Installing Alpine Linux on a Hetzner ARM server

Unknown — Mon, 24 Jul 2023 00:00:00 +0000

Recently, I've gotten myself one of those ARM VPSes from Hetzner</a>, excited about the very good price-to-performance ratio. I fired the server up, and immediately went on to replace the default Ubuntu install with Alpine</a>, as it has long ago become the only server distro I use.

I was disappointed to see that Alpine Linux is not on the list of available ISOs, though. That kinda shocked me, as I was accustomed to the insane amount of ISO choice Hetzner normally provides with their x86 servers.

I will not tolerate this.</h2>
Rescue mode</h3>
Go to the Hetzner Cloud control panel, and reboot the server into rescue mode (Rescue > "Enable rescue & power cycle"</code>). Pick linux64 for the Rescue OS.
Log in to the machine with SSH. In case you have not picked an SSH key, use the root password displayed on the Rescue tab.
Flashing the ISO</h3>Now we need to flash the Alpine Linux ISO onto the virtual hard disk. Go to the alpinelinux.org download page</a> and grab the link for the lastest aarch64 virtual release. Download and flash the ISO on the server: curl -LO https://dl-cdn.alpinelinux.org/alpine/v3.18/releases/aarch64/alpine-virt-3.18.2-aarch64.iso dd if=alpine-virt-3.18.2-aarch64.iso of=/dev/sda poweroff </code></pre> Installation</h3> After the server shuts down, turn it back on again using the Hetzner cloud control panel and enter the console (the terminal icon on the top right). Once the server boots, log in as root</code>, there's no password. Before we can proceed with the installation, we need to make a few preparations: # copy data from the mounted media to /root cp -r /.modloop /root cp -r /media/sda /root # unmount the media umount /.modloop /media/sda # move the data to directories that were the mountpoints rm /lib/modules mv /root/.modloop/modules /lib mv /root/sda /media </code></pre> Now you can install Alpine Linux using setup-alpine</code> as you'd do normally and then reboot.

The day I became the Mumble server Unknown — Sat, 22 Apr 2023 00:00:00 +0000 The Powerbank</h1> I know this might sound completely unrelated to the post title, but bear with me... I was looking for a powerbank recently, because I got tired of constantly keeping track of my phone's battery charge level every time I leave the house. Initially, I wanted to get one of those 18650 Li-Ion cell cases</a>, but the GC PowerPlay20</a> caught my attention. It's reasonably priced for the capacity it offers, and supports fast charging, so I decided to get it. After ordering the device and reading a bit through the specs in more detail, I thought to myself... ...what is fast charging anyway?</h2> I've never really dug into how the fast charging technology works before buying the powerbank, but once I had the device in my hands, I got curious and did some research. I quickly learned that there are thousands of fast charging solutions (most of which are proprietary), but one particular solution stands out - USB-C Power Delivery. It's an open standard for fast charging. I will refer to it as PD in the rest of the post. I figured, there must be a board of some sort that would deal with the PD protocol for me and give me the raw 12V output. Turns out, that's correct! Moreover, I could easily get such a board locally</a>. The same store also sells cables with it</a>, so I've immediately ordered one. The crazy idea</h1> I've always been fascinated with the idea of a mobile Linux server that I could take anywhere and let other people use. One good option for building one is obviously the Raspberry Pi, but due to the low specs of its internal WiFi, I didn't even bother trying to set it up. But what if I used an actual WiFi router? Unfortunately, my WiFi router turned out not to be powerful enough to set up services on it, so instead, I used a classic RPi Zero (without wifi) plugged in to the actual router. Note: I know that I could possibly get even better results with a good quality USB WiFi card and an external antenna, but carrying an actual home router and powering it from a powerbank is just cooler :3 Choosing a distro</h2> I've initially wanted to go with the official Raspberry Pi OS, but the flashbacks from spending hours debloating the thing, made me conclude that flashing such a bloated operating system on such a breathtakingly underpowered device is a crime. Thus, I've decided to go with DietPi</a>. Oh, I should also mention that due to the blazing performance of the SD card, the kernel update that DietPi does at startup took almost 2 hours! Still marginally better than the Raspberry Pi OS, though. RPi Zero's network connectivity</h2> The particular RPi Zero I'm going to use in this project doesn't actually come with a wireless module, so it has literally zero onboard network capability. Fortunately, it turns out that the Pi Zero supports a so-called "Gadget mode", which basically turns the Pi from a USB host into a USB device. The most common way of using the Gadget mode is running a "virtual Ethernet cable" over the USB connection. This means, the Pi can get both the power and network connectivity from the router with a single USB cable! Unfortunately, OpenWRT doesn't come with the required RNDIS kernel module out of the box (the same module that's used for Android tethering, by the way). Thankfully, this problem can easily be solved by installing the kmod-usb-net-rndis</code> package using opkg</code>. After setting the ethernet gadget up</a>, the Pi shows up in the Interfaces section of the OpenWRT web interface as usb0</code>: usb0</code> inteface on my OpenWRT router</figcaption> </figure> Upon adding the usb0</code> interface to the LAN bridge, the Pi gets access to the internet and I can ssh into it from my computer. Okay, what now?</h2> Now that the pain of getting the network part done is over, it's time to actually set something up on the Pi. I figured it would be cool to run a Mumble</a> server there! Mumble</h2> Due to the constrained resources of the Pi Zero, I used uMurmur</a> instead of the official Mumble server. Life, of course, would be too simple if it was available in the repos, so I had to compile myself. Not wanting to wait hours for the Pi to install GCC and compile the software, I quickly downloaded the Raspberry Pi OS rootfs and chrooted into it on my PC. I also had to use qemu-user-static</code>, as the chroot obviously uses the 32-bit ARM architecture. I built the umurmurd</code> binary and transferred it over to the Pi. I've written a simple systemd unit file for it and set it to start at boot. Miraculously, it worked without any manual intervention on every router power on. Worth?</h2> Yes and no. I tested the solution with my friend from the Attic Project (I'll probably write a blog post about that in the future), and the results were not much worse than what I expected. On a distance of roughly 50m with no obstacles, we maintained a RSSI of around -65, which is a great value, and allows me to think that the solution would work fine on even longer distances. Unfortunately - although as expected - after I moved behind a concrete building, we lost connection completely. At the end of the day, I learned a lot about configuring OpenWRT thanks to this project, and I think that's more important than the actual usefulness of the solution. 3 fun ways to (ab)use your school OneDrive storage Unknown — Mon, 29 Aug 2022 00:00:00 +0000 If you're a student (or a teacher) and your school/university has an Office 365 plan (e.g. for Microsoft Teams), you probably have an Education Office 365 account, which comes with a whopping 1 TB (!) of OneDrive storage and you're probably not even using 1% of that capacity. Kinda wasteful in my opinion. But before I list a few fun examples of how you can make use of your school OneDrive, I need to address a few - hopefully obvious - things: Everything I talk about here should technically be possible with a Google Suite account (or whatever it's called), although I have no experience with that, so YMMV.</li> The administrators of your school Office 365 suite do not have access to your files, but you should also know that they have the power to reset your password and gain access that way.</li> Your account is not permanent - it will eventually be removed (e.g. when you finish school) and you need to be prepared for that.</li> The examples I'll be showing are not always the best solutions to a given problem, but they are definetely fun ones!</li> </ul> With that out of the way, let's begin! rclone</h1> The examples I'll be covering involve the usage of rclone</code> - a commandline application that allows you to easily access remote storages of various kinds. On Linux it should be available in your distro's package manager and on macOS, Homebrew has it. If you use Windows, follow this guide</a></del> you can install rclone with scoop</code>, but the commands may be a bit different. After installation, run rclone config</code> and add your OneDrive storage using the onedrive</code> remote type - rclone should guide you through that. The rest of this post will assume that the name of the remote is sch</code>, so always replace sch</code> with your remote name if it's different. #1: Storing TV Shows, Movies, Music, etc.</h1> The "default" way of storing media on OneDrive is inconvenient - gently speaking - so we're gonna use rclone to make it easier and faster. Here's a short quickstart: Create a directory for the media</h3> rclone mkdir 'sch:anime' </code></pre> Upload media</h3> rclone copy -P rezero 'sch:anime/rezero' </code></pre> Note: When you tell rclone to copy a directory, it copies the contents of it, not the directory itself, so it's important to always specify the full destination path, as we did here. By the way, the -P</code> flag adds a nice progress display. If you omit it, rclone will work silently. Download media</h3> rclone copy -P 'sch:anime/rezero/ep1.mkv' . </code></pre> Get a link to a file (without downloading)</h3> rclone link 'sch:anime/rezero/ep1.mkv' </code></pre> Disclaimer: The generated link likely has your school name in it, so don't share it with people you don't trust! We can use this command with mpv</code> in order to stream a video or audio file directly without downloading it: mpv $(rclone link 'sch:anime/rezero/ep1.mkv') </code></pre> You can find more rclone commands by doing rclone --help</code>. #2: Image hosting</h1> Let's say you want to make a website or you just want to have your own hosting of images without exposing the end user to 3rd-party services. Why not make a proxy to your school OneDrive with a cheap VPS or a Raspberry Pi? Note: This method requires small Linux server administration knowledge In this example I will be using Alpine Linux, but the commands should be easily adaptable to your distribution of choice. Setup rclone on the remote machine</h3> Just follow the rclone</a> section of this post but on your server, as root/sudo (we're going to mount the remote and that requires root permissions, so the generated rclone config file should be in the root user's home directory) You'll also want to create a folder for the images: sudo rclone mkdir sch:imgs </code></pre> Mount the remote</h3> sudo mkdir /onedrive sudo rclone mount sch:imgs /onedrive --allow-other -v </code></pre> You should be able to access /onedrive</code> as root now. If everything is working properly, you can make the rclone mount persistent using your init system. For example, this is what I made for Alpine (OpenRC): #!/sbin/openrc-run name="onedrive" depend() { need net before nginx use logger } start() { checkpath -f -m 0644 -o root:root /var/log/onedrive.log rclone mount sch:imgs /onedrive --daemon --allow-other -v --log-file=/var/log/onedrive.log } stop() { fusermount -uz /onedrive } # vim:ft=sh </code></pre> Configuring the webserver</h3> Setup your webserver to serve static files from /onedrive. You probably want to enable SSL too. Assuming you're using Nginx, you can add a server block similar to this: server { listen [::]:443 ssl http2; merge_slashes off; server_name imgs.lemonsh.moe; ssl_certificate /etc/acme/imgs.lemonsh.moe.crt; ssl_certificate_key /etc/acme/imgs.lemonsh.moe.key; root /onedrive; } </code></pre> Of course, you need to adapt this config according to your needs. Testing the proxy</h3> The imgs</code> directory on your OneDrive should now be mapped to your domain's root. For example, in my case, sch:imgs/image.png</code> is mapped to https://imgs.lemonsh.moe/image.png</code>. NAQ (never asked questions)</h3> Now you might ask, why can't we just use rclone link</code> for the images, just like we did with your media before? Well, there are a few reasons: When your current OneDrive account is deleted, all links generated with rclone link</code> will become invalid. With a proxy like this, you can migrate the images somewhere else.</li> As I've said before, links generated with rclone link</code> are likely to contain your school name, which is not desired if you want to embed them on a website, for example.</li> You would need to run rclone link</code> manually every time you wanted to publish an image, this proxy maps the entire directory instead, so there's no manual intervention required.</li> OneDrive generally isn't the fastest file host, so if you run into performance issues with the proxy, you can attempt to fix it - for example, put it behind Cloudflare or enable the VFS cache in rclone</a>.</li> </ul> Another question you might have is, why images specifically? Why not music / videos / etc.? Well, you can technically host any kind of content with this proxy, but I just felt like image hosting is a good demo usecase. Larger files are going to be problematic because for every request, your server needs to use 2 * filesize</code> of bandwidth (download from OneDrive and then upload to the user) and caching may be unfeasible. #3: Storing personal data securely</h1> It's well-known that storing sensitive information in the cloud is a very bad idea, especially with non-private services like OneDrive or Google Drive, because these companies can access your data whenever they want - or when the government wants. But, we can use the crypt</code> remote type to mitigate this: Rclone crypt</code> remotes encrypt and decrypt other remotes. A remote of type crypt</code> does not access a storage system directly, but instead wraps another remote, which in turn accesses the storage system. </blockquote> Considering that we're working with sensitive data here, if you have trouble understanding something here, please RTFM</a>. With that in mind, let's begin: Create an empty folder for the encrypted files</h3> rclone mkdir sch:enc </code></pre> Create a crypt</code> wrapper</h3> Run rclone config</code> and create a new remote of type crypt</code> (instead of onedrive</code> like we did before). I'll call it esch</code>, but you can pick any other name. There are a few things you should know: remote</code> should be the empty folder you created in the previous step, e.g. sch:enc</code>.</li> The most secure variant for filename_encryption</code> is standard</code>, but it has a few implications</a>, so you might wanna choose obfuscate</code> instead if you think they might be a problem for you.</li> You should always generate a random password for security. 128 bits should be a secure enough option.</li> </ul> Upload something!</h3> You should be able to use the esch</code> remote just like any other rclone remote now. The only difference is that its root is mapped to the directory you specified before (e.g. sch:enc</code>) and everything going through it is encrypted. So, let's try uploading something now: rclone copy -P Pictures/miku-smol.png esch: </code></pre> Let's check if the file was actually uploaded: $ rclone lsf esch: miku-smol.png </code></pre> It was! But how does it look from OneDrive's perspective? enc</code> folder on my OneDrive</figcaption> </figure> As you can see, the file has been encrypted along with its filename. Important reminder</h3> Obviously, this doesn't prevent you from uploading sensitive files through the unencrypted sch</code> remote or even the OneDrive web interface, so remember to always handle sensitive data through esch</code>. Config encryption and backup</h1> Your rclone config contains passwords to all of the cloud remotes, so it's wise to protect it somehow. You can do that in rclone config</code> by choosing the s) Set configuration password</code> option. Upon doing that, you will be asked for a password on every rclone operation. You can always remove the password if you want (e.g. to make manual changes to the config). In order to backup or migrate all your rclone remotes (including crypt</code> if you set that up), you can just copy the entire config file to - for example - a password manager or a different machine. This will work even when you set a password on the file. The path to the config is ~/.config/rclone/rclone.conf</code>. The end.</h1> [PL] Własny Amazon S3 na Mikrusie? Unknown — Sat, 08 Jan 2022 00:00:00 +0000 This article is written in Polish, for the Mikrus</a> project. Czym jest MinIO?</h1> MinIO to napisany w Go otwartoźródłowy serwer object storage kompatybilny z Amazon S3. Posiada bardzo duże możliwości konfiguracji, a jego instalacja jest dość prosta. W tym poście, chciałbym opisać jego instalację na Mikrusie</a>

Testing the proxy</h3>
The `imgs</code> directory on your OneDrive should now be mapped to your domain's root. For example, in my case, sch:imgs/image.png</code> is mapped to https://imgs.lemonsh.moe/image.png</code>.</p>`

Important reminder</h3>
Obviously, this doesn't prevent you from uploading sensitive files through the unencrypted `sch</code> remote or even the OneDrive web interface, so remember to always handle sensitive data through esch</code>.</p>`

`The end.</h1>`

Czym jest MinIO?</h1>
MinIO</strong></em> to napisany w Go otwartoźródłowy serwer object storage</em> kompatybilny z Amazon S3</strong>. Posiada bardzo duże możliwości konfiguracji, a jego instalacja jest dość prosta.</p>
W tym poście, chciałbym opisać jego instalację na Mikrusie</a></p>

Installing Alpine Linux on a Hetzner ARM server

The day I became the Mumble server

3 fun ways to (ab)use your school OneDrive storage

[PL] Własny Amazon S3 na Mikrusie?

Installing Alpine Linux on a Hetzner ARM server

The day I became the Mumble server

The Powerbank</h1> I know this might sound completely unrelated to the post title, but bear with me...</p>

3 fun ways to (ab)use your school OneDrive storage

rclone</h1> The examples I'll be covering involve the usage of rclone</code> - a commandline application that allows you to easily access remote storages of various kinds.</p>

Configuring the webserver</h3> Setup your webserver to serve static files from /onedrive. You probably want to enable SSL too.</p> Assuming you're using Nginx, you can add a server block similar to this:</p>

Testing the proxy</h3> The imgs</code> directory on your OneDrive should now be mapped to your domain's root. For example, in my case, sch:imgs/image.png</code> is mapped to https://imgs.lemonsh.moe/image.png</code>.</p>

Important reminder</h3> Obviously, this doesn't prevent you from uploading sensitive files through the unencrypted sch</code> remote or even the OneDrive web interface, so remember to always handle sensitive data through esch</code>.</p>

The end.</h1>

[PL] Własny Amazon S3 na Mikrusie?

Testing the proxy</h3>
The `imgs</code> directory on your OneDrive should now be mapped to your domain's root. For example, in my case, sch:imgs/image.png</code> is mapped to https://imgs.lemonsh.moe/image.png</code>.</p>`

Important reminder</h3>
Obviously, this doesn't prevent you from uploading sensitive files through the unencrypted `sch</code> remote or even the OneDrive web interface, so remember to always handle sensitive data through esch</code>.</p>`

`The end.</h1>`