So it appears that just over 5 years ago I put together a computer as my old one had finally given up on life. Specs available here.

Well, 5 years later that same machine is still going well. It's had a couple of upgrades:

• an extra 16GB of RAM, for a total of 32GB
• 1 x 480GB and 1 x 240GB SSDs to replace a couple of HDDs. These hold OS X and Windows respectively
• A Radeon RX 580 8 GB video card driving 2 x 24" monitors and 1 x 27" monitor
• macOS 10.15.3 (and all versions from 10.10 through to 10.14 at one stage or another)

The Radeon is actually the third video card. The original NVidia GT740 was replaced with a GTX-1080 Ti, but when Apple decided to go Radeon again and wouldn't play nicely with NVidia (or vice-versa) the NVidia Web drivers wouldn't work with macOS 10.15. Plus it was about time for a new video card anyway.

Now the system has the following OS's configured to multi-boot using Clover V2.0 r5100

• Windows 10
• macOS 10.15.3
• Debian Buster

And here's another test

Photo by Harley-Davidson / Unsplash

Plugins, or apps, are still in their infancy for the Ghost blogging platform, as such people have resorted to adding custom Handlebars helpers using a variety of hacks.

One of these is shown at https://apatchofcode.com/adding-custom-handlebars-for-ghost-equals-awesome/

Here is an alternative implementation that makes use of the fledgling Ghost Apps feature.

Installation

Create a new directory in contents/apps

eg:

mkdir contents/apps/myhelpers

Place package.json and index.js in the directory.

To enable the app you need to manually add it to the database as described at: https://github.com/TryGhost/Ghost/wiki/Apps-Getting-Started-for-Ghost-Devs

Restart ghost

Usage

Simply use the new helper in your template, eg:

{{#compare 'apples' '===' 'oranges'}}
    <p>Totally not the case.<p>
{{/compare}}
{{#compare 'apples' 'typeof' 'string'}}
    <p>I think we're onto something.<p>
{{/compare}}

package.json

{
  "name":"my-helpers",
  "version": "0.0.1",
  "dependencies": {
    "ghost-app": "0.0.2"
  },
  "ghost": {
      "permissions": {
          "helpers": ["compare"]
      }
  }
}

index.js

var App = require('ghost-app'),
    myHelpers;

myHelpers = App.extend({

    install: function() {},

    uninstall: function() {},

    activate: function() {
        this.app.helpers.register('compare', this.compareHelper)
    },

    deactivate: function() {},

    compareHelper: function (v1, operator, v2, options) {
        switch (operator) {
            case '==':
                return (v1 == v2)  ? options.fn(this) : options.inverse(this);
            case '===':
                return (v1 === v2) ? options.fn(this) : options.inverse(this);
            case '!=':
                return (v1 != v2)  ? options.fn(this) : options.inverse(this);
            case '!==':
                return (v1 !== v2) ? options.fn(this) : options.inverse(this);
            case '<':
                return (v1 < v2)   ? options.fn(this) : options.inverse(this);
            case '<=':
                return (v1 <= v2)  ? options.fn(this) : options.inverse(this);
            case '>':
                return (v1 > v2)   ? options.fn(this) : options.inverse(this);
            case '>=':
                return (v1 >= v2)  ? options.fn(this) : options.inverse(this);
            case '&&':
                return (v1 && v2)  ? options.fn(this) : options.inverse(this);
            case '||':
                return (v1 || v2)  ? options.fn(this) : options.inverse(this);
            case 'typeof':
                return (typeof v1 == v2)  ? options.fn(this) : options.inverse(this);
            default:
                return options.inverse(this);
        }
    }
});

module.exports = myHelpers;

I've recently started experimenting with MQTT, in particular the Mosquito broker. After quite a bit of trial & error and plenty of man page reading I've managed to get things working nicely.

Features enabled:

• SSL/TLS connections
• Websockets proxied through Apache (ws:// and wss://)
• ACLs for anonymous access
• ACLs for username/password access
• Bridging selected local topics to the io.adafruit.com service

A visualisation of the topics I currently have is shown followed by configuration sections for the various options.

If you want to secure your connection using SSL/TLS then I recommend Let's Encrypt, to install the certificates see here

All configuration is based on an Ubuntu installation of Mosquitto.

Basic Server Config /etc/mosquitto/mosquitto.conf

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

log_dest file /var/log/mosquitto/mosquitto.log
#log_type all

acl_file /etc/mosquitto/acl.conf
password_file /etc/mosquitto/passwords

include_dir /etc/mosquitto/conf.d

ACLs /etc/mosquitto/acl.conf

# only allow anonymous users specific access
topic read #
topic read $SYS/broker/messages/#

# Allow user web to read anywhere
user web
topic read #
topic read $SYS/#

# Allow user sensor to write anywhere
user sensor
topic readwrite #

Generate your password file using mosquitto_passwd.

Set permissions and group on the password file as:

-rw-r----- 1 root mosquitto 229 Feb 4 20:18 /etc/mosquitto/passwords

ie: u+rw,g+r for root:mosquitto

Secure/Insecure MQTT config /etc/mosquitto/conf.d/01-default.conf

listener 1883
listener 8883
cafile /path/to/chain-ca.pem
certfile /path/to/cert.pem
keyfile /path/to/privkey.pem

Secure/Insecure Websockets config /etc/mosquitto/conf.d/02-websockets.conf

listener 8080
protocol websockets

listener 8083
protocol websockets
cafile /path/to/chain-ca.pem
certfile /path/to/cert.pem
keyfile /path/to/privkey.pem

Bridge config /etc/mosquitto/conf.d/03-adafruit-bridge.conf

connection bridge_adafruit
address io.adafruit.com:8883
remote_username <username>
remote_password <aio key>
start_type automatic
bridge_protocol_version mqttv311
bridge_capath /etc/ssl/certs/

notifications false
try_private false

topic throttle in 0 adafruit.io/ <username>/feeds/
topic welcome-feed both 0 adafruit.io/ <username>/feeds/

Apache config for proxying

Place this within your <Virtualhost *:80> or <Virtualhost *:443> directive.

If your VHost is a secure one then the SSL/TLS websocket connection will be handled by Apache and transparently proxied to the local MQTT broker. All communication between the browser and Apache will be secured.

This requires the mod_proxy_wstunnel module to be enabled.

        <Location "/mqtt">
                ProxyPreserveHost On
                ProxyPass ws://localhost:8080/mqtt
                ProxyPassReverse ws://localhost:8080/mqtt
        </Location>

This should get you started configuring a Linux OpenVPN server, creating your own certificate authority and generating certificates and profiles for use with Apple iOS devices like the iPad and iPhone.

The following script will generate a .ovpn profile that can be imported straight into the OpenVPN iOS app.

You will need to perform the steps as the root user or execute the commands using sudo.

Create certificate authority and client certs

For this we'll use easy_rsa that should be installed as part of your distributions OpenVPN install.

These instructions were written with the server being an Ubuntu installation, paths may need to be adjusted to suit your distribution.

mkdir /etc/openvpn/easy-rsa/
cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

Next, edit /etc/openvpn/easy-rsa/vars adjusting the following to your environment:

export KEY_COUNTRY="US"
export KEY_PROVINCE="NC"
export KEY_CITY="Winston-Salem"
export KEY_ORG="Example Company"
export KEY_EMAIL="steve@example.com"
export KEY_CN=MyVPN
export KEY_NAME=MyVPN
export KEY_OU=MyVPN

Enter the following to generate the master Certificate Authority (CA) certificate and key:

cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-ca

Server Certificates

Next, we will generate a certificate and private key for the server:

./build-key-server myservername

As in the previous step, most parameters can be defaulted. Two other queries require positive responses, "Sign the certificate? [y/n]" and "1 out of 1 certificate requests certified, commit? [y/n]".

Diffie Hellman parameters must be generated for the OpenVPN server:

./build-dh

All certificates and keys have been generated in the subdirectory keys/. Common practice is to copy them to /etc/openvpn/:

cd keys/
cp myservername.crt myservername.key ca.crt dh2048.pem /etc/openvpn/

Client Certificates

The VPN client will also need a certificate to authenticate itself to the server. Usually you create a different certificate for each client. To create the certificate, enter the following in a terminal while being user root:

cd /etc/openvpn/easy-rsa/
source vars
./build-key client1

Now that you have generated server and client certificates its time to configure the server

/etc/openvpn/server.conf

port 1194
proto udp
dev tun
# Server CA and certificate
ca ca.crt
cert myservername.crt
dh dh2048.pem
# Hand out IPs 192.168.1.67-79
server 192.168.1.64 255.255.255.224
# make sure clients know to use this route
push "route 192.168.1.0 255.255.255.0"
ifconfig-pool-persist pp.txt
# Allow clients to see each other
client-to-client
keepalive 30 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3

You should now be able to start the OpenVPN server.

Before you can connect your iOS device you need to generate a .ovpn file that contains the certificates for your client and some additional configuration options.

Create the following script and then use it to generate a .ovpn file.

create-ovpn-profile

#!/bin/bash
NAME=$1
KEYSTORE=/etc/openvpn/easy-rsa/keys
CA=$(< ${KEYSTORE}/ca.crt)
CERT=$(< ${KEYSTORE}/${NAME}.crt)
KEY=$(< ${KEYSTORE}/${NAME}.key)
OUTPUT=./${NAME}.ovpn

cat > ${OUTPUT} << __EOF__
client
dev tun
proto udp
remote vpn.host.com 1194
comp-lzo
redirect-gateway
<ca>
${CA}
</ca>
<cert>
${CERT}
</cert>
<key>
${KEY}
</key>
# other options (mostly defaults)
nobind
persist-key
persist-tun
user nobody
group nogroup
resolv-retry infinite
__EOF__

Usage ./create-ovpn-profile client1

The generated .ovpn file can then be copied to the device and imported into the OpenVPN app.

For more information see the OpenVPN iOS FAQ

Adafruit have recently enabled MQTT as a transport for feeds on io.adafruit.com.

If you already have a MQTT broker configured and working you probably don't want to reconfigure your clients to publish to io.adafruit. Additionally the feeds only permit one topic level, so your carefully crafted hierarchy of topics would have to be reworked as well.

Another option is to bridge your local MQTT broker to adafruit.io and select which topics you want to publish there.

Here's an example dashboard that uses data from my bridged MQTT broker to display the temperatures in and around my beer fermenting fridge.

See the gist below for all the details.

If you have a self hosted installation of Ghost upgrading it can be a little bit daunting and possibly dangerous. The instructions here are pretty good. Although sometimes all you want is one command to do the lot for you so you don't have to remember where those instructions are each time.

So here's my dodgy bash script that will upgrade your Ghost installation automagically for you. Be warned there's little in the way of error checking, so always have a backup.

#!/bin/bash
# Make sure only root can run our script
if [[ ${EUID} -ne 0 ]]; then
  echo "This script must be run as root" 1>&2
  exit 1
fi

if [[ $# -eq 0 ]]; then
  echo "Usage:"
  echo "    $0 <systemd|sysv>"
  echo -e "\n systemd : use systemd/systemctl to stop/start services"
  echo " sysv    : use /etc/init.d syvs init system to stop/start services"
fi
 
GHOST_PARENT=/var/www
OLD_PWD=$(pwd)

case "$1" in
   systemd)
     INIT_START="sudo systemctl start ghost.service"
     INIT_STOP ="sudo systemctl stop ghost.service"
     ;;
   sysv)
     INIT_START="sudo service ghost start"
     INIT_STOP ="sudo service ghost stop"
     ;;
sac
     
cd ${GHOST_PARENT}

# Get current Ghost version
OLD_VERSION=$(node -pe "JSON.parse(require('fs').readFileSync('/dev/stdin').toString()).version" < ghost/package.json)

echo "Upgrading Ghost"
echo -n "Fetching ... "
curl -LOk https://ghost.org/zip/ghost-latest.zip > upgrade.log 2>&1 || exit
echo "Unzipping ..."
unzip ghost-latest.zip -d ghost-latest >> upgrade.log 2>&1 || exit

# Get new Ghost version
NEW_VERSION=$(node -pe "JSON.parse(require('fs').readFileSync('/dev/stdin').toString()).version" < ghost-latest/package.json)

echo "Upgrading from ${OLD_VERSION} to ${NEW_VERSION}.  Please wait ..."

# Stop Ghost
${INIT_STOP}

# Backup the current version core files
mv -v ghost/core ghost-${OLD_VERSION}-core || exit

# Update with new files
cp -v ghost-latest/{*.js,*.json,*.md,LICENSE} ghost/ || exit
cp -R -v ghost-latest/core ghost/ || exit
cp -R -v ghost-latest/content/themes/casper ghost/content/themes || exit
cd ghost

# Update nodejs modules as required
npm install --production

# Fix permissions
chown -R ghost:www-data ./*

# Restart Ghost
${INIT_START}

cd ${OLD_PWD}

And for those using a systemd based init system here's a .service file for systemd

/etc/systemd/system/ghost.service

[Unit]
Description=Ghost service
# Make sure we have functional network and logging available
After=syslog.target
After=network.target

[Service]
User=ghost
Group=www-data
ExecStart=/usr/bin/node /path/to/ghost/index.js
Environment=NODE_ENV=production
StandardOutput=null
TimeoutSec=10

[Install]
WantedBy=multi-user.target

Once you've got a lot of ebooks in Calibre it is handy to have them available straight from your tablet. An easy way to do this is using the content server that is part of Calibre. If you have an Apache server it is fairly easy integrate the content server. There are two methods that can be used to do this:

1. Proxy the content server using mod_proxy
2. Run as an in-process server using WSGI (mod_wsgi under Apache)

mod_proxy is fairly well documented and works well for most people. I've used it for a few years but recently decided to give the mod_wsgi route a try. It was surprisingly easy to get working. Configuration files, wsgi script and notes are below.

Create WSGI application script

Firstly you'll need to create the WSGI application script that Apache will call when it needs to start an instance of the Calibre content server. Copy the following into /usr/lib/cgi-bin/calibre-wsgi-adapter.wsgi:

calibre-wsgi-adapter.wsgi

# WSGI script file to run calibre content server as a WSGI app
import sys, os

# You can get the paths referenced here by running
# calibre-debug --paths
# on your server

# The first entry from CALIBRE_PYTHON_PATH
sys.path.insert(0, '/usr/lib/calibre')

# CALIBRE_RESOURCES_PATH
sys.resources_location = '/usr/share/calibre'

# CALIBRE_EXTENSIONS_PATH
sys.extensions_location = '/usr/lib/calibre/calibre/plugins'

# Path to directory containing calibre executables
sys.executables_location = '/usr/bin'

# Path to a directory for which the server has read/write permissions
# calibre config will be stored here
os.environ['CALIBRE_CONFIG_DIRECTORY'] = '/storage/ebooks/calibre-config'

del sys
del os

from calibre.library.server.main import create_wsgi_app
application = create_wsgi_app(
        # The mount point of this WSGI application (i.e. the first argument to
        # the WSGIScriptAlias directive). Set to empty string is mounted at /
        prefix='/calibre',

        # Path to the calibre library to be served
        # The server process must have write permission for all files/dirs
        # in this directory or BAD things will happen
        path_to_library='/storage/ebooks/Calibre_Library',

        # The virtual library (restriction) to be used when serving this
        # library.
        virtual_library=None
)

del create_wsgi_app

Apache Virtual Host configuration

Add the following virtual host config file to the appropriate place in your Apache configuration.

e.g.: for Ubuntu put it in /etc/apache2/sites-available then enable it with a2ensite ebooks.domain.com

Restart Apache and navigate to https://ebooks.domain.com/calibre/ to browse your ebooks.

ebooks.domain.com.conf

<VirtualHost *:80>
	ServerName ebooks.domain.com
	ServerAdmin admin@ebooks.domain.com
	DocumentRoot /storage/ebooks/

        RewriteEngine on
        ReWriteCond %{SERVER_PORT} !^443$
        RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]

</VirtualHost>
<IfModule mod_ssl.c>
	<VirtualHost *:443>
	ServerName ebooks.domain.com
	ServerAdmin admin@ebooks.domain.com
	DocumentRoot /storage/ebooks/
	<Directory /storage/ebooks>
		AllowOverride None
		Require all granted
	</Directory>
	DirectoryIndex index.md index.sd index.php index.html
	Header set Accept-Ranges "none"
	RequestHeader unset Accept-Encoding
        WSGIDaemonProcess calibressl processes=1 threads=3
        WSGIScriptAlias /calibre /usr/lib/cgi-bin/calibre-wsgi-adapter.wsgi
        <Directory /storage/ebooks/>
                WSGIProcessGroup calibressl
                WSGIApplicationGroup %{GLOBAL}
                Order deny,allow
                Allow from all
        </Directory>

	SSLEngine on
	SSLCertificateFile	/etc/ssl/server/ebooks.domain.com.crt
	SSLCertificateKeyFile   /etc/ssl/private/ebooks.domain.com.key
	BrowserMatch "MSIE [2-6]" \
			nokeepalive ssl-unclean-shutdown \
			downgrade-1.0 force-response-1.0
	BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
	</VirtualHost>
</IfModule>

These cheap 2.2" LCDs are pretty handy for a Raspberry Pi.

Connect them like this:

Use Notoro's fbtft modules to get them working with Linux. They are included in the Raspberry Pi Raspbian image.

Edit /etc/modules and add (for landscape orientation):

fbtft_device name=adafruit22a rotate=90

Edit /boot/cmdline.txt to put login console on the LCD, add the following to the end:

fbcon=map:10

Edit /boot/config.txt and add or uncomment the following to enable SPI:

dtparam=spi=on

User mode access using PyGame and DirectFB took a bit of sleuthing, bit I finally nailed it down.

• Append the modes for the LCD to /etc/fb.modes

fbset --info -fb /dev/fb1|sed -n '/mode/,/endmode/p'|sudo tee -a /etc/fb.modes

• Create ~/.directfbrc with:

fbdev=/dev/fb1
quiet
no-vt
no-vt-switch
no-banner
mode=320x240
depth=16

• Check permissions and ownership of /dev/fb1

pi@raspberry ~ $ ls -l /dev/fb1
crw-rw---T 1 root video 29, 1 Jun 14 16:50 /dev/fb1

• Make your user is in the video group:

pi@raspberry ~ $ groups
pi adm dialout cdrom sudo audio video plugdev games users netdev gpio i2c spi input

• Use the following code to initialise your PyGame application

        """Ininitializes a new pygame screen using the framebuffer"""
        # Based on "Python GUI in Linux frame buffer"
        # http://www.karoltomala.com/blog/?p=679
        disp_no = os.getenv("DISPLAY")
        if disp_no:
            print "I'm running under X display = {0}".format(disp_no)
        
        # Check which frame buffer drivers are available
        # Start with fbcon since directfb hangs with composite output
        drivers = ['fbcon', 'directfb', 'svgalib']
        found = False
        for driver in drivers:
            # Make sure that SDL_VIDEODRIVER is set
            if not os.getenv('SDL_VIDEODRIVER'):
                os.putenv('SDL_VIDEODRIVER', driver)
            try:
                pygame.display.init()
            except pygame.error:
                print 'Driver: {0} failed.'.format(driver)
                continue
            found = True
            break
    
        if not found:
            raise Exception('No suitable video driver found!')
        
        size = (pygame.display.Info().current_w, pygame.display.Info().current_h)
        print "%s: framebuffer size: %d x %d" % (driver, size[0], size[1])
        screen = pygame.display.set_mode(size, pygame.FULLSCREEN)

My system has been running as a Hackinstosh for the better part 2 years, there’s been the odd hiccup along the way, mainly around sound drivers, but other than that it’s been pretty reliable. Its a GigaByte Z87-HD3 main board with a Core i7–4790 processor and an NVidia GT-740 video card.

I had to recently re-convince Windows 7 that it would work on my main machine. After trying a variety of BIOS settings I finally had a few working that would allow me to boot Windows in UEFI mode and, more importantly, allowed the USB keyboard and mouse to function during the install. The joys of an operating system that was created before USB3.

Once Windows was up and running, mother board drivers installed, software updates done (232 of them!), Office, SolidWorks, AutoCAD, MATLAB and a bunch of other software installed it was time to head back to the land of OS X.

And here’s where the grief really started.

After my futzing around with Windows I had managed to wipe the partition table on one of my other drives, the most important one. The one holding all my documents, my home folder etc.. A quick trip into Linux and it was back. Yippee! Go Linux for not breaking easily and being able to handle more file systems than you can poke a stick at.

On returning to OS X things went from bad to worse. OS X refused to display the login screen, getting stuck at a black screen with the mouse cursor present. Much debugging and swearing ensued. The system was accessible via SSH, so that was a start, but not so good for a pointy clicky GUI.

Digging through the logs I discovered that loginwindow.app was crashing. Then logind would respawn it. It would crash again. Constantly. This wasn’t right, I hadn’t done anything to OS X recently, why was it happening?

Reboot into Safe Mode — things work, but no accelerated graphics and a few other niceties aren’t working. Did the usual OS X thing, checked and repaired permissions, checked the file system.

All. Good.

Verbose boot logging wasn’t any more helpful, just showed lots of stuff starting and then back to the black screen.

So I headed back into the BIOS to see if I’d left anything turned off that should have been on from when I was fighting with Windows. Everything seemed fine, in fact pretty much everything I thought should be on was.

Time to hit up Google and see what it knew. Apparently nothing on this topic. How could the all knowing oracle not have an answer? Where do I go next? So many unanswered questions!

A little more sleuthing and I stumbled across the Intel Vt-d setting in the BIOS and some hints that OS X might not like it, and it was turned on. I thought this was a good thing, what self respecting nerd running multiple operating systems and virtual machines doesn’t want a bit of Vt-d?

It turns out those nerds who are running OS X on non-Apple hardware are the ones who don’t want Vt-d enabled. With flipping of one setting and a quick reboot later I was back in the land of Hackintosh. With everything working as it should.

So a lesson to all those who blithely swing a mouse around their BIOS settings — Save a “known good” copy of your settings somewhere before you screw something up and waste your time chasing rabbits down holes that don’t really exist.

Oh, the recent OS X 10.10.3 update installed without any problems on my Hackintosh.

If you feel the need to get your Telstra Bigpond usage from the command line, say for putting into a round-robin database for drawing pretty graphs, then give this a go:

#!/usr/bin/env python2.7
import requests, sys, re
from bs4 import BeautifulSoup
    
data = {'username': 'steve.smith', 'password': 'somethingsecret!'}
req = requests.post('https://signon.bigpond.com/login', params=data, allow_redirects=False)

if req.status_code == 302:
    cookies = {'BPSESSION': req.cookies['BPSESSION']}
    headers = {'Referer': 'https://signon.bigpond.com/login?goto=https%3A%2F%2Fusagemeter.bigpond.com%3A443%2Fdaily.do'}
    req = requests.get('https://usagemeter.bigpond.com/daily.do', headers=headers, cookies=cookies)
else:
    print "Didn't get redirected? ", req.status_code
    sys.exit()
    
if req.status_code == 200:
    # html.parser is important as it will ensure the document is parsed as
    # html rather than xml
    soup = BeautifulSoup(req.text, 'html.parser')
    usage = int(soup.find(class_='trStyleTotal').find('b').text) / 1e3
    limit = soup.find('th', text="Monthly allowance").parent.td.text.strip('\r\n\t')
    limit = re.match('\d+', limit).group()
    print usage, "/", limit, "GB"
else:
    print "Couldn't get usage page ", req.status_code
    sys.exit()

Grab it from GitHub

Output

 troy@skade:~$ python bigpond.py
 195.525 / 500 GB

After a great deal of frustration and much trial and error I have finally managed to get D3.js to plot multiple lines, and when the data changes the lines are updated, complete with transitions.

Head over to http://brew-pi.dack.com.au/temps/d3 to see the code behind the example below.