Project-Insanity

Site Tools

Trace:
onny:notizen

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
onny:notizen [2026/07/02 12:09] – [system config] fdc9:281f:4d7:9ee9::1onny:notizen [2026/07/14 09:42] (current) – [packaging] 10.250.0.1
Line 1224: Line 1224:
 <code bash> <code bash>
 nix-shell -p 'python3.withPackages (p: [p.pygobject3])' -p libnotify -p gobjectIntrospection nix-shell -p 'python3.withPackages (p: [p.pygobject3])' -p libnotify -p gobjectIntrospection
-</code> 
- 
-fetchpatch array 
- 
-<code> 
-patches = map fetchpatch [ 
-  /* This patch is currently necessary for the unit test suite to run correctly. 
-   * See https://www.mail-archive.com/klee-dev@imperial.ac.uk/msg03136.html 
-   * and https://github.com/klee/klee/pull/1458 for more information. 
-   */ 
-  #{ 
-  #  name = "fix-gtest"; 
-  #  sha256 = "F+/6videwJZz4sDF9lnV4B8lMx6W11KFJ0Q8t1qUDf4="; 
-  #  url = "https://github.com/klee/klee/pull/1458.patch"; 
-  #} 
- 
-  # This patch fixes test compile issues with glibc 2.33+. 
-  #{ 
-  #  name = "fix-glibc-2.33"; 
-  #  sha256 = "PzxqtFyLy9KF1eA9AAKg1tu+ggRdvu7leuvXifayIcc="; 
-  #  url = "https://github.com/klee/klee/pull/1385.patch"; 
-  #} 
 </code> </code>
  
Line 1280: Line 1258:
     };     };
   };   };
 +</code>
 +
 +update package
 +
 +<code>
 +nix-update gelly
 +nix-update stamp --version=branch=main
 </code> </code>
 ==== packaging ==== ==== packaging ====
Line 1295: Line 1280:
 </code> </code>
  
 +fetchpatch array
 +
 +<code>
 +patches = map fetchpatch [
 +  /* This patch is currently necessary for the unit test suite to run correctly.
 +   * See https://www.mail-archive.com/klee-dev@imperial.ac.uk/msg03136.html
 +   * and https://github.com/klee/klee/pull/1458 for more information.
 +   */
 +  #{
 +  #  name = "fix-gtest";
 +  #  sha256 = "F+/6videwJZz4sDF9lnV4B8lMx6W11KFJ0Q8t1qUDf4=";
 +  #  url = "https://github.com/klee/klee/pull/1458.patch";
 +  #}
 +
 +  # This patch fixes test compile issues with glibc 2.33+.
 +  #{
 +  #  name = "fix-glibc-2.33";
 +  #  sha256 = "PzxqtFyLy9KF1eA9AAKg1tu+ggRdvu7leuvXifayIcc=";
 +  #  url = "https://github.com/klee/klee/pull/1385.patch";
 +  #}
 +</code>
 +
 +systemd hardening
 +
 +<code>
 +{
 +  ...
 +}:
 +
 +let
 +
 +  defaultServiceConfig = {
 +    User = "openproject";
 +    Group = "openproject";
 +    WorkingDirectory = "${pkgs.openproject}";
 +    StateDirectory = cfg.stateDir;
 +    # Service hardening
 +    ReadWritePaths = [ cfg.stateDir ];
 +    CacheDirectory = "openproject";
 +    AmbientCapabilities = "";
 +    CapabilityBoundingSet = "";
 +    # ProtectClock adds DeviceAllow=char-rtc r
 +    DeviceAllow = "";
 +    DevicePolicy = "closed";
 +    LockPersonality = true;
 +    # Loosening setting, required by Ruby daemon
 +    MemoryDenyWriteExecute = false;
 +    NoNewPrivileges = true;
 +    RemoveIPC = true;
 +    PrivateDevices = true;
 +    PrivateMounts = true;
 +    PrivateTmp = true;
 +    PrivateUsers = true;
 +    ProtectClock = true;
 +    ProtectHome = true;
 +    ProtectHostname = true;
 +    ProtectSystem = "strict";
 +    ProtectControlGroups = true;
 +    ProtectKernelLogs = true;
 +    ProtectKernelModules = true;
 +    ProtectKernelTunables = true;
 +    ProtectProc = "invisible";
 +    ProcSubset = "pid";
 +    RestrictAddressFamilies = [
 +      "AF_UNIX"
 +      "AF_INET"
 +      "AF_INET6"
 +    ];
 +    RestrictNamespaces = true;
 +    RestrictRealtime = true;
 +    RestrictSUIDSGID = true;
 +    SystemCallArchitectures = "native";
 +    SystemCallFilter = [
 +      "@system-service"
 +      # Loosening setting, required by Ruby daemon
 +      #"~@privileged @setuid @keyring"
 +    ];
 +    UMask = "0077";
 +  };
 +
 +in
 +{
 +
 +  [...]
 +    systemd.services."openproject-seeder" = {
 +      serviceConfig = defaultServiceConfig // {
 +</code>
 +
 +python modules hooks
 +
 +<code>
 +nativeCheckInputs = [
 +  pytestCheckHook
 +  writableTmpDirAsHomeHook
 +]
 +</code>
 +
 +update script git updater
 +
 +<code>
 +passthru.updateScript = gitUpdater {
 +  ignoredVersions = "_rc";
 +};
 +</code>
 +
 +debuggig, run commands inside derivation
 +
 +<code>
 +nix develop -f . stamp -c bash -c 'pkg-config --cflags --print-errors gio-unix-2.0'
 +nix develop -f . stamp -c bash -c 'pkg-config --variable=includedir gio-unix-2.0'
 +nix develop -f . stamp -c bash -c 'pkg-config --modversion gio-unix-2.0; pkg-config --path gio-unix-2.0 2>/dev/null || pkg-config --debug gio-unix-2.0 2>&1 | grep -i "gio-unix-2.0.pc"'
 +2.88.1
 +</code>
 ===== tools ===== ===== tools =====
  
Line 1832: Line 1930:
 ===== postmarketOS ===== ===== postmarketOS =====
  
 +====== personal setup ======
 +  * enable beacondb in geoclue conf
 +
 +====== notes ======
 update checksum update checksum
 <code bash> <code bash>
Line 1966: Line 2068:
 import dump import dump
 <code bash> <code bash>
-mysql -u root nextcloud < mydump.sql+mariadb -u root nextcloud < mydump.sql
 </code> </code>
  
Line 2034: Line 2136:
  
 multi-cursor selection mode multi-cursor selection mode
 +
 <code> <code>
 Normal mode -> V (visual mode) -> Shift+C (multiple times) -> i (insert mode) -> Enter something Normal mode -> V (visual mode) -> Shift+C (multiple times) -> i (insert mode) -> Enter something
 ESC -> , ESC -> ,
 +</code>
 +
 +sort
 +
 +<code>
 +- select multiple lines
 +- press Alt-S
 +- type ":sort"
 </code> </code>
  
onny/notizen.1782994152.txt.gz · Last modified: by fdc9:281f:4d7:9ee9::1