Project-Insanity

You've loaded an old revision of the document! If you save it, you will create a new version with this data.

===== bash =====

lzma hado compression and extraction
<code bash>
tar -c --lzma -f my_archive.tar.lzma /some_directory
tar -x --lzma -f my_archive.tar.lzma
</code>
run script verbose
<code bash>
sh -x scripname.sh
</code>
cheap python virtualenv
<code bash>
mkdir path
ln -s /usr/bin/python2 path/python
export PATH="$srcdir/path:$PATH"
</code>
get process runtime by pid, where pid is 1234 in this example
<code bash>
ps -o etime= -p "1234" 
</code>
write command output to file and to stdout (python -u for unbuffered output)
<code bash>
python3 -u sperrmuell.py 2>&1 | tee sperrmuell_ka.csv
</code>
recurseviley rename string
<code bash>
find . -type f -print0 | xargs -0 sed -i 's/twentytwelve/projectinsanity/g'
</code>
overwrite LD_LIBRARY_PATH
<code bash>
LD_LIBRARY_PATH="/home/onny/projects/onlyoffice-documentserver/src/DocumentServer-ONLYOFFICE-DocumentServer-5.2.7/core/build/lib/linux_64/:$LD_LIBRARY_PATH" ./AllFontsGen
</code>
compare command line argument to string
<code bash>
#!/bin/bash
if [ "$1" = "-v" ]; then
	wf-recorder -g "$(slurp)" -f "$(xdg-user-dir PICTURES)/$(date +'%Y-%m-%d-%H%M%S_wf-recorder.mp4')"
else
	slurp | grim -g - - | wl-copy && wl-paste > "$(xdg-user-dir PICTURES)/$(date +'%Y-%m-%d-%H%M%S_grim.png')"
fi
</code>
file exists
<code bash>
if [ ! -f /tmp/foo.txt ]; then
    echo "File not found!"
fi
</code>
program exit
<code bash>
exit 0 # okay
exit 1 # fail
</code>
receive signal bash
<code bash>
trap_with_arg() {
    func="$1" ; shift
    for sig ; do
        trap "$func $sig" "$sig"
    done
}

func_trap() {
    echo "Trapped: $1"
}

trap_with_arg func_trap INT TERM EXIT

echo "Send signals to PID $$ and type [enter] when done."
read # Wait so the script doesn't exit.
</code>

check file checksum
<code bash>
echo "$SHA256SUM  $FILE" \
  | sha256sum -c

if [ $? != 0 ]; then
  echo 'checkra1n checksum is not valid'
  exit 1
fi
</code>

launcher or wrapper: pass arguments into script
<code bash>
FILE=/tmp/checkra1n-0.12.4-beta
chmod +x $FILE
$FILE "$@"
</code>

==== grep ====
regex match group
<code bash>
grep -Po "(?<=Version: )([0-9]|\.)*(?=\s|\$)" style.css
</code>

==== patching ====
=== appling ===
<code bash>
diff -u original.c new.c > original.patch
patch < original.patch
# patch -p0 < original.patch
# patch -p1 -i packaging-fix.patch
</code>

=== creating patch ===
<code bash>
git commit -am "meine änderungen"
git format-patch "HEAD^"
</code>

==== xargs ====

<code>
fd . | xargs -I {} rm "{}"
</code>
===== date =====

convert date to unix timestamp

convert unix timestamp to datetime

<code bash>
date -d @1254330900 '+%Y-%m-%d %H:%M:%S'
</code>
===== rsync =====
custom ssh port
<code bash>
rsync -rvz -e 'ssh -p 2222' --progress --remove-sent-files ./dir user@host:/path
</code>
parallel, threaded
<code bash>
ls -1 | parallel rsync -a {} /destination/directory/
</code>
===== openssh =====
SSH public key deployen
<code bash>
ssh-copy-id alarm@10.0.0.2
</code>
local port forwarding to remote
<code bash>
ssh -R 0.0.0.0:8096:localhost:8096 onny@example.com
</code>
<file - /etc/ssh/sshd_config>
[...]
GatewayPorts yes
[...]
</file>
===== networking =====
==== ip ====

set new address

<code bash>
ip addr flush dev enp7s0f4u2
ip addr add 10.42.0.2/24 dev enp7s0f4u2
ip link set enp7s0f4u2 up
</code>

add route

<code bash>
ip route add default via 10.42.0.1 dev usb0
</code>
==== nftables ====

<code bash>
nft list ruleset
nft flush ruleset
nft -f ruleset.nft
</code>

display handles, insert rule at position

<code bash>
nft -a list ruleset
nft add rule inet filter input position 17 tcp dport "{http, https}" accept
nft delete rule inet filter input handle 23
</code>

==== sysctl ====
disable ipv6
<code bash>
sysctl net.ipv6.conf.all.disable_ipv6=1
sysctl net.ipv6.conf.default.disable_ipv6=1
sysctl net.ipv6.conf.lo.disable_ipv6=1
</code>

==== iptables ====
connection sharing. Iptables-Fu (internet0 ist das Interface, dass mit dem Internet verbunden ist):
<code bash>
sysctl net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i net0 -o internet0 -j ACCEPT
</code>
picloud network sharing & port forwarding openwrt
<code bash>
sysctl net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i net0 -o wlan0 -j ACCEPT
iptables -I FORWARD -o br-lan -d 192.168.1.2 -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 8096 -j DNAT --to 192.168.1.2:8096
iptables -t nat -A OUTPUT -p tcp --dport 8096 -j DNAT --to 192.168.1.2:8096
iptables -t nat -I PREROUTING -p tcp --dport 2222 -j DNAT --to 192.168.1.2:22
iptables -t nat -A OUTPUT -p tcp --dport 2222 -j DNAT --to 192.168.1.2:22
</code>
</code>

==== dnsmasq ====
minimal hostapd and dnsmasq config
<file - /etc/dnsmasq/dnsmasq.conf>
interface=wlan0
listen-address=172.24.1.1
bind-interfaces
server=8.8.8.8 
#port=0 # disable dns
domain-needed
bogus-priv
dhcp-range=172.24.1.50,172.24.1.150,12h
</file>

<file - /etc/hostapd/hostapd.conf>
interface=wlan0
driver=nl80211
ssid=MyAP
hw_mode=g
channel=11
wpa=1
wpa_passphrase=MyPasswordHere
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
wpa_ptk_rekey=600
</file>

==== ifupd ====
<file - /etc/ifplugd/ifplugd.action>
#!/bin/sh
ifname="$1"
action="$2"

case "$action.$ifname" in
up.enp0s10)
	systemctl restart systemd-networkd
	;;
down.enp0s10)
	;;
esac
</file>
<file - /etc/ifplugd/ifplugd.conf>
INTERFACES="enp0s10"
ARGS="-fwI -u0 -d10"
</file>
<code bash>
systemctl restart ifupd@enp0s25
systemctl enable ifupd@enp0s25
</code>
===== document manipulation =====
==== pdf document manipulation ====
compression
<code bash>
gm convert -density 200x200 -units PixelsPerInch -compress jpeg -quality 70 in.pdf out.pdf
</code>
lossless merge
<code bash>
pdfunite in-1.pdf in-2.pdf in-n.pdf out.pdf
</code>
extract page range
<code bash>
pdftk campus_italia.pdf cat 1-280 output campus_italia_a1a2.pdf
</code>
insert into pdf
<code bash>
pdftk A=bigpdf.pdf B=insert.pdf cat A1-180 B A181-end output output.pdf
</code>
imagemagick picture to equal size pdf
<code bash>
i=300; convert a.png b.png -compress jpeg -quality 100 \
      -density ${i}x${i} -units PixelsPerInch \
      -resize $((i*827/100))x$((i*1169/100)) \
      -gravity center \
      -extent $((i*827/100))x$((i*1169/100)) multipage.pdf
</code>
<code>convert a.jpeg b.pdf -compress jpeg -quality 70 -density 300x300 -units PixelsPerInch -resize 2481x3507 -gravity center -extent 2481x3507 multipage.pdf</code>
scale pdf pages to specific size (a4)
<code bash>
cpdf -scale-to-fit "210mm 297mm" Scheine\ Germanistik\ 3.pdf -o Scheine\ Germanistik\ 4.pdf
</code>
==== ffmpeg ====
Constant quality AV1.  The CRF value can be from 0–63. Lower values mean better quality.
<code bash>
ffmpeg -i input.mov -c:v libsvtav1 -crf 30 -preset 6 -svtav1-params tune=0 -c:a libopus -b:a 128k output.webm
</code>
Burn subtitles, fast video conversion
<code bash>
ffmpeg -i Kawamata\ -\ La\ passage\ des\ chaises.mkv -vf subtitles=Kawamata\ -\ La\ passage\ des\ chaises.mkv -acodec copy -preset:v ultrafast Kawamata\ -\ La\ passage\ des\ chaises.mp4
</code>

==== lossless mp3 merge ====
<code bash>
ffmpeg -f concat -i <(printf "file '%s'\n" ./*.mp3) -c copy output.mp3
</code>

==== lossless audio extraction ====
<code bash>
ffmpeg -i videofile.mp4 -vn -acodec copy audiofile.mp3
</code>
extract from mkv
<code bash>
n=`mkvinfo ${base}.mkv |grep "Track type" |grep -n "audio" |cut -d":" -f1`
audTrack=`echo "${n} - 1" |bc`
mkvextract tracks ${base}.mkv ${audTrack}:${base}.ac3
</code>
===== security =====

==== age ====

encrypt secret
<code>
echo -n "mypassword" > /tmp/hannypw
age -e -r "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAABCDEFGMbPeQlq4nw3jQPqG4qYV3TEVCCSz4Aa4gH picloud@picloudrv" -o stalwart-mail-user-crux.age /tmp/hannypw
</code>

==== web discovery ====

=== photon ===

<code>
photon -u test.example.org
</code>

==== lynis ====
<code bash>
lynis audit system --quick
</code>

==== subbrute ====
check for subdomains
<code bash>
torify subbrute leel.de
</code>
  * or via https://github.com/UnaPibaGeek/ctfr (Abusing Certificate Transparency logs for getting HTTPS websites subdomains)
  * https://github.com/caffix/amass
==== wfuzz ====
<code bash>
wfuzz -c --hc 404 -w /opt/wfuzz/wordlist/general/megabeast.txt http://www.leeel.de/FUZZ
wfuzz -c --hc 404,403 -w /opt/wfuzz/wordlist/general/admin-panels.txt -w /opt/wfuzz/wordlist/general/extensions_common.txt http://www.leeel.de/FUZZFUZ2Z
</code>
Preparing data for LFI scan
<code bash>
cat /var/cache/pkgfile/* | grep -a ".*/.*\.conf$" | sort | uniq > lfi
</code>
==== exploit kits ====
  * whatcms https://github.com/HA71/WhatCMS
  * ssh-auditor ssh vuln scan, pw bruteforce https://github.com/ncsa/ssh-auditor
  * https://sploitus.com/?query=openssh#exploits
  * hate_crack: hashcat wrapper
  * https://www.shodan.io/host/5.9.99.52
  * web scanner
    * https://github.com/maurosoria/dirsearch
  * wifite wifi auditing tool

sec tools

* dirbuster
  * https://mitmproxy.org/
  * **tiger** - system sec scanner
  * sub domain evaluation
    * https://github.com/kpcyrd/sn0int
    * https://github.com/OWASP/Amass
    * subfinder (passive, external sources)
  * vhost scanning
    * https://github.com/codingo/VHostScan
  * bettercap - wifi network
  * iodine dns tunnel https://code.kryo.se/iodine/
  * command searchsploit in exploitdb
  * NixOS for Pentesting Overview https://github.com/NixOS/nixpkgs/issues/81418

===== chromium / chrome =====
disable gpu blacklist, enable nouveau hardware acceleration
<code bash>
chromium --ignore-gpu-blacklist
</code>
===== vscodium =====

shortcut toggle block comment
<code bash>
Ctrl + Shift + A
</code>

add and jump to bookmark (requires extension)
<code bash>
Ctrl + Alt + K
Ctrl + Alt + J
</code>
===== eigenes system setup =====
==== signatures ====
<code bash>
gpg --keyserver pool.sks-keyservers.net --recv-keys 0x4E2C6E8793298290 # tor-browser-en aur packet
</code>

===== podcasts =====
kolhacampus archiv
^ sendung        ^ genre       ^ url                                       ^
| PLUG-IN        | drum&base   | http://www.icast.co.il/Rss.aspx?ID=515483 |
<code>
https://onny.project-insanity.org/laboumdeluxe/feed.xml # FM4 La Boum de Luxe, Music EDM Techno Radio
https://onny.project-insanity.org/bounce/feed.xml # SRF Virus Bounce, Music Hip Hop Radio
</code>
===== vs code =====
==== plugins ====
  * vetur (vuejs highlighting)

===== firejail =====
Running app without networking
<code bash>
firejail --net=none vlc
</code>
Running app in private mode (fresh home folder)
<code bash>
firefox --private firefox
</code>
Persistent user specific configuration
<code bash>
cat ~/.config/firejail/vlc.profile
include /etc/firejail/vlc.profile
net none
</code>

===== nextcloud =====
Sync only a specific folder with nextcloud
<code bash>
nextcloudcmd pictures https://nextcloud.project-insanity.org/remote.php/webdav/pictures
</code>

===== developement =====
==== gcc ====
<code>
-Werror=implicit-fallthrough=
</code>
<code>
-Wno-implicit-fallthrough
</code>
==== git ====

git fetch remote branch of a pull request
<code>
git fetch upstream pull/518799/head:pr-518799
git checkout pr-518799
</code>

git show, list only affected files
<code bash>
git show 45d2d903d507e8c8ce0c766243af103baa1bbe24 --name-only
</code>

unstage changes to a specific file of a specific commit
<code bash>
git rebase -i 19d0900f23e0b29fc2706dbbf8a806cea7c3e0f2^
git restore --staged --source=HEAD^ -- pkgs/by-name/op/openproject/package.nix
git restore -- pkgs/by-name/op/openproject/package.nix
git commit --amend
git rebase --continue
</code>

git rebase --onto, change base of current branch to one commit before 2c1231... but keep every commits after 52d639995...

<code bash>
git rebase --onto 2c1231d61dad184b6ebcff43bb5487a2cdfcc760~1 52d639995ffe58e3dc9de3c9d4193c2188133793
</code>

merge changes into last commit
<code bash>
git commit -a --amend --no-edit
</code>

show remote origin
<code bash>
git remote show origin
</code>

change remote origin
<code bash>
git remote set-url origin gitlab@http-new.pi:onny/web-wikidict.git
</code>

merge commits from a remote repository

<code bash>
git fetch https://github.com/rfc2822/davdroid.git master
git branch -r
git merge FETCH_HEAD
"force pull", overwrite local changes
git fetch --all
git reset --hard origin/master
git branch
git branch firefox45
git checkout firefox45
</code>
new branch
<code bash>
git branch iss53
git checkout iss53
</code>

delete branch

<code bash>
git branch # list
git branch -d swaybar
git push onny -d samsung-treltexx # delete remote branch
</code>

git show all tags
<code>
git log --no-walk --tags --pretty="%h %d %s"
</code>
delete last commit
<code bash>
git reset --hard HEAD~1
</code>
remove sensitive files from repo
<code>
git filter-branch --force --index-filter \
'git rm --cached --ignore-unmatch PATH-TO-YOUR-FILE-WITH-SENSITIVE-DATA' \
--prune-empty --tag-name-filter cat -- --all
git push origin --force --all
git push origin --force --tags
</code>
rebase upstream
<code bash>
git clone git@github.com:croaky/dotfiles.git
cd dotfiles
git remote add upstream git@github.com:thoughtbot/dotfiles.git
git fetch upstream
git rebase upstream/master
</code>
git cherry pick commit for specific files
<code bash>
git checkout 13243f2eafc4292917178051fe1bb5aab2774dca -p include/mmc.h drivers/mmc/mmc.c arch/arm/include/asm/arch-exynos/mmc.h drivers/mmc/s5p_sdhci.c common/cmd_mmc.c common/cmd_mmc_spi.c common/env_mmc.c include/sdhci.h
</code>

rebase

<code bash>
git remote add upstream https://github.com/whoever/whatever.git
git fetch upstream
git checkout master
git rebase upstream/master
git push -f origin master
</code>

rebase, force overwrite upstream changes
<code bash>
git rebase -X theirs master
</code>

rebase branch
<code bash>
git checkout fragments
git rebase upstream/master
</code>

squash commits

<code bash>
git rebase -i upstream/master
# < choose squash for all of your commits, except the first one >
# < Edit the commit message to make sense, and describe all your changes >
# or
git rebase -i HEAD~3
# or (replace main with origin branch)
git rebase -i $(git merge-base HEAD main)
# or
git merge --squash apple-a9
</code>

rerun tests with empty commit
<code bash>
git commit --allow-empty -m 'run tests again'
git push --set-upstream USERNAME mynewbranch
</code>
force push, remove latest commit of remote repository (origin)
<code bash>
git reset HEAD^
git push origin +HEAD
</code>

integrate changes into last commit
<code bash>
git commit --amend --no-edit
</code>

overwrite branch with other branch
<code bash>
git checkout maddy
git reset --hard maddytest
git push onny maddy -f
</code>

modify older or specific commit

<code bash>
git rebase --interactive 'bbc643cd^'
# make changes
git commit --all --amend --no-edit
git rebase --continue
</code>
===== yum =====
<code bash>
yum install rpm-build
rpmbuild --rebuild aiccu-2007.01.15-7.el6.src.rpm
cd /root/rpmbuild/RPMS/x86_64
rpm -i aiccu-2007.01.15-7.el7.centos.x86_64.rpm
</code>

===== tmux =====
copy all scrollback buffer into a file. Press keys: "Prefix + :"
<code>
capture-pane -S -3000
save-buffer filename.txt
</code>

===== wine =====
installing msi
<code bash>
wine msiexec /i xyz.msi
</code>

===== scanning =====
wireshark: filter only http traffic
<code>http</code>
arp-scan
<code bash>
arp-scan --interface=wlp3s0 --localnet
</code>
nmap use nse script
<code bash>
nmap -p 80 192.168.188.0/24 -n --open --script /usr/share/nmap/scripts/http-title.nse
</code>

===== Makefile =====
define variables with preset which can be overwritten
<code>
DOCUMENT_ROOT ?= /var/www/onlyoffice/documentserver
LOG_DIR ?= /var/log/onlyoffice/documentserver
DATA_DIR ?= /var/lib/onlyoffice/documentserver/App_Data
CONFIG_DIR ?= /etc/onlyoffice/documentserver
CREATE_USER ?= TRUE
</code>
conditions
<code>
ifeq ($(CREATE_USER),TRUE)
	adduser --quiet --home ${DESTDIR}${DOCUMENT_ROOT} --system --group onlyoffice
	chown onlyoffice:onlyoffice -R ${DESTDIR}$(dirname {DOCUMENT_ROOT})
	chown onlyoffice:onlyoffice -R ${DESTDIR}$(dirname {LOG_DIR})
	chown onlyoffice:onlyoffice -R ${DESTDIR}$(dirname $(dirname {DATA_DIR}))
endif
</code>
condition if directory exists
<code>
.PHONY: all
all:
ifneq ($(wildcard tileserver/*),)
    cd tileserver
    git pull
    cd ..
else
    git clone https://github.com/maptiler/tileserver-php.git tileserver
endif
</code>
===== mail =====

test imap login
<code>
openssl s_client -connect mx1.project-insanity.org:993 -crlf
# a1 LOGIN <username> <password>
# a2 LOGOUT
</code>

echo mail server
<code>
echo@univie.ac.at
</code>
  * check spamminess of email server: https://www.mail-tester.com/

send smtp mail
<code>
echo -n "username" | base64
# dXNlcm5hbWU=
echo -n "password" | base64
# cGFzc3dvcmQ=
openssl s_client -connect mail.agenturserver.de:465
AUTH LOGIN
ZGRkZGRkZGRk
enp6enp6enp6eno=
RCPT TO: <admin@example.local>
Subject: I have some questions!
Question 1: ...
DONE
</code>

====== davdroid ======
<code>
https://nextcloud.project-insanity.org/remote.php/dav
</code>
In case of 2FA requires device specific password

===== vim =====
comment multiple lines
<code>
CTRL + V # visual block mode
after selecting
Shift + I # insert mode
type #
ESC
</code>

===== onlyoffice =====
zitieren
<code>
Anführungszeichen öffnend: [Alt Gr] + [V]
Anführungszeichen schließend: [Alt Gr] + [B]
</code>

===== wayland =====
run x apps with root
<code bash>
xhost +SI:localuser:root
sudo gparted
</code>
===== gpg =====
<code bash>
==> Verifying source file signatures with gpg...
    aurutils-1.5.3.tar.gz ... FAILED (unknown public key 6BC26A17B9B7018A)
==> ERROR: One or more PGP signatures could not be verified!
==> ERROR: Could not download sources.
onny@http ~ % sudo -u aur gpg --recv-keys 6BC26A17B9B7018A    
</code>
decrypt symmetric
<code bash>
gpg doc.gpg
</code>
===== tools =====
  * etcher: create windows, mac and linux usb flash installation sticks
    * github.com/slacka/WoeUSB
  * browsh: graphical terminal browser
  * meld compare folders
  * cpod github
  * flutter sdk
  * deezloader remix
  * scrcpy: access android screen via adb and control ist
<code bash>
ngrep -q -W byline "^(GET|POST) .*"
ngrep -q -W byline "search" host www.google.com and port 80
</code>
  * sys
    * **usbtop**
    * **gotty** share terminal via web
  * privacy
    * **mat2** remove metadata from files https://0xacab.org/jvoisin/mat2
  * andoird
    * **anbox** android "emulator" linux systems
    * **scrcpy** access android phones with broken display via adb
  * piracy
    * **smloadr**
  * office
    * spice-up simple presentations
  * media
    * r128gain
    * https://github.com/Moonbase59/loudgain
  * https://github.com/marcelklehr/floccus
  * https://f-droid.org/en/packages/org.kde.kdeconnect_tp/
  * https://tsl0922.github.io/ttyd/
  * [[Network hacking]]
===== pages =====
  * unpaywall hack
<code>
https://outline.com/zeit.de/2011/26/Nationalsozialismus-Tagebuecher/komplettansicht
</code>

===== openwrt =====
udate all packages
<code bash>
opkg update
opkg list-upgradable | cut -f 1 -d ' ' | xargs opkg upgrade 
</code>

===== dbus =====
dbus system monitor with filter
<code bash>
busctl --match "path=/net/connman/iwd" monitor
</code>
list tree
<code bash>
busctl tree net.connman.iwd
</code>
introspect available properties
<code bash>
busctl introspect net.connman.iwd /net/connman/iwd/636166652d6d6174732d67617374_psk
</code>
===== systemd =====

systemctl show unit environment
<code>
systemctl show rsshub --property=Environment
</code>

service hardening
<code>
PrivateTmp=true
ProtectHome=true
# Mounts the /usr, /boot, and /etc directories read-only for processes invoked by this unit.
ProtectSystem=full
# Ensures that the service process and all its children can never gain new privileges
NoNewPrivileges=true
# Sets up a new /dev namespace for the executed processes and only adds API pseudo devices
# such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it,
# but no physical devices such as /dev/sda.
PrivateDevices=true
# Explicit module loading will be denied. This allows to turn off module load and unload
# operations on modular kernels. It is recommended to turn this on for most services that
# do not need special file systems or extra kernel modules to work.
ProtectKernelModules=true
# Kernel variables accessible through /proc/sys, /sys, /proc/sysrq-trigger, /proc/latency_stats,
# /proc/acpi, /proc/timer_stats, /proc/fs and /proc/irq will be made read-only to all processes
# of the unit. Usually, tunable kernel variables should only be written at boot-time, with the
# sysctl.d(5) mechanism. Almost no services need to write to these at runtime; it is hence
# recommended to turn this on for most services.
ProtectKernelTunables=true
# The Linux Control Groups (cgroups(7)) hierarchies accessible through /sys/fs/cgroup will be
# made read-only to all processes of the unit. Except for container managers no services should
# require write access to the control groups hierarchies; it is hence recommended to turn this on
# for most services
ProtectControlGroups=true
# Restricts the set of socket address families accessible to the processes of this unit.
# Protects against vulnerabilities such as CVE-2016-8655
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
# Takes away the ability to create or manage any kind of namespace
RestrictNamespaces=true
</code>
===== nix =====

nix repl usage

<code bash>
nix repl --expr 'let eval = import <nixpkgs/nixos/lib/eval-config.nix> { system = "x86_64-linux"; modules = []; }; in eval'
:p options.services.nextcloud.settings
</code>

<code>
nix repl nixpkgs
> legacyPackages.x86_64-linux.hello
</code>

run tests interactive

<code bash>
nix build -L .#nixosTests.quake3.driverInteractive
./result/bin/nixos-test-driver
start_all()
</code>

get attributes of test

<code bash>
nix eval .#nixosTests.nextcloud --apply builtins.attrNames --json
["with-imaginary34"]
nix build -L .#nixosTests.nextcloud.with-imaginary34
</code>

===== nixos =====

apply changes to system

<code>
sudo nixos-rebuild switch --flake '/etc/nixos#joes-desktop'
</code>

search package

<code bash>
nix search gedit
</code>

custom local repository, list packages

<code bash>
nix-env -f /etc/nixos/apps -qaP '*'
</code>

install package from local repo

<code bash>
nix-env -f /etc/nixos/apps -iA xerox6000-6010
</code>

package shell script

<code>
  # Here we but a shell script into path, which lets us start sway.service (after importing the environment of the login shell).
  environment.systemPackages = with pkgs; [
    (
      pkgs.writeTextFile {
        name = "startsway";
        destination = "/bin/startsway";
        executable = true;
        text = ''
          #! ${pkgs.bash}/bin/bash

# first import environment variables from the login manager
          systemctl --user import-environment
          # then start the service
          exec systemctl --user start sway.service
        '';
      }
    )
  ];
</code>

garbade collector
<code bash>
nix-collect-garbage -d
</code>

list package files
<code bash>
find $(nix eval -f /etc/nixos/apps --raw xerox6000-6010.outPath)
</code>

install package
<code bash>
nix-env -i icecat
</code>

remove package
<code bash>
nix-env -e icecat
</code>

or

<code bash>
sudo nix-store --delete --ignore-liveness /nix/store/1hnbdgz5yy9agnbnix2d8cvxj2d6hlc5-system-path
</code>

python virtualenv

<code bash>
nix-shell -p python3Packages.virtualenv
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
</code>

test packages git pull request

<code>
let
[...]
  nixpkgs-tars = "https://github.com/NixOS/nixpkgs/archive/";

# FIXME iwd networks option
  pr75800 = import (fetchTarball
    "${nixpkgs-tars}ba0baf53e24a123a45861cf5fa08e4b3e1377db0.tar.gz")
    { config = config.nixpkgs.config; };
  # FIXME nftables + docker
  pr81172 = import (fetchTarball 
    "${nixpkgs-tars}0b4e135d8e9c76a43346ae24e33572e627951203.tar.gz") 
    { config = config.nixpkgs.config; };
[...]
in
[...]
  nixpkgs.overlays = [
    (self: super:
      {
        # FIXME: add iwd networks option
        inherit (pr75800) iwd;
      }
      )];
</code>

retrieve hash

<code bash>
curl -sL https://github.com/NixOS/nixpkgs/pull/64977.patch \
                | head -n 1 | grep -o -E -e "[0-9a-f]{40}"
</code>

build local package

<code bash>
cd nixpkgs
nix build -f ./. python310Packages.baserow
nix build -f ./. nodePackages.hyperpotamus
nix-build -E 'with import <nixpkgs> { }; callPackage ./default.nix { nodejs = pkgs."nodejs-10_x"; }'
nix-build -E 'with import /home/onny/nixpkgs { }; libsForQt5.callPackage ./pkgs/applications/office/shelf/default.nix {}'

</code>

rebuilding with progress indication

<code bash>	 
nix build '(with import <nixpkgs/nixos> { }; system)'	 
nixos-rebuild -I nixpkgs=/home/onny/projects/nixpkgs switch --max-jobs 1	 
</code>

run program

<code bash>
nix run nixpkgs#electrum -- --help
nix run github:TheZombie1999/nixpkgs#upscaly
nix shell nixpkgs#hash-slinger --command tlsa --create example.org
</code>

review repository

<code bash>
nixpkgs-review pr 98044
nixpkgs-review wip --build-args="-j3"
</code>

setup python virtualenv, working pip

<code>
15.17.3.6. How to consume python modules using pip in a virtual environment like I am used to on other Operating Systems?
https://nixos.org/manual/nixpkgs/stable/#python
</code>

which package provides certain file

<code>
command-not-found telnet
</code>

overlay generate package derivation which includes custom files

<code>
  nwjs' = nwjs.overrideAttrs (x: {
    ffmpegPrebuilt = fetchurl {
      url = "https://github.com/iteufel/nwjs-ffmpeg-prebuilt/releases/download/${x.version}/${x.version}-linux-x64.zip";
      sha256 = "1ch14s80p4dpwkhwa831kqy4j7m55v1mdxvq0bdaa5jpd7c75mbk";
    };
    patchPhase = ''
      cd lib
      ${unzip}/bin/unzip -o $ffmpegPrebuilt
      ${x.patchPhase or ""}
    '';
  });
</code>

override only source hash

<code>
django-oauth-toolkit = super.django-oauth-toolkit.overrideAttrs (old: {
  version = "3.3.0";

src = old.src.override {
    hash = "sha256-eRQzAFUvSgoDiP7LW/+hMrNxHuXVxY+wc/E3VU/zeXo=";
  };
});
</code>

python environment with gobject introspection etc

<code bash>
nix-shell -p 'python3.withPackages (p: [p.pygobject3])' -p libnotify -p gobjectIntrospection
</code>

locate / search file belongs to which package
<code>
nix-locate -w libnss3.so
</code>

list package content
<code>
tree (nix-instantiate --eval -E 'with import <nixpkgs> {}; glibcLocales.outPath' | xargs)
</code>

nixos-shell usage

<code bash>
QEMU_NET_OPTS="hostfwd=tcp::8080-:80" NIX_PATH=nixpkgs=/home/onny/projects/nixpkgs nixos-shell vm-invoiceplane.nix
sudo -E QEMU_NET_OPTS="hostfwd=tcp::80-:80" NIX_PATH=nixpkgs=/home/onny/projects/nixpkgs nixos-shell vm-invoiceplane.nix
</code>

systemd one shot service

<code>
  # Symlink nvim user config for root user
  systemd.services.nvim-symlink = {
    script = ''
      if [[ ! -h "/root/.config/nvim" ]]; then
        ln -s "/home/onny/.config/nvim" "/root/.config/"
      fi
    '';
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
    };
  };
</code>

update package

<code>
nix-update gelly
nix-update stamp --version=branch=main
nix-update --use-update-script python3Packages.django-filingcabinet
</code>

run dynamically linked app

<code bash>
NIXPKGS_ALLOW_UNFREE=1 nix run --impure nixpkgs#steam-run -- ./pdfcraft
</code>
==== configuration ====

prepend list to existing default configuration of option

<code nix>
enabledPreviewProviders = lib.mkOptionDefault (
  lib.mkBefore [
    "OC\\Preview\\Imaginary"
    "OC\\Preview\\ImaginaryPDF"
  ]
);
</code>

==== packaging ====

template
<code>
{
  lib,
  buildGoModule,
  fetchFromCodeberg,
}:

buildGoModule (finalAttrs: {
  pname = "slurp";
  version = "1.1.1";
  __structuredAttrs = true;
  strictDeps = true;

src = fetchFromCodeberg {
    owner = "vyr";
    repo = "slurp";
    rev = "v${finalAttrs.version}";
    hash = "sha256-bqIX+kG/VXLvw/ORqS+Gq8fezd0QW6dlKdLr2vW0YY0=";
  };

vendorHash = "sha256-i/xoMJORuJbAQW+g9H95xQ5O3811NncCgJIL9OY+B5k=";

# Tests require networking
  doCheck = false;

meta = {
    description = "Tool for exporting data from and importing data to Fediverse instances";
    homepage = "https://codeberg.org/vyr/slurp";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ onny ];
    mainProgram = "slurp";
  };
})
</code>

fetchpatch

<code>
patches = [
  (fetchpatch {
    url = "https://salsa.debian.org/webkit-team/webkit/-/raw/debian/2.44.1-1/debian/patches/fix-ftbfs-riscv64.patch";
    hash = "sha256-MgaSpXq9l6KCLQdQyel6bQFHG53l3GY277WePpYXdjA=";
    name = "fix_ftbfs_riscv64.patch";
  })
];
</code>

fetchpatch array

<code>
patches = map fetchpatch [
  /* This patch is currently necessary for the unit test suite to run correctly.
   * See https://www.mail-archive.com/klee-dev@imperial.ac.uk/msg03136.html
   * and https://github.com/klee/klee/pull/1458 for more information.
   */
  #{
  #  name = "fix-gtest";
  #  sha256 = "F+/6videwJZz4sDF9lnV4B8lMx6W11KFJ0Q8t1qUDf4=";
  #  url = "https://github.com/klee/klee/pull/1458.patch";
  #}

# This patch fixes test compile issues with glibc 2.33+.
  #{
  #  name = "fix-glibc-2.33";
  #  sha256 = "PzxqtFyLy9KF1eA9AAKg1tu+ggRdvu7leuvXifayIcc=";
  #  url = "https://github.com/klee/klee/pull/1385.patch";
  #}
</code>

python modules hooks

<code>
nativeCheckInputs = [
  pytestCheckHook
  writableTmpDirAsHomeHook
]
</code>

update script git updater

<code>
passthru.updateScript = gitUpdater {
  ignoredVersions = "_rc";
};
</code>

debuggig, run commands inside derivation

<code>
nix develop -f . stamp -c bash -c 'pkg-config --cflags --print-errors gio-unix-2.0'
nix develop -f . stamp -c bash -c 'pkg-config --variable=includedir gio-unix-2.0'
nix develop -f . stamp -c bash -c 'pkg-config --modversion gio-unix-2.0; pkg-config --path gio-unix-2.0 2>/dev/null || pkg-config --debug gio-unix-2.0 2>&1 | grep -i "gio-unix-2.0.pc"'
2.88.1
</code>

===== python =====

python relax dependency

<code>
pythonRelaxDeps = [ "pydantic" ];
</code>
==== packaging module ====

systemd hardening

<code>
{
  ...
}:

let

defaultServiceConfig = {
    User = "openproject";
    Group = "openproject";
    WorkingDirectory = "${pkgs.openproject}";
    StateDirectory = cfg.stateDir;
    # Service hardening
    ReadWritePaths = [ cfg.stateDir ];
    CacheDirectory = "openproject";
    AmbientCapabilities = "";
    CapabilityBoundingSet = "";
    # ProtectClock adds DeviceAllow=char-rtc r
    DeviceAllow = "";
    DevicePolicy = "closed";
    LockPersonality = true;
    # Loosening setting, required by Ruby daemon
    MemoryDenyWriteExecute = false;
    NoNewPrivileges = true;
    RemoveIPC = true;
    PrivateDevices = true;
    PrivateMounts = true;
    PrivateTmp = true;
    PrivateUsers = true;
    ProtectClock = true;
    ProtectHome = true;
    ProtectHostname = true;
    ProtectSystem = "strict";
    ProtectControlGroups = true;
    ProtectKernelLogs = true;
    ProtectKernelModules = true;
    ProtectKernelTunables = true;
    ProtectProc = "invisible";
    ProcSubset = "pid";
    RestrictAddressFamilies = [
      "AF_UNIX"
      "AF_INET"
      "AF_INET6"
    ];
    RestrictNamespaces = true;
    RestrictRealtime = true;
    RestrictSUIDSGID = true;
    SystemCallArchitectures = "native";
    SystemCallFilter = [
      "@system-service"
      # Loosening setting, required by Ruby daemon
      #"~@privileged @setuid @keyring"
    ];
    UMask = "0077";
  };

in
{

[...]
    systemd.services."openproject-seeder" = {
      serviceConfig = defaultServiceConfig // {
</code>

settings option

<code>
settings = lib.mkOption {
  type = lib.types.submodule {
    freeformType = lib.types.attrsOf (
      lib.types.nullOr (
        lib.types.oneOf [
          lib.types.str
          lib.types.bool
          lib.types.int
          lib.types.port
          lib.types.path
        ]
      )
    );
    options = {
      OPENPROJECT_HOST__NAME = lib.mkOption {
        type = lib.types.str;
        default = "localhost";
        description = "Hostname to use";
      };
      PORT = lib.mkOption {
        type = lib.types.port;
        default = 6346;
        description = "Port for the puma daemon to bind to.";
      };
    };
  };
  default = { };
  description = ''
    Extra configuration options to append or override.
    For available and default option values see
    [upstream configuration file](https://www.openproject.org/docs/installation-and-operations/configuration/environment/).
  '';
};
</code>

merge settings with defaults

<code>
config = lib.mkIf cfg.enable {

services.openproject.settings = lib.mkMerge [
    {
      OPENPROJECT_RAILS_CACHE_STORE = "memcache";
      OPENPROJECT_CACHE__MEMCACHE__SERVER = "unix:///run/memcached/memcached.sock";
      OPENPROJECT_CACHE__NAMESPACE = "openproject";
    }
  ];
</code>

migrate option

<code>
  imports = [
    (mkRenamedOptionModule
      [ "services" "nextcloud" "logLevel" ] [ "services" "nextcloud" "settings" "loglevel" ])
  ];
  
  options.services.nextcloud = {
    enable = mkEnableOption "nextcloud";
</code>

lib.getExe

<code>
"${lib.getExe' quake3pkg "quake3-server"} +set g_gametype 0 "
</code>
===== tools =====

run / test update script
<code>
nix-shell maintainers/scripts/update.nix --argstr package openproject
</code>

===== snippets =====

fetchurl
<code>
{ fetchurl, }:

let
  pname = "librewolf-bin";
  version = "85.0.2-1";
  name = "${pname}-${version}";

src = fetchurl {
    url = "https://gitlab.com/librewolf-community/browser/linux/uploads/b87285386bed26dc6d6d4cf252ca7adf/LibreWolf-${version}.x86_64.AppImage";
    sha256 = "0sapm4g4qs63sm640kxcjrngxnix524ms6mxnn0xz6p0xr8dz27r";
  };

</code>

build package
<code bash>
cd /path/to/nixpkgs
nix-build -A nodePackages.<new-or-updated-package>
nix-build -E 'with import /home/onny/projects/nixpkgs { }; python3Packages.callPackage ./pkgs/development/python-modules/pyasn {}'
</code>

get checksum
<code bash>
nix-prefetch-url 'http://i3wm.org/downloads/i3-4.5.1.tar.bz2'
</code>

running tests
<code bash>
echo "$PR_DIFF" | xargs editorconfig-checker -disable-indent-size
</code>

reviewing uncommited changes
<code bash>
nixpkgs-review wip
</code>

tempalte fetchFromGitLab + cmake qt application
<code>
{ lib
, stdenv
, fetchFromGitLab
, cmake
, pkg-config
, qtbase
, qttools
, qpdf
, podofo
}:

stdenv.mkDerivation rec {
  pname = "pdfmixtool";
  version = "1.0.2";

src = fetchFromGitLab {
    owner = "scarpetta";
    repo = pname;
    rev = "v${version}";
    sha256 = "066ap1w05gj8n0kvilyhlr1fzwrmlczx3lax7mbw0rfid9qh3467";
  };

nativeBuildInputs = [
    cmake
    pkg-config
  ];

buildInputs = [
    qtbase
    qttools
    qpdf
    podofo
  ];

meta = with lib; {
    description = "An application to split, merge, rotate and mix PDF files";
    homepage = "https://gitlab.com/scarpetta/pdfmixtool";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ onny ];
  };

}
</code>

run test locally
<code bash>
nix-build nixos/tests/dokuwiki.nix
</code>

test changes to a modul
<code bash>
nixos-rebuild --upgrade switch -I nixpkgs=/home/onny/projects/nixpkgs
</code>

wrapProgram add binary to path
<code>
 nativeBuildInputs = [
    makeWrapper
  ];

[...]

postInstall = ''
    wrapProgram $out/bin/wihotspot-gui \
      --prefix PATH : ${lib.makeBinPath [ iw ]}
  '';
</code>

wrapProgram add specific arguments
<code bash>
{ lib, stdenv, fetchurl, makeWrapper, adoptopenjdk-bin, jre }:

[...]
  nativeBuildInputs = [ makeWrapper ];

installPhase = ''
    mkdir -p $out/share/java $out/bin
    cp $src $out/share/java/tla2tools.jar
    makeWrapper ${jre}/bin/java $out/bin/tlc \
      --add-flags "-XX:+UseParallelGC -cp $out/share/java/tla2tools.jar tlc2.TLC"
  '';

</code>

install and modify systemd service
<code>
  postInstall = ''
    mkdir -p $out/lib/systemd/system
    substitute dist/systemd/maddy.service $out/lib/systemd/system/maddy.service \
      --replace "/usr/bin/maddy" "$out/bin/maddy" \
      --replace "/bin/kill" "${coreutils}/bin/kill"
    substitute dist/systemd/maddy@.service $out/lib/systemd/system/maddy@.service \
      --replace "/usr/bin/maddy" "$out/bin/maddy" \
      --replace "/bin/kill" "${coreutils}/bin/kill"
  '';
</code>

build rust package
<code>
{ lib
, fetchFromGitHub
, rustPlatform
, pkg-config
, openssl
, dbus
, sqlite
, file
, gzip
, makeWrapper
}:

rustPlatform.buildRustPackage rec {
  pname = "krankerl";
  version = "0.13.0";

src = fetchFromGitHub {
    owner = "ChristophWurst";
    repo = "krankerl";
    rev = "v${version}";
    sha256 = "1gp8b2m8kcz2f16zv9xwv4n1zki6imvz9z31kixh6amdj6fif3d1";
  };

cargoSha256 = "sha256:01hcxs14wwhhvr08x816wa3jcm4zvm6g7vais793cgijipyv00rc";

nativeBuildInputs = [
    pkg-config
    gzip
    makeWrapper
  ];

buildInputs = [
    openssl
    dbus
    sqlite
  ];

checkInputs = [
    file
  ];

meta = with lib; {
    description = "A CLI helper to manage, package and publish Nextcloud apps";
    homepage = "https://github.com/ChristophWurst/krankerl";
    license = licenses.gpl3Only;
    platforms = platforms.linux;
    maintainers = with maintainers; [ onny ];
  };
}
</code>

packaging scheme unstable git
<code>
unstable-2018-05-15
</code>

package binary deb
<code>
{ stdenv
, lib
, fetchurl
, autoPatchelfHook
, dpkg
, qt5
, libjack2
, alsa-lib
, bzip2
, libpulseaudio }:

stdenv.mkDerivation rec {
  pname = "ocenaudio";
  version = "3.10.6";

src = fetchurl {
    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
    sha256 = "0fgvm1xw2kgrqj3w6slpfxbb3pw9k8i0dz16q9d5d8gyyvr2mh8g";
  };

nativeBuildInputs = [
    autoPatchelfHook
    qt5.qtbase
    qt5.wrapQtAppsHook
    libjack2
    libpulseaudio
    bzip2
    alsa-lib
  ];

buildInputs = [ dpkg ];

dontUnpack = true;
  dontBuild = true;
  dontStrip = true;

installPhase = ''
    mkdir -p $out
    dpkg -x $src $out
    cp -av $out/opt/ocenaudio/* $out
    rm -rf $out/opt
    # Create symlink bzip2 library
    ln -s ${bzip2.out}/lib/libbz2.so.1 $out/libbz2.so.1.0
  '';

meta = with lib; {
    description = "Cross-platform, easy to use, fast and functional audio editor";
    homepage = "https://www.ocenaudio.com";
    license = licenses.unfree;
    platforms = platforms.linux;
    maintainers = with maintainers; [ onny ];
  };
}
</code>

package appimage program
<code>
{ lib
, fetchurl
, appimageTools
}:

appimageTools.wrapType2 rec {
  pname = "sonixd";
  version = "0.14.0";

src = fetchurl {
    url = "https://github.com/jeffvli/sonixd/releases/download/v${version}/Sonixd-${version}-linux-x86_64.AppImage";
    sha256 = "sha256-q+26Ut5wN9gFDBdqirR+he/ppu/b1wiqq23WkcRAQd4=";
  };

extraInstallCommands = ''
    mv $out/bin/sonixd-${version} $out/bin/sonixd
  '';

meta = with lib; {
    description = "Full-featured Subsonic/Jellyfin compatible desktop music player";
    homepage = "https://github.com/jeffvli/sonixd";
    license = licenses.gpl3Only;
    maintainers = with maintainers; [ onny ];
    platforms = [ "x86_64-linux" ];
  };
}
</code>

packaging java / jar file

<code>
  installPhase = ''
    mkdir -p $out/{bin,lib}
    cp ${src}/briar-desktop.jar $out/lib/
    makeWrapper ${openjdk}/bin/java $out/bin/briar-desktop \
      --add-flags "-jar $out/lib/briar-desktop.jar"
  '';
</code>

==== system config ====

use module and package from remote repo

<code>
{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
    invoiceplane-unstable.url = "nixpkgs/master";
  };
};
</code>

<code>
disabledModules = [
  "services/web-apps/invoiceplane.nix"
];
imports = [
  "${inputs.invoiceplane-unstable}/nixos/modules/services/web-apps/invoiceplane.nix"
];

nixpkgs.overlays = [
  (self: super: {
    invoiceplane = inputs.invoiceplane-unstable.legacyPackages.x86_64-linux.invoiceplane;
    plausible = inputs.plausible-riscv.legacyPackages.x86_64-linux.pkgsCross.riscv64.plausible;
  })
];
</code>

overlay examples

<code>
nixpkgs.overlays = [
  (self: super: {

python3 = super.python3.override {
      packageOverrides = python-final: python-prev: {
        mypy = python-prev.mypy.overridePythonAttrs (old: {
          nativeBuildInputs = (old.nativeBuildInputs or []) ++ [
            super.librt
          ];
        });
      };
    };

bcachefs-tools = super.bcachefs-tools.overrideAttrs (final: oldAttrs: {
      version = "1.38.7-unstable-2026-07-02";
      src = super.fetchFromGitHub {
        owner = "koverstreet";
        repo = "bcachefs-tools";
        rev = "7f0cce3cf4d5241569674bbc92af8a75e78ade75";
        hash = "sha256-RXerSh8gRyODncfLZsSz+5Foi6JShUI3dO1zZT/NMZU=";
      };
      cargoHash = null;
      cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
        src = final.src;
        hash = "sha256-DV0YPv+WtqtbTjwDdqj1r1jySVM8mgkscj+8NqVum2M=";
      };
    });

})
];
</code>
==== modules ====

converting cfg.settings to strings only for systemd environment variables etc

<code>
let
  configEnv = concatMapAttrs (
    name: value:
    optionalAttrs (value != null) {
      ${name} = if isBool value then boolToString value else toString value;
    }
  ) cfg.settings;
in
</code>
==== flake ====

local file path as flake input
<code>
inputs.verwaltungstracker.url = "git+file:///home/onny/projects/verwaltungstracker";
</code>

development flake.nix
<code>
{
  description = "Invoiceplane invoice template development shell";

inputs.nixpkgs.url = "nixpkgs/nixos-25.11";

outputs = { self, nixpkgs, ... }@inputs:
    let
      pkgs = nixpkgs.legacyPackages.x86_64-linux;
    in {
    devShells.x86_64-linux.default = pkgs.mkShell {
      packages = [ pkgs.pnpm ];
    };

};
}
</code>
===== filesystem =====
==== partitioning ====
reset flash drive
<code bash>
dd if=/dev/zero of=/dev/sdX bs=2M count=32
</code>
change label (vfat etc)
<code bash>
fatlabel /dev/sdb1 "mystick"
</code>

resize extX partition

<code bash>
sfdisk -l /dev/sdb
# Disk /dev/sdb: 55.9 GiB, 60022480896 bytes, 117231408 sectors
# Disk model: CR60GB External 
# Units: sectors of 1 * 512 = 512 bytes
# Sector size (logical/physical): 512 bytes / 512 bytes
# I/O size (minimum/optimal): 512 bytes / 512 bytes
# Disklabel type: dos
# Disk identifier: 0x2486e7f7
#
# Device     Boot Start       End   Sectors  Size Id Type
# /dev/sdb1        2048 117231407 117229360 55.9G 83 Linux

e2fsck -f /dev/sdb1
resize2fs /dev/sdb1 50G
# resize2fs 1.45.5 (07-Jan-2020)
# Resizing the filesystem on /dev/sdb1 to 13107200 (4k) blocks.
# The filesystem on /dev/sdb1 is now 13107200 (4k) blocks long.
fdisk /dev/sdb
# 1. (d) delete partition
# 2. (n) create new partition
# 3. (p) primary
# 4. (1) partition number
# 5. (2048) start block, same as above
# 6. (+52428800K) last sector partition (13107200k*4k)
# 7. (a) partition is bootable flag
# 8. (w) write changes
</code>

recover gpt partition
<code bash>
sgdisk -e /dev/sda
</code>
==== lvm ====
restore snapshot
<code bash>
lvconvert --merge /dev/vg0/playground_snap
</code>
==== dd ====
<code bash>
isoinfo -d -i /dev/cdrom | grep -i -E 'block size|volume size' 
dd if=/dev/cdrom of=test.iso bs=<block size from above> count=<volume size from above> status=progress
</code>

==== mount ====
mount with offset
<code bash>
# find offset in testdisk, multiplay start sector with sector-bytes
mount -o loop,offset=1048576 /dev/sdb /mnt
</code>

mount webdav
<code bash>
mount.davfs https://bwsyncandshare.kit.edu/remote.php/dav/files/7bac0379-52e8-42e4-xxxx@bwidm.scc.kit.edu/ remote
</code>
===== mixxx =====
  * Theme: LateNight
  * Set Microphone Output to default Pulseaudio
<code bash>
./sync.sh
./generate_playlist.sh
</code>
<code bash>
env QT_QPA_PLATFORM=xcb mixxx
</code>

===== samba =====
<file - /etc/samba/smb.conf>
[global]
workgroup = WORKGROUP
server role = standalone server
security = user
map to guest = Bad Password

[public]
path = /mnt
writeable = no
browsable = yes
guest ok = yes
</file>
<code bash>
systemctl restart smb nmb
</code>

===== npm =====

check for major updates
<code bash>
npm-check-updates -u
</code>

===== pnpm =====

<code bash>
pnpm init
pnpm install jquery@3.5.1 --save # see npmjs.com
</code>

check package updates

<code bash>
pnpm outdated
</code>

update specific package
<code bash>
pnpm update @nextcloud/dialogs --latest
</code>
===== gitlab-ci =====
Test gitlab-ci.yml, change into root dir, then:
<code bash>
gitlab-runner exec docker packaging
</code>
Where ''packaging'' is the name of the job.

===== lrzip =====

Compress/decompress files and directories multithreaded
<code bash>
lrztar directory
lrzuntar directory.tar.lrz
lrzip filename
lrunzip filename.lrz
</code>

===== postmarketOS =====

====== personal setup ======
  * enable beacondb in geoclue conf

====== notes ======
update checksum
<code bash>
pmbootstrap checksum device-samsung-dream
</code>

general chroot management
<code bash>
pmbootstrap pull
pmbootstrap shutdown
</code>

install package into chroot
<code bash>
pmbootstrap chroot --suffix native -- apk add paxmark
</code>

emulated chroot
<code bash>
pmbootstrap chroot -b=armv7
</code>

update package index
<code bash>
pmbootstrap update
</code>

edit kernel config
<code bash>
pmbootstrap kconfig edit htc-pyramid
</code>

apk commands
<code bash>
pmbootstrap chroot
$ apk update
$ apk add paxmark
$ apk add paxmark-0.12-r0.apk
</code>

working with git
<code bash>
cd .local/var/pmbootstrap/cache_git/pmaports
git checkout htcpyramix
git pull master
git rebase master
</code>

cleanup chroot(s)
<code bash>
pmbootstrap zap
</code>

flash or boot kernel directly
<code bash>
pmbootstrap flasher flash_kernel
pmbootstrap flasher boot
</code>

prepare kernel image for odin
<code bash>
pmbootstrap export
cd /tmp/postmarketOS-export
cp boot.img-samsung-i8150 recovery.img
tar -cf recovery.tar recovery.img
md5sum -t recovery.tar >> recovery.tar
mv recovery.tar recovery.tar.md5
</code>

apk list installed files

<code>
apk info -L calls-systemd
</code>
===== parted =====

list
<code bash>
parted /dev/sda
$ print
</code>

resize partition (default unit size MB)
<code bash>
parted /dev/sda
$ resizepartition
Partition number? 1
End?  [10.0GB]? 15000MB
</code>

change unit
<code bash>
unit GB
</code>

===== wireshark =====

capture usb traffic

<code bash>
modprobe usbmon
tshark -D
tshark -i usbmon0
</code>

===== binaries and libraries =====

read symbols of library
<code bash>
readelf -Ws /usr/lib/libusb-1.0.so.0
</code>

===== wf-recorder =====

record system video + audio

<code bash>
pactl list sources short
wf-recorder -aalsa_output.pci-0000_00_1b.0.analog-stereo.monitor --file=recording_with_audio.mp4
</code>

note there's a bug in wf-recorder, devicename directly after -a without space

encoded
<code bash>
wf-recorder -d /dev/dri/renderD128 -c h264_vaapi --bframes 0 -p crf=20 -aalsa_output.pci-0000_00_1b.0.analog-stereo.monitor --file=recording_encoded.mp4
</code>

===== qemu =====

booting armv7 alpinelinux
<code bash>
# download kernel and stuff from here http://dl-cdn.alpinelinux.org/alpine/edge/releases/armv7/netboot/
qemu-system-arm -M virt -m 512M -cpu cortex-a15 -kernel vmlinuz-lts -initrd initramfs-lts -append "console=ttyAMA0 ip=dhcp alpine_repo=http://dl-cdn.alpinelinux.org/alpine/edge/main/" -nographic
</code>

===== mariadb (mysql) =====

import dump
<code bash>
mycli -u root nextcloud < mydump.sql
</code>

list tables and size of database nextcloud
<code bash>
SELECT 
    table_name AS `Table`,
    ROUND(((data_length + index_length) / 1024 / 1024), 2) AS `Size (MB)`,
    table_rows AS `Approx Rows`
FROM information_schema.tables
WHERE table_schema = 'nextcloud'
ORDER BY (data_length + index_length) DESC;
</code>

enable logging

<code sql>
SET GLOBAL general_log = 0;
SET GLOBAL log_output = 'FILE';
SET GLOBAL general_log_file = '/var/lib/mysql/general.log';
SET GLOBAL general_log = 1;
</code>
<code bash>
ls -l /tmp/systemd-private-*-mysql.service-*/tmp/mariadb-general.log
</code>
===== postgresql =====

list all databases
<code bash>
sudo -u postgres psql
# \l
</code>

drop database
<code bash>
sudo -u postgres psql
# drop database gitlabhq_production;
# drop database gitlabhq_production WITH (FORCE);
</code>

list tables
<code bash>
sudo -u postgres psql
# \c gitlabhq_production
# \dt
</code>

create and delete user
<code>
DROP ROLE gitlab;
CREATE USER gitlab WITH PASSWORD 'test123';
</code>

grant permissions
<code>
ALTER USER gitlab SUPERUSER;
CREATE DATABASE gitlabhq_production OWNER gitlab;
ALTER DATABASE gitlabhq_production OWNER TO gitlab;
</code>

dump database
<code>
pg_dump -U gitlab gitlabhq_production > /tmp/gitlab.pgsql
</code>

dump all
<code>
pg_dumpall > /tmp/dump_file_name.tar
</code>

import database
<code>
psql# CREATE DATABASE gitlabhq_production;
psql -U gitlab gitlabhq_production < gitlab.pgsql
</code>

===== helix =====

multi-cursor selection mode

<code>
Normal mode -> V (visual mode) -> Shift+C (multiple times) -> i (insert mode) -> Enter something
ESC -> ,
</code>

sort

<code>
- select multiple lines
- press Alt-S
- type ":sort"
</code>

copy to clipboard

<code>
- select area
- press <space>+y
</code>

select all lines

buffer close

helix editor vertical split

update or reload current buffer
<code>
:reload
</code>
===== traceroute =====

traceroute TCP packages specific port
<code>
traceroute -T -p 25 mail.karlsruhe.de
</code>

===== curl =====

fetch headers
<code>
curl -sI https://project-insanity.org/
</code>

===== ripgrep =====

multiline regex whole file

<code>
rg -U --multiline-dotall 'bundlerEnv.*updateScript'
</code>

with proximity, only 1-2 lines in between

<code bash>
rg -U --multiline-dotall "depsBuildBuild(?:[^\n]*\n){0,2}[^\n]*buildInputs"
</code>

search only in specific file extensions

===== act =====

manually run github workflow locally

<code>
act -W .github/workflows/lint-eslint.yml
</code>

map custom docker image to some other

<code>
act -W .github/workflows/lint-eslint.yml -P ubuntu-latest-low=catthehacker/ubuntu:act-latest
</code>

===== composer =====

upgrade to new major version

<code bash>
composer outdated
composer require --dev psalm/phar:^6.0
</code>

===== namei =====

list permissions, users file path

<code bash>
[picloud@picloudrv:~]$ sudo namei -l /nix/store/c12wcqvlkcildargvd0nnxryl07r731x-invoiceplane-invoice.project-insanity.org-riscv64-unknown-linux-gnu-1.7.1/uploads/temp/Rechnung_129.xml
f: /nix/store/c12wcqvlkcildargvd0nnxryl07r731x-invoiceplane-invoice.project-insanity.org-riscv64-unknown-linux-gnu-1.7.1/uploads/temp/Rechnung_129.xml
drwxr-xr-x root         root   /
drwxr-xr-x root         root   nix
drwxrwxr-t root         nixbld store
dr-xr-xr-x root         root   c12wcqvlkcildargvd0nnxryl07r731x-invoiceplane-invoice.project-insanity.org-riscv64-unknown-linux-gnu-1.7.1
lrwxrwxrwx root         root   uploads -> /var/lib/invoiceplane/invoice.project-insanity.org/uploads
drwxr-xr-x root         root     /
drwxr-xr-x root         root     var
drwxr-xr-x root         root     lib
drwxr-xr-x root         root     invoiceplane
drwxr-x--- invoiceplane caddy    invoice.project-insanity.org
drwxr-x--- invoiceplane caddy    uploads
drwxr-x--- invoiceplane caddy  temp
                                Rechnung_129.xml - No such file or directory
</code>

===== reuse =====

general usage

<code bash>
reuse download MIT
reuse annotate --copyright "Jonas Heinrich <heinrich@synyx.de>" --license MIT \
  .github/pull_request_template.md flake.nix nextcloud-extras.nix psalm.xml
reuse lint
</code>

===== kernel =====

query config of current running kernel

<code bash>
zcat /proc/config.gz | rg CONFIG_RUST
</code>

===== fd =====

search for all files with specific extension in directory /

zip all files with specific file extension

<code bash>
fd -t f -e fm . / | zip source -@
</code>

file creation timespan

<code bash>
fd --type f -e pdf --change-newer-than "2020-09-09" --changed-before "2020-10-01" .
</code>

execute command

<code bash>
fd --type f -e doc -e docx -e pdf -i gabriel -x cp --backup=t {} /tmp/gabriel/
</code>

find filenames unallowed characters

<code bash>
fd '[^A-Z a-züö@0-9._-]' remote/200_Archiv/CP_Dont_Touch
</code>

remove empty dirs in dir "data"

<code bash>
fd --type empty --type directory . /path/to/specific/dir -X rmdir
</code>

Edit summary

Note: By editing this page you agree to license your content under the following license: CC Attribution-Noncommercial-Share Alike 4.0 International