Differences

This shows you the differences between two versions of the page.

--- onny:notizen [2026/05/18 16:27] – [git] 10.250.0.1
+++ onny:notizen [2026/07/14 09:42] (current) – [packaging] 10.250.0.1
@@ Line 489: / Line 489: @@
 </code>
-==== wordpress docker image ====
-<file yml docker-compose.yml>
-version: '3'
-services:
-   db:
-     image: mysql:5.7
-     volumes:
-       - db_data:/var/lib/mysql
-     restart: always
-     environment:
-       MYSQL_ROOT_PASSWORD: somewordpress
-       MYSQL_DATABASE: wordpress
-       MYSQL_USER: wordpress
-       MYSQL_PASSWORD: wordpress
-   wordpress:
-     depends_on:
-       - db
-     image: wordpress:latest
-     volumes:
-       - .:/var/www/html/wp-content/themes/ausstellung-virtuell
-     ports:
-       - "8000:80"
-     restart: always
-     environment:
-       WORDPRESS_DB_HOST: db:3306
-       WORDPRESS_DB_USER: wordpress
-       WORDPRESS_DB_PASSWORD: wordpress
-volumes:
-    db_data:
-</file>
-Note the mount instruction in the volumes section, providing the local theme to the wordpress container.
-<code bash>
-docker-compose up -d
-</code>
-Visit 127.0.0.1:8000
 ===== eigenes system setup =====
@@ Line 635: / Line 598: @@
 </code>
 ==== git ====
+git fetch remote branch of a pull request
+<code>
+git fetch upstream pull/518799/head:pr-518799
+git checkout pr-518799
+</code>
 git show, list only affected files
@@ Line 1255: / Line 1224: @@
 <code bash>
 nix-shell -p 'python3.withPackages (p: [p.pygobject3])' -p libnotify -p gobjectIntrospection
-</code>
-fetchpatch array
-<code>
-patches = map fetchpatch [
-  /* This patch is currently necessary for the unit test suite to run correctly.
-   * See https://www.mail-archive.com/klee-dev@imperial.ac.uk/msg03136.html
-   * and https://github.com/klee/klee/pull/1458 for more information.
-   */
-  #{
-  #  name = "fix-gtest";
-  #  sha256 = "F+/6videwJZz4sDF9lnV4B8lMx6W11KFJ0Q8t1qUDf4=";
-  #  url = "https://github.com/klee/klee/pull/1458.patch";
-  #}
-  # This patch fixes test compile issues with glibc 2.33+.
-  #{
-  #  name = "fix-glibc-2.33";
-  #  sha256 = "PzxqtFyLy9KF1eA9AAKg1tu+ggRdvu7leuvXifayIcc=";
-  #  url = "https://github.com/klee/klee/pull/1385.patch";
-  #}
 </code>
@@ Line 1311: / Line 1258: @@
     };
   };
+</code>
+update package
+<code>
+nix-update gelly
+nix-update stamp --version=branch=main
 </code>
 ==== packaging ====
+fetchpatch
+<code>
+patches = [
+  (fetchpatch {
+    url = "https://salsa.debian.org/webkit-team/webkit/-/raw/debian/2.44.1-1/debian/patches/fix-ftbfs-riscv64.patch";
+    hash = "sha256-MgaSpXq9l6KCLQdQyel6bQFHG53l3GY277WePpYXdjA=";
+    name = "fix_ftbfs_riscv64.patch";
+  })
+];
+</code>
+fetchpatch array
+<code>
+patches = map fetchpatch [
+  /* This patch is currently necessary for the unit test suite to run correctly.
+   * See https://www.mail-archive.com/klee-dev@imperial.ac.uk/msg03136.html
+   * and https://github.com/klee/klee/pull/1458 for more information.
+   */
+  #{
+  #  name = "fix-gtest";
+  #  sha256 = "F+/6videwJZz4sDF9lnV4B8lMx6W11KFJ0Q8t1qUDf4=";
+  #  url = "https://github.com/klee/klee/pull/1458.patch";
+  #}
+  # This patch fixes test compile issues with glibc 2.33+.
+  #{
+  #  name = "fix-glibc-2.33";
+  #  sha256 = "PzxqtFyLy9KF1eA9AAKg1tu+ggRdvu7leuvXifayIcc=";
+  #  url = "https://github.com/klee/klee/pull/1385.patch";
+  #}
+</code>
+systemd hardening
+<code>
+{
+  ...
+}:
+let
+  defaultServiceConfig = {
+    User = "openproject";
+    Group = "openproject";
+    WorkingDirectory = "${pkgs.openproject}";
+    StateDirectory = cfg.stateDir;
+    # Service hardening
+    ReadWritePaths = [ cfg.stateDir ];
+    CacheDirectory = "openproject";
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = "";
+    # ProtectClock adds DeviceAllow=char-rtc r
+    DeviceAllow = "";
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    # Loosening setting, required by Ruby daemon
+    MemoryDenyWriteExecute = false;
+    NoNewPrivileges = true;
+    RemoveIPC = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProtectClock = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectSystem = "strict";
+    ProtectControlGroups = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    RestrictAddressFamilies = [
+      "AF_UNIX"
+      "AF_INET"
+      "AF_INET6"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+      # Loosening setting, required by Ruby daemon
+      #"~@privileged @setuid @keyring"
+    ];
+    UMask = "0077";
+  };
+in
+{
+  [...]
+    systemd.services."openproject-seeder" = {
+      serviceConfig = defaultServiceConfig // {
+</code>
+python modules hooks
+<code>
+nativeCheckInputs = [
+  pytestCheckHook
+  writableTmpDirAsHomeHook
+]
+</code>
+update script git updater
+<code>
+passthru.updateScript = gitUpdater {
+  ignoredVersions = "_rc";
+};
+</code>
+debuggig, run commands inside derivation
+<code>
+nix develop -f . stamp -c bash -c 'pkg-config --cflags --print-errors gio-unix-2.0'
+nix develop -f . stamp -c bash -c 'pkg-config --variable=includedir gio-unix-2.0'
+nix develop -f . stamp -c bash -c 'pkg-config --modversion gio-unix-2.0; pkg-config --path gio-unix-2.0 2>/dev/null || pkg-config --debug gio-unix-2.0 2>&1 | grep -i "gio-unix-2.0.pc"'
+.88.1
+</code>
 ===== tools =====
@@ Line 1641: / Line 1720: @@
     invoiceplane = inputs.invoiceplane-unstable.legacyPackages.x86_64-linux.invoiceplane;
     plausible = inputs.plausible-riscv.legacyPackages.x86_64-linux.pkgsCross.riscv64.plausible;
+  })
+];
+</code>
+overlay examples
+<code>
+nixpkgs.overlays = [
+  (self: super: {
+    python3 = super.python3.override {
+      packageOverrides = python-final: python-prev: {
+        mypy = python-prev.mypy.overridePythonAttrs (old: {
+          nativeBuildInputs = (old.nativeBuildInputs or []) ++ [
+            super.librt
+          ];
+        });
+      };
+    };
+    bcachefs-tools = super.bcachefs-tools.overrideAttrs (final: oldAttrs: {
+      version = "1.38.7-unstable-2026-07-02";
+      src = super.fetchFromGitHub {
+        owner = "koverstreet";
+        repo = "bcachefs-tools";
+        rev = "7f0cce3cf4d5241569674bbc92af8a75e78ade75";
+        hash = "sha256-RXerSh8gRyODncfLZsSz+5Foi6JShUI3dO1zZT/NMZU=";
+      };
+      cargoHash = null;
+      cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+        src = final.src;
+        hash = "sha256-DV0YPv+WtqtbTjwDdqj1r1jySVM8mgkscj+8NqVum2M=";
+      };
+    });
   })
 ];
@@ Line 1816: / Line 1930: @@
 ===== postmarketOS =====
+====== personal setup ======
+  * enable beacondb in geoclue conf
+====== notes ======
 update checksum
 <code bash>
@@ Line 1944: / Line 2062: @@
 # download kernel and stuff from here http://dl-cdn.alpinelinux.org/alpine/edge/releases/armv7/netboot/
 qemu-system-arm -M virt -m 512M -cpu cortex-a15 -kernel vmlinuz-lts -initrd initramfs-lts -append "console=ttyAMA0 ip=dhcp alpine_repo=http://dl-cdn.alpinelinux.org/alpine/edge/main/" -nographic
+</code>
+===== mariadb =====
+import dump
+<code bash>
+mariadb -u root nextcloud < mydump.sql
+</code>
+list tables and size of database nextcloud
+<code bash>
+SELECT
+    table_name AS `Table`,
+    ROUND(((data_length + index_length) / 1024 / 1024), 2) AS `Size (MB)`,
+    table_rows AS `Approx Rows`
+FROM information_schema.tables
+WHERE table_schema = 'nextcloud'
+ORDER BY (data_length + index_length) DESC;
 </code>
@@ Line 2000: / Line 2136: @@
 multi-cursor selection mode
 <code>
 Normal mode -> V (visual mode) -> Shift+C (multiple times) -> i (insert mode) -> Enter something
 ESC -> ,
+</code>
+sort
+<code>
+- select multiple lines
+- press Alt-S
+- type ":sort"
 </code>