notify-send&lt;/code&gt; command, which displays a notification directly on the desktop:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;notify-send &amp;#34;Notification title&amp;#34; &amp;#34;Notification description&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;But what if you want to update or delete a notification already displayed? If this command is executed several times, the notifications pile up rather than updating the one that has just been sent.&lt;/p&gt;
&lt;p&gt;The manual (&lt;code&gt;man notify-send&lt;/code&gt;) shows us that the options are rather short and do not allow us to expect much:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;-?, --help
-u, --urgency=LEVEL
-t, --expire-time=TIME
-i, --icon=ICON[,ICON...]
-c, --category=TYPE[,TYPE...]
-h, --hint=TYPE:NAME:VALUE
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We will therefore have to move away from it and return to the fundamentals.&lt;/p&gt;
&lt;h2 id=&#34;using-gdbus&#34;&gt;Using gdbus&lt;/h2&gt;
&lt;p&gt;&lt;code&gt;notify-send&lt;/code&gt; simply sends information as defined in the &amp;ldquo;Desktop Notifications&amp;rdquo; specification, which we will be able to do ourselves with &lt;code&gt;gdbus&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;The following function will allow us to obtain the same result as before:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;gdbus call \
    --session \
    --dest org.freedesktop.Notifications \
    --object-path /org/freedesktop/Notifications \
    --method org.freedesktop.Notifications.Notify \
    &amp;#34;identifier&amp;#34; \
    &amp;#34;1&amp;#34; \
    &amp;#34;&amp;#34; \
    &amp;#34;Notification title&amp;#34; \
    &amp;#34;Notification description&amp;#34; \
    &amp;#34;[]&amp;#34; \
    &amp;#34;{}&amp;#34; \
    &amp;#34;2000&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The second identifier (here &lt;code&gt;1&lt;/code&gt;) concerns the id of the notification we wish to replace, we will come back to this shortly. The next identifier allows you to define an icon. &lt;code&gt;&amp;quot;[]&amp;quot;&lt;/code&gt; allows you to define actions, &lt;code&gt;&amp;quot;{}&amp;quot;&lt;/code&gt; to define hints, and finally the last argument &lt;code&gt;2000&lt;/code&gt; presents the time during which the notification must remain visible (in milliseconds).&lt;/p&gt;
&lt;p&gt;Once this command is executed, the system returns a response that looks like :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;(uint32 13,)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This number, here &lt;code&gt;13&lt;/code&gt;, is the id of the notification that we will be able to replace.&lt;/p&gt;
&lt;p&gt;This means that the following command will not create a new notification, but will replace the one we just created:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;gdbus call \
    --session \
    --dest org.freedesktop.Notifications \
    --object-path /org/freedesktop/Notifications \
    --method org.freedesktop.Notifications.Notify \
    &amp;#34;identifier&amp;#34; \
    &amp;#34;13&amp;#34; \
    &amp;#34;&amp;#34; \
    &amp;#34;My updated title&amp;#34; \
    &amp;#34;My updated description&amp;#34; \
    &amp;#34;[]&amp;#34; \
    &amp;#34;{}&amp;#34; \
    &amp;#34;2000&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;getting-notification-id&#34;&gt;Getting notification id&lt;/h2&gt;
&lt;p&gt;All that remains is to automatically retrieve this number, and to reinject it as an argument in our function.&lt;/p&gt;
&lt;p&gt;To retrieve it, filter the previous function with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;| sed &amp;#39;s/[^ ]* //; s/,.//&amp;#39;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We could then store the number in a temporary file, for example with &lt;code&gt;&amp;gt; /tmp/.notif&lt;/code&gt;. However, to avoid using the hard disk or the SSD, let&amp;rsquo;s go directly to the RAM :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;gt; ${XDG_RUNTIME_DIR}/.notif
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This number can be initiated at startup with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;echo &amp;#39;1&amp;#39; &amp;gt; ${XDG_RUNTIME_DIR}/.notif
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is then easily retrieved with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;notif=`cat ${XDG_RUNTIME_DIR}/.notif`
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;result&#34;&gt;Result&lt;/h2&gt;
&lt;p&gt;The following code, executed several times, will then update the notification :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;notif=`cat ${XDG_RUNTIME_DIR}/.notif`
gdbus call \
    --session \
    --dest org.freedesktop.Notifications \
    --object-path /org/freedesktop/Notifications \
    --method org.freedesktop.Notifications.Notify \
    &amp;#34;identifier&amp;#34; \
    &amp;#34;`echo $notif`&amp;#34; \
    &amp;#34;&amp;#34; \
    &amp;#34;My updated title&amp;#34; \
    &amp;#34;My updated description&amp;#34; \
    &amp;#34;[]&amp;#34; \
    &amp;#34;{}&amp;#34; \
    &amp;#34;2000&amp;#34; \
| sed &amp;#39;s/[^ ]* //; s/,.//&amp;#39; &amp;gt; ${XDG_RUNTIME_DIR}/.notif
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Arch Linux on Macbook Pro late 2013</title>
      <link>https://sylvaindurand.org/installing-arch-linux-on-macbook-pro-late-2013/</link>
      <pubDate>Sun, 12 Jan 2020 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/installing-arch-linux-on-macbook-pro-late-2013/</guid>
      <description>&lt;p&gt;Arch Linux is a distribution whose installation procedure may seem demanding, but which in return offers complete control over what is installed, but above all allows you to experiment with and understand many of the basic elements of how a Linux system works.&lt;/p&gt;
&lt;p&gt;This article details the specific steps that allow me to get a minimum functional installation on a 13&amp;quot; MacBook Pro, late 2013 (11.x). This one is characterized by a few specificities, notably a recalcitrant Broadcom wifi card.&lt;/p&gt;
&lt;p&gt;It is strictly discouraged to follow these commands blindly, because Arch Linux is a distribution that is very regularly updated and because each system is different.&lt;/p&gt;
&lt;p&gt;Start by opening and following the installation guide and the specific page on the Arch Linux Wiki, which are very detailed. This article can serve as a complement of the intallation guide.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://wiki.archlinux.org/title/installation_guide&#34;&gt;Arch Wiki: Installation guide&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://wiki.archlinux.org/index.php/MacBookPro11,x&#34;&gt;Arch Wiki: Macbook Pro 11.x&lt;/a&gt;&lt;/p&gt;
&lt;h3 id=&#34;activating-wifi-during-the-installation-process&#34;&gt;Activating Wifi during the installation process&lt;/h3&gt;
&lt;p&gt;This is the most blocking part compared to the usual computers. The MacBook Pro for late 2013 usually comes with a Broadcom wifi card, which is known to be difficult to use with regular drivers.&lt;/p&gt;
&lt;p&gt;The purpose of this part is only to have a network connection to do the installation, we are not yet configuring the wifi for our final system. If your system is already installed and you want to have a working wifi, you can go further down on this page.&lt;/p&gt;
&lt;p&gt;To check which card is on board, use the command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;lspci -k
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;In my case, the lines concerned are as follows:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Network controller: Broadcom Inc. and subsidiaries BCM4360 802.11ac Wireless Network Adapter (rev 03)
Subsystem: Apple Inc. BCM3460 802.11ac Wireless Network AdapterKernel driver in use: bcma-pci-bridge
Kernel modules: bcma, wl
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If the &lt;code&gt;iw dev&lt;/code&gt; command doesn&amp;rsquo;t return anything, it is because the driver (&lt;code&gt;broadcom-wl&lt;/code&gt; in our case), although present in the installer, is not loaded. We start by disabling the concurrent modules, which could be run:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;rmmod b43 bcma ssb wl
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we activate:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;modprobe wl
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If all goes well, &lt;code&gt;iw dev&lt;/code&gt; now displays something:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;phy#1
    Interface wlan0
        ifindexwdev 0x100000001
        addr 00:00:00:00:00:00
        type managedtxpower 200.00 dBm
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can then activate the connection and then scan the surrounding networks (if the interface has, in the result of the previous command, a name other than &lt;code&gt;wlan0&lt;/code&gt;, you have to adapt it):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ifconfig wlan0 up
iwlist wlan0 scan
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If you can&amp;rsquo;t connect, you can still use a small USB wifi adapter to continue the installation, or use the &amp;ldquo;modem&amp;rdquo; mode of your Android phone.&lt;/p&gt;
&lt;p&gt;To connect to the wifi, use the command (where &lt;code&gt;ssid&lt;/code&gt; and &lt;code&gt;password&lt;/code&gt; are respectively the name and password of your access point):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;wpa_supplicant -B -i wlan0 -c &amp;lt;(wpa_passphrase &amp;#34;ssid&amp;#34; &amp;#34;password&amp;#34;)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Be careful not to put a space between the &lt;code&gt;&amp;lt;&lt;/code&gt; and the &lt;code&gt;(&lt;/code&gt;, to avoid getting the error &lt;code&gt;zsh: number expected&lt;/code&gt;. Also, depending on the situation, it may not work on some channels in the 5 GHz band. In this case, the simplest way is to reconfigure your wifi on the 2.4 GHz band.&lt;/p&gt;
&lt;p&gt;We get an IP address with the following command (which should display a succession of communications):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;dhcpcd
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If you get the message &lt;code&gt;no interface have a carrier&lt;/code&gt;, you can try running &lt;code&gt;dhcpcd --release&lt;/code&gt; and then &lt;code&gt;dhcpcd&lt;/code&gt; again.&lt;/p&gt;
&lt;p&gt;We&amp;rsquo;re checking that we&amp;rsquo;re connected with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ping archlinux.org
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installing-wifi-for-the-first-launch&#34;&gt;Installing Wifi for the first launch&lt;/h3&gt;
&lt;p&gt;We still have to install our driver on our system to have a network connection on reboot. Let&amp;rsquo;s start by retrieving the tools to be able to connect, while &lt;code&gt;arch-chroot&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -Syu networkmanager
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It will allow us, after the reboot, to simply connect with &lt;code&gt;nmtui&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;With a Broadcom BCM4360 (rev 03) card, we will install the &lt;code&gt;broadcom-wl&lt;/code&gt; package in its DKMS version. This will allow it to be upgraded along with the Linux kernels.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -Syu linux-headers broadcom-wl-dkms
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;red-light-in-the-jack-audio-output&#34;&gt;Red light in the jack audio output&lt;/h3&gt;
&lt;p&gt;I had a lot of trouble to get rid of the red light in the jack output. I manage to do it with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo pacman -S alsa-utils
sudo hda-verb /dev/snd/hwC1D0 0x21 SET_PIN_WID 0x00
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Outlook emails analytics with Python</title>
      <link>https://sylvaindurand.org/outlook-email-analytics-with-python/</link>
      <pubDate>Sun, 15 Dec 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/outlook-email-analytics-with-python/</guid>
      <description>&lt;p&gt;Microsoft Outlook uses a proprietary data format, &amp;ldquo;PST&amp;rdquo; (Personal Storage Table), to store emails, appointments or tasks. It was not until 2010 that the specifications of this format were made public, which probably explains why few tools are available to open it and use its data.&lt;/p&gt;
&lt;p&gt;Under Python, however, there is the libpff library that allows most metadata to be exported. The following lines show how to use it to graph incoming emails.&lt;/p&gt;
&lt;h2 id=&#34;installation-of-libpff&#34;&gt;Installation of libpff&lt;/h2&gt;
&lt;p&gt;Like all Python libraries, libpff can be installed with &lt;code&gt;pip&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip install libpff-python
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;However, at the time of writing, the version proposed by pip (20161119) does not allow to retrieve the time of the messages. Corrections have been made in a more recent version (20190725), available with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip install libpff-python-ratom
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;retrieving-emails&#34;&gt;Retrieving emails&lt;/h2&gt;
&lt;h3 id=&#34;file-opening&#34;&gt;File opening&lt;/h3&gt;
&lt;p&gt;First we load the library:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;import pypff
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we open our file: the opening can nevertheless be quite long depending on the size of your archive.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pst = pypff.file()
pst.open(&amp;#34;mails.pst&amp;#34;)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;metadata-extraction&#34;&gt;Metadata extraction&lt;/h3&gt;
&lt;p&gt;It is possible to navigate through the structure using the functions offered by the library, from the root:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;root = pst.get_root_folder()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To extract the data, a recursive function can then be used:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;def parse_folder(base):
    messages = []
    for folder in base.sub_folders:
        if folder.number_of_sub_folders:
            messages += parse_folder(folder)
        print(folder.name)
        for message in folder.sub_messages:
            messages.append({
                &amp;#34;subject&amp;#34;: message.subject,
                &amp;#34;sender&amp;#34;: message.sender_name,
                &amp;#34;datetime&amp;#34;: message.client_submit_time
            })
    return messages

messages = parse_folder(root)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This function can be quite slow depending on the number of messages (about 300 messages are processed per second on my computer).&lt;/p&gt;
&lt;p&gt;Once this is done, can then import this file into Pandas:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;import pandas as pd
df = pd.DataFrame(messages)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;time-conversion&#34;&gt;Time conversion&lt;/h3&gt;
&lt;p&gt;The hours extracted from the file are stored in UTC format, which means that you will have to reprocess the correct time zone. First, the time zone is declared UTC, then converted to the desired time zone:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;df[&amp;#39;datetime&amp;#39;] = df[&amp;#39;datetime&amp;#39;].dt.tz_localize(tz=&amp;#39;UTC&amp;#39;)
df[&amp;#39;datetime&amp;#39;] = df[&amp;#39;datetime&amp;#39;].dt.tz_convert(tz=&amp;#39;Europe/Paris&amp;#39;)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;plot-example&#34;&gt;Plot example&lt;/h3&gt;
&lt;p&gt;We will plot a point cloud showing the arrival time of emails by date. To do this, two columns are created with the coordinates of the points to be traced:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;df[&amp;#39;hour&amp;#39;] = df[&amp;#39;datetime&amp;#39;].dt.hour + df[&amp;#39;datetime&amp;#39;].dt.minute / 60
df[&amp;#39;date&amp;#39;] = df[&amp;#39;datetime&amp;#39;].dt.year + df[&amp;#39;datetime&amp;#39;].dt.dayofyear / 365
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we trace:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;import matplotlib.pyplot as plt
import seaborn as sns

plt.clf()
ax = sns.scatterplot(x=&amp;#34;date&amp;#34;, y=&amp;#34;hour&amp;#34;, s=3, alpha=.3, linewidth=0, marker=&amp;#34;.&amp;#34;, data=df)
ax.set(xlim=(2014.5,2020), ylim=(7,25))
ax.invert_yaxis()
sns.despine()
ax.get_figure().savefig(&amp;#34;plot.png&amp;#34;, dpi=400)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This gives us:&lt;/p&gt;
&lt;p&gt;&lt;img src=&#34;mails.png&#34; alt=&#34;Scatter plot of emails depending of the hour and date&#34;&gt;&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Send emails with msmtp</title>
      <link>https://sylvaindurand.org/send-emails-with-msmtp/</link>
      <pubDate>Sat, 03 Aug 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/send-emails-with-msmtp/</guid>
      <description>&lt;p&gt;There are many situations in which sending emails from a server can be useful, either because applications require it, or to do monitoring, such as being notified of security updates available on your system or the proper execution of cron tasks.&lt;/p&gt;
&lt;p&gt;However, configuring a mail server with &lt;code&gt;postfix&lt;/code&gt;, &lt;code&gt;exim&lt;/code&gt; or &lt;code&gt;sendmail&lt;/code&gt; requires a large number of steps to be performed and a careful configuration, due to all the devices set up to fight spam (including DKIM, SPF, DMARC, static IP and Reverse DNS, white list&amp;hellip;), which makes the task very tedious for a simple personal server.&lt;/p&gt;
&lt;p&gt;Nevertheless, it is possible to simply use an existing email account, and send via SMTP emails as a traditional email client would.&lt;/p&gt;
&lt;p&gt;Until now, I used to use ssmtp for this, but this one is no longer maintained, and it is no longer possible to install it from Debian 10 Buster. We will use msmtp, which is just as easy to use and efficient.&lt;/p&gt;
&lt;h3 id=&#34;installation-of-msmtp&#34;&gt;Installation of msmtp&lt;/h3&gt;
&lt;p&gt;From a Debian based system, you can simply install the following packages :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install msmtp msmtp-mta
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The configuration file is as follows:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo nano /etc/msmtprc
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then use the following settings with the IDs and settings of your email provider:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;defaults
auth           on
tls            on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
logfile        ~/.msmtp.log
account        gmail
host           smtp.gmail.com
port           587
from           username@gmail.com
user           username
password       password
account default : gmail
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Or, with OVH :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;defaults
auth           on
tls            on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
logfile        ~/.msmtp.log
account        ovh
host           ssl0.ovh.net
port           587
from           username@domain.tld
user           username@domain.tld
password       password
account default : ovh
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Once the file has been saved, we can try to send our first emails.&lt;/p&gt;
&lt;h3 id=&#34;test-sending-emails&#34;&gt;Test sending emails&lt;/h3&gt;
&lt;p&gt;It is possible to use &lt;code&gt;msmtp&lt;/code&gt; directly to send your email:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;echo &amp;#34;Message&amp;#34; | mail -s &amp;#34;Title&amp;#34; &amp;lt;email-adress&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;change-the-senders-name&#34;&gt;Change the sender&amp;rsquo;s name&lt;/h3&gt;
&lt;p&gt;It is possible to define, for each user of your server, a personalized sender name when sending emails:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo chfn -f &amp;#39;Custom name for root&amp;#39; root
sudo chfn -f &amp;#39;Custom name for user&amp;#39; &amp;lt;user&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;example-of-use-apticron&#34;&gt;Example of use: apticron&lt;/h3&gt;
&lt;p&gt;If you have a server, you should always be informed of the latest updates available for your system.&lt;/p&gt;
&lt;p&gt;If you use a system based on Debian, and you use &lt;code&gt;apt&lt;/code&gt; to install or update your packages, the little &lt;code&gt;apticron&lt;/code&gt; utility automatically sends you an email as soon as an update is available.&lt;/p&gt;
&lt;p&gt;It is installed with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install apticron
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To indicate your email address, simply change it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo nano /etc/apticron/apticron.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, indicate the address at which you wish to receive the notifications:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;EMAIL=&amp;#34;&amp;lt;your-email&amp;gt;&amp;#34;
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Overlay image in pure CSS</title>
      <link>https://sylvaindurand.org/overlay-image-in-pure-css/</link>
      <pubDate>Fri, 10 May 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/overlay-image-in-pure-css/</guid>
      <description>&lt;p&gt;There is no native solution within browsers to display, on click, a full screen image. Several Javascript libraries have come to fill this gap: Lightbox (which was a precursor, to the point of giving its name to the concept), Fancybox, PhotoSwipe&amp;hellip;&lt;/p&gt;
&lt;p&gt;These solutions are sometimes heavy, whereas if you are only looking for a simple behavior, a few lines of CSS are enough, and no Javascript code is required.&lt;/p&gt;
&lt;h2 id=&#34;principle&#34;&gt;Principle&lt;/h2&gt;
&lt;h3 id=&#34;target-selector&#34;&gt;:target selector&lt;/h3&gt;
&lt;p&gt;We will use the CSS selector &lt;code&gt;:target&lt;/code&gt;, which allows to apply a style to an element when its identifier (&lt;code&gt;id=&amp;quot;&amp;quot;&lt;/code&gt;) is the one of the anchor (&lt;code&gt;#&lt;/code&gt;) in the page URL. To take an example:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;a href=&amp;#34;#myid&amp;#34;&amp;gt;Click to color in red!&amp;lt;/a&amp;gt;
&amp;lt;div id=&amp;#34;myid&amp;#34;&amp;gt;Hello World!&amp;lt;/div&amp;gt;

&amp;lt;style&amp;gt;
div:target {
  color: red;
}
&amp;lt;/style&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Note that this selector actually allows you to add a lot of interactive elements to a page without Javascript, such as showing and hiding an element or a navigation bar.&lt;/p&gt;
&lt;h3 id=&#34;compatibility&#34;&gt;Compatibility&lt;/h3&gt;
&lt;p&gt;According to developer.mozilla.org and caniuse.com, the &lt;code&gt;:target&lt;/code&gt; selector is supported by all browsers released since 2008, and especially since Internet Explorer 9.&lt;/p&gt;
&lt;h2 id=&#34;html&#34;&gt;HTML&lt;/h2&gt;
&lt;p&gt;For each image, the HTML markup will be as simple as possible:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;!-- The link that, when clicked, will display the image in full screen --&amp;gt;
&amp;lt;a href=&amp;#34;#img-id&amp;#34;&amp;gt;
  &amp;lt;img src=&amp;#34;image-thumbnail.png&amp;#34; alt=&amp;#34;Thumbnail&amp;#34;&amp;gt;
&amp;lt;/a&amp;gt;

&amp;lt;!-- The full screen image, hidden by default  --&amp;gt;
&amp;lt;a href=&amp;#34;#_&amp;#34; class=&amp;#34;overlay&amp;#34; id=&amp;#34;img-id&amp;#34;&amp;gt;
  &amp;lt;img src=&amp;#34;image-fullscreen.png&amp;#34; alt=&amp;#34;Fullscreen&amp;#34;&amp;gt;
&amp;lt;/a&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The first line, customizable at will, will display the image in full screen thanks to the link to &lt;code&gt;#img-id&lt;/code&gt;. The second, hidden by default, contains the corresponding identifier.&lt;/p&gt;
&lt;p&gt;If several images are present on the page, it will obviously be necessary to give them a unique identifier for each one, and to match the link.&lt;/p&gt;
&lt;p&gt;The link to &lt;code&gt;#_&lt;/code&gt; has no particular meaning, and could have been replaced by &lt;code&gt;#anything&lt;/code&gt;. It simply aims to cause &lt;code&gt;#img-id&lt;/code&gt; to lose the status &lt;code&gt;:target&lt;/code&gt; and therefore to close the full screen when clicking.&lt;/p&gt;
&lt;h2 id=&#34;css&#34;&gt;CSS&lt;/h2&gt;
&lt;h3 id=&#34;display&#34;&gt;Display&lt;/h3&gt;
&lt;p&gt;The overlay is nothing more than a &lt;code&gt;div&lt;/code&gt; with a fixed position, located at the top left and covering the entire page. We add a &lt;code&gt;flex&lt;/code&gt; property to it to place the image in the center of it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;
.overlay {
  /* Display over the entire page */
  position: fixed;
  z-index: 99;
  top: 0;
  left: 0;
  width: 100%;
  height: 100%;
  background: rgba(0,0,0,0.9);

  /* Horizontal and vertical centering of the image */
  display: flex;
  align-items: center;
  text-align: center;

  /* We hide all this by default */
  visibility: hidden;
}

.overlay img{
  /* Maximum image size */
  max-width: 90%;
  max-height: 90%;

  /* We keep the ratio of the image */
  width: auto;
  height: auto;
}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;activation-on-click&#34;&gt;Activation on click&lt;/h3&gt;
&lt;p&gt;As we have seen previously, we now have to add a &lt;code&gt;visibility: visible&lt;/code&gt; with the selector &lt;code&gt;:target&lt;/code&gt; to display all this when you click on the trigger link.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;.overlay:target {
  visibility: visible;
  outline: none;
  cursor: default;
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We add an &lt;code&gt;outline: none&lt;/code&gt; to avoid the border that is displayed, by default, on several browsers. In addition, &lt;code&gt;cursor: default&lt;/code&gt;, optional, avoids having a &amp;ldquo;hand&amp;rdquo; in place of the cursor on the entire page.&lt;/p&gt;
&lt;h3 id=&#34;animation&#34;&gt;Animation&lt;/h3&gt;
&lt;p&gt;The Javascript libraries mentioned above allowed to have a nice fade effect when opening. Never mind: CSS allows almost any kind of madness in terms of animation.&lt;/p&gt;
&lt;p&gt;We&amp;rsquo;re going to stay sober here, with a slight bland effect, with a very small zoom effect on the image.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;.overlay {
  opacity: 0;
  transition: opacity .3s;
}

.overlay img {
  transform: scale(0.95);
  transition: transform .3s;
}

.overlay:target img {
    transform: scale(1);
}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;full-code&#34;&gt;Full code:&lt;/h3&gt;
&lt;p&gt;Finally, our CSS code became:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;
.overlay {
  position: fixed;
  z-index: 99;
  top: 0;
  left: 0;
  width: 100%;
  height: 100%;
  background: rgba(0,0,0,0.9);
  display: flex;
  align-items: center;
  text-align: center;
  visibility: hidden;
  opacity: 0;
  transition: opacity .3s;
}

.overlay img{
  max-width: 90%;
  max-height: 90%;
  width: auto;
  height: auto;
  transform: scale(0.95);
  transition: transform .3s;
}

.overlay:target {
  visibility: visible;
  outline: none;
  cursor: default;
}

.overlay:target img {
    transform: scale(1);
}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;bonus-shortcode-for-hugo&#34;&gt;Bonus: shortcode for Hugo&lt;/h2&gt;
&lt;p&gt;With the static website generator Hugo, you can easily automate the process with a shortcode. To do so, we create a &lt;code&gt;img.html&lt;/code&gt; file in &lt;code&gt;layouts/shortcodes/&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;a href=&amp;#34;#{{ anchorize (.Get &amp;#34;src&amp;#34;) }}&amp;#34;&amp;gt;
  &amp;lt;img src=&amp;#34;{{.Get &amp;#34;src&amp;#34; }}&amp;#34; alt=&amp;#34;{{.Get &amp;#34;alt&amp;#34; }}&amp;#34; /&amp;gt;
&amp;lt;/a&amp;gt;
&amp;lt;a href=&amp;#34;#_&amp;#34; class=&amp;#34;overlay&amp;#34; id=&amp;#34;{{ anchorize (.Get &amp;#34;src&amp;#34;) }}&amp;#34;&amp;gt;
  &amp;lt;img src=&amp;#34;{{.Get &amp;#34;src&amp;#34; }}&amp;#34; alt=&amp;#34;{{.Get &amp;#34;alt&amp;#34; }}&amp;#34;&amp;gt;
&amp;lt;/a&amp;gt;
{{ .Inner }}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, you just have to add, in your articles:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{{&amp;lt; img src=&amp;#34;image.jpg&amp;#34; alt=&amp;#34;Description&amp;#34; /&amp;gt;}}
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>GPS data from photos with Python</title>
      <link>https://sylvaindurand.org/gps-data-from-photos-with-python/</link>
      <pubDate>Sat, 04 May 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/gps-data-from-photos-with-python/</guid>
      <description>&lt;p&gt;Most recent cameras and mobile phones record photographs with geographical data (longitude, latitude, but also altitude). If this data is readable with most photo and file explorer software, it is also possible to access it with Python.&lt;/p&gt;
&lt;h2 id=&#34;reading-metadata&#34;&gt;Reading metadata&lt;/h2&gt;
&lt;p&gt;The Python Imaging Library (PIL) provides easy access to EXIF data with the function &lt;code&gt;_getexif()&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;It is easily installed, under Python3, with the fork Pillow. We use the following command (depending on your configuration, &lt;code&gt;pip3&lt;/code&gt; can be directly accessible with &lt;code&gt;pip&lt;/code&gt;):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip3 install pillow
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;However, this results in an indexed dictionary with numerical identifiers. To get the corresponding names, we use &lt;code&gt;ExifTags&lt;/code&gt; and rename the keys of the dictionary:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;from PIL import Image
from PIL.ExifTags import TAGS, GPSTAGS

def get_exif(filename):
    exif = Image.open(filename)._getexif()

    if exif is not None:
        for key, value in exif.items():
            name = TAGS.get(key, key)
            exif[name] = exif.pop(key)

        if &amp;#39;GPSInfo&amp;#39; in exif:
            for key in exif[&amp;#39;GPSInfo&amp;#39;].keys():
                name = GPSTAGS.get(key,key)
                exif[&amp;#39;GPSInfo&amp;#39;][name] = exif[&amp;#39;GPSInfo&amp;#39;].pop(key)

    return exif

exif = get_exif(&amp;#39;image.jpg&amp;#39;)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The &lt;code&gt;exif&lt;/code&gt; variable then contains all the metadata of the image: objective, aperture, speed, author&amp;hellip; Our GPS data is stored in &lt;code&gt;exif[&#39;GPSInfo&#39;]&lt;/code&gt;, in the following form:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{&amp;#39;GPSLongitude&amp;#39;: ((19, 1), (31, 1), (5139, 100)),
 &amp;#39;GPSAltitudeRef&amp;#39;: b&amp;#39;\x00&amp;#39;,
 &amp;#39;GPSAltitude&amp;#39;: (92709, 191),
 &amp;#39;GPSTimeStamp&amp;#39;: ((13, 1), (18, 1), (42, 1)),
 &amp;#39;GPSHPositioningError&amp;#39;: (10, 1),
 &amp;#39;GPSLatitudeRef&amp;#39;: &amp;#39;N&amp;#39;,
 &amp;#39;GPSLatitude&amp;#39;: ((63, 1), (40, 1), (5908, 100)),
 &amp;#39;GPSLongitudeRef&amp;#39;: &amp;#39;W&amp;#39;}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;getting-gps-data&#34;&gt;Getting GPS data&lt;/h2&gt;
&lt;h3 id=&#34;sexagesimal-form&#34;&gt;Sexagesimal form&lt;/h3&gt;
&lt;p&gt;Geographic coordinates are usually expressed in the sexagesimal system, or DMS for degrees (°), minutes (′) and seconds (″). The unit is the degree of angle (1 turn = 360°), then the minute of angle (1° = 60′), then the second of angle (1° = 3 600″).&lt;/p&gt;
&lt;p&gt;Compared to the equatorial plane, the latitude is completed by a letter &lt;code&gt;N&lt;/code&gt; (hemisphere) or &lt;code&gt;S&lt;/code&gt; depending on whether one is located in the northern or southern hemisphere. Compared to the Greenwich meridian, the longitude is completed by a letter &lt;code&gt;W&lt;/code&gt; or &lt;code&gt;E&lt;/code&gt; depending on whether you are located in the west or east.&lt;/p&gt;
&lt;p&gt;The data is directly accessible in &lt;code&gt;exif[&#39;GPSInfo&#39;]&lt;/code&gt; to be able to output this format:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;def get_coordinates(info):
    for key in [&amp;#39;Latitude&amp;#39;, &amp;#39;Longitude&amp;#39;]:
        if &amp;#39;GPS&amp;#39;+key in info and &amp;#39;GPS&amp;#39;+key+&amp;#39;Ref&amp;#39; in info:
            e = info[&amp;#39;GPS&amp;#39;+key]
            ref = info[&amp;#39;GPS&amp;#39;+key+&amp;#39;Ref&amp;#39;]
            info[key] = ( str(e[0][0]/e[0][1]) + &amp;#39;°&amp;#39; +
                          str(e[1][0]/e[1][1]) + &amp;#39;′&amp;#39; +
                          str(e[2][0]/e[2][1]) + &amp;#39;″ &amp;#39; +
                          ref )

    if &amp;#39;Latitude&amp;#39; in info and &amp;#39;Longitude&amp;#39; in info:
        return [info[&amp;#39;Latitude&amp;#39;], info[&amp;#39;Longitude&amp;#39;]]

get_coordinates(exif[&amp;#39;GPSInfo&amp;#39;])
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We get:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[&amp;#39;63.0°40.0′59.08″ N&amp;#39;, &amp;#39;19.0°31.0′51.39″ W&amp;#39;]
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;decimal-form&#34;&gt;Decimal form&lt;/h3&gt;
&lt;p&gt;To obtain automated geographic data processing, a decimal format is often more convenient: minutes are divided by 60 and seconds by 3600 and added together. Latitude is negative in the Southern Hemisphere (S), and west of the Greenwich Meridian (W). The calculation is then very simple:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;def get_decimal_coordinates(info):
    for key in [&amp;#39;Latitude&amp;#39;, &amp;#39;Longitude&amp;#39;]:
        if &amp;#39;GPS&amp;#39;+key in info and &amp;#39;GPS&amp;#39;+key+&amp;#39;Ref&amp;#39; in info:
            e = info[&amp;#39;GPS&amp;#39;+key]
            ref = info[&amp;#39;GPS&amp;#39;+key+&amp;#39;Ref&amp;#39;]
            info[key] = ( e[0][0]/e[0][1] +
                          e[1][0]/e[1][1] / 60 +
                          e[2][0]/e[2][1] / 3600
                        ) * (-1 if ref in [&amp;#39;S&amp;#39;,&amp;#39;W&amp;#39;] else 1)

    if &amp;#39;Latitude&amp;#39; in info and &amp;#39;Longitude&amp;#39; in info:
        return [info[&amp;#39;Latitude&amp;#39;], info[&amp;#39;Longitude&amp;#39;]]

get_decimal_coordinates(exif[&amp;#39;GPSInfo&amp;#39;])
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We get:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;[63.683077777777775, -19.530941666666667]
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;with-gpsphoto&#34;&gt;With GPSPhoto&lt;/h2&gt;
&lt;p&gt;Since the end of 2018, the Python library &lt;code&gt;GPSPhoto&lt;/code&gt; allows to obtain directly the geographical coordinates of a photo.&lt;/p&gt;
&lt;p&gt;It is installed with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip3 install GPSPhoto
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can now use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;from GPSPhoto import gpsphoto
gpsphoto.getGPSData(&amp;#39;image.jpg&amp;#39;)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We get:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{&amp;#39;Latitude&amp;#39;: 63.683077777777775,
 &amp;#39;Longitude&amp;#39;: -19.530941666666667,
 &amp;#39;Altitude&amp;#39;: 485.3874345549738,
 &amp;#39;UTC-Time&amp;#39;: &amp;#39;13:18:42&amp;#39;,
 &amp;#39;Date&amp;#39;: &amp;#39;09/03/2018&amp;#39;}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Nevertheless, according to the file, GPSPhoto tends to easily return errors that, in my case, make it impossible to automate a large number of photos:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ValueError: malformed node or string: &amp;lt;_ast.BinOp object at 0x10ea16320&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;automation&#34;&gt;Automation&lt;/h2&gt;
&lt;p&gt;If you want to recover metadata from a set of photos, you can iterate to a folder (and its subfolders).&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;import os
points = []
for r, d, f in os.walk(path):
    for file in f:
        if file.lower().endswith((&amp;#39;.png&amp;#39;, &amp;#39;.jpg&amp;#39;, &amp;#39;.jpeg&amp;#39;)):
            filepath = os.path.join(r, file)
            exif = get_exif(filepath)
            if exif is not None and &amp;#39;GPSInfo&amp;#39; in exif:
                latlong = get_decimal_coordinates(exif[&amp;#39;GPSInfo&amp;#39;])
                if latlong is not None:
                    points.append(latlong)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can then export &lt;code&gt;points&lt;/code&gt; to display it on a map, for example with Leaflet.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Surveillance camera with Raspberry Pi</title>
      <link>https://sylvaindurand.org/surveillance-camera-with-raspberry-pi/</link>
      <pubDate>Wed, 24 Apr 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/surveillance-camera-with-raspberry-pi/</guid>
      <description>&lt;p&gt;While connected surveillance cameras can be useful, they are also likely to have serious security breaches. They are thus at the origin of one of the most important DDOS attacks, or are sometimes publicly visible. In fact, it is very difficult to identify the origin of the cameras; no guarantee can be given on the security level or the durability of the manufacturer&amp;rsquo;s servers.&lt;/p&gt;
&lt;p&gt;However, it is very simple – and very economical – to be able to make a simple monitoring system yourself using a Raspberry Pi. The Raspberry Pi Foundation offers a small camera module). Many other brands exist, and the following article will also work with a simple USB webcam.&lt;/p&gt;
&lt;h2 id=&#34;camera-activation&#34;&gt;Camera activation&lt;/h2&gt;
&lt;p&gt;First connect the camera to the Raspberry Pi using the correct interface. Apply yourself to this connection: it took me a long time to try to operate this camera before I realized that the web was not inserted to the bottom of the connector.&lt;/p&gt;
&lt;p&gt;It is then necessary to activate the camera with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo raspi-config
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Select &lt;code&gt;Interfacing Options&lt;/code&gt; » &lt;code&gt;P1 Camera&lt;/code&gt; » &lt;code&gt;Enable&lt;/code&gt;, before restarting the Raspberry Pi.&lt;/p&gt;
&lt;p&gt;The camera uses the &lt;code&gt;v4l2&lt;/code&gt; driver, which is integrated by default in the kernel provided with Raspbian. To test if the camera is working properly, you can take a picture with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;raspistill -v -o test.jpg
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can also record a video (here for five seconds):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;raspivid -o test.h264 -t 5000
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If your camera is upside down for connection reasons, you can return it with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;v4l2-ctl --set-ctrl vertical_flip=1
v4l2-ctl --set-ctrl horizontal_flip=1
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;first-try-motioneye&#34;&gt;First try: MotionEye&lt;/h2&gt;
&lt;p&gt;I first tried to use the excellent MotionEye software, which offers a web interface to view the webcam, but also to make recordings and detect movements.&lt;/p&gt;
&lt;p&gt;However, I couldn&amp;rsquo;t get a suitable framerate: whatever the settings used (including with minimal resolution and quality), I never managed to exceed 1.0 fps, which makes the result quite disappointing&amp;hellip;&lt;/p&gt;
&lt;h2 id=&#34;second-try-v4l2rtspserver&#34;&gt;Second try: v4l2rtspserver&lt;/h2&gt;
&lt;p&gt;The well named RTSP, for Real Time Streaming Protocol, allows to set up a particularly fluid streaming.&lt;/p&gt;
&lt;h3 id=&#34;installation&#34;&gt;Installation&lt;/h3&gt;
&lt;p&gt;The v4l2rtspserver software allows you to easily use this protocol with our camera. You can install it with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install cmake liblog4cpp5-dev libv4l-dev
git clone https://github.com/mpromonet/v4l2rtspserver.git
cd v4l2rtspserver/
cmake .
make
sudo make install
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;configuration&#34;&gt;Configuration&lt;/h3&gt;
&lt;p&gt;You can then start a video stream with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;v4l2rtspserver -H 972 -W 1296 -F 15 -P 8555 /dev/video0
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The previous command allows you to delimit an image in 1296x972, with 15 fps (which allows a suitable brightness in a dark room).&lt;/p&gt;
&lt;p&gt;The video stream then becomes available from the following address from any software that can play it, such as VLC (on your computer or phone):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;rtsp://&amp;lt;raspberry-pi-ip&amp;gt;:8555/unicast
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The image becomes perfectly smooth and, as soon as the connection is sufficient, the quality is very suitable. However, there is still a latency time of about one second.&lt;/p&gt;
&lt;p&gt;It should be noted that v4l2rtspserver also allows you to specify a user name and password, for greater security.&lt;/p&gt;
&lt;h3 id=&#34;launch-on-startup&#34;&gt;Launch on startup&lt;/h3&gt;
&lt;p&gt;To launch v4l2rtspserver at boot, let&amp;rsquo;s start by entering the command with the above parameters in the &lt;code&gt;ExecStart&lt;/code&gt; section of the following file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo nano /lib/systemd/system/v4l2rtspserver.service
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We then activate v4l2rtspserver at boot:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo systemctl enable v4l2rtspserver
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Installing Pi-hole with PiVPN</title>
      <link>https://sylvaindurand.org/installing-pi-hole-with-pivpn/</link>
      <pubDate>Wed, 20 Mar 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/installing-pi-hole-with-pivpn/</guid>
      <description>&lt;p&gt;While ad blockers remain highly effective within browsers, advertisements and trackers remain largely intact outside, whether it is computers, phones, televisions and other connected objects.&lt;/p&gt;
&lt;p&gt;Pi-hole is an application that allows you to block ads and trackers by acting directly at the DNS resolution level. In general, it provides relatively comprehensive information on a large number of connections that pass through your network.&lt;/p&gt;
&lt;p&gt;Combined with PiVPN, it becomes possible to use Pi-hole when roaming, from your phone or on a public network, while encrypting all your connections.&lt;/p&gt;
&lt;h2 id=&#34;installation-of-pi-hole&#34;&gt;Installation of Pi-hole&lt;/h2&gt;
&lt;p&gt;It is also important that your router assigns a fixed IP address to the Raspberry Pi, so that it can be declared as a DNS host from your devices.&lt;/p&gt;
&lt;p&gt;The installation of Pi-hole is done simply with a single command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;curl -sSL https://install.pi-hole.net | bash
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;On a personal note, I chose Quad9&amp;rsquo;s DNS servers (&lt;code&gt;9.9.9.9&lt;/code&gt;).&lt;/p&gt;
&lt;p&gt;Once the installation is complete, you can change the password:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo pihole -a -p
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;There are three ways to ensure that your computer is using your Raspberry Pi to resolve DNS.&lt;/p&gt;
&lt;p&gt;The easiest way is to activate the Pi-Hole DHCP server: from the web server, you go to &lt;code&gt;Settings&lt;/code&gt;, then &lt;code&gt;DHCP&lt;/code&gt;, before selecting &lt;code&gt;DHCP server enabled&lt;/code&gt;; then you have to go to the administration interface of your router or your box to disable DHCP.&lt;/p&gt;
&lt;p&gt;Another solution is, in the configuration interface of your router or internet box, to declare the IP of your Raspberry Pi as a DNS server field.&lt;/p&gt;
&lt;p&gt;If none of these solutions are possible, it is necessary to declare your Raspberry Pi as a DNS server in the network settings of all your devices.&lt;/p&gt;
&lt;p&gt;Restart your network connection: the Pi-hole administration interface should now be available from &lt;code&gt;http://pi.hole/&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;You can then declare the blocking lists there to start blocking ads.&lt;/p&gt;
&lt;h2 id=&#34;installation-of-pivpn&#34;&gt;Installation of PiVPN&lt;/h2&gt;
&lt;p&gt;The installation is done again with a single command line:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;curl -L https://install.pivpn.io | bash
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;When asked which DNS server to choose, select &lt;code&gt;Custom&lt;/code&gt;, then indicate the IP of the Raspberry Pi.&lt;/p&gt;
&lt;p&gt;Once the installation is done, let&amp;rsquo;s go back to the administration interface of Pi-hole, to go to &lt;code&gt;Settings&lt;/code&gt;, &lt;code&gt;DNS&lt;/code&gt;, and &lt;code&gt;Interface listening behavior&lt;/code&gt;: we use &lt;code&gt;Listen on all interfaces&lt;/code&gt; to make sure that PiVPN is communicating with Pi-hole.&lt;/p&gt;
&lt;p&gt;You can simply create a new VPN profile with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pivpn add
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To retrieve the profile, we use locally:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;scp pi:/home/pi/ovpns/&amp;lt;your-profile&amp;gt;.ovpn .
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is now possible to connect, from an OpenVPN client, to a computer or a phone, to benefit from the filtering of Pi-hole.&lt;/p&gt;
&lt;p&gt;Make sure your client does not have an option to use other DNS (the client for iOS, for example, automatically switches to Google&amp;rsquo;s DNS servers).&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Raspbian Lite on Raspberry Pi</title>
      <link>https://sylvaindurand.org/raspbian-lite-on-raspberry-pi/</link>
      <pubDate>Tue, 12 Mar 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/raspbian-lite-on-raspberry-pi/</guid>
      <description>&lt;p&gt;More than four years ago, I wrote an article explaining how to install Arch Linux on a Raspberry Pi:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/installing-archlinux-on-raspberry-pi/&#34;&gt;Installing Arch Linux on Raspberry Pi&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;I have since migrated to the Raspbian distribution, based on Debian and made specifically for the Raspberry Pi.&lt;/p&gt;
&lt;p&gt;Historically very large, because it has a graphic interface and several specific software, Raspbian now exists in a Light version that allows you to limit the packages to the essentials, to manage your Raspberry Pi from the command line.&lt;/p&gt;
&lt;p&gt;This article is a small personal memo on the steps to install and secure Raspbian to get a Raspberry Pi ready to use, usable via command line with SSH.&lt;/p&gt;
&lt;h2 id=&#34;downloading&#34;&gt;Downloading&lt;/h2&gt;
&lt;p&gt;First we download the image of Raspbian. Select &amp;ldquo;Raspbian Stretch Lite&amp;rdquo;. The official site offers user manuals for Linux, MacOS and Windows.&lt;/p&gt;
&lt;p&gt;On MacOS, we start by looking at the address of the SD card:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;diskutil list
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Once you know the SD card number, which appears as &lt;code&gt;/dev/disk&amp;lt;number&amp;gt;&lt;/code&gt;, you unmount the volume, then write the image on it :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;diskutil unmountDisk /dev/disk&amp;lt;number&amp;gt;
sudo dd bs=1m if=image.img of=/dev/rdisk&amp;lt;number&amp;gt; conv=sync
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To be able to connect with SSH, we must create a file named &lt;code&gt;ssh&lt;/code&gt; at the root of our SD card:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;touch /Volumes/boot/ssh
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If you need to connect on a Wifi network at boot:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano /Volumes/boot/wpa_supplicant.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We put:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
network={
    ssid=&amp;#34;&amp;lt;your-network-ssid&amp;gt;&amp;#34;
    psk=&amp;#34;&amp;lt;your-network-password&amp;gt;&amp;#34;
    key_mgmt=WPA-PSK
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, we eject the card:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo diskutil eject /dev/rdisk&amp;lt;number&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;first-connection&#34;&gt;First connection&lt;/h2&gt;
&lt;p&gt;Once the Raspberry is powered up with the SD card, you can connect with SSH:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh pi@&amp;lt;raspberry-pi-ip&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The default password is &lt;code&gt;raspberry&lt;/code&gt;. Let&amp;rsquo;s start by changing it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;passwd
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;updating&#34;&gt;Updating&lt;/h3&gt;
&lt;p&gt;After setting up a new server, we start by updating all the packages:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get update &amp;amp;&amp;amp; sudo apt-get upgrade
sudo apt-get dist-upgrade
sudo apt autoremove
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;language-settings&#34;&gt;Language settings&lt;/h3&gt;
&lt;p&gt;In order to set the language and time zone, launch:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo dpkg-reconfigure locales
sudo dpkg-reconfigure tzdata
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;security&#34;&gt;Security&lt;/h3&gt;
&lt;p&gt;We will prevent the `root&amp;rsquo; connection and change ports, in order to prevent a large number of attack attempts. To do this, we edit:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo nano /etc/ssh/sshd_config
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We modify the following parameters with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Port &amp;lt;your-custom-port&amp;gt;
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
PermitEmptyPasswords no
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We finally restart the Raspberry Pi:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo reboot
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;connection-via-ssh&#34;&gt;Connection via SSH&lt;/h3&gt;
&lt;p&gt;Locally, we create a new private key:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh-keygen -t ed25519 -a 100
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we edit &lt;code&gt;.ssh/config&lt;/code&gt; to connect easily:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Host pi
    Hostname &amp;lt;raspberry-pi-ip&amp;gt;
    Port &amp;lt;your-custom-port&amp;gt;
    User pi
    IdentityFile ~/.ssh/&amp;lt;your-private-key&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we send the public key to the server:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh-copy-id -i ~/.ssh/&amp;lt;your-private-key&amp;gt; pi
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can then connect directly with &lt;code&gt;ssh vps&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;The system is now fully operational!&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Emulate a browser with Selenium</title>
      <link>https://sylvaindurand.org/emulate-a-browser-with-selenium/</link>
      <pubDate>Sun, 10 Mar 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/emulate-a-browser-with-selenium/</guid>
      <description>&lt;p&gt;Python is particularly effective when you want to automatically browse or perform actions on web pages. If it is enough to use libraries like Beautiful Soup when you just scrape web pages, it is sometimes necessary to perform actions on pages that require Javascript, or even to imitate human behavior. To do this, it is possible to fully emulate a web browser with Python.&lt;/p&gt;
&lt;h2 id=&#34;installation&#34;&gt;Installation&lt;/h2&gt;
&lt;p&gt;We will use Selenium, which is easily installed with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip install selenium
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To be able to use it, it is necessary to install a rendering engine. We will use Gecko, the Firefox rendering engine.&lt;/p&gt;
&lt;p&gt;To do this, download &lt;code&gt;geckodriver&lt;/code&gt;, decompress it, and place it in &lt;code&gt;/usr/local/bin&lt;/code&gt;.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;tar xvfz geckodriver-version-plateform.tar.gz
mv geckodriver /usr/local/bin
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;usage-in-python&#34;&gt;Usage in Python&lt;/h2&gt;
&lt;p&gt;To use Selenium, simply import at the beginning of the file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;from selenium import webdriver
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;simple-usage&#34;&gt;Simple usage&lt;/h3&gt;
&lt;p&gt;You can start Selenium with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;driver = webdriver.Firefox(executable_path=r&amp;#39;/usr/local/bin/geckodriver&amp;#39;)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Thus, to click on an element, we use for example:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;driver.find_element_by_class_name(&amp;#39;my_class&amp;#39;).click()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To free the memory, you can exit Selenium with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;driver.quit()
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;use-without-graphical-interface&#34;&gt;Use without graphical interface&lt;/h3&gt;
&lt;p&gt;If you want to launch it without a graphical user interface, you can use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;options = webdriver.FirefoxOptions()
options.add_argument(&amp;#39;-headless&amp;#39;)
driver = webdriver.Firefox(options=options, executable_path=r&amp;#39;/usr/local/bin/geckodriver&amp;#39;)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;using-with-a-proxy-or-tor&#34;&gt;Using with a proxy or Tor&lt;/h3&gt;
&lt;p&gt;If you use a proxy, or Tor (which is used as a proxy, with local IP &lt;code&gt;127.0.0.0.1&lt;/code&gt; and port &lt;code&gt;9050&lt;/code&gt;), it is possible to connect to it with Selenium using the following options:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;profile = webdriver.FirefoxProfile()
profile.set_preference(&amp;#34;network.proxy.type&amp;#34;, 1)
profile.set_preference(&amp;#34;network.proxy.socks&amp;#34;, &amp;#39;127.0.0.1&amp;#39;)
profile.set_preference(&amp;#34;network.proxy.socks_port&amp;#34;, 9050)
profile.set_preference(&amp;#34;network.proxy.socks_remote_dns&amp;#34;, False)
profile.update_preferences()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can then use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;driver = webdriver.Firefox(firefox_profile=profile, executable_path=r&amp;#39;/usr/local/bin/geckodriver&amp;#39;)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;cache-and-cookies&#34;&gt;Cache and cookies&lt;/h3&gt;
&lt;p&gt;Other options are available, for example to disable the cache:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;profile.set_preference(&amp;#34;browser.cache.disk.enable&amp;#34;, False)
profile.set_preference(&amp;#34;browser.cache.memory.enable&amp;#34;, False)
profile.set_preference(&amp;#34;browser.cache.offline.enable&amp;#34;, False)
profile.set_preference(&amp;#34;network.http.use-cache&amp;#34;, False)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is also possible to clear cookies with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;driver.delete_all_cookies()
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Wildcard certificates with Let’s Encrypt</title>
      <link>https://sylvaindurand.org/wildcard-certificates-with-letsencrypt/</link>
      <pubDate>Sat, 16 Feb 2019 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/wildcard-certificates-with-letsencrypt/</guid>
      <description>&lt;p&gt;Launched in late 2015, Let’s Encrypt is a public benefit organization which democratized the use of HTTPS by providing free SSL certificates with an automated validation system.&lt;/p&gt;
&lt;p&gt;After several months of testing, Let&amp;rsquo;s Encrypt has launched the second version of its client (ACME v2) with a highly anticipated feature : you can obtain wildcard certificates, valid for all subdomains of one domain.&lt;/p&gt;
&lt;p&gt;This possibility is particularly interesting when using many subdomains: so far, it was necessary to issue a new certificate to add a new subdomain, or to delete an old one. Here, a simple &lt;code&gt;*.domain.tld&lt;/code&gt; is enough!&lt;/p&gt;
&lt;h3 id=&#34;installation&#34;&gt;Installation&lt;/h3&gt;
&lt;p&gt;To get our certificates, we will use the &lt;code&gt;certbot&lt;/code&gt; client. The site offers several installation methods depending on your platform. On Debian, you can simply use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install certbot
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;issuing-a-certificate-manually&#34;&gt;Issuing a certificate manually&lt;/h3&gt;
&lt;p&gt;Be careful, if you want a certificate for both the domain root (&lt;code&gt;domain.tld&lt;/code&gt;) and its subdomains (&lt;code&gt;*.domain.tld&lt;/code&gt;), both must be specified. With the &lt;code&gt;-d&lt;/code&gt; parameter, it is possible to list the desired domains and subdomains:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo letsencrypt certonly --manual --preferred-challenges dns --register -d domain.tld -d *.domain.tld
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Let&amp;rsquo;s encrypt will now have to ask us to prove that we have control over the domain names requested. It will request the creation of a specific TXT record in the DNS zone of the domain name, which can be done from your registar:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;----------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.domain.tld with the following value:

c81US66r6JVk1LwyFHbzINQvIU_m5gJWXgcUm8Qj2

Before continuing, verify the record is deployed.
----------------------------------------------------
Press Enter to Continue
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Two TXT records will be requested for the same domain, it is completely normal (for both &lt;code&gt;domain.tld&lt;/code&gt; and &lt;code&gt;*.domain.tld&lt;/code&gt;).&lt;/p&gt;
&lt;p&gt;Once created, the certificate is located in &lt;code&gt;/etc/letsencrypt/live/domain.tld&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;This certificate cannot be renewed automatically: it is necessary, as it approaches its expiration, to renew the step.&lt;/p&gt;
&lt;h3 id=&#34;automated-request-example-with-ovh&#34;&gt;Automated request: example with OVH&lt;/h3&gt;
&lt;p&gt;Fortunately, there are plugins to &lt;code&gt;certbot&lt;/code&gt; allowing to automatically request certificates, which take care of modifying the DNS themselves to proceed with the validation. For example, under Debian, the following packages are provided:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# apt-cache search certbot-dns
python3-certbot-dns-cloudflare
python3-certbot-dns-digitalocean
python3-certbot-dns-dnsimple
python3-certbot-dns-gandi
python3-certbot-dns-gehirn
python3-certbot-dns-google
python3-certbot-dns-linode
python3-certbot-dns-ovh
python3-certbot-dns-rfc2136
python3-certbot-dns-route53
python3-certbot-dns-sakuracloud
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Depending on your registrar, you can find documentation on their API and how to set up renewal. I am an OVH customer:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install python3-certbot-dns-ovh
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we go on &lt;code&gt;https://eu.api.ovh.com/createToken/&lt;/code&gt; to create a token in link with his account (be careful, we have to indicate his login of type &lt;code&gt;xx00000-ovh&lt;/code&gt; and not his email address) with the following rules:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;GET /domain/zone/*
PUT /domain/zone/*
POST /domain/zone/*
DELETE /domain/zone/*
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We get the generated data to create the file :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#/root/.ovh.ini
dns_ovh_endpoint = ovh-eu
dns_ovh_application_key =
dns_ovh_application_secret =
dns_ovh_consumer_key =
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We give it restricted rights, and then we can create a certificate:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo chmod 600 /root/.ovh.ini
sudo certbot certonly --dns-ovh --dns-ovh-credentials /root/.ovh.ini -d &amp;#34;domain.tld&amp;#34; -d &amp;#34;*.domain.tld&amp;#34;
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Use Tor with Python</title>
      <link>https://sylvaindurand.org/use-tor-with-python/</link>
      <pubDate>Fri, 21 Dec 2018 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/use-tor-with-python/</guid>
      <description>&lt;p&gt;This page will show you how to use Tor to anonymously access data with a Python script. This can be particularly useful if you want to create a scrapper without being banned by the server concerned.&lt;/p&gt;
&lt;h2 id=&#34;tor-installation&#34;&gt;Tor installation&lt;/h2&gt;
&lt;p&gt;The installation of Tor depends on your system, and is detailed on the official website. On a Debian or Raspbian, we use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install tor
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To launch Tor, just run:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo service tor start
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To check if it works, simply run the following command from a terminal:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;curl --socks5 localhost:9050 --socks5-hostname localhost:9050 -s https://check.torproject.org/ | cat | grep -m 1 Congratulations | xargs
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This command will display:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Congratulations. This browser is configured to use Tor.
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;usage-with-python&#34;&gt;Usage with Python&lt;/h2&gt;
&lt;h3 id=&#34;with-requests-library&#34;&gt;With requests library&lt;/h3&gt;
&lt;p&gt;To request a page, use the &lt;code&gt;requests&lt;/code&gt; library. If you do not have it, just install it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip install requests
pip install requests[socks]
pip install requests[security]
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If there is an error for the last command, try to install &lt;code&gt;cryptography&lt;/code&gt; requirements:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install build-essential libssl-dev libffi-dev python-dev
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We then use, in Python:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;import requests
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can check your IP address without Tor with the command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;requests.get(&amp;#39;https://ident.me&amp;#39;).text
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To use Tor, we tell it to use a proxy:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;proxies = {
    &amp;#39;http&amp;#39;: &amp;#39;socks5://127.0.0.1:9050&amp;#39;,
    &amp;#39;https&amp;#39;: &amp;#39;socks5://127.0.0.1:9050&amp;#39;
}

requests.get(url, proxies=proxies).text
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;So, you should have a new IP address with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;requests.get(&amp;#39;https://ident.me&amp;#39;, proxies=proxies).text
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;obtaining-a-new-identity&#34;&gt;Obtaining a new identity&lt;/h3&gt;
&lt;p&gt;If you need a new identity, and change your IP address, you need to install stem:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip install stem
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The Tor controller must also be configured to request identity renewal:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo nano /etc/tor/torrc
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We use the parameters:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ControlPort 9051
CookieAuthentication 1
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we restart Tor to take into account these modifications:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo service tor restart
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;With Python, we now use the following command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;from stem import Signal
from stem.control import Controller

with Controller.from_port(port = 9051) as c:
    c.authenticate()
    c.signal(Signal.NEWNYM)
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To check it, we look if we get a new IP with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;requests.get(&amp;#39;https://api.ipify.org&amp;#39;, proxies=proxies).text
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;strengthen-anonymity-by-changing-the-user-agent&#34;&gt;Strengthen anonymity by changing the User-Agent&lt;/h3&gt;
&lt;p&gt;If anonymity is required, it may be useful to change the user-agent , which betrays our identity to the server. To do this, install &lt;code&gt;fake_useragent&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pip install fake_useragent
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can then use, in Python:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;from fake_useragent import UserAgent
headers = { &amp;#39;User-Agent&amp;#39;: UserAgent().random }
requests.get(url, proxies=proxies, headers=headers).text
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;automation-with-cron&#34;&gt;Automation with Cron&lt;/h3&gt;
&lt;p&gt;If your Python script is to be used regularly using a Cron job, it may be useful to add a random delay to prevent the access time from being too regular:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;import random, time
wait = random.uniform(0, 2*60*60)
time.sleep(wait)
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Launch Chromium in kiosk mode</title>
      <link>https://sylvaindurand.org/launch-chromium-in-kiosk-mode/</link>
      <pubDate>Thu, 16 Aug 2018 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/launch-chromium-in-kiosk-mode/</guid>
      <description>&lt;p&gt;Chromium makes it easy to be started in &amp;ldquo;kiosk&amp;rdquo; mode, that is to say to launch in full screen, without any window border, toolbar or notification (surprisingly, this feature is not offered by Mozilla Firefox).&lt;/p&gt;
&lt;p&gt;Our goal will be to get:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;a minimal installation of the graphical server, without desktop environment or window manager;&lt;/li&gt;
&lt;li&gt;an automatic launch on startup, in full screen;&lt;/li&gt;
&lt;li&gt;no toolbar or notification.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;display-server&#34;&gt;Display server&lt;/h2&gt;
&lt;h3 id=&#34;installation&#34;&gt;Installation&lt;/h3&gt;
&lt;p&gt;To display the browser, we will have to install an X server. There is no need to install a desktop environment or window manager, unnecessarily large, since the browser will be launched directly in full screen.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install xserver-xorg-video-all xserver-xorg-input-all xserver-xorg-core xinit x11-xserver-utils
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;launch-at-startup&#34;&gt;Launch at startup&lt;/h3&gt;
&lt;p&gt;To start the server automatically at startup, edit the &lt;code&gt;~/.bash_profile&lt;/code&gt; file, which is executed when the user logs in, to put the following content (the server starts with &lt;code&gt;startx&lt;/code&gt;, but it is also necessary to check that a screen is available to avoid an error, for example, with SSH):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;if  ( -z $DISPLAY ) &amp;amp;&amp;amp;  ( $(tty) = /dev/tty1 ); then
    startx
fi
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Your system must also be configured so that the user is automatically logged in at startup. How to proceed depends on your configuration.&lt;/p&gt;
&lt;h2 id=&#34;chromium&#34;&gt;Chromium&lt;/h2&gt;
&lt;h3 id=&#34;installation-1&#34;&gt;Installation&lt;/h3&gt;
&lt;p&gt;We will install, of course, Chromium, but also &lt;code&gt;unclutter&lt;/code&gt;, which will allow us to hide the pointer of the mouse:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install chromium-browser
sudo apt-get install unclutter
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;launch-at-startup-1&#34;&gt;Launch at startup&lt;/h3&gt;
&lt;p&gt;To start them automatically at startup, we create a file&lt;code&gt;~/.xinitrc&lt;/code&gt; (this file is executed when the X server starts) which contains the following commands (take care to choose your URL and indicate the screen resolution) :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
xset -dpms
xset s off
xset s noblank

unclutter &amp;amp;
chromium-browser /path/to/your/file.html --window-size=1920,1080 --start-fullscreen --kiosk --incognito --noerrdialogs --disable-translate --no-first-run --fast --fast-start --disable-infobars --disable-features=TranslateUI --disk-cache-dir=/dev/null  --password-store=basic
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The &lt;code&gt;xset&lt;/code&gt; commands are used to avoid the automatic standby of the system, which will otherwise interrupt the display after a specified time.&lt;/p&gt;
&lt;p&gt;The option &lt;code&gt;--window-size=&lt;/code&gt; is essential, otherwise Chromium will only be displayed on half of the screen, despite the other instructions, in the absence of a window manager.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Setting up a Nginx server on macOS</title>
      <link>https://sylvaindurand.org/setting-up-a-nginx-web-server-on-macos/</link>
      <pubDate>Fri, 15 Dec 2017 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/setting-up-a-nginx-web-server-on-macos/</guid>
      <description>&lt;p&gt;Seeking a satisfactory solution to create a local web server for programming in macOS with PHP and MySQL, I was disappointed that the turnkey solutions were far from equaling the WAMP that may exist on Windows.&lt;/p&gt;
&lt;p&gt;But I forgot macOS is a Unix system, and unlike Windows, it&amp;rsquo;s perfectly possible to create a customized local server with some packages. We will see how to install Nginx, PHP-FPM and MariaDB (MySQL) on macOS thanks to Homebrew package manager.&lt;/p&gt;
&lt;h2 id=&#34;homebrew&#34;&gt;Homebrew&lt;/h2&gt;
&lt;p&gt;HomeBrew is a package manager for macOS, that allows to easily install various Unix applications. To install, simply execute the command shown on the official website:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://brew.sh/&#34;&gt;Homebrew officiel website&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;nginx&#34;&gt;Nginx&lt;/h2&gt;
&lt;p&gt;Although Apache is natively included with macOS, we propose here to install Nginx, particularly lightweight and easily configurable. To install and launch Nginx on startup, we use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;brew install nginx
brew services start nginx
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Now, &lt;code&gt;localhost:8080&lt;/code&gt; should show &lt;code&gt;Welcome to nginx!&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;The configuration file is located at &lt;code&gt;/opt/homebrew/etc/nginx/nginx.conf&lt;/code&gt;. Here is a minimal working example showing a website in your home folder:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;worker_processes  1;

events {
  worker_connections 1024;
}

http {
  include mime.types;
  default_type application/octet-stream;
  sendfile on;
  keepalive_timeout 65;
  gzip on;

  server {
    listen       8080;
    server_name  localhost;

    location / {
      root   /Users/&amp;lt;user&amp;gt;/my_website;
      index  index.html;
    }
  }
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We then restart Nginx in order to take this changes into account:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;brew services restart nginx
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;php&#34;&gt;PHP&lt;/h2&gt;
&lt;p&gt;In order to use PHP with Nginx we will use PHP-FPM:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;brew install php
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we re-edit the configuration file to use &lt;code&gt;index.php&lt;/code&gt; instead of &lt;code&gt;index.html&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;index index.php;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, add in the section &lt;code&gt;server&lt;/code&gt; the following lines to run PHP for all files with the extension&lt;code&gt; .php&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;location ~ \.php {
  fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  include fastcgi_params;
  fastcgi_pass 127.0.0.1:9000;
  fastcgi_split_path_info ^(.+\.php)(/.+)$;
  fastcgi_buffers 16 16k;
  fastcgi_buffer_size 32k;
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we take these changes into account and start PHP:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;brew services restart nginx
brew services start php
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;mysql&#34;&gt;MySQL&lt;/h2&gt;
&lt;p&gt;We will now install and launch MariaDB:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;brew install mariadb
brew services start mariadb
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Here is the perfect MAMP installation !&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>PHP 5.2 on Debian 7 Wheezy</title>
      <link>https://sylvaindurand.org/php-5-2-on-debian-7-wheezy/</link>
      <pubDate>Fri, 02 Dec 2016 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/php-5-2-on-debian-7-wheezy/</guid>
      <description>&lt;p&gt;Sometimes you need to bring back to life old lines of code which will only works with old PHP versions. We will here see how to install PHP 5.2 on Debian 7 Wheezy (because I couldn&amp;rsquo;t get it work on Debian 8 Jessie&amp;hellip;).&lt;/p&gt;
&lt;p&gt;PHP 5.2 end of life occured in January 2011; thus it is obviously a very bad idea to install it on a production environment, for obvious security reasons.&lt;/p&gt;
&lt;h2 id=&#34;sources&#34;&gt;Sources&lt;/h2&gt;
&lt;p&gt;We will use the Debian 6 Lenny sources. To do so, let&amp;rsquo;s edit &lt;code&gt;/etc/apt/sources.list&lt;/code&gt; in order to add the repo:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;deb http://archive.debian.org/debian lenny main contrib non-free
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We will also edit &lt;code&gt;/etc/apt/preferences&lt;/code&gt; in order to tell &lt;code&gt;apt&lt;/code&gt; we want to use PHP older versions. We add:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Package: *
Pin: release n=lenny*
Pin-Priority: 100

Package: php5 php5-common php5-cli php5-curl php5-gd php5-mcrypt php5-mysql php5-mhash php5-xsl php5-xmlrpc php5-sqlite libapache2-mod-php5 phpmyadmin
Pin: release n=lenny*
Pin-Priority: 999
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;installation&#34;&gt;Installation&lt;/h2&gt;
&lt;p&gt;The installation isn&amp;rsquo;t straightforward due to a conflict with the dependency &lt;code&gt;libkrb53&lt;/code&gt;. We will first download the packages:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd ~
apt-get update
apt-get download php5-common php5-cli php5-curl php5-gd \
    php5-mcrypt php5-mysql php5-mhash php5-xsl php5-xmlrpc \
    php5-sqlite libapache2-mod-php5
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we install them, while specifying we want to ignore the missing &lt;code&gt;libkrb53&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;dpkg --ignore-depends=libkrb53 -i *.deb
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;after-the-installation&#34;&gt;After the installation&lt;/h2&gt;
&lt;p&gt;Now, PHP 5.2 should work, but now &lt;code&gt;apt&lt;/code&gt; doesn&amp;rsquo;t accept to install new packages anymore. It will ask to run &lt;code&gt;apt-get -f install&lt;/code&gt;, wich will delete PHP:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;You might want to run &amp;#39;apt-get -f install&amp;#39; to correct these.
The following packages have unmet dependencies:
    libapache2-mod-php5 : Depends: libkrb53 (&amp;gt;= 1.6.dfsg.2) but it is not installed
    php5-cli : Depends: libkrb53 (&amp;gt;= 1.6.dfsg.2) but it is not installed
E: Unmet dependencies. Try using -f.
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;So, each time you need to install or upgrade a package, you will have to run &lt;code&gt;apt-get -f install&lt;/code&gt; before doing your stuff, then to install PHP 5.2 again with &lt;code&gt;dpkg --ignore-depends=libkrb53 -i *.deb&lt;/code&gt;.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Making Jekyll multilingual</title>
      <link>https://sylvaindurand.org/making-jekyll-multilingual/</link>
      <pubDate>Sat, 01 Oct 2016 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/making-jekyll-multilingual/</guid>
      <description>&lt;p&gt;Jekyll has a very flexible design that allows a great freedom of choice, allowing the user to simply introduce features that are not integrated into its engine. This is particularly the case when one wants to create a multilingual website: while CMS remain very rigid and often require plugins, few filters are sufficient to achieve it with &lt;em&gt;Jekyll&lt;/em&gt;.&lt;/p&gt;
&lt;p&gt;This article aims to present a way to create a multilingual site with &lt;em&gt;Jekyll&lt;/em&gt;. It has to be installed on your computer and you should be able to know how to generate a simple website.&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/static-website-with-jekyll/&#34;&gt;Static website with Jekyll&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;goals&#34;&gt;Goals&lt;/h2&gt;
&lt;p&gt;The method will provide a fully multilingual website, but will remain very flexible to allow everyone to do what he wants.&lt;/p&gt;
&lt;h3 id=&#34;flexibility&#34;&gt;Flexibility&lt;/h3&gt;
&lt;p&gt;Our website can be translated in as many languages as wanted. Each page may be translated or not in the various languages (regardless of the version, they may be pages which are not translated in each language). All pages and posts can be placed as desired.&lt;/p&gt;
&lt;h3 id=&#34;full-translation&#34;&gt;Full translation&lt;/h3&gt;
&lt;p&gt;On each page, all content must be in the same language : title, article, but also menus, dates, feeds or typography.&lt;/p&gt;
&lt;h3 id=&#34;language-selector&#34;&gt;Language selector&lt;/h3&gt;
&lt;p&gt;A language selector, as the one on the top right of this website, will show the actual language and the different translations available (the selector musn&amp;rsquo;t lead to the translated homepage, but to the translation of the current page).&lt;/p&gt;
&lt;h3 id=&#34;search-engine-optimization&#34;&gt;Search engine optimization&lt;/h3&gt;
&lt;p&gt;The links between the different versions of the same content must be known search engines, which can directly provide users with content in their language.&lt;/p&gt;
&lt;h3 id=&#34;no-plugin&#34;&gt;No plugin&lt;/h3&gt;
&lt;p&gt;Everything will work without any plugin, in order to get a good compatibility with the future versions of Jekyll and to be able to host it on GitHub Pages.&lt;/p&gt;
&lt;h2 id=&#34;principle&#34;&gt;Principle&lt;/h2&gt;
&lt;p&gt;The method is very simple: we will indicate, for each post and page, its language (&lt;code&gt;lang&lt;/code&gt;) and an unique identifier (&lt;code&gt;ref&lt;/code&gt;) to link the different translations. Jekyll will do the rest!&lt;/p&gt;
&lt;p&gt;To do so, we will use &lt;code&gt;lang&lt;/code&gt; et &lt;code&gt;ref&lt;/code&gt; in the frontmatter of each post and page. For instance, in English:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;---
title: Hello world!
lang: en
ref: hello
---
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, in French:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;---
title: Bonjour le monde !
lang: fr
ref: hello
---
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Or, in Chinese:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;---
title: 你好，世界！
lang: zh
ref: hello
---
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;links-between-the-two-translations&#34;&gt;Links between the two translations&lt;/h2&gt;
&lt;h3 id=&#34;list-of-articles-of-the-same-language&#34;&gt;List of articles of the same language&lt;/h3&gt;
&lt;p&gt;The page listing the articles has to display only the one with the good translation. That is easy to do, thanks to the &lt;code&gt;lang&lt;/code&gt; metadata.&lt;/p&gt;
&lt;p&gt;The following code provides every article with the same language than the actual page:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign posts=site.posts | where:&amp;#34;lang&amp;#34;, page.lang %}
&amp;lt;ul&amp;gt;
{% for post in posts %}
    &amp;lt;li&amp;gt;
        &amp;lt;a href=&amp;#34;{{ post.url }}&amp;#34;&amp;gt;{{ post.title }}&amp;lt;/a&amp;gt;
    &amp;lt;/li&amp;gt;
{% endfor %}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Unfortunately, there is currently no way to paginate the articles, without any plugin or Javascript.&lt;/p&gt;
&lt;h3 id=&#34;language-selector-1&#34;&gt;Language selector&lt;/h3&gt;
&lt;p&gt;To create a language selector, like the one at the top right of this page, the process is very similar. We show the language of each translation available, including the actual page, sorting by path in order to always get the same order:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;
{% assign posts=site.posts | where:&amp;#34;ref&amp;#34;, page.ref | sort: &amp;#39;lang&amp;#39; %}
{% for post in posts %}
  &amp;lt;li&amp;gt;
    &amp;lt;a href=&amp;#34;{{ post.url }}&amp;#34; class=&amp;#34;{{ post.lang }}&amp;#34;&amp;gt;{{ post.lang }}&amp;lt;/a&amp;gt;
  &amp;lt;/li&amp;gt;
{% endfor %}

{% assign pages=site.pages | where:&amp;#34;ref&amp;#34;, page.ref | sort: &amp;#39;lang&amp;#39; %}
{% for page in pages %}
  &amp;lt;li&amp;gt;
    &amp;lt;a href=&amp;#34;{{ page.url }}&amp;#34; class=&amp;#34;{{ page.lang }}&amp;#34;&amp;gt;{{ page.lang }}&amp;lt;/a&amp;gt;
  &amp;lt;/li&amp;gt;
{% endfor %}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;As you can see, we need to repeat the code for the pages (&lt;code&gt;site.page&lt;/code&gt;) and the posts (&lt;code&gt;site.posts&lt;/code&gt;). It will be possible to delete this redundancy when Jekyll will use Liquid 4.&lt;/p&gt;
&lt;p&gt;Then, in order to emphase the actual version, just use CSS (you need to declare the &lt;code&gt;lang&lt;/code&gt; attribute on the &lt;code&gt;html&lt;/code&gt;, with &lt;code&gt;&amp;lt;html lang=&amp;quot;{{ page.lang }}&amp;quot;&amp;gt;&lt;/code&gt; in the layout). For instance, if you want to bold it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;.en:lang(en), .fr:lang(fr), .zh:lang(zh){
    font-weight: bold;
}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;links-to-previous-and-next-posts&#34;&gt;Links to previous and next posts&lt;/h3&gt;
&lt;p&gt;Using loops can also allow us to show the previous and the next posts:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% for post in site.posts %}
  {% if post.lang == page.lang %}
    {% if prev %}
      &amp;lt;a href=&amp;#34;{{ post.url }}&amp;#34;&amp;gt;Previous&amp;lt;/a&amp;gt;
    {% endif %}
    {% assign prev = false %}
    {% if post.id == page.id %}
      {% assign prev = true %}
    {% endif %}
  {% endif %}
{% endfor %}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;And:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% for post in site.posts reversed %}
  {% if post.lang == page.lang %}
    {% if next %}
      &amp;lt;a href=&amp;#34;{{ post.url }}&amp;#34;&amp;gt;Next&amp;lt;/a&amp;gt;
      {% break %}
    {% endif %}
    {% assign next = false %}
    {% if post.id == page.id %}
      {% assign next = true %}
    {% endif %}
  {% endif %}
{% endfor %}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;tweaking&#34;&gt;Tweaking&lt;/h2&gt;
&lt;h3 id=&#34;translation-of-website-elements&#34;&gt;Translation of website elements&lt;/h3&gt;
&lt;p&gt;Around the articles, it is also necessary to translate the various elements like menus, header, footer, some titles&amp;hellip;&lt;/p&gt;
&lt;p&gt;To do so, we can provide translations into &lt;code&gt;_config.yml&lt;/code&gt; (since Jekyll 2.0, it is also possible to put the translations in the &lt;code&gt;_data&lt;/code&gt; folder). Then, in the following example, &lt;code&gt;{{ site.t[page.lang].home }}&lt;/code&gt; will generate &lt;code&gt;Home&lt;/code&gt;, &lt;code&gt;Accueil&lt;/code&gt; or &lt;code&gt;首页&lt;/code&gt; depending of the page language:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;t:
  en:
    home:  &amp;#34;Home&amp;#34;
  fr:
    home:  &amp;#34;Accueil&amp;#34;
  zh:
    home:  &amp;#34;首页&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is possible to do the same in order to generate the menu of each version. For example, if you want to provide a two elements menu, you just have to provide in &lt;code&gt;_config.yml&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;t:
  en:
    home:
      name: &amp;#34;Home&amp;#34;
      url: &amp;#34;/&amp;#34;
    about:
      name: &amp;#34;About&amp;#34;
      url: &amp;#34;/about/&amp;#34;
  fr:
    home:
      name: &amp;#34;Accueil&amp;#34;
      url: &amp;#34;/accueil/&amp;#34;
    about:
      name: &amp;#34;À propos&amp;#34;
      url: &amp;#34;/a-propos/&amp;#34;
  zh:
    home:
      name: &amp;#34;首页&amp;#34;
      url: &amp;#34;/首页/&amp;#34;
    about:
      name: &amp;#34;关于&amp;#34;
      url: &amp;#34;/关于/&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, you can generate the menu with a simple loop:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;
  {% for menu in site.t[page.lang] %}
    &amp;lt;li&amp;gt;&amp;lt;a href=&amp;#34;{{ menu[1].url }}&amp;#34;&amp;gt;{{ menu[1].name }}&amp;lt;/a&amp;gt;&amp;lt;/li&amp;gt;
  {% endfor %}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;translation-of-dates&#34;&gt;Translation of dates&lt;/h3&gt;
&lt;p&gt;At this point, everything can be translated on the site except the dates automatically generated by Jekyll. Short formats, consisting only of numbers, can be adapted without difficulty. Depending of the language, we want to get:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;in English : &amp;ldquo;2014/09/01&amp;rdquo; ;&lt;/li&gt;
&lt;li&gt;in French : &amp;ldquo;01/09/2014&amp;rdquo; ;&lt;/li&gt;
&lt;li&gt;in Chinese : &amp;ldquo;2014年9月1号&amp;rdquo;.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;To do so, we just have to use the following code, which we may then put in the &lt;code&gt;_includes&lt;/code&gt; folder in order to use it when needed:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% if page.lang == &amp;#39;en&amp;#39; %}
    {{ page.date | date: &amp;#34;%d/%m/%Y&amp;#34; }}
{% endif %}

{% if page.lang == &amp;#39;fr&amp;#39; %}
    {{ page.date | date: &amp;#34;%Y-%m-%d&amp;#34; }}
{% endif %}

{% if page.lang == &amp;#39;zh&amp;#39; %}
    {{ page.date | date: &amp;#34;%Y年%-m月%-d号&amp;#34; }}
{% endif %}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;For the long format dates, it is possible to use date filters and replacements for any format. For example, we want to get:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;in English : &amp;ldquo;1&lt;!-- raw HTML omitted --&gt;st&lt;!-- raw HTML omitted --&gt; March 2016&amp;rdquo; ;&lt;/li&gt;
&lt;li&gt;in French : &amp;ldquo;1&lt;!-- raw HTML omitted --&gt;er&lt;!-- raw HTML omitted --&gt; mars 2016&amp;rdquo;.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;To do so, we just have to put the following code in a file named &lt;code&gt;date.html&lt;/code&gt; stored in the &lt;code&gt;_includes&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign day = include.date | date: &amp;#34;%-d&amp;#34; %}
{% if page.lang != &amp;#39;fr&amp;#39; %}
    {% case day %}
        {% when &amp;#39;1&amp;#39; or &amp;#39;21&amp;#39; or &amp;#39;31&amp;#39; %} {{ day }}&amp;lt;sup&amp;gt;st&amp;lt;/sup&amp;gt;
        {% when &amp;#39;2&amp;#39; or &amp;#39;22&amp;#39; %} {{ day }}&amp;lt;sup&amp;gt;nd&amp;lt;/sup&amp;gt;
        {% when &amp;#39;3&amp;#39; or &amp;#39;23&amp;#39; %} {{ day }}&amp;lt;sup&amp;gt;rd&amp;lt;/sup&amp;gt;
        {% else %} {{ day }}&amp;lt;sup&amp;gt;th&amp;lt;/sup&amp;gt;
    {% endcase %}
{% else %}
    {% if day == &amp;#34;1&amp;#34; %}
        {{ day }}&amp;lt;sup&amp;gt;er&amp;lt;/sup&amp;gt;
    {% else %} {{ day }}
    {% endif %}
{% endif %} {% if page.lang != &amp;#39;fr&amp;#39; %}
    {{ include.date | date: &amp;#34;%B&amp;#34; }}
{% else %}
    {% assign m = include.date | date: &amp;#34;%-m&amp;#34; %}
    {% case m %}
            {% when  &amp;#39;1&amp;#39; %}janvier
            {% when  &amp;#39;2&amp;#39; %}février
            {% when  &amp;#39;3&amp;#39; %}mars
            {% when  &amp;#39;4&amp;#39; %}avril
            {% when  &amp;#39;5&amp;#39; %}mai
            {% when  &amp;#39;6&amp;#39; %}juin
            {% when  &amp;#39;7&amp;#39; %}juillet
            {% when  &amp;#39;8&amp;#39; %}août
            {% when  &amp;#39;9&amp;#39; %}septembre
            {% when &amp;#39;10&amp;#39; %}octobre
            {% when &amp;#39;11&amp;#39; %}novembre
            {% when &amp;#39;12&amp;#39; %}décembre
    {% endcase %}
{% endif %} {{ include.date | date: &amp;#34;%Y&amp;#34; }}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, we just have to call:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% include date.html date=page.date %}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;website-access-and-search-engine&#34;&gt;Website access and search engine&lt;/h2&gt;
&lt;p&gt;The website is completely static, so it is difficult to know the language of our visitors, either by detecting the headers sent by the browser or on the basis of their geographical location. Nevertheless, it is possible to indicating the search engines which pages are translations of the same content (thus, users finding our website through a search engine should be offered the good translation).&lt;/p&gt;
&lt;p&gt;To do so, two ways are possible: use &lt;code&gt;&amp;lt;link&amp;gt;&lt;/code&gt; or create a &lt;code&gt;sitemaps.xml&lt;/code&gt; file.&lt;/p&gt;
&lt;h3 id=&#34;with-a-link-tag&#34;&gt;With a link tag&lt;/h3&gt;
&lt;p&gt;You only have to provide in the &lt;code&gt;&amp;lt;head&amp;gt;&lt;/code&gt; part of the page, every translation available of the actual version (you need to be careful to use the good country codes). To do so, we can use the following code, similar to those used previously:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign posts=site.posts | where:&amp;#34;ref&amp;#34;, page.ref | sort: &amp;#39;lang&amp;#39; %}
{% for post in posts %}
  &amp;lt;link rel=&amp;#34;alternate&amp;#34; hreflang=&amp;#34;{{ post.lang }}&amp;#34; href=&amp;#34;{{ post.url }}&amp;#34; /&amp;gt;
{% endfor %}
{% assign pages=site.pages | where:&amp;#34;ref&amp;#34;, page.ref | sort: &amp;#39;lang&amp;#39; %}
{% for page in pages %}
  &amp;lt;link rel=&amp;#34;alternate&amp;#34; hreflang=&amp;#34;{{ page.lang }}&amp;#34; href=&amp;#34;{{ page.url }}&amp;#34; /&amp;gt;
{% endfor %}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;with-a-sitemaps-file&#34;&gt;With a sitemaps file&lt;/h3&gt;
&lt;p&gt;The &lt;code&gt;sitemaps.xml&lt;/code&gt; file,  which allows search engines to know the pages and the structure of your website, also helps tell the search engines which pages are different translations of the same content.&lt;/p&gt;
&lt;p&gt;For this, just indicate all pages of the site (regardless of language) in &lt;code&gt;&amp;lt;url&amp;gt;&lt;/code&gt; elements, and for each of them all the versions that exist, including the one we are now describing.&lt;/p&gt;
&lt;p&gt;This file can be generated automatically by Jekyll with the following code, which will create a &lt;code&gt;sitemaps.xml&lt;/code&gt; file on the root of the website:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;---
layout:
permalink: /sitemaps.xml
---
&amp;lt;?xml version=&amp;#34;1.0&amp;#34; encoding=&amp;#34;UTF-8&amp;#34;?&amp;gt;
&amp;lt;urlset xmlns=&amp;#34;http://www.sitemaps.org/schemas/sitemap/0.9&amp;#34; xmlns:xhtml=&amp;#34;http://www.w3.org/1999/xhtml&amp;#34;&amp;gt;
  {% for post in site.posts %}
    {% if post.id contains &amp;#34;404&amp;#34; %}{% else %}
      &amp;lt;url&amp;gt;
        &amp;lt;loc&amp;gt;{{site.base}}{{ post.url }}&amp;lt;/loc&amp;gt;
        {% assign versions=site.posts | where:&amp;#34;ref&amp;#34;, post.ref %}
        {% for version in versions %}
          &amp;lt;xhtml:link rel=&amp;#34;alternate&amp;#34; hreflang=&amp;#34;{{ version.lang }}&amp;#34; href=&amp;#34;{{site.base}}{{ version.url }}&amp;#34; /&amp;gt;
        {% endfor %}
        &amp;lt;lastmod&amp;gt;{{ post.date | date_to_xmlschema }}&amp;lt;/lastmod&amp;gt;
        &amp;lt;changefreq&amp;gt;weekly&amp;lt;/changefreq&amp;gt;
      &amp;lt;/url&amp;gt;
    {% endif %}
  {% endfor %}
  {% for page in site.pages %}
    {% if page.id contains &amp;#34;404&amp;#34; %}{% else %}
      &amp;lt;url&amp;gt;
        &amp;lt;loc&amp;gt;{{site.base}}{{ page.url }}&amp;lt;/loc&amp;gt;
        {% assign versions=site.pages | where:&amp;#34;ref&amp;#34;, page.ref %}
        {% for version in versions %}
          &amp;lt;xhtml:link rel=&amp;#34;alternate&amp;#34; hreflang=&amp;#34;{{ version.lang }}&amp;#34; href=&amp;#34;{{site.base}}{{ version.url }}&amp;#34; /&amp;gt;
        {% endfor %}
        &amp;lt;changefreq&amp;gt;weekly&amp;lt;/changefreq&amp;gt;
      &amp;lt;/url&amp;gt;
    {% endif %}
  {% endfor %}
&amp;lt;/urlset&amp;gt;
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Getting a git server with Gitolite</title>
      <link>https://sylvaindurand.org/getting-a-git-server-with-gitolite/</link>
      <pubDate>Fri, 19 Aug 2016 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/getting-a-git-server-with-gitolite/</guid>
      <description>&lt;p&gt;Github helped popularize git and its concepts to many. Nevertheless, it involves making public all the codes you want to host, unless you buy a fairly expensive subscription, and for a limited number of projects. Moreover, Github is not open, and it is therefore necessary to give it some trust to store its projects.&lt;/p&gt;
&lt;p&gt;Several solutions exist to host a git server on his personal server. For example, Gitlab aims to become equal to Github, with a graphical interface and many tools; thereby, it is very large and relatively heavy for a small server.&lt;/p&gt;
&lt;p&gt;Here we will see how to install Gitolite, which provides a very light and functional git server, in order to synchronizing repositories between different working stations.&lt;/p&gt;
&lt;h2 id=&#34;installation&#34;&gt;Installation&lt;/h2&gt;
&lt;h3 id=&#34;creating-git-user-on-the-server&#34;&gt;Creating git user on the server&lt;/h3&gt;
&lt;p&gt;First, we will create on the server a &lt;code&gt;git&lt;/code&gt; user, which will be needed:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo adduser git
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Once connected to &lt;code&gt;git&lt;/code&gt; on the server, we create a &lt;code&gt;bin&lt;/code&gt; directory that will contain binaries, that we then add to the &lt;code&gt;path&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd ~
mkdir bin
PATH=$PATH:~/bin
PATH=~/bin:$PATH
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;creating-an-authentication-key&#34;&gt;Creating an authentication key&lt;/h3&gt;
&lt;p&gt;In order to connect to Gitolite, we will used SSH key-based authentication, both simpler and more secure than HTTP. If you do not already have a key, it is necessary to create one. For this, we will used &lt;code&gt;ssh-keygen&lt;/code&gt; locally:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd ~/.ssh
ssh-keygen -t ed25519 -a 100
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;When the path is requested, enter your username &lt;code&gt;&amp;lt;user&amp;gt;&lt;/code&gt;. The password is optional: if you choose one, it will be asked each time a git command is requesting the server.&lt;/p&gt;
&lt;p&gt;We then send the public key on the server:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cat ~/.ssh/&amp;lt;user&amp;gt;.pub | ssh git@&amp;lt;hostname&amp;gt; -p &amp;lt;port&amp;gt; &amp;#39;umask 0077; mkdir -p .ssh; cat &amp;gt;&amp;gt; &amp;lt;user&amp;gt;.pub&amp;#39;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, we create a &lt;code&gt;~/.ssh/config&lt;/code&gt; file that contains the following information:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Host git
  HostName &amp;lt;hostname&amp;gt;
  Port &amp;lt;port&amp;gt;
  User git
  IdentityFile ~/.ssh/&amp;lt;user&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installing-gitolite&#34;&gt;Installing Gitolite&lt;/h3&gt;
&lt;p&gt;Back to the user &lt;code&gt;git&lt;/code&gt; on the server, we can now install Gitolite:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd ~
git clone git://github.com/sitaramc/gitolite
gitolite/install -ln
gitolite setup -pk ~/&amp;lt;user&amp;gt;.pub
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Locally, you can now check that everything works well with &lt;code&gt;ssh git&lt;/code&gt;. This should return something like:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;PTY allocation request failed on channel 0
hello &amp;lt;user&amp;gt;, this is git@&amp;lt;hostname&amp;gt; running
gitolite3 v3.6.5-9-g490b540 on git 2.1.4

 R W    gitolite-admin
 R W    testing
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;That&amp;rsquo;s all ! Now, if you want to clone a &lt;code&gt;repo&lt;/code&gt; directory, simply run the command &lt;code&gt;git clone git:repo&lt;/code&gt;. The &lt;code&gt;git push&lt;/code&gt;,&lt;code&gt; pull&lt;/code&gt;, &lt;code&gt;fetch&lt;/code&gt; &amp;hellip; will operate without password.&lt;/p&gt;
&lt;h2 id=&#34;configuration&#34;&gt;Configuration&lt;/h2&gt;
&lt;p&gt;The main originality of Gitolite is that its configuration system uses a specific git repository. To configure Gitolite, simply clone the &lt;code&gt;gitolite-admin&lt;/code&gt; repository:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;git clone git:gitolite-admin
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;This repository contains a &lt;code&gt;conf/gitolite.conf&lt;/code&gt; file that lists the directories and permissions, and a &lt;code&gt;keydir&lt;/code&gt; folder containing the users public keys (your &lt;code&gt;&amp;lt;user&amp;gt;.pub&lt;/code&gt; key, provided during the installation, is already there).&lt;/p&gt;
&lt;p&gt;For example, to add a &lt;code&gt;project&lt;/code&gt; repository, just edit &lt;code&gt;conf/gitolite.conf&lt;/code&gt; to add:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;repo project
    RW+     =   &amp;lt;user&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To apply all changes, &lt;code&gt;commit&lt;/code&gt; then &lt;code&gt;push&lt;/code&gt; those files on the server.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>SSH key-based authentication</title>
      <link>https://sylvaindurand.org/ssh-key-based-authentication/</link>
      <pubDate>Wed, 17 Aug 2016 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/ssh-key-based-authentication/</guid>
      <description>&lt;p&gt;When you want to connect to an SSH server, default authentication is based on username and password. However, passwords are quite insecure, difficult to remember and hard to write; they are effective against computers if they are very restrictive, even unusable, for humans.&lt;/p&gt;
&lt;p&gt;The key-based authentication can fill these two requirements: it provides a very high safety and makes connection fast and easy. This authentication is based on three components:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;a public key, which is previously provided to the server;&lt;/li&gt;
&lt;li&gt;a private key, used to prove its identity while connecting;&lt;/li&gt;
&lt;li&gt;a passphrase (optional), which will be requested every time the private key is provided.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;key-generation&#34;&gt;Key generation&lt;/h2&gt;
&lt;p&gt;First, we will locally create an SSH private key, and the associated public key:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd ~/.ssh
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The algorithm &lt;code&gt;ed25519&lt;/code&gt; appears so far to be one of the most secure, while remaining very fast:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh-keygen -t ed25519 -a 100
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;However, it is still new and is not supported on all systems. In this case, it is possible to use RSA instead:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh-keygen -t rsa -b 4096
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;When the path is asked, simply write the username &lt;code&gt;&amp;lt;user&amp;gt;&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;It is then proposed to enter a password, which will be requested every time the private key is provided. It is not necessary. Of course, in any case, the private key should never be transmitted.&lt;/p&gt;
&lt;p&gt;Once this has been accomplished, we now have:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;~/.ssh/&amp;lt;user&amp;gt;&lt;/code&gt;, your private key;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;~/.ssh/&amp;lt;user&amp;gt;.pub&lt;/code&gt;, the associated public key.&lt;/li&gt;
&lt;/ul&gt;
&lt;h3 id=&#34;transfer-on-the-server&#34;&gt;Transfer on the server&lt;/h3&gt;
&lt;p&gt;We need to transmit the public key we just generated to the server. Its content must be stored on the server in &lt;code&gt;~/.ssh/authorized_keys&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;Locally, this can be done in one command line:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cat ~/.ssh/&amp;lt;user&amp;gt;.pub | ssh &amp;lt;user&amp;gt;@&amp;lt;hostname&amp;gt; -p &amp;lt;port&amp;gt; &amp;#39;umask 0077; mkdir -p .ssh; cat &amp;gt;&amp;gt; ~/.ssh/authorized_keys&amp;#39;
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;configuration&#34;&gt;Configuration&lt;/h2&gt;
&lt;p&gt;In order to be able to quickly connect to the server, we create a local configuration file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano ~/.ssh/config
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It will contain the following data:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;Host &amp;lt;shortcut&amp;gt;
  HostName &amp;lt;hostname&amp;gt;
  Port &amp;lt;port&amp;gt;
  User &amp;lt;user&amp;gt;
  IdentityFile ~/.ssh/&amp;lt;user&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;In order to connect to the server, we will now just have to use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh &amp;lt;shortcut&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If you associated a password to the private key, it will then be asked. Otherwise, you will be connected directly.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Improving typography on Jekyll</title>
      <link>https://sylvaindurand.org/improving-typography-on-jekyll/</link>
      <pubDate>Mon, 29 Feb 2016 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/improving-typography-on-jekyll/</guid>
      <description>&lt;p&gt;Observing typographical rules on the Internet is not always easy: although Unicode reserves many areas of characters for typographic symbols, many punctuation marks and spaces are most of the time unused.&lt;/p&gt;
&lt;p&gt;With Jekyll, the articles are written very simply with Markdown before being generated in HTML by the engine: we can add automatic rules to improve typography on our site without carrying about it when writing articles.&lt;/p&gt;
&lt;h2 id=&#34;apply-filters-to-the-content&#34;&gt;Apply filters to the content&lt;/h2&gt;
&lt;h3 id=&#34;modify-paragraphs-leave-the-code&#34;&gt;Modify paragraphs, leave the code&lt;/h3&gt;
&lt;p&gt;Care must be taken to apply the changes only in paragraphs, not in code blocks that could become unusable for users that will copy them.&lt;/p&gt;
&lt;p&gt;To do so, we will replace &lt;code&gt;{{ content }}&lt;/code&gt;, in the &lt;code&gt;_layout/default.html&lt;/code&gt; file (or equivalent), with :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign content = content | split: &amp;#39;&amp;lt;pre&amp;#39; %}

{% for parts in content %}

  {% assign part = parts | split: &amp;#39;&amp;lt;/pre&amp;gt;&amp;#39; %}
  {% assign c = part.first %}
  {% assign t = part.last %}

  {% if part.size == 2 %}

    {% capture output %}{{ output }}&amp;lt;pre{{ c }}&amp;lt;/pre&amp;gt;{% endcapture %}

  {% endif %}

  {% capture output %}{{ output }}{{ t }}{% endcapture %}

{% endfor %}
{{ output }}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We just have to act on the variable &lt;code&gt;t&lt;/code&gt;, which corresponds to the texts, by applying different filters, just after &lt;code&gt;{% assign t = part.last %}&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;For example, if you want to replace all a&amp;rsquo;s in b&amp;rsquo;s in the texts, but not in the code blocks, juste use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign t = t | replace: &amp;#39;a&amp;#39; , &amp;#39;b&amp;#39; %}
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;french-typography&#34;&gt;French typography&lt;/h2&gt;
&lt;p&gt;We will show here how to make Jekyll automatically generates quotes French and non-breaking spaces to the right length before the various punctuation marks.&lt;/p&gt;
&lt;h3 id=&#34;using-french-guillemets&#34;&gt;Using French guillemets&lt;/h3&gt;
&lt;p&gt;For quotes French &lt;code&gt;«&lt;/code&gt; and &lt;code&gt;»&lt;/code&gt;, we simply replace English quotation marks, as seen in the previous section, with: (we add a normal non-breaking space before the closing quotation mark, and after entering quote with &lt;code&gt;&amp;amp;#160;&lt;/code&gt;)&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign t = t | replace: &amp;#39;“&amp;#39;, &amp;#39;«&amp;amp;#160;&amp;#39;
                | replace: &amp;#39;”&amp;#39;, &amp;#39;&amp;amp;#160;»&amp;#39; %}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;using-the-right-spaces-before-punctuation&#34;&gt;Using the right spaces before punctuation&lt;/h3&gt;
&lt;p&gt;In French, the colons (&lt;code&gt;:&lt;/code&gt;) and percent (&lt;code&gt;%&lt;/code&gt;) must be preceded by a normal non-breaking space, which is obtained with &lt;code&gt;&amp;amp;#160;&lt;/code&gt;. We use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign t = t | replace: &amp;#39; :&amp;#39;, &amp;#39;&amp;amp;#160;:&amp;#39;
                | replace: &amp;#39; %&amp;#39;, &amp;#39;&amp;amp;#160;%&amp;#39; %}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;However, the semicolon (&lt;code&gt;;&lt;/code&gt;), the exclamation point (&lt;code&gt;!&lt;/code&gt;) and the question mark (&lt;code&gt;?&lt;/code&gt;) are preceded by a thin non-breaking space. Thereof is obtained using &lt;code&gt;&amp;amp;thinsp;&lt;/code&gt;. However, it is preferable to use &lt;code&gt;&amp;lt;span style=&amp;quot;white-space:nowrap&amp;quot;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;;&lt;/code&gt; because some browsers that do not treat the space as indivisible.&lt;/p&gt;
&lt;p&gt;We then use the following code to get the desired result:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign t = t | replace: &amp;#39; ;&amp;#39;, &amp;#39;&amp;lt;span style=&amp;#34;white-space:nowrap&amp;#34;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;;&amp;#39;
                | replace: &amp;#39; !&amp;#39;, &amp;#39;&amp;lt;span style=&amp;#34;white-space:nowrap&amp;#34;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;!&amp;#39;
                | replace: &amp;#39; ?&amp;#39;, &amp;#39;&amp;lt;span style=&amp;#34;white-space:nowrap&amp;#34;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;?&amp;#39; %}
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;final-result&#34;&gt;Final result&lt;/h3&gt;
&lt;p&gt;Finally, the following code provides all the typographical improvements presented above:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign content = content | split: &amp;#39;&amp;lt;pre&amp;#39; %}

{% for parts in content %}

  {% assign part = parts | split: &amp;#39;&amp;lt;/pre&amp;gt;&amp;#39; %}
  {% assign c = part.first %}
  {% assign t = part.last %}

  {% assign t = t | replace: &amp;#39;“&amp;#39;, &amp;#39;«&amp;amp;#160;&amp;#39;
                  | replace: &amp;#39;”&amp;#39;, &amp;#39;&amp;amp;#160;»&amp;#39;
                  | replace: &amp;#39; :&amp;#39;, &amp;#39;&amp;amp;#160;:&amp;#39;
                  | replace: &amp;#39; %&amp;#39;, &amp;#39;&amp;amp;#160;%&amp;#39;
                  | replace: &amp;#39; ;&amp;#39;, &amp;#39;&amp;lt;span style=&amp;#34;white-space:nowrap&amp;#34;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;;&amp;#39;
                  | replace: &amp;#39; !&amp;#39;, &amp;#39;&amp;lt;span style=&amp;#34;white-space:nowrap&amp;#34;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;!&amp;#39;
                  | replace: &amp;#39; ?&amp;#39;, &amp;#39;&amp;lt;span style=&amp;#34;white-space:nowrap&amp;#34;&amp;gt;&amp;amp;thinsp;&amp;lt;/span&amp;gt;?&amp;#39; %}

  {% if part.size == 2 %}

    {% capture output %}{{ output }}&amp;lt;pre{{ c }}&amp;lt;/pre&amp;gt;{% endcapture %}

  {% endif %}

  {% capture output %}{{ output }}{{ t }}{% endcapture %}

{% endfor %}
{{ output }}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;If your website is multilingual, you can restrict the previous modifications to the French articles, by adding:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% if page.lang == &amp;#39;fr&amp;#39; %}
...
{% endif %}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, to lighten the code, it is possible to include these codes in a specific page, for example &lt;code&gt;_includes/typography.html&lt;/code&gt;. Then, we simply use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% if page.lang != &amp;#39;en&amp;#39; %}
    {% include typography.html %}
{% else %}
    {{ content }}
{% endif %}
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Compressing Liquid generated code</title>
      <link>https://sylvaindurand.org/compressing-liquid-generated-html/</link>
      <pubDate>Sun, 28 Feb 2016 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/compressing-liquid-generated-html/</guid>
      <description>&lt;p&gt;The Liquid syntax, which is used by Jekyll, has an unpleasant default: it generates significant spaces and unneccessary line breaks in the generated pages source code.&lt;/p&gt;
&lt;p&gt;This is especially true when you want to indent your Liquid code, or want to use loops.&lt;/p&gt;
&lt;p&gt;For instance, the following example (which show each multiplication which gives &amp;ldquo;12&amp;rdquo;) will generate almost 500 lignes of codes, almost empty:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;
{% for i in (1..12) %}
  {% for j in (1..12) %}
  {% assign result = i | times: j %}
  {% if result == 12 %}
    &amp;lt;li&amp;gt; {{ i }} ⨉ {{ j }} = 12 &amp;lt;/li&amp;gt;
  {% endif %}
  {% endfor %}
{% endfor %}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;What happens? Liquid reads all the characters in the loop, including spaces and line breaks, and restores them without asking any questions. Thus, this double loop will generate hundred of useless breaklines and spaces.&lt;/p&gt;
&lt;p&gt;However, in order to get a readable HTML code, we would like to get:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;
    &amp;lt;li&amp;gt; 1 ⨉ 12 = 12 &amp;lt;/li&amp;gt;
    &amp;lt;li&amp;gt; 2 ⨉ 6 = 12 &amp;lt;/li&amp;gt;
    &amp;lt;li&amp;gt; 3 ⨉ 4 = 12 &amp;lt;/li&amp;gt;
    &amp;lt;li&amp;gt; 4 ⨉ 3 = 12 &amp;lt;/li&amp;gt;
    &amp;lt;li&amp;gt; 6 ⨉ 2 = 12 &amp;lt;/li&amp;gt;
    &amp;lt;li&amp;gt; 12 ⨉ 1 = 12 &amp;lt;/li&amp;gt;
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;first-try--unindent-your-code&#34;&gt;First try : unindent your code&lt;/h2&gt;
&lt;p&gt;A first answer, which is also the less satisfying, would be to delete all spaces and linebreak which shoudn&amp;rsquo;t be shown. In the previous example, it would give:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;{% for i in (1..12) %}{% for j in (1..12) %}{% assign result = i | times: j %}{% if result == 12 %}
    &amp;lt;li&amp;gt; {{ i }} ⨉ {{ j }} = 12 &amp;lt;/li&amp;gt;{% endif %}{% endfor %}{% endfor %}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The HTML output is perfect, but our Liquid code is unreadable&amp;hellip;&lt;/p&gt;
&lt;h2 id=&#34;second-try--using-capture&#34;&gt;Second try : using capture&lt;/h2&gt;
&lt;p&gt;The &lt;code&gt;capture&lt;/code&gt; tag will store, as a variable, every interpreted code which is inside.&lt;/p&gt;
&lt;p&gt;By using a &lt;code&gt;capture&lt;/code&gt; tag around a Liquid code, you will hide its output, and therefore the unwanted spaces and linebreaks. Then, you just have to use a second &lt;code&gt;capture&lt;/code&gt; tag around the wanted output, then to print it.&lt;/p&gt;
&lt;p&gt;The previous example would become:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;{% capture hide %}
{% for i in (1..12) %}
  {% for j in (1..12) %}
  {% assign result = i | times: j %}
  {% if result == 12 %}
{% capture show %}{{ show }}
    &amp;lt;li&amp;gt; {{ i }} ⨉ {{ j }} = 12 &amp;lt;/li&amp;gt;{% endcapture %}
  {% endif %}
  {% endfor %}
{% endfor %}
{% endcapture %}{{ show }}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The code remains still a little verbous, and isn&amp;rsquo;t that clean yet.&lt;/p&gt;
&lt;h2 id=&#34;using--the-final-answer-&#34;&gt;Using %}{%, the final answer ?&lt;/h2&gt;
&lt;p&gt;Since Jekyll 3.0.0, it is possible to put linebreaks inside Liquid tags, without any influence on the output code. So, it is possible to indent your code like:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;ul&amp;gt;{%
for i in (1..12) %}{%
  for j in (1..12) %}{%
    assign result = i | times: j %}{%
    if result == 12 %}
    &amp;lt;li&amp;gt; {{ i }} ⨉ {{ j }} = 12 &amp;lt;/li&amp;gt;{%
    endif %}{%
  endfor %}{%
endfor %}
&amp;lt;/ul&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Despite this unusual way to write Liquid code, it remains quite readable and gives us the wanted result.&lt;/p&gt;
&lt;p&gt;However, I couldn&amp;rsquo;t find if this behaviour is wanted by Liquid developers, and thus if it will be maintain in the future.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Getting a web server with Nginx</title>
      <link>https://sylvaindurand.org/getting-a-web-server-with-nginx/</link>
      <pubDate>Fri, 26 Dec 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/getting-a-web-server-with-nginx/</guid>
      <description>&lt;p&gt;Apache was once the ideal solution for creating a web server. Its great features induced a certain heaviness, and its popularity made him very attacked, and therefore frequently updated.&lt;/p&gt;
&lt;p&gt;In recent years, Nginx has established itself as a high quality alternative: although comprehensive features, the software is characterized by great lightness, which allows to run on very modest configurations such as a Raspberry Pi.&lt;/p&gt;
&lt;p&gt;We&amp;rsquo;ll see how to install a Nginx able to use PHP, on a Raspberry Pi which is running Arch Linux. However, the procedure will remain very similar to another machine or other configuration (it is essentially the commands &lt;code&gt;systemctl&lt;/code&gt; and &lt;code&gt;pacman&lt;/code&gt; which need to be adapted).&lt;/p&gt;
&lt;h2 id=&#34;installing-nginx&#34;&gt;Installing Nginx&lt;/h2&gt;
&lt;p&gt;Installing Nginx is easily obtained with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -S nginx
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is then possible to start Nginx with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl start nginx
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;By opening the IP address (or the domain name that points to your Raspberry Pi) of your Raspberry Pi, you should see a page showing that Nginx is functional.&lt;/p&gt;
&lt;h2 id=&#34;static-website&#34;&gt;Static website&lt;/h2&gt;
&lt;p&gt;We will start by creating a first site entirely static. The files will be located in &lt;code&gt;/srv/http/mysite&lt;/code&gt;, which will be available at &lt;code&gt;mysite.tld&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;For this, we edit the Nginx configuration file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano /etc/nginx/nginx.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Before the latest ending curly bracket of the file, add the following lines for declaring our new website:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;server {
    listen 80;
    server_name mysite.tld;
    root /srv/http/mysite;
    index index.html;
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The &lt;code&gt;listen&lt;/code&gt; parameter specifies the listening port (we generally chose port 80 for HTTP or 443 for HTTPS), &lt;code&gt;server_name&lt;/code&gt; allows to wanted URLs, &lt;code&gt;root&lt;/code&gt; the file locations and &lt;code&gt;index&lt;/code&gt; the file to be served by default.&lt;/p&gt;
&lt;p&gt;We created this folder, and an &lt;code&gt;index.html&lt;/code&gt; file with the right attributes:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mkdir -p /srv/http/mysite
nano /srv/http/index.html
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Its configuration has been modified, we restart Nginx to take into account the changes:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl restart nginx
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;dynamic-website&#34;&gt;Dynamic website&lt;/h2&gt;
&lt;p&gt;Static websites are great, but being able to create dynamic sites is often helpful. This allows, for example, with a Raspberry Pi, to host web applications at home as an RSS reader or cloud. Examples are presented below.&lt;/p&gt;
&lt;h3 id=&#34;installing-php&#34;&gt;Installing PHP&lt;/h3&gt;
&lt;p&gt;To install PHP, we use the package &lt;code&gt;php-fpm&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -S php-fpm
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The we activate it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl start php-fpm
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;creating-a-site-with-php&#34;&gt;Creating a site with PHP&lt;/h3&gt;
&lt;p&gt;As before, we edit the Nginx configuration file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano /etc/nginx/nginx.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Before the latest ending curly bracket of the file, add the following lines for declaring how to handle PHP:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;server {
    listen 80;
    server_name mysite.tld;
    root /srv/http/mysite;
    index index.php;
    location ~ \.php$ {
       try_files $uri =404;
       fastcgi_split_path_info ^(.+\.php)(/.+)$;
       include fastcgi.conf;
       fastcgi_index index.php;
       fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
    }
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Again, we restart Nginx:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl restart nginx
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installer-sqlite&#34;&gt;Installer sqlite&lt;/h3&gt;
&lt;p&gt;A growing number of web applications use &lt;code&gt;sqlite&lt;/code&gt; as a database. If you need it, install the package &lt;code&gt;php-sqlite&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -S php-sqlite
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then tells PHP to use it by adding at the end of file &lt;code&gt;/etc/php/php.ini&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;extension=pdo_sqlite.so
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we restart PHP:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;systemctl restart php-fpm
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installing-mysql&#34;&gt;Installing MySQL&lt;/h3&gt;
&lt;p&gt;If you want to use MySQL, install the &lt;code&gt;mariadb&lt;/code&gt; package, start &lt;code&gt;mysqld&lt;/code&gt; then use the installation script:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -S mariadb
systemctl start mysqld
mysql_secure_installation
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;As before, we then tells PHP to use by adding at the end of file &lt;code&gt;/etc/php/php.ini&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;extension = mysql.so
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;examples&#34;&gt;Examples&lt;/h2&gt;
&lt;h3 id=&#34;getting-an-rss-reader-miniflux&#34;&gt;Getting an RSS reader Miniflux&lt;/h3&gt;
&lt;p&gt;Miniflux is a web application for reading RSS feeds that I particularly appreciated for its simplicity and minimalist design. It is the replacement for Google Reader I&amp;rsquo;ve searched for a long time.&lt;/p&gt;
&lt;p&gt;As previously stated, creating a dynamic site for the folder &lt;code&gt;/srv/http/miniflux/&lt;/code&gt; taking care to install sqlite, needed by Miniflux.&lt;/p&gt;
&lt;p&gt;Installation is simple: download Miniflux, extract it, and give write access to the folder &lt;code&gt;data/&lt;/code&gt;.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cd /srv/http/
wget http://miniflux.net/miniflux-latest.zip
unzip miniflux-latest.zip
rm miniflux-latest.zip
cd miniflux
chmod 777 data/
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, to enable monitoring RSS feeds every hour, create a &lt;code&gt;cron&lt;/code&gt; task with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;crontab -e
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then enter therein:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;0 */1 * * *  cd /srv/http/miniflux &amp;amp;&amp;amp; php cronjob.php &amp;gt;/dev/null 2&amp;gt;&amp;amp;1
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;getting-a-personnal-cloud-with-owncloud&#34;&gt;Getting a personnal cloud with OwnCloud&lt;/h3&gt;
&lt;p&gt;Synchronize calendars, contacts and files between different devices - computers, tablets, phones - is very common today. Because these data can be very personal, installing a web application like OwnCloud on its Raspberry Pi.&lt;/p&gt;
&lt;p&gt;Again, create a dynamic site for &lt;code&gt;/srv/http/owncloud/&lt;/code&gt;. Then, we download OwnCloud:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mkdir -p /srv/http/owncloud
wget http://download.owncloud.org/community/owncloud-7.0.4.tar.bz2
tar xvf owncloud-7.0.4.tar.bz2
mv owncloud/ /srv/http/
chown -R www-data:www-data /srv/http
rm -rf owncloud owncloud-7.0.4.tar.bz2
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We then add a &lt;code&gt;cron&lt;/code&gt; task that will automate the update by running:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;crontab -e
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then enter therein:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;*/15  *  *  *  * php -f /srv/http/owncloud/cron.php
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;From our local network, we can access the web interface OwnCloud by going to the address of our Raspberry Pi (the external IP or the domain name).&lt;/p&gt;
&lt;p&gt;In Applications uncheck all applications you won’t use, in order to make OwnCloud more fluid. I only keep “Calendar” and “Contacts”.&lt;/p&gt;
&lt;p&gt;In Administration, uncheck the share permissions that are not useful, and select &lt;code&gt;cron&lt;/code&gt; as the update method.&lt;/p&gt;
&lt;p&gt;You can start creating address books and calendars from the web interface. It provides links &lt;code&gt;CardDAV&lt;/code&gt; and &lt;code&gt;CalDAV&lt;/code&gt; which can then be entered, along with your username and password, on your computers and devices.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Installing Arch Linux on Raspberry Pi</title>
      <link>https://sylvaindurand.org/installing-archlinux-on-raspberry-pi/</link>
      <pubDate>Wed, 24 Dec 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/installing-archlinux-on-raspberry-pi/</guid>
      <description>&lt;p&gt;Is it still necessary to present it? The Raspberry Pi is a nano-computer which, due to its small size, low power consumption and very low cost (about 35 € in its most powerful version, to which must be added an SD card, μUSB  and ethernet cables, less than € 50 in total), makes an essential personal server or hack tool.&lt;/p&gt;
&lt;p&gt;Despite its limited computing power, it is perfectly possible to make a web server, a personal cloud, a NAS, an Airplay terminal, a retro games console&amp;hellip; or all at once. Whatever your goal, it is necessary to install a Linux distribution.&lt;/p&gt;
&lt;p&gt;We will see how to install and configure Arch Linux on our Raspberry Pi, directly from the command line by the network, which means that we will have no need of keyboard or screen.&lt;/p&gt;
&lt;p&gt;So for this tutorial, you&amp;rsquo;ll only need:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;a &lt;em&gt;Raspberry Pi&lt;/em&gt;, model B ;&lt;/li&gt;
&lt;li&gt;a &lt;em&gt;SD card&lt;/em&gt; with at least 2 GB to install our system;&lt;/li&gt;
&lt;li&gt;an &lt;em&gt;µUSB cable&lt;/em&gt; to put our Raspberry Pi powered;&lt;/li&gt;
&lt;li&gt;an &lt;em&gt;ethernet cable&lt;/em&gt; to connect our Pi to our router.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;installing-arch-linux&#34;&gt;Installing Arch Linux&lt;/h2&gt;
&lt;p&gt;Among the many distributions available for Raspberry Pi, we will use Arch Linux, due to its lightness and comprehensive ecosystem that has been built around it.&lt;/p&gt;
&lt;h3 id=&#34;downloading&#34;&gt;Downloading&lt;/h3&gt;
&lt;p&gt;Start by retrieving the latest version of Arch Linux. An image is offered on the Raspberry Pi site (at the time of writing this article, the last image has been published in this format on June 2014; however, we will update the system once it is installed). Download it, and then extract it:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;curl -OL https://downloads.raspberrypi.org/arch/images/arch-2014-06-22/ArchLinuxARM-2014.06-rpi.img.zip
unzip ArchLinuxARM-2014.06-rpi.img.zip
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installing&#34;&gt;Installing&lt;/h3&gt;
&lt;p&gt;We will write the previously downloaded image to the SD card. To do this, insert into our computer the SD card that will host the system.&lt;/p&gt;
&lt;p&gt;It is necessary for us to know the path to the SD card. On macOS, you can use in the terminal the following command to get the ID of your SD card (&lt;code&gt;/dev/disk2&lt;/code&gt; in the following example):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;diskutil list
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We now write the image to the card. Warning, the entire contents of the SD card will be lost! For this, we enter the following commands (where &lt;code&gt;/dev/disk2&lt;/code&gt; (on macOS, we use &lt;code&gt;rdisk2&lt;/code&gt; instead of &lt;code&gt;disk2&lt;/code&gt; in order to make the copy faster) is the path to the SD card):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;diskutil unmountDisk /dev/disk2
sudo dd if=ArchLinuxARM-2014.06-rpi.img of=/dev/rdisk2 bs=1m
sudo diskutil eject /dev/disk2
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can then eject the SD card and insert it into your Raspberry Pi. Connect it to our network, and then put it on.&lt;/p&gt;
&lt;h2 id=&#34;connecting-to-the-raspberry-pi&#34;&gt;Connecting to the Raspberry Pi&lt;/h2&gt;
&lt;p&gt;We will access our Raspberry Pi from our computer, using SSH. Users of macOS or Linux can directly launch &lt;code&gt;ssh&lt;/code&gt;, while those of Windows prefer to use a program like PuTTY. Otherwise, it is possible to connect a USB keyboard and connect the Raspberry Pi to a monitor using its HDMI port.&lt;/p&gt;
&lt;p&gt;Like any computer, the Raspberry Pi is identified on the network by its IP address. For us to connect, it is necessary to know it.&lt;/p&gt;
&lt;p&gt;Two options are available:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;you want to access it from your local network, and in this case it suffices to know what IP your router assigns;&lt;/li&gt;
&lt;li&gt;you want to be able to access it anywhere (for instance, this will be the case for a web server), and in this case your router must redirect external requests to your Raspberry Pi.&lt;/li&gt;
&lt;/ul&gt;
&lt;h3 id=&#34;from-the-local-network&#34;&gt;From the local network&lt;/h3&gt;
&lt;p&gt;After connecting to your router and then turned our Raspberry Pi, we need to know its IP address (under macOS, use &lt;code&gt;arp -a&lt;/code&gt;).&lt;/p&gt;
&lt;p&gt;For more comfort, go on your router admin interface and ask to assign a fixed IP address. Thus, it will always be the same if your router or Raspberry restart.&lt;/p&gt;
&lt;p&gt;Once the address of the Raspberry Pi known (we will use &lt;code&gt;192.168.1.1&lt;/code&gt; in the following example), we can connect via SSH to our Raspberry Pi with the command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh root@192.168.1.1
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then validate the security certificate, and enter the default password &lt;code&gt;root&lt;/code&gt;. Here we are connected to our Raspberry Pi!&lt;/p&gt;
&lt;h3 id=&#34;from-anywhere&#34;&gt;From anywhere&lt;/h3&gt;
&lt;p&gt;In many cases, we want our Raspberry Pi accessible from outside our network. Your router must have a fixed IP; otherwise, it is necessary to use a dynamic DNS client.&lt;/p&gt;
&lt;p&gt;For this, the approach depends largely on the model of your router or box: connect to the administration interface and begin to assign a fixed IP to your Raspberry Pi. Then, tell the router to always transfer to this IP address the desired ports: in particular, port 22 for SSH (if you want to configure a web server later, you can do the same with ports 80 and 443).&lt;/p&gt;
&lt;p&gt;Once this is achieved, we can now connect from anywhere on internal (where &lt;code&gt;80.23.170.17&lt;/code&gt; is the external IP of our network):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh root@80.23.170.17
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can also assign a domain name to our Raspberry (especially if it will serve as a web server). At your registar, create an &lt;code&gt;A&lt;/code&gt; field for your &lt;code&gt;domain.tld&lt;/code&gt; in which you specify the external IP address (&lt;code&gt;80.23.170.17&lt;/code&gt; in our example). Once committed changes, we can access our Pi with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh pi@domain.tld
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then validate the security certificate, and enter the default password &lt;code&gt;raspberry&lt;/code&gt;. Here we are connected to our Raspberry Pi!&lt;/p&gt;
&lt;h2 id=&#34;configuring-arch-linux&#34;&gt;Configuring Arch Linux&lt;/h2&gt;
&lt;h3 id=&#34;creating-users&#34;&gt;Creating users&lt;/h3&gt;
&lt;p&gt;First, let&amp;rsquo;s change the administrator password:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;passwd root
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can also take the opportunity to create an user account, to whom we can give &lt;code&gt;sudo&lt;/code&gt; rights:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;useradd -m -g users -G wheel -s /bin/bash pi
passwd pi
pacman -S sudo
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;updating-arch&#34;&gt;Updating Arch&lt;/h3&gt;
&lt;p&gt;To update the entire (this command will update your software as well as the drivers required to Raspberry Pi) system, we simply use the following command:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -Suy
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;language&#34;&gt;Language&lt;/h3&gt;
&lt;p&gt;By default, the system is configured in English. In order to obtain an interface in another language, modify the following file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano /etc/locale.gen
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;For French, simply uncomment the line &lt;code&gt;fr_FR.UTF-8&lt;/code&gt;. The we regenerate locales with:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;locale-gen
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then select the default locale by editing the following file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano /etc/locale.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To this is added the following content:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;LANG=&amp;#34;fr_FR.UTF-8&amp;#34;
LANGUAGE=&amp;#34;fr_FR:en_US&amp;#34;
LC_COLLATE=C
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Upon restart, then the terminal will be in the right language.&lt;/p&gt;
&lt;h3 id=&#34;miscellaneous&#34;&gt;Miscellaneous&lt;/h3&gt;
&lt;p&gt;Arch Linux use the &lt;code&gt;vi&lt;/code&gt; text editor, which I prefer &lt;code&gt;nano&lt;/code&gt; for its simplicity. To change this default, we use:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -Rns vi
ln -s /usr/bin/nano /usr/bin/vi
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It is also possible to rename the machine name that appears in the terminal. For example:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;hostname raspberry
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;improving-safety&#34;&gt;Improving safety&lt;/h3&gt;
&lt;p&gt;Our Raspberry Pi being connected to a network, it will be subject to many attacks. To minimize the risk, it is first possible to change the default port for SSH (22) at any port. To do this, edit the following file:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;nano /etc/ssh/sshd_config
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Change the &lt;code&gt;Port 22&lt;/code&gt; line by remplacing &lt;code&gt;22&lt;/code&gt; with the wanted number (for instance, &lt;code&gt;50132&lt;/code&gt;). You can then connect via SSH, indicating the parameter &lt;code&gt;-p 50132&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;ssh pi@80.23.170.17 -p 50132
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Moreover, the &lt;code&gt;fail2ban&lt;/code&gt; package helps prevent dictionary attacks or bruteforce reading the connection logs and blocking repeated attempts connection with a user name or bad password. Simply install the package:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pacman -S fail2ban
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can regularly monitor the logs to identify fraudulent attempts connection with the command &lt;code&gt;grep &#39;sshd&#39; /var/log/auth.log&lt;/code&gt;.&lt;/p&gt;
&lt;h2 id=&#34;conclusion&#34;&gt;Conclusion&lt;/h2&gt;
&lt;p&gt;You now have a fully functional machine accessible from your network or from the Internet. If its computing power is limited, however, it is possible to use it in many ways:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;web server;&lt;/li&gt;
&lt;li&gt;personal cloud;&lt;/li&gt;
&lt;li&gt;RSS feed manager;&lt;/li&gt;
&lt;li&gt;torrent downloads manager;&lt;/li&gt;
&lt;li&gt;NAS;&lt;/li&gt;
&lt;li&gt;Airplay terminal;&lt;/li&gt;
&lt;li&gt;Retro games console&amp;hellip;&lt;/li&gt;
&lt;/ul&gt;
</description>
    </item>
    
    <item>
      <title>Using CSS to add line numbering</title>
      <link>https://sylvaindurand.org/using-css-to-add-line-numbering/</link>
      <pubDate>Mon, 20 Oct 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/using-css-to-add-line-numbering/</guid>
      <description>&lt;p&gt;When you want to display a code listing with HTML, you use a &lt;code&gt;&amp;lt;pre&amp;gt;&lt;/code&gt; tag in order to indicate that the text is preformatted, then inside one or multiple &lt;code&gt;&amp;lt;code&amp;gt;&lt;/code&gt; tags to specify it is a code.&lt;/p&gt;
&lt;p&gt;Showing line numbers appears may be quite useful, and the methods to achieve this vary widely: many use Javascript or tables&amp;hellip;&lt;/p&gt;
&lt;p&gt;Yet it is possible to achieve this in a simple way, using only CSS and HTML. The line numbers won&amp;rsquo;t be selected when the user wants to copy the code.&lt;/p&gt;
&lt;h2 id=&#34;html&#34;&gt;HTML&lt;/h2&gt;
&lt;p&gt;The only thing to do in our HTML code is to use a &lt;code&gt;&amp;lt;code&amp;gt;&lt;/code&gt; tag for each line of code. This will produce a perfectly valid HTML code:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;&amp;lt;pre&amp;gt;
&amp;lt;code&amp;gt;line 1&amp;lt;/code&amp;gt;
&amp;lt;code&amp;gt;line 2&amp;lt;/code&amp;gt;
&amp;lt;code&amp;gt;line 3&amp;lt;/code&amp;gt;
&amp;lt;code&amp;gt;line 4&amp;lt;/code&amp;gt;
&amp;lt;code&amp;gt;line 5&amp;lt;/code&amp;gt;
&amp;lt;/pre&amp;gt;
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;css&#34;&gt;CSS&lt;/h2&gt;
&lt;p&gt;The &lt;code&gt;:before&lt;/code&gt; pseudo-element will allow us to show an element before each line, while the CSS counters will allow us to count the lines.&lt;/p&gt;
&lt;p&gt;We will first define a counter that starts at one for each block, then which is incremented at each new line of code:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pre{
    counter-reset: line;
}
code{
    counter-increment: line;
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we display the number at the beginning of each line:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;code:before{
    content: counter(line);
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;With Webkit browsers, selecting the code to copy it gives the impression that the numbers are selected (although fortunately they are not copied). To avoid this, simply use the property &lt;code&gt;user-select&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;code:before{
    -webkit-user-select: none;
}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;It only remains to improve their style as desired. That&amp;rsquo;s it!&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Using Github to serve Jekyll</title>
      <link>https://sylvaindurand.org/using-github-to-serve-jekyll/</link>
      <pubDate>Sun, 28 Sep 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/using-github-to-serve-jekyll/</guid>
      <description>&lt;p&gt;GitHub has created a wonderful ecosystem built around the static websites generator Jekyll. GitHub Pages allows to generate, then to serve automatically Jekyll websites. This service, free and quite effective, brings together the best aspects of static websites – speed, reliability, security, ability to use &lt;code&gt;git&lt;/code&gt; – while allowing their modification online. This article aims to show how to:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;synchronize your website with &lt;code&gt;git&lt;/code&gt; on GitHub ;&lt;/li&gt;
&lt;li&gt;generate and serve it on the fly with GitHub Pages ;&lt;/li&gt;
&lt;li&gt;write articles directly on line thanks to Prose ;&lt;/li&gt;
&lt;li&gt;test compilations, HTML validity and links with Travis.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;hosting-our-website-on-github&#34;&gt;Hosting our website on GitHub&lt;/h2&gt;
&lt;h3 id=&#34;account-creation&#34;&gt;Account creation&lt;/h3&gt;
&lt;p&gt;If you haven&amp;rsquo;t already got one, create an account on GitHub by providing an username (beware, the username is important, because it will be used in the repository and the URL used by GitHub Pages), an email address and a password; otherwise, use your usual login informations.&lt;/p&gt;
&lt;h3 id=&#34;creating-the-repository&#34;&gt;Creating the repository&lt;/h3&gt;
&lt;p&gt;In your profile page, choose Repositories then New in order to create the repository which will host our website. The repository name has to be &lt;code&gt;username.github.io&lt;/code&gt;, where &lt;code&gt;username&lt;/code&gt; is the one you provided when you signed up. The website will also be available on this location.&lt;/p&gt;
&lt;p&gt;Choose the Initialize this repository with a README option in order to be able to use directly &lt;code&gt;git clone&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;If you have got a GitHub paid plans, you can create a private repository in order to hide your codes (in the case of a simple Jekyll website, this option may not be really useful).&lt;/p&gt;
&lt;h3 id=&#34;synchronizing-our-local-folder&#34;&gt;Synchronizing our local folder&lt;/h3&gt;
&lt;p&gt;On your computer, create the folder where the website will be stored, then open a terminal and clone the newly created repository:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;git clone https://github.com/username/username.github.io.git
cd username.github.io
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Let&amp;rsquo;s start by creating a &lt;code&gt;.gitignore&lt;/code&gt; file which will allow us to ignore the &lt;code&gt;_site&lt;/code&gt; repository in which the website will be generated (we musn&amp;rsquo;t check this folder, which is only a result of the source code), the &lt;code&gt;Gemfile.lock&lt;/code&gt; file we will create later, and if you use on macOS the &lt;code&gt;.DS_Store&lt;/code&gt; folders created by the operating system. The &lt;code&gt;.gitignore&lt;/code&gt; file will looks like:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;_site
.jekyll-metadata
Gemfile.lock
.DS_Store
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can now push this file on GitHub (when you &lt;code&gt;push&lt;/code&gt; for the first time, you have to provide your username and your password, but they won&amp;rsquo;t be asked again) :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;git add .gitignore
git commit -m &amp;#34;First commit&amp;#34;
git push
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;synchronizing-the-website&#34;&gt;Synchronizing the website&lt;/h3&gt;
&lt;p&gt;Now, you only have to put your Jekyll website in this folder. It may be an existing website, or a newly created one thanks to &lt;code&gt;jekyll new&lt;/code&gt;.  It is then easy to maintain and edit the website with &lt;code&gt;git&lt;/code&gt; :&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;git add&lt;/code&gt; add the changes for the next commit;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;git commit&lt;/code&gt; valids thoses changes;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;git push&lt;/code&gt; sends them on GitHub.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;For instance, in order to send our new website, we add every file, then we use  &lt;code&gt;git commit&lt;/code&gt; then &lt;code&gt;git push&lt;/code&gt; :&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;git add --all
git commit -m &amp;#34;First version&amp;#34;
git push
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Because the website only use simple text files, you can use git as you would do with any other project.&lt;/p&gt;
&lt;h2 id=&#34;serving-jekyll-on-github-pages&#34;&gt;Serving Jekyll on GitHub Pages&lt;/h2&gt;
&lt;p&gt;We will now see how to use GitHub to generate, then host and serve the website. You will just have to use &lt;code&gt;git push&lt;/code&gt; in order to make GitHub generating and serving the last version of your website.&lt;/p&gt;
&lt;h3 id=&#34;being-able-to-reproduce-github-settings&#34;&gt;Being able to reproduce GitHub settings&lt;/h3&gt;
&lt;p&gt;Each time you will use &lt;code&gt;git push&lt;/code&gt;, your website will be automatically generated on GitHub.&lt;/p&gt;
&lt;p&gt;This is why it is highly important to make sure everything is going to work perfectly, if we don&amp;rsquo;t want to break our website online. In order to ensure your computer most closely matches the GitHub Pages settings, the best way to do is to use &lt;code&gt;bundler&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;gem install bundler
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, create on the root a &lt;code&gt;Gemfile&lt;/code&gt; file which will tells to use the &lt;code&gt;github-pages&lt;/code&gt; gem, which provide automatically the last versions and dependancies used by GitHub:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;source &amp;#39;https://rubygems.org&amp;#39;
gem &amp;#39;github-pages&amp;#39;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can then use &lt;code&gt;bundle install&lt;/code&gt; in order to install the gem(s). The &lt;code&gt;bundle update&lt;/code&gt; command will ensure you always have an up to date system.&lt;/p&gt;
&lt;p&gt;The &lt;code&gt;bundle exec jekyll serve&lt;/code&gt; command will now generate the website exactly as Github would do, so you can check on &lt;code&gt;http://localhost:4000&lt;/code&gt; that everything is right before pushing anything.&lt;/p&gt;
&lt;h3 id=&#34;activating-github-pages&#34;&gt;Activating GitHub Pages&lt;/h3&gt;
&lt;p&gt;Back on GitHub, go in the &lt;code&gt;username.github.io&lt;/code&gt; repository, choose &lt;code&gt;Settings&lt;/code&gt;, then the &lt;code&gt;GitHub Pages&lt;/code&gt; section in order to activate the website generation.&lt;/p&gt;
&lt;p&gt;Within a few moments (the first time, it can take a dozen of minutes, but then the website will be generated in a couple of seconds each time you push a commit), your website will be available on &lt;code&gt;https://username.github.io&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id=&#34;using-a-custom-domain-name&#34;&gt;Using a custom domain name&lt;/h3&gt;
&lt;p&gt;If you have a custom domain name &amp;ldquo;&lt;code&gt;domain.tld&lt;/code&gt;&amp;rdquo;, it is of course possible to use it instead of the default URL given by GitHub, which will then redirect to the new domain name. However, it won&amp;rsquo;t be possible to use HTTPS (if you try to go to &lt;code&gt;https://domain.tld&lt;/code&gt;, you will get a blank page showing &lt;code&gt;unknown domain: domain.tld&lt;/code&gt;).&lt;/p&gt;
&lt;p&gt;If you want to use a subdomain &lt;code&gt;subdomain.domain.tld&lt;/code&gt;, tell your registar to create a &lt;code&gt;CNAME&lt;/code&gt; record, with the &lt;code&gt;subdomain&lt;/code&gt; name and the &lt;code&gt;username.github.io&lt;/code&gt; value. Then, create a file named &lt;code&gt;CNAME&lt;/code&gt; on the root of the repository, containing exactly &lt;code&gt;subdomain.domain.tld&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id=&#34;custom-404-error-page&#34;&gt;Custom 404 error page&lt;/h3&gt;
&lt;p&gt;GitHub allows you to have a custom 404 error page. When you test your website locally with &lt;code&gt;bundle exec jekyll serve&lt;/code&gt;, this error page also works: you can try by providing an incorrect URL. Just tell Jekyll to create a &lt;code&gt;404.html&lt;/code&gt; on the root:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;---
title: Page not found
permalink: /404.html
---

This page must have been removed or had its name changed.
&lt;/code&gt;&lt;/pre&gt;&lt;h2 id=&#34;to-go-further&#34;&gt;To go further&lt;/h2&gt;
&lt;h3 id=&#34;writing-and-editing-your-articles-online-with-prose&#34;&gt;Writing and editing your articles online with Prose&lt;/h3&gt;
&lt;p&gt;One of the main disadvantages of static websites is the impossibility to edit them online without your computer.&lt;/p&gt;
&lt;p&gt;Because your website is hosted on GitHub, it is possible to modify files directly online. Jekyll generates Pages each time you modify a page. You can also use the Prose.io website, which provides a nice interface, a great syntax highlighting and a preview system in order to write your articles.&lt;/p&gt;
&lt;p&gt;On the Prose.io website, use your GitHub login information and allow Prose to see and change your repositories. You can then create and edit your articles, or any other file of the website.&lt;/p&gt;
&lt;h3 id=&#34;using-travis-to-check-your-website&#34;&gt;Using Travis to check your website&lt;/h3&gt;
&lt;p&gt;Travis allows your to generate the website each time you push something, in order to check nothing is wrong. It is also possible to add some other tests like &lt;code&gt;htmlproofer&lt;/code&gt; which checks if the HTML code is valid and there are no rotten links. You will get a warning email if something is wrong.&lt;/p&gt;
&lt;p&gt;To do so, use your GitHub login informations on Travis, then enable the &lt;code&gt;username.github.io&lt;/code&gt; repository. Then, add &lt;code&gt;htmlproofer&lt;/code&gt; in your &lt;code&gt;Gemfile&lt;/code&gt; file, which now looks like:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;source &amp;#39;https://rubygems.org&amp;#39;
gem &amp;#39;github-pages&amp;#39;
gem &amp;#39;html-proofer&amp;#39;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, create a &lt;code&gt;.travis.yml&lt;/code&gt; file in order to tell Travis how to build and test the website:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;language: ruby
rvm:
- 2.1.1
script:
- bundle exec jekyll build &amp;amp;&amp;amp; bundle exec htmlproof ./_site
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Now, each time you push something, Travis will send you an email if Jekyll can&amp;rsquo;t generate your website, if the HTML code is not valid or if a link rot remains.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Website delivery with Cloudfront</title>
      <link>https://sylvaindurand.org/website-delivery-with-cloudfront/</link>
      <pubDate>Sun, 14 Sep 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/website-delivery-with-cloudfront/</guid>
      <description>&lt;p&gt;The main interest of static website is to be able to be stored in the cloud, that is to say on a content delivery network able to serve our data with amazing performances, a very low cost, and multiple benefits in terms of lightness, safety and reliability.&lt;/p&gt;
&lt;p&gt;This article sets out to show how to host a static website (wether built from a generator like Jekyll, Pelican or Hyde, or &amp;ldquo;by hand&amp;rdquo;) on Amazon Web Services, especially Amazon S3 in order to store the website files, and CloudFront in order to deliver them. The main purpose is to be able to get a website fast from anywhere, reliable, secure, highly scalable and inexpensive (with a low traffic, the hosting will cost you about one dollar a month).&lt;/p&gt;
&lt;p&gt;To this purpose, we will use:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;S3 in order to store the website;&lt;/li&gt;
&lt;li&gt;CloudFront in order to deliver our data;&lt;/li&gt;
&lt;li&gt;Route 53 in order to use our domain name.&lt;/li&gt;
&lt;li&gt;Awstats in order to analyse the logs.&lt;/li&gt;
&lt;/ul&gt;
&lt;h2 id=&#34;hosting-on-s3&#34;&gt;Hosting on S3&lt;/h2&gt;
&lt;p&gt;After having created an AWS account, go to the management console, then to S3: this service will store the website files.&lt;/p&gt;
&lt;h3 id=&#34;creating-buckets&#34;&gt;Creating buckets&lt;/h3&gt;
&lt;p&gt;The website will be located on &lt;code&gt;www.domain.tld&lt;/code&gt;. The domain name root, &lt;code&gt;domain.tld&lt;/code&gt;, will redirect to this location. Create two buckets (with &lt;code&gt;Create bucket&lt;/code&gt;) named from the expected URL: &lt;code&gt;domain.tld&lt;/code&gt; and &lt;code&gt;www.domain.tld&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id=&#34;bucket-hosting-the-website&#34;&gt;Bucket hosting the website&lt;/h3&gt;
&lt;p&gt;In &lt;code&gt;www.domain.tld&lt;/code&gt; properties, activate website hosting (&lt;code&gt;Static Website Hosting&lt;/code&gt; then &lt;code&gt;Enable website hosting&lt;/code&gt;): you can choose a home page (&lt;code&gt;index.html&lt;/code&gt;) or an error page (&lt;code&gt;error.html&lt;/code&gt;). The website will be available from the  &lt;code&gt;Endpoint&lt;/code&gt; URL: keep it, we will need it in the following section.&lt;/p&gt;
&lt;h3 id=&#34;buckets-redirecting&#34;&gt;Buckets redirecting&lt;/h3&gt;
&lt;p&gt;In &lt;code&gt;domain.tld&lt;/code&gt; properties, choose &lt;code&gt;Static Website Hosting&lt;/code&gt; in order to select &lt;code&gt;Redirect all requests&lt;/code&gt;: we provide &lt;code&gt;domain.tld&lt;/code&gt;. This bucket will stay empty.&lt;/p&gt;
&lt;p&gt;From &lt;code&gt;Endpoint&lt;/code&gt; location, we can now see the files hosted in &lt;code&gt;www.domain.tld&lt;/code&gt; bucket. We can upload those files from the AWS console, but we will explain on the last part how to upload it with one bash command line.&lt;/p&gt;
&lt;h2 id=&#34;serving-data-with-cloudfront&#34;&gt;Serving data with Cloudfront&lt;/h2&gt;
&lt;p&gt;S3 hosts our data in one unique location. Data stored in Dublin will be provided quite fast to a visitor located in Paris (about 200 ms in order to load the home page of this website) but less in New-York (500 ms) or Shanghai (1,300 ms).&lt;/p&gt;
&lt;p&gt;Amazon CloudFront is a CDN, serving content to end-users with high availability and high performance. The access time falls below 100 ms in Paris, New-York and Shanghai.&lt;/p&gt;
&lt;p&gt;In return, a propagation delay exists between an upload and its update on Cloudfront. We will see in the last part how to notify any modification.&lt;/p&gt;
&lt;h3 id=&#34;creating-the-distribution&#34;&gt;Creating the distribution&lt;/h3&gt;
&lt;p&gt;In the AWS management console, choose CloudFront, &lt;code&gt;Create Distribution&lt;/code&gt;, then &lt;code&gt;Web&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;In &lt;code&gt;Origin Domain Name&lt;/code&gt;, we provide the address previously copied, similar to &lt;code&gt;www.domain.tld.s3-website-eu-west-1.amazonaws.com&lt;/code&gt;. The field will automatically propose an other value (like &lt;code&gt;www.domain.tld.s3.amazonaws.com&lt;/code&gt;); don&amp;rsquo;t click on it: URL ending with &lt;code&gt;/&lt;/code&gt; wouldn&amp;rsquo;t lead to &lt;code&gt;/index.html&lt;/code&gt;. Choose an ID in &lt;code&gt;Origin ID&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;Leave the other field as default, except &lt;code&gt;Alternate Domain Names&lt;/code&gt; where we provide our domain name: &lt;code&gt;www.domain.tld&lt;/code&gt;. Indicate the homepage in &lt;code&gt;Default Root Object&lt;/code&gt;: &lt;code&gt;index.html&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;Our distribution is now created: we can now activate it with &lt;code&gt;Enable&lt;/code&gt;. &lt;code&gt;InProgress&lt;/code&gt;  status means Cloudfront is currently propagating our data; when it&amp;rsquo;s over, the status will become &lt;code&gt;Deployed&lt;/code&gt;.&lt;/p&gt;
&lt;h2 id=&#34;domain-name-with-route-53&#34;&gt;Domain name with Route 53&lt;/h2&gt;
&lt;h3 id=&#34;creating-zone&#34;&gt;Creating zone&lt;/h3&gt;
&lt;p&gt;Route 53 service will allow us to use our own domain name. In AWS console management, select Route 53 then &lt;code&gt;Create Hosted Zone&lt;/code&gt;. In &lt;code&gt;Domain Name&lt;/code&gt;, put your domain name without any sub-domain: &lt;code&gt;domain.tld&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id=&#34;redirecting-dns&#34;&gt;Redirecting DNS&lt;/h3&gt;
&lt;p&gt;Select the newly created zone, then the &lt;code&gt;NS&lt;/code&gt; type. Its &lt;code&gt;Value&lt;/code&gt; field gives 4 addresses. Tell your registrar to make the DNS pointing to them.&lt;/p&gt;
&lt;h3 id=&#34;domain-with-cloudfront&#34;&gt;Domain with Cloudfront&lt;/h3&gt;
&lt;p&gt;Back to Route 53, in &lt;code&gt;domain.tld&lt;/code&gt;, create 3 records set with &lt;code&gt;Create Record Set&lt;/code&gt;:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;domain.tld&lt;/code&gt; (put  &lt;code&gt;www&lt;/code&gt; in &lt;code&gt;name&lt;/code&gt;), &lt;code&gt;A&lt;/code&gt; type: in &lt;code&gt;Alias&lt;/code&gt;, select our Cloudfront distribution;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;domain.tld&lt;/code&gt;, &lt;code&gt;A&lt;/code&gt; type: select the same name bucket.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Of course, it is possible to redirect sub-domains to other services (with NS, A and CNAME records) and to use mails (MX records).&lt;/p&gt;
&lt;p&gt;Now, an user going to &lt;code&gt;domain.tld&lt;/code&gt; or &lt;code&gt;www.domain.tld&lt;/code&gt; will target the same name buckets (thanks to Route 53) which redirect to &lt;code&gt;www.domain.tld&lt;/code&gt; (thanks to S3). This address directly leads (thanks to Route 53) to the Cloudfront distribution, which provides our files stored in the  bucket &lt;code&gt;www.domain.tld&lt;/code&gt;. Now, we just have to send our website to Amazon S3.&lt;/p&gt;
&lt;h2 id=&#34;deploying-jekyll-to-the-cloud&#34;&gt;Deploying Jekyll to the cloud&lt;/h2&gt;
&lt;p&gt;We will now create a &lt;code&gt;sh&lt;/code&gt; file which will build the website, compress and send to Amazon S3 files which has been updated since the previous version, and indicate it to Cloudfront.&lt;/p&gt;
&lt;h3 id=&#34;prerequisite&#34;&gt;Prerequisite&lt;/h3&gt;
&lt;p&gt;We will use &lt;code&gt;s3cmd&lt;/code&gt; in order to sync our bucket with our local files. Install the last development version (you need to install at least the 1.5 version) which allows us to invalidate files on Cloudfront.&lt;/p&gt;
&lt;p&gt;On Mac OS, with Homebrew, install &lt;code&gt;s3cmd&lt;/code&gt; with &lt;code&gt;--devel&lt;/code&gt; option, and &lt;code&gt;gnupg&lt;/code&gt; for secured transfers:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;brew install --devel s3cmd
brew install gpg
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Now we have to gives &lt;code&gt;s3cmd&lt;/code&gt; the ability to deal with our AWS account. In Security Credentials, go to &lt;code&gt;Access Key&lt;/code&gt; and generate one access key and its secret Key. Then configure &lt;code&gt;s3cmd&lt;/code&gt; with  &lt;code&gt;s3cmd --configure&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;In order to optimize images, we will install &lt;code&gt;jpegoptim&lt;/code&gt; and &lt;code&gt;optipng&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo brew install jpegoptim
sudo brew install optipng
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;building-jekyll-and-compressing-files&#34;&gt;Building Jekyll and compressing files&lt;/h3&gt;
&lt;p&gt;We first build Jekyll into the &lt;code&gt;_site&lt;/code&gt; folder:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;jekyll build
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Using &lt;code&gt;jekyll-press&lt;/code&gt; plugin will optimize HTML, CSS and JS files. If &lt;code&gt;jpegoptim&lt;/code&gt; and &lt;code&gt;optipng&lt;/code&gt; are installed, we can optimize images:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;find _site -name &amp;#39;*.jpg&amp;#39; -exec jpegoptim --strip-all -m80 {} \;
find _site -name &amp;#39;*.png&amp;#39; -exec optipng -o5 {} \;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then, in order to improve performances, we compress HTML, CSS and JS files with Gzip, that is to say all files out of &lt;code&gt;static/&lt;/code&gt; folder:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;find _site -path _site/static -prune -o -type f \
-exec gzip -n &amp;#34;{}&amp;#34; \; -exec mv &amp;#34;{}.gz&amp;#34; &amp;#34;{}&amp;#34; \;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;uploading-files-to-amazon-s3&#34;&gt;Uploading files to Amazon S3&lt;/h3&gt;
&lt;p&gt;We use &lt;code&gt;s3cmd&lt;/code&gt; to upload the website; only the updated files will be sent. We use the following options:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;acl-public&lt;/code&gt; make our files public;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;cf-invalidate&lt;/code&gt; warn Cloudfront files have to be updated;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;add-header&lt;/code&gt; defines headers (compression, cache duration&amp;hellip;);&lt;/li&gt;
&lt;li&gt;&lt;code&gt;delete-sync&lt;/code&gt; delete files removed locally;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;M&lt;/code&gt; defines files MIME type.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;We first send static files, stored in &lt;code&gt;static/&lt;/code&gt;, assigning them a 10 weeks cache duration:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;s3cmd --acl-public --cf-invalidate -M \
      --add-header=&amp;#34;Cache-Control: max-age=6048000&amp;#34; \
      --cf-invalidate \
      sync _site/static s3://www.domain.tld/
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Then we send the other files (HTML, CSS, JS&amp;hellip;) with a 48 hours cache duration:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;s3cmd --acl-public --cf-invalidate -M \
      --add-header &amp;#39;Content-Encoding:gzip&amp;#39; \
      --add-header=&amp;#34;Cache-Control: max-age=604800&amp;#34; \
      --cf-invalidate \
      --exclude=&amp;#34;/static/*&amp;#34; \
      sync _site/ s3://www.domain.tld/
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally we clean the bucket by deleting files which have been deleted in the local folder, and we invalidate the home page on Cloudfront (&lt;code&gt;cf-invalidate&lt;/code&gt; doesn&amp;rsquo;t do it):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;s3cmd --delete-removed --cf-invalidate-default-index \
      sync _site/ s3://www.domain.tld/
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;deploy-in-one-single-command&#34;&gt;Deploy in one single command&lt;/h3&gt;
&lt;p&gt;We put those command in one single file, named &lt;code&gt;_deploy.sh&lt;/code&gt;, located in Jekyll folder:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
# Building Jekyll
jekyll build

# Compressing and optimizing files
find _site -path _site/static -prune -o -type f \
      -exec gzip -n &amp;#34;{}&amp;#34; \; -exec mv &amp;#34;{}.gz&amp;#34; &amp;#34;{}&amp;#34; \;
find _site -name &amp;#39;*.jpg&amp;#39; -exec jpegoptim --strip-all -m80 {} \;
find _site -name &amp;#39;*.png&amp;#39; -exec optipng -o5 {} \;

# Synchronisation des médias
s3cmd --acl-public --cf-invalidate -M \
      --add-header=&amp;#34;Cache-Control: max-age=6048000&amp;#34; \
      --cf-invalidate \
      sync _site/static s3://www.domain.tld/

# Sync media
s3cmd --acl-public --cf-invalidate -M \
      --add-header &amp;#39;Content-Encoding:gzip&amp;#39; \
      --add-header=&amp;#34;Cache-Control: max-age=604800&amp;#34; \
      --cf-invalidate \
      --exclude=&amp;#34;/static/*&amp;#34; \
      sync _site/ s3://www.domain.tld/

# Delete removed files
s3cmd --delete-removed --cf-invalidate-default-index \
      sync _site/ s3://www.domain.tld/
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You only have to execute &lt;code&gt;sh _deploy.sh&lt;/code&gt; to update the website. A few minutes may be required in order to update CloudFront data.&lt;/p&gt;
&lt;h2 id=&#34;stats&#34;&gt;Stats&lt;/h2&gt;
&lt;p&gt;Although our site is static and served by a CDN, it is quite possible to analyze the logs if you do not want to use a system based on a javascript code, such as Matomo or Google Analytics. Here, we will automate the task (recovery logs, processing and displaying statistics) from a server (in our example, a Raspberry Pi in Raspbian) and we will use Awstats.&lt;/p&gt;
&lt;h3 id=&#34;retrieving-logs&#34;&gt;Retrieving logs&lt;/h3&gt;
&lt;p&gt;Let&amp;rsquo;s start by activating logs creation on our Cloudfront distribution. In the AWS Management Console, select the Amazon S3 service and create a &amp;ldquo;statistics&amp;rdquo; bucket which will store logs waiting to be retrieved. Then, in Cloudfront, select the distribution that provides our website, then &lt;code&gt;Distribution&lt;/code&gt; settings, &lt;code&gt;Edit&lt;/code&gt;, and select the &lt;code&gt;statistics&lt;/code&gt; bucket in the field &lt;code&gt;Bucket for Logs&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;We create locally a folder that will retrieve these logs, then we can then retrieve the logs and then delete the bucket using &lt;code&gt;s3cmd&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mkdir ~/awstats
mkdir ~/awstats/logs
s3cmd get --recursive s3://statistics/ ~/awstats/logs/
s3cmd del --recursive --force s3://statistics/
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;installing-and-configuring-awstats&#34;&gt;Installing and configuring Awstats&lt;/h3&gt;
&lt;p&gt;We begin by installing and copy Awstats (where &lt;code&gt;www.domain.tld&lt;/code&gt; is your domain name):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo apt-get install awstats
sudo cp /etc/awstats/awstats.conf \
        /etc/awstats/awstats.www.domain.tld.conf
sudo nano /etc/awstats/awstats.www.domain.tld.conf
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;In this configuration file, change the following settings to specify how to treat Awstats logs Cloudfront (where &lt;code&gt;user&lt;/code&gt; is your username):&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Processing multiple gzip logs files
LogFile=&amp;#34;/usr/share/awstats/tools/logresolvemerge.pl /home/user/awstats/logs/* |&amp;#34;
# Formating Cloudfront generated logs
LogFormat=&amp;#34;%time2 %cluster %bytesd %host %method %virtualname %url %code %referer %ua %query&amp;#34;
LogSeparator=&amp;#34;\t&amp;#34;
# Domain names (website and Cloudfront)
SiteDomain=&amp;#34;www.domain.tld&amp;#34;
HostAliases=&amp;#34;REGEX[.cloudfront\.net]&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Finally, we copy the images which will be displayed in the reports:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo cp -r /usr/share/awstats/icon/ ~/awstats/awstats-icon/
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;generating-stats&#34;&gt;Generating stats&lt;/h3&gt;
&lt;p&gt;Once this configuration is done, it is possible to generate statistics as a static HTML file using:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;/usr/share/awstats/tools/awstats_buildstaticpages.pl \
    -dir=~/awstats/ -update -config=www.domain.tld \
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The statistics are now readable from the &lt;code&gt;awstats.www.domain.tld.html&lt;/code&gt; file. It is then possible to publish it, send it to a server or email for example.&lt;/p&gt;
&lt;h3 id=&#34;regular-updating&#34;&gt;Regular updating&lt;/h3&gt;
&lt;p&gt;To automate the generation of statistics at regular intervals, creating a &lt;code&gt;stats.sh&lt;/code&gt; with &lt;code&gt;nano ~/awstats/stats.sh&lt;/code&gt; that retrieves logs and generates statistics:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;#!/bin/sh
# Retrieving logs
s3cmd get --recursive s3://statistics/ ~/awstats/logs/
s3cmd del --recursive --force s3://statistics/
# Generating stats
/usr/share/awstats/tools/awstats_buildstaticpages.pl \
    -dir=~/awstats/ -update -config=www.domain.tld \
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We give the rights to this file so it can be executed, and then create a cron task:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;sudo chmod 711 ~/awstats/stats.sh
sudo crontab -e
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;To generate statistics of every six hours for example:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;0 */6 * * * ~/awstats/stats.sh
&lt;/code&gt;&lt;/pre&gt;</description>
    </item>
    
    <item>
      <title>Static website with Jekyll</title>
      <link>https://sylvaindurand.org/static-website-with-jekyll/</link>
      <pubDate>Mon, 01 Sep 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/static-website-with-jekyll/</guid>
      <description>&lt;p&gt;At the beginning of the Internet, there were static sites: each web page was written &amp;ldquo;by hand&amp;rdquo; using a text editor, and then put online. The disadvantages are many, especially the need to duplicate the same changes on some pages (this is why it was sometimes really hard to maintain a website), to know HTML and to have his computer available to edit pages. The advent of CSS, which allows to separate actual content from its presentation format and to share it between the pages has not changed this fact (moreover, the inexistant interoperability between browsers and the poor support of CSS with Microsoft Internet Explorer, have delayed its use).&lt;/p&gt;
&lt;p&gt;It was then that appeared dynamic sites: the different programming languages, running on the server side, such as PHP, helped the rise of CMS, which made possible to create sites and change their content directly from a browser, thus allowing the emergence of sites, blogs, forums accessible to the greatest number. This is for example the case of Spip, Dotclear or WordPress. However, these systems are not without disadvantages:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;they are very sensitive to security gaps, which implies that you need to  monitor carefully updates and logs;&lt;/li&gt;
&lt;li&gt;they are server ressource intensive, and need specific hostings for large volume of visitors;&lt;/li&gt;
&lt;li&gt;they badly handle significant increases in workload, so they are very sensitive to DDoS attacks or huge influx of visitors (it is not uncommon that a website become unavailable because of an important event or a link from a news website);&lt;/li&gt;
&lt;li&gt;they tend to be a labyrinthine system, largely overkill for their use and needing databases.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;For a couple of years, static websites has come back into favor with the emergence of the static website generators. With simple text files, a program generates a website made entirely from static pages you just have to host. Security problems are thus virtually non-existent, it is possible to host your website on a very modest server or rather the opposite, to get excellent performances and handle huge increases in workload using a CDN like Cloudflare or Cloudfront. Ways to host a static website on Amazon S3 and Cloudfront are explained here:&lt;/p&gt;
&lt;p&gt;&lt;a href=&#34;https://sylvaindurand.org/static-website-with-cloudfront/&#34;&gt;Static website with Cloudfront&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;In addition, it is possible to follow the changes and to work collaboratively thanks to &lt;code&gt;git&lt;/code&gt;, to write the articles online and to generate the website on the fly with services like GitHub and Prose.io, or to have a commenting system with Disqus.&lt;/p&gt;
&lt;p&gt;This article will show how to install (I) and use (II) the Jekyll website static generator to create and modify a simple website.&lt;/p&gt;
&lt;h2 id=&#34;first-website-with-jekyll&#34;&gt;First website with Jekyll&lt;/h2&gt;
&lt;h3 id=&#34;installation-of-jekyll&#34;&gt;Installation of Jekyll&lt;/h3&gt;
&lt;p&gt;Directly install the last stable version of Ruby, or RVM, then simply launch:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;gem install jekyll
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;creation-of-a-new-website&#34;&gt;Creation of a new website&lt;/h3&gt;
&lt;p&gt;The command &lt;code&gt;jekyll new mysite&lt;/code&gt; will create the source code of a working website in the &lt;code&gt;mysite&lt;/code&gt; folder. In this folder, you can generate the website with &lt;code&gt;jekyll build&lt;/code&gt;. The output can then be seen in the &lt;code&gt;_site/&lt;/code&gt; folder.&lt;/p&gt;
&lt;p&gt;With a single command, it is possible to generate the website and create a local host in order to watch the produced website: use &lt;code&gt;jekyll serve&lt;/code&gt; in order to get your website available on &lt;code&gt;http://localhost:4000&lt;/code&gt;. You can also automatically regenerate the website each time you change something in the source code (however, this option doesn&amp;rsquo;t detect the changes provided in &lt;code&gt;_config.yml&lt;/code&gt;) with &lt;code&gt;jekyll serve -w&lt;/code&gt;, which will be by far the most useful command when you&amp;rsquo;ll start to play with Jekyll.&lt;/p&gt;
&lt;h3 id=&#34;tree-structure&#34;&gt;Tree structure&lt;/h3&gt;
&lt;p&gt;Jekyll uses several folders:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;code&gt;_posts/&lt;/code&gt; in which the articles are stored (you can freely organize your files in &lt;code&gt;_post&lt;/code&gt;), with names such as &lt;code&gt;yyyy-mm-dd-post-name.md&lt;/code&gt;;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;_layouts/&lt;/code&gt; which contains the layout of the website, that is to say everythin that will surround the articles;&lt;/li&gt;
&lt;li&gt;&lt;code&gt;_includes/&lt;/code&gt;, which contains small page fragments that you wish to include in multiple places on your site (when you put a file in &lt;code&gt;_includes&lt;/code&gt;, it is possible to include it anywhere with the tag &lt;code&gt;{{ include filename }}&lt;/code&gt;. Il is also possible to provide it parameters).&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The tree structure may then looks like:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;mysite/
    _includes/
    _layouts/
        default.html
        page.html
        post.html
    _posts/
        2014-08-24-static-website-with-jekyll.md
    assets/
        style.sass
        script.js
        favicon.ico
    index.html
    rss.xml
    _config.yml
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;You can add any folder or file in your website folder. If they don&amp;rsquo;t start with an underscore, Jekyll will generate them on the same location.&lt;/p&gt;
&lt;h2 id=&#34;using-jekyll&#34;&gt;Using Jekyll&lt;/h2&gt;
&lt;p&gt;Now that the first website is created, we will see how to make it evolve, how to write articles and use metadata.&lt;/p&gt;
&lt;p&gt;In order to create an article, juste create in &lt;code&gt;_posts&lt;/code&gt; folder a file with a name with the following format: &lt;code&gt;yyyy-mm-dd-post-name.md&lt;/code&gt; (it is also possible to create articles in the folder &lt;code&gt;_drafts&lt;/code&gt;, without any date in the file name: thus, it will create drafts invisible in the posts list but available with their URL). This file is divided into two sections: the frontmatter where the metadata are stored, and the content of the article.&lt;/p&gt;
&lt;h3 id=&#34;frontmatter-and-metadata&#34;&gt;Frontmatter and metadata&lt;/h3&gt;
&lt;p&gt;The frontmatter allows us to declare metadata, which will be called or tested in the website. It is set into the top of the file, under the following format:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;---
layout: default
title: My title
---
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Only the &lt;code&gt;layout&lt;/code&gt; variable is required: it defines which file in &lt;code&gt;_layouts/&lt;/code&gt; Jekyll should use to build the page. It is also usual to define a &lt;code&gt;title&lt;/code&gt; variable in order to provide a title to our article (some variables are reserved by Jekyll with a particuliar behaviour: &lt;code&gt;permalink&lt;/code&gt; for exemple specifies the final URL of a file).&lt;/p&gt;
&lt;p&gt;It is also possible to define default variables, declared once for all or parts of the articles. For instance, instead of declare &lt;code&gt;layout: default&lt;/code&gt; in each article stored in &lt;code&gt;_posts/&lt;/code&gt;, you may declare it once in &lt;code&gt;_config.yml&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;defaults:
  -
    scope:
      path: &amp;#34;_posts&amp;#34;
    values:
      layout: &amp;#34;default&amp;#34;
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;writing-articles-with-markdown&#34;&gt;Writing articles with Markdown&lt;/h3&gt;
&lt;p&gt;By default, Jekyll use Markdown. The purpose of this language is to provide a very simple syntax to replace the most commons HTML tags. It is however still quite possible to use HTML in posts.&lt;/p&gt;
&lt;p&gt;From its second version, Jekyll uses Kramdown which add many features like the possibility of giving CSS classes to elements, footnotes, definition lists, tables&amp;hellip;&lt;/p&gt;
&lt;h3 id=&#34;using-metadata&#34;&gt;Using metadata&lt;/h3&gt;
&lt;p&gt;Any metadata &amp;ldquo;&lt;code&gt;variable&lt;/code&gt;&amp;rdquo;, declared in the frontmatter or as a default, can be called anywhere in the website, with the tag &lt;code&gt;{{ page.variable }}&lt;/code&gt;, which returns its value.&lt;/p&gt;
&lt;p&gt;It is also possible to do some tests:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% if page.variable == &amp;#39;value&amp;#39; %}
    banana
{% else %}
    coconut
{% endif %}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;We can also, for example, make loops on each article satisfying some conditions:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;{% assign posts=site.posts | where: &amp;#34;variable&amp;#34;, &amp;#34;value&amp;#34; %}
{% for post in posts %}
    {{ post.lang }}
{% endfor %}
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Although the syntax may not be very elegant to use, the large number of available variables, plus the custom metadata, combined with the filters et commands, may become highly effective.&lt;/p&gt;
</description>
    </item>
    
    <item>
      <title>Spatial Data Analysis with R</title>
      <link>https://sylvaindurand.org/spatial-data-analysis-with-r/</link>
      <pubDate>Sat, 01 Feb 2014 00:00:00 +0000</pubDate>
      <guid>https://sylvaindurand.org/spatial-data-analysis-with-r/</guid>
      <description>&lt;p&gt;If R language has already become a reference in statistical analysis and data processing, it may be thanks to its hability to represent and visualize data. They can be used in order to visualize spatial data in the form of cartographic representations which, combined with its other features, makes it an excellent geographic information system. This article sets out to show, through the provision of relevant example, how R can handle spatial data by creating maps.&lt;/p&gt;
&lt;h3 id=&#34;prerequisite&#34;&gt;Prerequisite&lt;/h3&gt;
&lt;p&gt;Once R is installed on your computer, few libraries will be used: &lt;code&gt;rgdal&lt;/code&gt; allows us to import and project shapefiles, &lt;code&gt;plotrix&lt;/code&gt; creates color scales, and &lt;code&gt;classInt&lt;/code&gt; assigns colors to map data. Once the libraries installed with &lt;code&gt;install.packages&lt;/code&gt;, load them at the beginning of the session:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;library(&amp;#39;rgdal&amp;#39;)      # Reading and projecting shapefiles
library(&amp;#39;plotrix&amp;#39;)    # Creating color scales
library(&amp;#39;classInt&amp;#39;)   # Assigning colors to data
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;Graphics will be plot using R base functions. &lt;code&gt;ggplot2&lt;/code&gt; is an alternative, but it seems less relevant here: longer and less legible code, unability to plot holes inside polygones, &lt;code&gt;fortify&lt;/code&gt; and ploting can last much longer.&lt;/p&gt;
&lt;h2 id=&#34;blank-france-map&#34;&gt;Blank France map&lt;/h2&gt;
&lt;h3 id=&#34;reading-shapefiles&#34;&gt;Reading shapefiles&lt;/h3&gt;
&lt;p&gt;The &lt;code&gt;rgdal&lt;/code&gt; library provides &lt;code&gt;readOGR()&lt;/code&gt; in order to read shapefiles. &lt;code&gt;dsn&lt;/code&gt; must contain the path where shapefiles are located, and &lt;code&gt;layer&lt;/code&gt; the shapefile name, without extension. &lt;code&gt;readOGR&lt;/code&gt; reads &lt;code&gt;.shp&lt;/code&gt;, &lt;code&gt;.shx&lt;/code&gt;, &lt;code&gt;.dbf&lt;/code&gt; and &lt;code&gt;.prj&lt;/code&gt; files. Departements of France are given by Geofla:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Reading departements
departements &amp;lt;- readOGR(dsn=&amp;#34;shp/geofla&amp;#34;,  layer=&amp;#34;DEPARTEMENT&amp;#34;)

# Reading departements boundaries in order to plot France boundaries
bounderies &amp;lt;- readOGR(dsn=&amp;#34;shp/geofla&amp;#34;,  layer=&amp;#34;LIMITE_DEPARTEMENT&amp;#34;)
bounderies &amp;lt;- bounderies[bounderies$NATURE %in% c(&amp;#39;Fronti\xe8re internationale&amp;#39;,&amp;#39;Limite c\xf4ti\xe8re&amp;#39;),]
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;In order to show neighbouring countries, we will use data provided by Natural Earth. We will select Europe countries only:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Reading country and selecting Europe
europe &amp;lt;- readOGR(dsn=&amp;#34;shp/ne/cultural&amp;#34;, layer=&amp;#34;ne_10m_admin_0_countries&amp;#34;)
europe &amp;lt;- europe[europe$REGION_UN==&amp;#34;Europe&amp;#34;,]
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;projection-and-plot&#34;&gt;Projection and plot&lt;/h3&gt;
&lt;p&gt;The map will use the French official projection &amp;ldquo;Lambert 93&amp;rdquo;, already declared in the Geofla &lt;code&gt;.prj&lt;/code&gt; files. &lt;code&gt;spTransform&lt;/code&gt; will be used for the European coutries.&lt;/p&gt;
&lt;p&gt;Then, we will first plot French boundaries, in order to center the map on France. Borders colors are defined in &lt;code&gt;border&lt;/code&gt;, their tickness in &lt;code&gt;lwd&lt;/code&gt; and the filling color in &lt;code&gt;col&lt;/code&gt;.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Projection
europe &amp;lt;- spTransform(europe, CRS(&amp;#34;+init=epsg:2154&amp;#34;))

# Plot
pdf(&amp;#39;france.pdf&amp;#39;,width=6,height=4.7)
par(mar=c(0,0,0,0))

plot(bounderies,  col=&amp;#34;#FFFFFF&amp;#34;)
plot(europe,      col=&amp;#34;#E6E6E6&amp;#34;, border=&amp;#34;#AAAAAA&amp;#34;,lwd=1, add=TRUE)
plot(bounderies,  col=&amp;#34;#D8D6D4&amp;#34;, lwd=6, add=TRUE)
plot(departements,col=&amp;#34;#FFFFFF&amp;#34;, border=&amp;#34;#CCCCCC&amp;#34;,lwd=.7, add=TRUE)
plot(bounderies,  col=&amp;#34;#666666&amp;#34;, lwd=1, add=TRUE)

dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;france.webp&#34; alt=&#34;France blank map&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;visualizing-a-data-population-density&#34;&gt;Visualizing a data: population density&lt;/h2&gt;
&lt;h3 id=&#34;reading-data&#34;&gt;Reading data&lt;/h3&gt;
&lt;p&gt;The very large number of communes (the smallest administrative level in France) gives us excellent spatial data. Geofla provides us their bounderies, population and area. So we will plot population density:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Reading shapefile
communes &amp;lt;- readOGR(dsn=&amp;#34;shp/geofla&amp;#34;, layer=&amp;#34;COMMUNE&amp;#34;)
# Calculate density
communes$DENSITY &amp;lt;- communes$POPULATION/communes$SUPERFICIE*100000
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;color-scale&#34;&gt;Color scale&lt;/h3&gt;
&lt;p&gt;In order to create a color scale, we will assign shades of blue to each percentile. &lt;code&gt;classIntervals&lt;/code&gt; calculates percentiles, &lt;code&gt;smoothColors&lt;/code&gt; create the blue scale, and &lt;code&gt;findColours&lt;/code&gt; assigns blues depending on each commune depending on their population density. Then, we create a legend, with only five colors.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Color scale
col &amp;lt;- findColours(classIntervals(
            communes$DENSITY, 100, style=&amp;#34;quantile&amp;#34;),
            smoothColors(&amp;#34;#0C3269&amp;#34;,98,&amp;#34;white&amp;#34;))
# Legend
leg &amp;lt;- findColours(classIntervals(
            round(communes$DENSITY), 5, style=&amp;#34;quantile&amp;#34;),
            smoothColors(&amp;#34;#0C3269&amp;#34;,3,&amp;#34;white&amp;#34;),
            under=&amp;#34;less than&amp;#34;, over=&amp;#34;more than&amp;#34;, between=&amp;#34;–&amp;#34;,
            cutlabels=FALSE)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;plot&#34;&gt;Plot&lt;/h3&gt;
&lt;p&gt;We can now plot the map. In order to use an embedded font in the PDF, we will use &lt;code&gt;cairo_pdf()&lt;/code&gt; instead of &lt;code&gt;pdf&lt;/code&gt;:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Exporting in PDF
cairo_pdf(&amp;#39;densite.pdf&amp;#39;,width=6,height=4.7)
par(mar=c(0,0,0,0),family=&amp;#34;Myriad Pro&amp;#34;,ps=8)

# Ploting the map
plot(bounderies, col=&amp;#34;#FFFFFF&amp;#34;)
plot(europe,     col=&amp;#34;#E6E6E6&amp;#34;, border=&amp;#34;#AAAAAA&amp;#34;,lwd=1, add=TRUE)
plot(bounderies, col=&amp;#34;#D8D6D4&amp;#34;, lwd=6, add=TRUE)
plot(communes,   col=col, border=col, lwd=.1, add=TRUE)
plot(bounderies, col=&amp;#34;#666666&amp;#34;, lwd=1, add=TRUE)

# Ploting the legend
legend(-10000,6387500,fill=attr(leg, &amp;#34;palette&amp;#34;),
        legend=names(attr(leg,&amp;#34;table&amp;#34;)),
        title = &amp;#34;Density (p/km²):&amp;#34;)

dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;density.webp&#34; alt=&#34;Population density in France&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;visualizing-an-external-data--incomes&#34;&gt;Visualizing an external data : incomes&lt;/h2&gt;
&lt;p&gt;The main value is to plot data provided by external files. We will plot the median taxable income per consumption unit.&lt;/p&gt;
&lt;h3 id=&#34;reading-and-supplementing-data&#34;&gt;Reading and supplementing data&lt;/h3&gt;
&lt;p&gt;Unfortunately, data is missing for more than 5 000 communes, due to tax secrecy. We can &amp;ldquo;cheat&amp;rdquo; in order to improve the global render by assigning to those communes the canton (a larger administrative level) median income, given in the same file.&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Loading communes data
incomes &amp;lt;- read.csv(&amp;#39;csv/revenus.csv&amp;#39;)
communes &amp;lt;- merge(communes, incomes, by.x=&amp;#34;INSEE_COM&amp;#34;, by.y=&amp;#34;COMMUNE&amp;#34;)

# Loading cantons data
cantons  &amp;lt;- read.csv(&amp;#39;csv/cantons.csv&amp;#39;)

# Merging data
communes &amp;lt;- merge(communes, cantons, by=&amp;#34;CANTON&amp;#34;, all.x=TRUE)

# Assigning canton median income to communes with missing data
communes$REVENUS[is.na(communes$REVENUS)] &amp;lt;- communes$REVENUC[is.na(communes$REVENUS)]
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;color-scale-1&#34;&gt;Color scale&lt;/h3&gt;
&lt;p&gt;We generate color scale and legend:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;col &amp;lt;- findColours(classIntervals(
            communes$REVENUS, 100, style=&amp;#34;quantile&amp;#34;),
            smoothColors(&amp;#34;#FFFFD7&amp;#34;,98,&amp;#34;#F3674C&amp;#34;))

leg &amp;lt;- findColours(classIntervals(
            round(communes$REVENUS,0), 4, style=&amp;#34;quantile&amp;#34;),
            smoothColors(&amp;#34;#FFFFD7&amp;#34;,2,&amp;#34;#F3674C&amp;#34;),
            under=&amp;#34;moins de&amp;#34;, over=&amp;#34;plus de&amp;#34;, between=&amp;#34;–&amp;#34;,
            cutlabels=FALSE)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;plot-1&#34;&gt;Plot&lt;/h3&gt;
&lt;p&gt;And we plot:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;cairo_pdf(&amp;#39;incomes.pdf&amp;#39;,width=6,height=4.7)
par(mar=c(0,0,0,0),family=&amp;#34;Myriad Pro&amp;#34;,ps=8)

plot(boundaries, col=&amp;#34;#FFFFFF&amp;#34;)
plot(europe,     col=&amp;#34;#F5F5F5&amp;#34;, border=&amp;#34;#AAAAAA&amp;#34;,lwd=1, add=TRUE)
plot(boundaries, col=&amp;#34;#D8D6D4&amp;#34;, lwd=6, add=TRUE)
plot(communes,   col=col, border=col, lwd=.1, add=TRUE)
plot(boundaries, col=&amp;#34;#666666&amp;#34;, lwd=1, add=TRUE)

legend(-10000,6337500,fill=attr(leg, &amp;#34;palette&amp;#34;),
    legend=gsub(&amp;#34;\\.&amp;#34;, &amp;#34;,&amp;#34;, names(attr(leg,&amp;#34;table&amp;#34;))),
    title = &amp;#34;Median income:&amp;#34;)

dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;incomes.webp&#34; alt=&#34;Median taxable income per consumption unit in France in 2010&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;visualizing-map-data-the-road-network&#34;&gt;Visualizing map data: the road network&lt;/h2&gt;
&lt;p&gt;We can also add map data: cities, urban areas, rivers, forests&amp;hellip; We will here plot the French road network, thanks to Route 500, from IGN:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;roads &amp;lt;- readOGR(dsn=&amp;#34;shp/geofla&amp;#34;,  layer=&amp;#34;TRONCON_ROUTE&amp;#34;)
local     &amp;lt;- roads[roads$VOCATION==&amp;#34;Liaison locale&amp;#34;,]
principal &amp;lt;- roads[roads$VOCATION==&amp;#34;Liaison principale&amp;#34;,]
regional  &amp;lt;- roads[roads$VOCATION==&amp;#34;Liaison r\xe9gionale&amp;#34;,]
highway &amp;lt;- roads[roads$VOCATION==&amp;#34;Type autoroutier&amp;#34;,]

cairo_pdf(&amp;#39;roads.pdf&amp;#39;,width=6,height=4.7)
par(mar=c(0,0,0,0),family=&amp;#34;Myriad Pro&amp;#34;,ps=8)

plot(boundaries,  col=&amp;#34;#FFFFFF&amp;#34;)
plot(europe,      col=&amp;#34;#F5F5F5&amp;#34;, border=&amp;#34;#AAAAAA&amp;#34;,lwd=1, add=TRUE)
plot(boundaries,  col=&amp;#34;#D8D6D4&amp;#34;, lwd=6, add=TRUE)
plot(departements,col=&amp;#34;#FFFFFF&amp;#34;, border=&amp;#34;#FFFFFF&amp;#34;,lwd=.7, add=TRUE)
plot(local,       col=&amp;#34;#CBCBCB&amp;#34;, lwd=.1, add=TRUE)
plot(principal,   col=&amp;#34;#CCCCCC&amp;#34;, lwd=.3, add=TRUE)
plot(regional,    col=&amp;#34;#BBBBBB&amp;#34;, lwd=.5, add=TRUE)
plot(highway,     col=&amp;#34;#AAAAAA&amp;#34;, lwd=.7, add=TRUE)
plot(boundaries,  col=&amp;#34;#666666&amp;#34;, lwd=1, add=TRUE)

dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;routes.webp&#34; alt=&#34;French roads network&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;blank-world-map&#34;&gt;Blank world map&lt;/h2&gt;
&lt;h3 id=&#34;reading-shapefiles-1&#34;&gt;Reading shapefiles&lt;/h3&gt;
&lt;p&gt;We will load the following Natural Earth:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Loading Shapefiles
countries   &amp;lt;- readOGR(dsn=&amp;#34;shp/ne/cultural&amp;#34;,layer=&amp;#34;ne_110m_admin_0_countries&amp;#34;)
graticules  &amp;lt;- readOGR(dsn=&amp;#34;shp/ne/physical&amp;#34;,layer=&amp;#34;ne_110m_graticules_10&amp;#34;)
bbox        &amp;lt;- readOGR(dsn=&amp;#34;shp/ne/physical&amp;#34;,layer=&amp;#34;ne_110m_wgs84_bounding_box&amp;#34;)
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;projection-and-plot-1&#34;&gt;Projection and plot&lt;/h3&gt;
&lt;p&gt;We will use the Winkel Tripel projection:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Winkel Tripel projection
countries   &amp;lt;- spTransform(countries,CRS(&amp;#34;+proj=wintri&amp;#34;))
bbox        &amp;lt;- spTransform(bbox,  CRS(&amp;#34;+proj=wintri&amp;#34;))
graticules  &amp;lt;- spTransform(graticules, CRS(&amp;#34;+proj=wintri&amp;#34;))

# Ploting world map
pdf(&amp;#39;world.pdf&amp;#39;,width=10,height=6) # PDF export
par(mar=c(0,0,0,0))                # Zero margins

plot(bbox, col=&amp;#34;white&amp;#34;, border=&amp;#34;grey90&amp;#34;,lwd=1)
plot(countries, col=&amp;#34;#E6E6E6&amp;#34;, border=&amp;#34;#AAAAAA&amp;#34;,lwd=1, add=TRUE)
plot(graticules, col=&amp;#34;#CCCCCC33&amp;#34;, lwd=1, add=TRUE)

dev.off()                          # Saving file
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;monde.webp&#34; alt=&#34;Carte du monde projetée en Winkel Tripel&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;visualizing-data-human-development-index&#34;&gt;Visualizing data: Human Development Index&lt;/h2&gt;
&lt;p&gt;Most frequent usage consists of visualizing data with a color scale. Let&amp;rsquo;s plot the HDI, provided by the United Nations Develment Programme in a CSV file. The procedure is as described above:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Loading data and merging dataframes
hdi  &amp;lt;- read.csv(&amp;#39;csv/hdi.csv&amp;#39;)
countries &amp;lt;- merge(countries, hdi, by.x=&amp;#34;iso_a3&amp;#34;, by.y=&amp;#34;Abbreviation&amp;#34;)

# Converting HDI in numeric
countries$hdi &amp;lt;- as.numeric(levels(countries$X2012.HDI.Value))[countries$X2012.HDI.Value]

# Generating color scale and assigning colors
col &amp;lt;- findColours(classIntervals(countries$hdi, 100, style=&amp;#34;pretty&amp;#34;),
                       smoothColors(&amp;#34;#ffffe5&amp;#34;,98,&amp;#34;#00441b&amp;#34;))

# Assigning grey to missing data
col[is.na(countries$hdi)] &amp;lt;- &amp;#34;#DDDDDD&amp;#34;

# Generating legend
leg &amp;lt;- findColours(classIntervals(round(countries$hdi,3), 7, style=&amp;#34;pretty&amp;#34;),
                       smoothColors(&amp;#34;#ffffe5&amp;#34;,5,&amp;#34;#00441b&amp;#34;),
                       under=&amp;#34;less than&amp;#34;, over=&amp;#34;more than&amp;#34;, between=&amp;#34;–&amp;#34;, cutlabels=FALSE)

# Ploting
cairo_pdf(&amp;#39;hdi.pdf&amp;#39;,width=10,height=6)
par(mar=c(0,0,0,0),family=&amp;#34;Myriad Pro&amp;#34;,ps=8)

plot(bbox, col=&amp;#34;white&amp;#34;, border=&amp;#34;grey90&amp;#34;,lwd=1)
plot(countries,  col=col, border=col,lwd=.8, add=TRUE)
plot(graticules,col=&amp;#34;#00000009&amp;#34;,lwd=1, add=TRUE)

legend(-15000000,-3000000,fill=attr(leg, &amp;#34;palette&amp;#34;),
    legend= names(attr(leg,&amp;#34;table&amp;#34;)),
    title = &amp;#34;HDI in 2012 :&amp;#34;)
dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;hdi.webp&#34; alt=&#34;Human Development Index (HDI) in 2012&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;circles-visualization-most-populated-cities&#34;&gt;Circles visualization: most populated cities&lt;/h2&gt;
&lt;h3 id=&#34;reading-data-1&#34;&gt;Reading data&lt;/h3&gt;
&lt;p&gt;An other kind of visualization is given by circles. Population of most populated cities is provided by Natural Earth:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Loading shapefile
cities &amp;lt;- readOGR(dsn=&amp;#34;shp/ne/cultural&amp;#34;, layer=&amp;#34;ne_110m_populated_places&amp;#34;)
cities &amp;lt;- spTransform(cities, CRS(&amp;#34;+proj=wintri&amp;#34;))
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;circle-size&#34;&gt;Circle size&lt;/h3&gt;
&lt;p&gt;The data shall be proportionate to the circles areas, not the radius; so the radius is the square root of the population:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;# Calculating circles radius
cities$radius &amp;lt;- sqrt(cities$POP2015)
cities$radius &amp;lt;- cities$radius/max(cities$radius)*3
&lt;/code&gt;&lt;/pre&gt;&lt;h3 id=&#34;plot-2&#34;&gt;Plot&lt;/h3&gt;
&lt;p&gt;We plot the map:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;pdf(&amp;#39;cities.pdf&amp;#39;,width=10,height=6)
par(mar=c(0,0,0,0))

plot(bbox, col=&amp;#34;white&amp;#34;, border=&amp;#34;grey90&amp;#34;, lwd=1)
plot(countries, col=&amp;#34;#E6E6E6&amp;#34;, border=&amp;#34;#AAAAAA&amp;#34;, lwd=1, add=TRUE)
points(cities, col=&amp;#34;#8D111766&amp;#34;, bg=&amp;#34;#8D111766&amp;#34;, lwd=1, pch=21, cex=cities$radius)
plot(graticules, col=&amp;#34;#CCCCCC33&amp;#34;, lwd=1, add=TRUE)

dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;villes.webp&#34; alt=&#34;Most populated cities in the world&#34;&gt;&lt;/p&gt;
&lt;h2 id=&#34;visualizing-map-data-urban-areas&#34;&gt;Visualizing map data: urban areas&lt;/h2&gt;
&lt;p&gt;Natural Earth provides urban areas shapefiles, derived from satellite data. Let&amp;rsquo;us map them with night lights colors:&lt;/p&gt;
&lt;pre tabindex=&#34;0&#34;&gt;&lt;code&gt;areas  &amp;lt;- readOGR(dsn=&amp;#34;shp/ne/cultural&amp;#34;,layer=&amp;#34;ne_10m_urban_areas&amp;#34;)
areas &amp;lt;- spTransform(areas, CRS(&amp;#34;+proj=wintri&amp;#34;))

pdf(&amp;#39;areas.pdf&amp;#39;,width=10,height=6)
par(mar=c(0,0,0,0))
plot(bbox, col=&amp;#34;#000000&amp;#34;, border=&amp;#34;#000000&amp;#34;,lwd=1)
plot(countries, col=&amp;#34;#000000&amp;#34;, border=&amp;#34;#000000&amp;#34;,lwd=1, add=TRUE)
plot(areas, col=&amp;#34;#FFFFFF&amp;#34;, border=&amp;#34;#FFFFFF66&amp;#34;,lwd=1.5, add=TRUE)

dev.off()
&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;&lt;img src=&#34;urbain.webp&#34; alt=&#34;World map (Winkel Tripel projection)&#34;&gt;&lt;/p&gt;
</description>
    </item>
    
  </channel>
</rss>