chaops

Managing DNS Records with deSEC.io and Terraform

2026-07-01T00:00:00+00:00

I manage all my DNS records using deSEC.io</a> as the DNS provider and Terraform</a> to define them as code. This keeps everything version-controlled, reviewable, and reproducible. OpenTofu</a> works as well since the setup is fully compatible.</p>

</div>

Why deSEC.io?</a></h2>
deSEC</a> is a free, non-profit DNS hosting service based in Germany. It supports DNSSEC out of the box and has a clean REST API.</p>

Repository Structure</a></h2>

The setup is minimal:</p>

tf-desecio/</span></span>
├── main.tf          # Terraform logic</span></span>
├── providers.tf     # Provider configuration</span></span>
├── records.yaml     # All DNS records</span></span>
└── .forgejo/workflows/terraform.yaml  # CI pipeline</span></span></code></pre>Provider Configuration</a></h2>
Using the Valodim/desec</a> Terraform provider:</p>
terraform</span> {</span></span>
  required_providers</span> {</span></span>
    desec</span> =</span> {</span></span>
      source</span>  =</span> "</span>Valodim/desec</span>"</span></span>
      version</span> =</span> "</span>0.6.1</span>"</span></span>
    }</span></span>
  }</span></span>
}</span></span></code></pre>
Authentication is done via the DESEC_API_TOKEN</code> environment variable.</p>
Defining Records in YAML</a></h2>
All DNS records live in a single records.yaml</code> file, grouped by domain:</p>
e</span>xample.com</span>:</span></span>
  -</span> s</span>ubname</span>:</span> "</span>"</span></span>
    t</span>ype</span>:</span> "</span>MX</span>"</span></span>
    r</span>ecords</span>:</span></span>
      -</span> "</span>10 mail.example.com.</span>"</span></span>
  -</span> s</span>ubname</span>:</span> "</span>mail</span>"</span></span>
    t</span>ype</span>:</span> "</span>A</span>"</span></span>
    r</span>ecords</span>:</span></span>
      -</span> "</span>203.0.113.1</span>"</span></span>
  -</span> s</span>ubname</span>:</span> "</span>mail</span>"</span></span>
    t</span>ype</span>:</span> "</span>AAAA</span>"</span></span>
    r</span>ecords</span>:</span></span>
      -</span> "</span>2001:db8::1</span>"</span></span>
  -</span> s</span>ubname</span>:</span> "</span>"</span></span>
    t</span>ype</span>:</span> "</span>TXT</span>"</span></span>
    r</span>ecords</span>:</span></span>
      -</span> "</span>v=spf1 mx -all</span>"</span></span>
</span>
a</span>nother-domain.de</span>:</span></span>
  -</span> s</span>ubname</span>:</span> "</span>www</span>"</span></span>
    t</span>ype</span>:</span> "</span>CNAME</span>"</span></span>
    r</span>ecords</span>:</span></span>
      -</span> a</span>nother-domain.de.</span></span></code></pre>
This makes it easy to see all records at a glance and add new ones without touching any HCL.</p>
Terraform Logic</a></h2>
The main.tf</code> flattens the YAML structure into individual desec_rrset</code> resources:</p>
locals</span> {</span></span>
  raw_records</span> =</span> yamldecode</span>(</span>file</span>(</span>"</span>records.yaml</span>"</span>)</span>)</span></span>
</span>
  records_flattened</span> =</span> flatten</span>(</span>[</span></span>
    for</span> domain_name</span>,</span> record_set</span> in</span> local</span>.</span>raw_records</span> :</span> [</span></span>
      for</span> item</span> in</span> record_set</span> :</span> {</span></span>
        domain</span>  = </span>domain_name</span></span>
        subname</span> = </span>item</span>.</span>subname</span></span>
        type</span>    = </span>item</span>.</span>type</span></span>
        records</span> = </span>item</span>.</span>records</span></span>
        ttl</span>     = </span>lookup</span>(</span>item</span>,</span> "</span>ttl</span>"</span>,</span> 3600</span>)</span></span>
      }</span></span>
    ]</span></span>
  ]</span>)</span></span>
}</span></span>
</span>
resource</span> "desec_rrset"</span> "rrset"</span> {</span></span>
  for_each</span> =</span> {</span> for</span> rr</span> in</span> local</span>.</span>records_flattened</span> :</span> "</span>${</span>rr</span>.</span>domain</span>}</span>-</span>${</span>rr</span>.</span>subname</span>}</span>-</span>${</span>rr</span>.</span>type</span>}</span>"</span> =></span> rr</span> }</span></span>
  domain</span>   =</span> each</span>.</span>value</span>.</span>domain</span></span>
  subname</span>  =</span> each</span>.</span>value</span>.</span>subname</span></span>
  type</span>     =</span> each</span>.</span>value</span>.</span>type</span></span>
  records</span>  =</span> each</span>.</span>value</span>.</span>records</span></span>
  ttl</span>      =</span> each</span>.</span>value</span>.</span>ttl</span></span>
}</span></span></code></pre>
Each record gets a unique key based on domain, subname, and type. Adding a new record is just appending a few lines to the YAML file.</p>
CI Pipeline</a></h2>
A Forgejo Actions workflow runs on every push and PR:</p>
on</span>:</span></span>
  p</span>ush</span>:</span></span>
    b</span>ranches</span>:</span> [</span>m</span>ain</span>]</span></span>
  p</span>ull_request</span>:</span></span>
</span>
j</span>obs</span>:</span></span>
  t</span>erraform</span>:</span></span>
    r</span>uns-on</span>:</span> u</span>buntu-latest</span></span>
    s</span>teps</span>:</span></span>
      -</span> u</span>ses</span>:</span> a</span>ctions/checkout@v6</span></span>
      -</span> u</span>ses</span>:</span> h</span>ashicorp/setup-terraform@v4</span></span>
      -</span> r</span>un</span>:</span> t</span>erraform init</span></span>
      -</span> r</span>un</span>:</span> t</span>erraform fmt -check</span></span>
      -</span> r</span>un</span>:</span> t</span>erraform validate</span></span></code></pre>
This catches formatting issues and invalid configurations.</p>
Workflow</a></h2>
Adding or changing a DNS record:</p>

Edit records.yaml</code></li>
Run terraform plan</code> to verify changes</li>
Run terraform apply</code> to push to deSEC</li>
Commit and push</li>
</ol>
That's it. No web UI clicking, no forgetting what you changed, and full git history of every DNS modification.</p>


Running TeamSpeak 6 Server with Podman Rootless & Auto-Updates
2026-02-23T00:00:00+00:00
This guide shows how to run a TeamSpeak 6 server</a> using rootless Podman with Quadlets and automatic container updates.</p>
Why containers?</strong></p>

Easy updates and rollbacks</li>
Isolated from your host system</li>
Same setup works on any Linux distribution</li>
</ul>
Why Podman rootless?</strong></p>

Runs without root privileges for better security</li>
If compromised, attacker can't access the whole system</li>
</ul>

Architecture</a></h2>


</div>
Prerequisites</a></h2>
Create Podman User</a></h3>
Create a dedicated user for running containers:</p>
#</span> Create podman user if it doesn't exist</span></span>
if</span> !</span> id</span> -</span>u</span> podman</span> &</span>></span> /dev/null</span>;</span> then</span></span>
    sudo</span> useradd</span> -</span>r</span> -</span>m</span> -</span>d</span> /home/podman</span> -</span>s</span> /bin/bash</span> podman</span></span>
fi</span></span></code></pre>Install Podman</a></h3>
Ubuntu:</strong></p>
sudo</span> apt-get</span> update</span></span>
sudo</span> apt-get</span> install</span> -</span>y</span> podman</span></span></code></pre>
AlmaLinux:</strong></p>
sudo</span> dnf</span> install</span> -</span>y</span> podman</span></span></code></pre>Enable Lingering</a></h3>
Enable lingering to allow rootless containers to run without an active user session:</p>
sudo</span> loginctl</span> enable-linger</span> podman</span></span></code></pre>Setup</a></h2>
All following commands should be run as the podman</code> user:</p>
sudo</span> -</span>iu</span> podman</span></span></code></pre>
We will do the following:</p>
Create Directory Structure</a></h3>
mkdir</span> -</span>p</span> ~/.config/containers/systemd</span></span></code></pre>Create Network Quadlet</a></h3>
We need a new network to run the container in with enabled IPv6.</p>
Create ~/.config/containers/systemd/teamspeak.network</code>:</p>
cat > ~/.config/containers/systemd/teamspeak.network <<'EOF'</span></span>
[Network]</span></span>
IPv6</span>=</span>true</span></span>
</span>
[Service]</span></span>
ExecStop</span>=</span>/usr/bin/podman network rm teamspeak</span></span>
</span>
[Unit]</span></span>
Description</span>=</span>Podman network for teamspeak</span></span>
EOF</span></span></code></pre>Create Volume Quadlet</a></h3>
To persist the teamspeak database we need a new volume.</p>
Create ~/.config/containers/systemd/teamspeak-data.volume</code>:</p>
cat > ~/.config/containers/systemd/teamspeak-data.volume <<'EOF'</span></span>
[Volume]</span></span>
</span>
[Service]</span></span>
</span>
[Unit]</span></span>
Description</span>=</span>Podman volume for teamspeak data</span></span>
EOF</span></span></code></pre>Create Container Quadlet</a></h3>
Create ~/.config/containers/systemd/teamspeak.container</code>:</p>
cat > ~/.config/containers/systemd/teamspeak.container <<'EOF'</span></span>
[Container]</span></span>
AutoUpdate</span>=</span>registry</span></span>
Environment</span>=</span>TSSERVER_DATABASE_PLUGIN</span>=</span>sqlite3</span></span>
Environment</span>=</span>TSSERVER_LICENSE_ACCEPTED</span>=</span>accept</span></span>
Environment</span>=</span>TSSERVER_QUERY_HTTP_ENABLED</span>=</span>1</span></span>
Image</span>=</span>docker.io/teamspeaksystems/teamspeak6-server:latest</span></span>
Network</span>=</span>teamspeak.network</span></span>
PublishPort</span>=</span>9987</span>:9987/udp</span></span>
PublishPort</span>=</span>30033</span>:30033/tcp</span></span>
PublishPort</span>=</span>10080</span>:10080/tcp</span></span>
Volume</span>=</span>teamspeak-data.volume:/var/tsserver</span></span>
</span>
[Service]</span></span>
Restart</span>=</span>always</span></span>
TimeoutStartSec</span>=</span>900</span></span>
</span>
[Unit]</span></span>
Description</span>=</span>Podman teamspeak container</span></span>
EOF</span></span></code></pre>
Port mapping:</strong></p>

9987/udp</code> - Voice server - required</li>
30033/tcp</code> - Filetransfer - required</li>
10080/tcp</code> - ServerQuery (HTTP) - not required</li>
</ul>
Enable and Start</a></h2>
#</span> Reload systemd to recognize new or changed Quadlets</span></span>
systemctl</span> -</span>-user</span> daemon-reload</span></span>
</span>
#</span> Enable auto-start on boot</span></span>
systemctl</span> -</span>-user</span> enable</span> teamspeak</span></span>
</span>
#</span> Start the service</span></span>
systemctl</span> -</span>-user</span> start</span> teamspeak</span></span>
</span>
#</span> Check status</span></span>
systemctl</span> -</span>-user</span> status</span> teamspeak</span></span></code></pre>Auto-Updates</a></h2>
Enable automatic container updates with a systemd timer:</p>
#</span> Enable auto-update timer</span></span>
systemctl</span> -</span>-user</span> enable</span> -</span>-now</span> podman-auto-update.timer</span></span></code></pre>
This checks for image updates daily and restarts updated containers with AutoUpdate=registry</code>.</p>
To manually trigger an update:</p>
podman</span> auto-update</span></span></code></pre>Firewall Configuration</a></h2>
Open required ports:</p>
Ubuntu (ufw):</strong></p>
sudo</span> ufw</span> allow</span> 9987/udp</span> comment</span> '</span>TeamSpeak Voice</span>'</span></span>
sudo</span> ufw</span> allow</span> 30033/tcp</span> comment</span> '</span>TeamSpeak Filetransfer</span>'</span></span>
sudo</span> ufw</span> allow</span> 10080/tcp</span> comment</span> '</span>TeamSpeak HTTP Query</span>'</span></span></code></pre>
AlmaLinux (firewalld):</strong></p>
sudo</span> firewall-cmd</span> -</span>-permanent</span> -</span>-add-port=9987/udp</span></span>
sudo</span> firewall-cmd</span> -</span>-permanent</span> -</span>-add-port=30033/tcp</span></span>
sudo</span> firewall-cmd</span> -</span>-permanent</span> -</span>-add-port=10080/tcp</span></span>
sudo</span> firewall-cmd</span> -</span>-reload</span></span></code></pre>First-Time Setup</a></h2>
On first run, TeamSpeak generates an admin token. Retrieve it from the logs:</p>
podman</span> logs</span> teamspeak</span> |</span> grep</span> -</span>i</span> "</span>token</span>"</span></span></code></pre>
Connect to your server at <your-ip></code> and use the token to claim admin privileges.</p>
Troubleshooting</a></h2>
Check Service Status</a></h3>
#</span> Check if service is running</span></span>
systemctl</span> -</span>-user</span> status</span> teamspeak</span></span>
</span>
#</span> Check if container is running</span></span>
podman</span> ps</span> -</span>a</span> |</span> grep</span> teamspeak</span></span></code></pre>Logs</a></h3>
#</span> Get logs on failing start</span></span>
journalctl</span> -</span>-user</span> -</span>xeu</span> teamspeak</span></span>
</span>
#</span> Follow logs</span></span>
journalctl</span> -</span>-user</span> -</span>feu</span> teamspeak</span></span>
</span>
#</span> Get logs with podman</span></span>
podman</span> logs</span> -</span>f</span> teamspeak</span></span></code></pre>Port Binding Issues</a></h3>
If ports are already in use:</p>
#</span> Check what's using the ports</span></span>
sudo</span> ss</span> -</span>tulpn</span> |</span> grep</span> -</span>E</span> '</span>9987|30033|10080</span>'</span></span></code></pre>Permission Issues</a></h3>
Ensure the podman user has proper subuid/subgid mappings</a>:</p>
#</span> Check mappings</span></span>
grep</span> podman</span> /etc/subuid</span> /etc/subgid</span></span>
</span>
#</span> If missing, add them (as root)</span></span>
sudo</span> usermod</span> -</span>-add-subuids</span> 100000-165535</span> -</span>-add-subgids</span> 100000-165535</span> podman</span></span></code></pre>
To view and modify real UIDs/GIDs of files in volumes, use podman unshare</code>:</p>
#</span> Check which user runs the TeamSpeak process</span></span>
podman</span> exec</span> teamspeak</span> ps</span> aux</span></span>
#</span># USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND</span></span>
#</span># tsserver       1  0.9  0.1 2417440 19996 ?       Ssl  Feb18  65:56 tsserver</span></span>
#</span># tsserver      52  0.0  0.0   7064  2864 pts/0    Rs+  19:09   0:00 ps aux</span></span>
</span>
#</span> Find the UID/GID used inside the container</span></span>
podman</span> exec</span> teamspeak</span> id</span> tsserver</span></span>
#</span># uid=9987(tsserver) gid=9987(tsserver) groups=9987(tsserver)</span></span>
</span>
#</span> Enter user namespace to see real UIDs/GIDs</span></span>
podman</span> unshare</span></span>
</span>
#</span> Now you can see and change ownership to the teamspeak user in the container</span></span>
ls</span> -</span>ln</span> ~/.local/share/containers/storage/volumes/teamspeak-data/_data/</span></span>
chown</span> -</span>R</span> 9987:9987</span> ~/.local/share/containers/storage/volumes/teamspeak-data/_data/</span></span>
</span>
#</span> Exit namespace</span></span>
exit</span></span></code></pre>


Running systemd-resolved to cache DNS queries with NetworkManager
2025-06-16T00:00:00+00:00
This post describes how to set up systemd-resolved</code> to cache DNS queries with NetworkManager. Using systemd-resolved provides several benefits:</p>

DNS Caching</strong>: Improves performance by reducing repeated lookups</li>
DNSSEC Support</strong>: Adds security by validating DNS responses</li>
DNS-over-TLS</strong>: Encrypts DNS traffic for better privacy</li>
Centralized Management</strong>: Simplifies DNS configuration across the system</li>
</ul>
Why Use systemd-resolved?</a></h2>
Traditional DNS resolution on Linux can be fragmented across different applications and configuration files. systemd-resolved provides a unified approach that works well with modern Linux distributions and NetworkManager.</p>
Configure NetworkManager</a></h2>
First, configure NetworkManager to use systemd-resolved for DNS resolution:</p>
In /etc/NetworkManager/NetworkManager.conf</code> under the [main]</code> section, add the following line:</p>
[</span>main</span>]</span></span>
dns</span>=</span>systemd-resolved</span></span></code></pre>
This instructs NetworkManager to pass DNS server information from network connections to systemd-resolved.</p>
Reload the NetworkManager configuration to apply the changes:</p>
sudo</span> nmcli</span> general</span> reload</span></span></code></pre>Configure systemd-resolved</a></h2>
Installation</a></h3>
Install systemd-resolved if it is not already installed:</p>
#</span> For Fedora/RHEL/CentOS</span></span>
sudo</span> dnf</span> install</span> systemd-resolved</span></span>
</span>
#</span> For Debian/Ubuntu</span></span>
sudo</span> apt</span> install</span> systemd-resolved</span></span>
</span>
#</span> For Arch Linux</span></span>
sudo</span> pacman</span> -</span>S</span> systemd-resolved</span></span></code></pre>Configuration</a></h3>
Edit the /etc/systemd/resolved.conf</code> file to set the DNS servers and other options. Here's an example configuration using Quad9 as the global DNS provider with DNSSEC and DNS-over-TLS enabled:</p>
[</span>Resolve</span>]</span></span>
#</span> Quad9 secure DNS servers (blocks malicious domains)</span></span>
DNS</span>=</span>9.9.9.9</span>#</span>dns.quad9.net 2620:fe::fe#dns.quad9.net</span></span>
FallbackDNS</span>=</span>149.112.112.112</span>#</span>dns.quad9.net 2620:fe::9#dns.quad9.net</span></span>
</span>
#</span> Security features</span></span>
DNSSEC</span>=</span>yes</span></span>
DNSOverTLS</span>=</span>yes</span></span>
</span>
#</span> Caching</span></span>
Cache</span>=</span>yes</span></span>
</span>
#</span> Local resolution</span></span>
DNSStubListener</span>=</span>yes</span></span>
ReadEtcHosts</span>=</span>yes</span></span></code></pre>

Note</strong>: The #dns.quad9.net</code> suffix enables DNS-over-TLS for that server.</p>
</blockquote>
Alternative DNS Providers</a></h3>
You can replace Quad9 with other providers:</p>
#</span> Cloudflare</span></span>
DNS</span>=</span>1.1.1.1</span>#</span>cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com</span></span>
FallbackDNS</span>=</span>1.0.0.1</span>#</span>cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com</span></span>
</span>
#</span> Google</span></span>
DNS</span>=</span>8.8.8.8</span>#</span>dns.google 2001:4860:4860::8888#dns.google</span></span>
FallbackDNS</span>=</span>8.8.4.4</span>#</span>dns.google 2001:4860:4860::8844#dns.google</span></span></code></pre>Enable and Start the Service</a></h3>
Now enable and start the systemd-resolved service:</p>
sudo</span> systemctl</span> enable</span> -</span>-now</span> systemd-resolved</span></span>
sudo</span> systemctl</span> status</span> systemd-resolved</span></span></code></pre>Configure resolv.conf</a></h3>
To make applications use systemd-resolved, link the stub resolver to /etc/resolv.conf</code>:</p>
#</span> Backup the existing resolv.conf</span></span>
sudo</span> mv</span> /etc/resolv.conf</span> /etc/resolv.conf.bak</span></span>
</span>
#</span> Create the symlink</span></span>
sudo</span> ln</span> -</span>sf</span> /run/systemd/resolve/stub-resolv.conf</span> /etc/resolv.conf</span></span>
</span>
#</span> Reload NetworkManager to apply changes immediately (not needed at reboot)</span></span>
sudo</span> nmcli</span> general</span> reload</span></span>
</span>
#</span> Verify the configuration</span></span>
cat</span> /etc/resolv.conf</span></span></code></pre>

Important</strong>: The stub-resolv.conf points to 127.0.0.53, which is systemd-resolved's stub resolver address.</p>
</blockquote>
Verify and Troubleshoot</a></h2>
Test DNS Resolution</a></h3>
Query the stub resolver to verify it's working:</p>
dig</span> google.com</span> @127.0.0.53</span> +short</span></span></code></pre>Check Interface Configurations</a></h3>
View DNS settings for all network interfaces:</p>
resolvectl</span> status</span></span></code></pre>
This shows which DNS servers are being used for each connection.</p>
Monitor DNS Queries in Real-time</a></h3>
sudo</span> resolvectl</span> monitor</span></span></code></pre>View Cache Statistics</a></h3>
resolvectl</span> statistics</span></span></code></pre>View Cache Entries</a></h3>
To see what's currently in the DNS cache:</p>
resolvectl</span> show-cache</span></span></code></pre>Managing DNS Settings</a></h2>
Per-Connection DNS Settings</a></h3>
NetworkManager can set different DNS servers for each connection, which systemd-resolved will respect:</p>
#</span> Set specific DNS servers for a connection</span></span>
sudo</span> nmcli</span> connection</span> modify</span> "</span>My Connection</span>"</span> ipv4.dns</span> "</span>1.1.1.1 8.8.8.8</span>"</span></span>
sudo</span> nmcli</span> connection</span> modify</span> "</span>My Connection</span>"</span> ipv6.dns</span> "</span>2606:4700:4700::1111 2001:4860:4860::8888</span>"</span></span>
</span>
#</span> Remove specific DNS configuration from a connection</span></span>
sudo</span> nmcli</span> connection</span> modify</span> "</span>My Connection</span>"</span> ipv4.dns</span> "</span>"</span></span>
sudo</span> nmcli</span> connection</span> modify</span> "</span>My Connection</span>"</span> ipv6.dns</span> "</span>"</span></span></code></pre>Flush DNS Cache</a></h3>
If you need to clear the DNS cache:</p>
sudo</span> resolvectl</span> flush-caches</span></span></code></pre>


Using Podman Quadlets for Dynamic DNS with desec.io
2025-04-26T00:00:00+00:00
Dynamic DNS (DDNS)</a> automatically updates DNS records when your IP address changes. This following post shows how to set up DDNS using ddns-updater</a>, desec.io</a>, and Podman Quadlets</a>.</p>
The podman container can run under the root user or rootless</a>.</p>


</div>
Setup</a></h2>
1. Create Kubernetes Pod YAML</a></h3>
Create a yaml file to store the following manifest:</p>
---</span></span>
a</span>piVersion</span>:</span> v</span>1</span></span>
k</span>ind</span>:</span> P</span>od</span></span>
m</span>etadata</span>:</span></span>
  l</span>abels</span>:</span></span>
    a</span>pp</span>:</span> d</span>dns-updater</span></span>
    i</span>o.containers.autoupdate</span>:</span> r</span>egistry</span></span>
  n</span>ame</span>:</span> d</span>dns-updater</span></span>
s</span>pec</span>:</span></span>
  c</span>ontainers</span>:</span></span>
    -</span> i</span>mage</span>:</span> d</span>ocker.io/qmcgaw/ddns-updater:latest</span></span>
      n</span>ame</span>:</span> v</span>4</span></span>
      e</span>nv</span>:</span></span>
      -</span> n</span>ame</span>:</span> L</span>OG_LEVEL</span></span>
        v</span>alue</span>:</span> I</span>NFO</span></span>
      -</span> n</span>ame</span>:</span> S</span>ERVER_ENABLED</span></span>
        v</span>alue</span>:</span> "</span>false</span>"</span></span>
      -</span> n</span>ame</span>:</span> P</span>ERIOD</span></span>
        v</span>alue</span>:</span> 5</span>m</span></span>
      -</span> n</span>ame</span>:</span> C</span>ONFIG</span></span>
        v</span>alue</span>:</span> ></span></span>
          {</span></span>
            "settings": [</span></span>
              {</span></span>
                "provider": "desec",</span></span>
                "domain": "ddns.example.com",</span></span>
                "token": "your_desec_token_here",</span></span>
                "ip_version": "ipv4"</span></span>
              }</span></span>
            ]</span></span>
          }</span></span>
</span>
    -</span> i</span>mage</span>:</span> d</span>ocker.io/qmcgaw/ddns-updater:latest</span></span>
      n</span>ame</span>:</span> v</span>6</span></span>
      e</span>nv</span>:</span></span>
      -</span> n</span>ame</span>:</span> L</span>OG_LEVEL</span></span>
        v</span>alue</span>:</span> I</span>NFO</span></span>
      -</span> n</span>ame</span>:</span> S</span>ERVER_ENABLED</span></span>
        v</span>alue</span>:</span> "</span>false</span>"</span></span>
      -</span> n</span>ame</span>:</span> H</span>EALTH_SERVER_ADDRESS</span></span>
        v</span>alue</span>:</span> "</span>127.0.0.1:9998</span>"</span></span>
      -</span> n</span>ame</span>:</span> P</span>ERIOD</span></span>
        v</span>alue</span>:</span> 5</span>m</span></span>
      -</span> n</span>ame</span>:</span> C</span>ONFIG</span></span>
        v</span>alue</span>:</span> ></span></span>
          {</span></span>
            "settings": [</span></span>
              {</span></span>
                "provider": "desec",</span></span>
                "domain": "ddns.example.com",</span></span>
                "ipv6_suffix": ""</span></span>
                "token": "your_desec_token_here",</span></span>
                "ip_version": "ipv6"</span></span>
              }</span></span>
            ]</span></span>
          }</span></span></code></pre>2. Create Podman Quadlet</a></h3>
Create /etc/containers/systemd/ddns-updater.kube</code> (rootfull) or ~/.config/containers/systemd/ddns-updater.kube</code> (rootless):</p>
[</span>Install</span>]</span></span>
WantedBy</span>=</span>default.target</span></span>
</span>
[</span>Unit</span>]</span></span>
Description</span>=</span>Dynamic DNS Updater for desec.io</span></span>
After</span>=</span>network-online.target</span></span>
Wants</span>=</span>network-online.target</span></span>
</span>
[</span>Kube</span>]</span></span>
Yaml</span>=</span><full path to pod yaml></span></span>
Network</span>=</span>host</span></span>
</span>
[</span>Service</span>]</span></span>
Restart</span>=</span>always</span></span>
RestartSec</span>=</span>10</span></span>
TimeoutStartSec</span>=</span>900</span></span></code></pre>3. Enable and Start</a></h3>
#</span> rootfull</span></span>
sudo</span> systemctl</span> daemon-reload</span></span>
sudo</span> systemctl</span> enable</span> -</span>-now</span> ddns-updater</span></span>
</span>
#</span> rootless</span></span>
systemctl</span> -</span>-user</span> daemon-reload</span></span>
systemctl</span> -</span>-user</span> enable</span> -</span>-now</span> ddns-updater</span></span></code></pre>Monitoring</a></h2>
Check status:</p>
#</span> rootfull</span></span>
systemctl</span> status</span> ddns-updater</span></span>
</span>
#</span> rootless</span></span>
systemctl</span> -</span>-user</span> status</span> ddns-updater</span></span></code></pre>
View logs:</p>
podman</span> logs</span> ddns-updater-v4</span></span>
podman</span> logs</span> ddns-updater-v6</span></span>
</span>
#</span> rootfull</span></span>
journalctl</span> -</span>u</span> ddns-updater</span></span>
</span>
#</span> rootless</span></span>
journalctl</span> -</span>-user</span> -</span>u</span> ddns-updater</span></span></code></pre>
Test DNS resolution:</p>
dig</span> +short</span> A</span> ddns.example.com</span></span>
dig</span> +short</span> AAAA</span> ddns.example.com</span></span></code></pre>


Python Cloudflare TTL Changer
2025-04-05T00:00:00+00:00
Using the Cloudflare API, this script updates the TTL (Time To Live) of DNS records. It can be useful for changing the TTL of multiple records at once.</p>
import</span> requests</span></span>
</span>
API_TOKEN</span> =</span> (</span></span>
    "</span>XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX</span>"</span>  #</span> Replace with your Cloudflare API token</span></span>
)</span></span>
ZONE_ID</span> =</span> "</span>00000000000000000000000000000000</span>"</span>  #</span> Replace with your Cloudflare Zone ID found in the dashboard</span></span>
HEADERS</span> =</span> {</span>"</span>Authorization</span>"</span>:</span> f</span>"</span>Bearer </span>{</span>API_TOKEN</span>}</span>"</span>,</span> "</span>Content-Type</span>"</span>:</span> "</span>application/json</span>"</span>}</span></span>
CURRENT_TTL</span> =</span> 1</span></span>
TARGET_TTL</span> =</span> 3600</span></span>
PROXIED</span> =</span> False</span></span>
TYPES</span> =</span> [</span>"</span>A</span>"</span>,</span> "</span>AAAA</span>"</span>,</span> "</span>CNAME</span>"</span>]</span></span>
</span>
</span>
def</span> list_dns_records</span>(</span>)</span>:</span></span>
    page</span>,</span> all_records</span> =</span> 1</span>,</span> [</span>]</span></span>
    while</span> True</span>:</span></span>
        url</span> =</span> f</span>"</span>https://api.cloudflare.com/client/v4/zones/</span>{</span>ZONE_ID</span>}</span>/dns_records?per_page=100&page=</span>{</span>page</span>}</span>"</span></span>
        response</span> =</span> requests</span>.</span>get</span>(</span>url</span>,</span> headers</span>=</span>HEADERS</span>)</span></span>
        response</span>.</span>raise_for_status</span>(</span>)</span></span>
        data</span> =</span> response</span>.</span>json</span>(</span>)</span></span>
        all_records</span>.</span>extend</span>(</span>data</span>[</span>"</span>result</span>"</span>]</span>)</span></span>
        if</span> data</span>[</span>"</span>result_info</span>"</span>]</span>[</span>"</span>total_pages</span>"</span>]</span> ==</span> page</span>:</span></span>
            break</span></span>
        page</span> +=</span> 1</span></span>
    return</span> all_records</span></span>
</span>
</span>
def</span> update_dns_record</span>(</span>record</span>)</span>:</span></span>
    url</span> =</span> f</span>"</span>https://api.cloudflare.com/client/v4/zones/</span>{</span>ZONE_ID</span>}</span>/dns_records/</span>{</span>record</span>[</span>'</span>id</span>'</span>]</span>}</span>"</span></span>
    response</span> =</span> requests</span>.</span>put</span>(</span>url</span>,</span> headers</span>=</span>HEADERS</span>,</span> json</span>=</span>record</span>)</span></span>
    response</span>.</span>raise_for_status</span>(</span>)</span></span>
    return</span> response</span>.</span>json</span>(</span>)</span></span>
</span>
</span>
dns_records</span> =</span> list_dns_records</span>(</span>)</span></span>
print</span>(</span>f</span>"</span>Total DNS records: </span>{</span>len</span>(</span>dns_records</span>)</span>}</span>"</span>)</span></span>
for</span> record</span> in</span> dns_records</span>:</span></span>
    if</span> (</span></span>
        record</span>[</span>"</span>ttl</span>"</span>]</span> ==</span> CURRENT_TTL</span></span>
        and</span> record</span>[</span>"</span>type</span>"</span>]</span> in</span> TYPES</span></span>
        and</span> record</span>[</span>"</span>proxied</span>"</span>]</span> is</span> PROXIED</span></span>
    )</span>:</span></span>
        record</span>[</span>"</span>ttl</span>"</span>]</span> =</span> TARGET_TTL</span></span>
        print</span>(</span></span>
            f</span>"</span>Updating </span>{</span>record</span>[</span>'</span>name</span>'</span>]</span>}</span> (</span>{</span>record</span>[</span>'</span>type</span>'</span>]</span>}</span>) from </span>{</span>CURRENT_TTL</span>}</span> to </span>{</span>TARGET_TTL</span>}</span>"</span></span>
        )</span></span>
        update_dns_record</span>(</span>record</span>)</span></span></code></pre>


Podman hoarder kubefile with traefik
2025-03-22T00:00:00+00:00
---</span></span>
a</span>piVersion</span>:</span> v</span>1</span></span>
k</span>ind</span>:</span> P</span>od</span></span>
m</span>etadata</span>:</span></span>
  l</span>abels</span>:</span></span>
    a</span>pp</span>:</span> h</span>oarder</span></span>
    i</span>o.containers.autoupdate</span>:</span> r</span>egistry</span></span>
    t</span>raefik.docker.network</span>:</span> p</span>roxy</span></span>
    t</span>raefik.enable</span>:</span> true</span></span>
    t</span>raefik.http.middlewares.hoarder-https-redirect.redirectscheme.scheme</span>:</span> h</span>ttps</span></span>
    t</span>raefik.http.routers.hoarder-secure.entrypoints</span>:</span> h</span>ttps</span></span>
    t</span>raefik.http.routers.hoarder-secure.rule</span>:</span> H</span>ost(`hoarder.domain`)</span></span>
    t</span>raefik.http.routers.hoarder-secure.service</span>:</span> h</span>oarder</span></span>
    t</span>raefik.http.routers.hoarder-secure.tls</span>:</span> true</span></span>
    t</span>raefik.http.routers.hoarder-secure.tls.certresolver</span>:</span> l</span>etsencrypt</span></span>
    t</span>raefik.http.routers.hoarder.entrypoints</span>:</span> h</span>ttp</span></span>
    t</span>raefik.http.routers.hoarder.middlewares</span>:</span> h</span>oarder-https-redirect</span></span>
    t</span>raefik.http.routers.hoarder.rule</span>:</span> H</span>ost(`hoarder.domain`)</span></span>
    t</span>raefik.http.services.hoarder.loadbalancer.server.port</span>:</span> 3000</span></span>
  n</span>ame</span>:</span> h</span>oarder</span></span>
s</span>pec</span>:</span></span>
  c</span>ontainers</span>:</span></span>
    -</span> n</span>ame</span>:</span> m</span>ain</span></span>
      i</span>mage</span>:</span> g</span>hcr.io/hoarder-app/hoarder:release</span></span>
      e</span>nv</span>:</span></span>
        -</span> n</span>ame</span>:</span> M</span>EILI_ADDR</span></span>
          v</span>alue</span>:</span> h</span>ttp://localhost:7700</span></span>
        -</span> n</span>ame</span>:</span> M</span>EILI_MASTER_KEY</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
        -</span> n</span>ame</span>:</span> B</span>ROWSER_WEB_URL</span></span>
          v</span>alue</span>:</span> h</span>ttp://localhost:9222</span></span>
        -</span> n</span>ame</span>:</span> D</span>ATA_DIR</span></span>
          v</span>alue</span>:</span> /</span>data</span></span>
        -</span> n</span>ame</span>:</span> N</span>EXTAUTH_SECRET</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
        -</span> n</span>ame</span>:</span> N</span>EXTAUTH_URL</span></span>
          v</span>alue</span>:</span> h</span>ttps://hoarder.domain</span></span>
        -</span> n</span>ame</span>:</span> D</span>ISABLE_SIGNUPS</span></span>
          v</span>alue</span>:</span> "</span>true</span>"</span></span>
        -</span> n</span>ame</span>:</span> C</span>RAWLER_FULL_PAGE_ARCHIVE</span></span>
          v</span>alue</span>:</span> "</span>true</span>"</span></span>
        -</span> n</span>ame</span>:</span> O</span>PENAI_API_KEY</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
      v</span>olumeMounts</span>:</span></span>
        -</span> n</span>ame</span>:</span> d</span>ata</span></span>
          m</span>ountPath</span>:</span> /</span>data</span></span>
</span>
    -</span> n</span>ame</span>:</span> c</span>hrome</span></span>
      i</span>mage</span>:</span> g</span>cr.io/zenika-hub/alpine-chrome:123</span></span>
      a</span>rgs</span>:</span></span>
        -</span> "</span>--no-sandbox</span>"</span></span>
        -</span> "</span>--disable-gpu</span>"</span></span>
        -</span> "</span>--disable-dev-shm-usage</span>"</span></span>
        -</span> "</span>--remote-debugging-address=0.0.0.0</span>"</span></span>
        -</span> "</span>--remote-debugging-port=9222</span>"</span></span>
        -</span> "</span>--hide-scrollbars</span>"</span></span>
</span>
    -</span> n</span>ame</span>:</span> m</span>eilisearch</span></span>
      i</span>mage</span>:</span> d</span>ocker.io/getmeili/meilisearch:v1.11.1</span></span>
      e</span>nv</span>:</span></span>
        -</span> n</span>ame</span>:</span> M</span>EILI_NO_ANALYTICS</span></span>
          v</span>alue</span>:</span> "</span>true</span>"</span></span>
        -</span> n</span>ame</span>:</span> M</span>EILI_MASTER_KEY</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
      v</span>olumeMounts</span>:</span></span>
        -</span> n</span>ame</span>:</span> m</span>eilisearch-data</span></span>
          m</span>ountPath</span>:</span> /</span>meili_data</span></span>
  v</span>olumes</span>:</span></span>
    -</span> n</span>ame</span>:</span> d</span>ata</span></span>
      p</span>ersistentVolumeClaim</span>:</span></span>
        c</span>laimName</span>:</span> h</span>oarder-data</span></span>
    -</span> n</span>ame</span>:</span> m</span>eilisearch-data</span></span>
      p</span>ersistentVolumeClaim</span>:</span></span>
        c</span>laimName</span>:</span> h</span>oarder-meilisearch-data</span></span></code></pre>


Podman authentik kubefile with traefik
2025-03-20T00:00:00+00:00
Authentik Instance</h2>
---</span></span>
a</span>piVersion</span>:</span> v</span>1</span></span>
k</span>ind</span>:</span> P</span>od</span></span>
m</span>etadata</span>:</span></span>
  l</span>abels</span>:</span></span>
    a</span>pp</span>:</span> a</span>uthentik</span></span>
    i</span>o.containers.autoupdate</span>:</span> r</span>egistry</span></span>
    t</span>raefik.enable</span>:</span> true</span></span>
    t</span>raefik.docker.network</span>:</span> p</span>roxy</span></span>
    t</span>raefik.http.middlewares.authentik-https-redirect.redirectscheme.scheme</span>:</span> h</span>ttps</span></span>
    t</span>raefik.http.routers.authentik-secure.entrypoints</span>:</span> h</span>ttps</span></span>
    t</span>raefik.http.routers.authentik-secure.rule</span>:</span> H</span>ost(`auth.domain`)</span></span>
    t</span>raefik.http.routers.authentik-secure.service</span>:</span> a</span>uthentik</span></span>
    t</span>raefik.http.routers.authentik-secure.tls</span>:</span> true</span></span>
    t</span>raefik.http.routers.authentik-secure.tls.certresolver</span>:</span> l</span>etsencrypt</span></span>
    t</span>raefik.http.routers.authentik.entrypoints</span>:</span> h</span>ttp</span></span>
    t</span>raefik.http.routers.authentik.middlewares</span>:</span> a</span>uthentik-https-redirect</span></span>
    t</span>raefik.http.routers.authentik.rule</span>:</span> H</span>ost(`auth.domain`)</span></span>
    t</span>raefik.http.services.authentik.loadbalancer.server.port</span>:</span> 9000</span></span>
  n</span>ame</span>:</span> a</span>uthentik</span></span>
s</span>pec</span>:</span></span>
  c</span>ontainers</span>:</span></span>
    -</span> n</span>ame</span>:</span> p</span>ostgresql</span></span>
      i</span>mage</span>:</span> d</span>ocker.io/library/postgres:16-alpine</span></span>
      e</span>nv</span>:</span></span>
        -</span> n</span>ame</span>:</span> P</span>OSTGRES_DB</span></span>
          v</span>alue</span>:</span> a</span>uthentik</span></span>
        -</span> n</span>ame</span>:</span> P</span>OSTGRES_USER</span></span>
          v</span>alue</span>:</span> a</span>uthentik</span></span>
        -</span> n</span>ame</span>:</span> P</span>OSTGRES_PASSWORD</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
      v</span>olumeMounts</span>:</span></span>
        -</span> m</span>ountPath</span>:</span> /</span>var/lib/postgresql/data</span></span>
          n</span>ame</span>:</span> a</span>uthentik-postgresql</span></span>
      h</span>ealthcheck</span>:</span></span>
        e</span>xec</span>:</span></span>
          c</span>ommand</span>:</span> [</span>"</span>pg_isready</span>"</span>,</span> "</span>-d</span>"</span>,</span> "</span>${POSTGRES_DB}</span>"</span>,</span> "</span>-U</span>"</span>,</span> "</span>${POSTGRES_USER}</span>"</span>]</span></span>
        p</span>eriodSeconds</span>:</span> 30</span></span>
        t</span>imeoutSeconds</span>:</span> 5</span></span>
        f</span>ailureThreshold</span>:</span> 5</span></span>
</span>
    -</span> n</span>ame</span>:</span> r</span>edis</span></span>
      i</span>mage</span>:</span> d</span>ocker.io/library/redis:alpine</span></span>
      c</span>ommand</span>:</span> [</span>"</span>redis-server</span>"</span>,</span> "</span>--save</span>"</span>,</span> "</span>60</span>"</span>,</span> "</span>1</span>"</span>,</span> "</span>--loglevel</span>"</span>,</span> "</span>warning</span>"</span>]</span></span>
      v</span>olumeMounts</span>:</span></span>
        -</span> m</span>ountPath</span>:</span> /</span>data</span></span>
          n</span>ame</span>:</span> a</span>uthentik-redis</span></span>
      h</span>ealthcheck</span>:</span></span>
        e</span>xec</span>:</span></span>
          c</span>ommand</span>:</span> [</span>"</span>redis-cli ping | grep PONG</span>"</span>]</span></span>
        p</span>eriodSeconds</span>:</span> 30</span></span>
        t</span>imeoutSeconds</span>:</span> 3</span></span>
        f</span>ailureThreshold</span>:</span> 5</span></span>
</span>
    -</span> n</span>ame</span>:</span> s</span>erver</span></span>
      i</span>mage</span>:</span> g</span>hcr.io/goauthentik/server:latest</span></span>
      a</span>rgs</span>:</span> [</span>"</span>server</span>"</span>]</span></span>
      e</span>nv</span>:</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_REDIS__HOST</span></span>
          v</span>alue</span>:</span> r</span>edis</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__HOST</span></span>
          v</span>alue</span>:</span> p</span>ostgresql</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__USER</span></span>
          v</span>alue</span>:</span> a</span>uthentik</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__NAME</span></span>
          v</span>alue</span>:</span> a</span>uthentik</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__PASSWORD</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_SECRET_KEY</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
      s</span>ecurityContext</span>:</span></span>
        r</span>unAsUser</span>:</span> 1000</span></span>
      v</span>olumeMounts</span>:</span></span>
        -</span> m</span>ountPath</span>:</span> /</span>media</span></span>
          n</span>ame</span>:</span> m</span>edia</span></span>
        -</span> m</span>ountPath</span>:</span> /</span>templates</span></span>
          n</span>ame</span>:</span> c</span>ustom-templates</span></span>
</span>
    -</span> n</span>ame</span>:</span> w</span>orker</span></span>
      i</span>mage</span>:</span> g</span>hcr.io/goauthentik/server:latest</span></span>
      a</span>rgs</span>:</span> [</span>"</span>worker</span>"</span>]</span></span>
      e</span>nv</span>:</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_REDIS__HOST</span></span>
          v</span>alue</span>:</span> r</span>edis</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__HOST</span></span>
          v</span>alue</span>:</span> p</span>ostgresql</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__USER</span></span>
          v</span>alue</span>:</span> a</span>uthentik</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__NAME</span></span>
          v</span>alue</span>:</span> a</span>uthentik</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_POSTGRESQL__PASSWORD</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
        -</span> n</span>ame</span>:</span> A</span>UTHENTIK_SECRET_KEY</span></span>
          v</span>alue</span>:</span> "</span>"</span></span>
      s</span>ecurityContext</span>:</span></span>
        r</span>unAsUser</span>:</span> 1000</span></span>
      v</span>olumeMounts</span>:</span></span>
        -</span> m</span>ountPath</span>:</span> /</span>media</span></span>
          n</span>ame</span>:</span> m</span>edia</span></span>
        -</span> m</span>ountPath</span>:</span> /</span>templates</span></span>
          n</span>ame</span>:</span> c</span>ustom-templates</span></span>
  v</span>olumes</span>:</span></span>
    -</span> n</span>ame</span>:</span> a</span>uthentik-postgresql</span></span>
      p</span>ersistentVolumeClaim</span>:</span></span>
        c</span>laimName</span>:</span> a</span>uthentik-postgresql</span></span>
    -</span> n</span>ame</span>:</span> a</span>uthentik-redis</span></span>
      p</span>ersistentVolumeClaim</span>:</span></span>
        c</span>laimName</span>:</span> a</span>uthentik-redis</span></span>
    -</span> n</span>ame</span>:</span> m</span>edia</span></span>
      h</span>ostPath</span>:</span></span>
        p</span>ath</span>:</span> /</span>opt/container/authentik/media</span></span>
        t</span>ype</span>:</span> D</span>irectoryOrCreate</span></span>
    -</span> n</span>ame</span>:</span> c</span>ustom-templates</span></span>
      h</span>ostPath</span>:</span></span>
        p</span>ath</span>:</span> /</span>opt/container/authentik/custom-templates</span></span>
        t</span>ype</span>:</span> D</span>irectoryOrCreate</span></span></code></pre>Authentik Proxy</h2>
---</span></span>
a</span>piVersion</span>:</span> v</span>1</span></span>
k</span>ind</span>:</span> P</span>od</span></span>
m</span>etadata</span>:</span></span>
  l</span>abels</span>:</span></span>
    a</span>pp</span>:</span> a</span>uthentik-proxy</span></span>
    i</span>o.containers.autoupdate</span>:</span> r</span>egistry</span></span>
    t</span>raefik.enable</span>:</span> true</span></span>
    t</span>raefik.docker.network</span>:</span> p</span>roxy</span></span>
    t</span>raefik.http.routers.authentik-proxy.rule</span>:</span> "</span>PathPrefix(`/outpost.goauthentik.io/`)</span>"</span></span>
    t</span>raefik.http.routers.authentik-proxy.service</span>:</span> a</span>uthentik-proxy</span></span>
    t</span>raefik.http.services.authentik-proxy.loadbalancer.server.port</span>:</span> 9000</span></span>
  n</span>ame</span>:</span> a</span>uthentik-proxy</span></span>
s</span>pec</span>:</span></span>
  c</span>ontainers</span>:</span></span>
    -</span> n</span>ame</span>:</span> m</span>ain</span></span>
      i</span>mage</span>:</span> g</span>hcr.io/goauthentik/proxy:latest</span></span>
      e</span>nv</span>:</span></span>
      -</span> n</span>ame</span>:</span> A</span>UTHENTIK_HOST</span></span>
        v</span>alue</span>:</span> h</span>ttps://auth.domain</span></span>
      -</span> n</span>ame</span>:</span> A</span>UTHENTIK_INSECURE</span></span>
        v</span>alue</span>:</span> "</span>false</span>"</span></span>
      -</span> n</span>ame</span>:</span> A</span>UTHENTIK_TOKEN</span></span>
        v</span>alue</span>:</span> "</span>"</span></span></code></pre>


Transitioning from pip Requirements to UV
2025-01-09T00:00:00+00:00
UV</a> is a fast alternative to pip. It offers better speed and performance, making it a smooth replacement. To get started, just run pip install uv to download the binary.</p>
All functions from pip are still there. Just use the command uv pip  to access them.</p>
Migrating a project</a></h2>
Let's explore how to migrate a project using requirements.txt and requirements-dev.txt files to UV.</p>
Initialize with UV</a></h2>
Begin by creating a new UV-managed project using:</p>
uv</span> init</span></span></code></pre>
This command will create a pyproject.toml</a> file. This file is a central configuration file in Python, introduced to standardize packaging and build processes.</p>
Clean up the Environment</a></h2>
To avoid using an old virtual environment, replace it by running:</p>
rm</span> -</span>r</span> .venv/</span></span>
uv</span> venv</span> &&</span> source</span> .venv/bin/activate</span></span></code></pre>Add your requirements</a></h2>
Now, add your requirements from existing files:</p>
uv</span> add</span> -</span>r</span> requirements.txt</span></span>
uv</span> add</span> -</span>-dev</span> -</span>r</span> requirements-dev.txt</span></span></code></pre>
Your pyproject.toml</code> file should now look something like this:</p>
[</span>project</span>]</span></span>
name</span> =</span> "</span>myproject</span>"</span></span>
version</span> =</span> "</span>0.1.0</span>"</span></span>
description</span> =</span> "</span>Add your description here</span>"</span></span>
readme</span> =</span> "</span>README.md</span>"</span></span>
requires-python</span> =</span> "</span>>=3.12</span>"</span></span>
dependencies</span> =</span> [</span></span>
    "</span>fastapi==0.115.7</span>"</span>,</span></span>
]</span></span>
</span>
[</span>dependency-groups</span>]</span></span>
dev</span> =</span> [</span></span>
    "</span>mypy==1.14.1</span>"</span>,</span></span>
    "</span>pre-commit==4.1.0</span>"</span>,</span></span>
]</span></span></code></pre>
With uv sync</code> dependencies are installed (or uninstalled if no longer mentioned) in a virtual environment under the .venv</code> directory.</p>
Additional Configurations</a></h2>
If your project is a package, be sure to add this:</p>
[</span>tool</span>.</span>uv</span>]</span></span>
package</span> =</span> true</span></span></code></pre>CLI Commands</a></h2>
To expose CLI commands from your project, include them in the pyproject.toml file:</p>
[</span>project</span>.</span>scripts</span>]</span></span>
my-cmd</span> =</span> "</span>my_project.cli:app</span>"</span></span></code></pre>Publish to PyPI</a></h2>
To publish your package to PyPI, you can do it manually or use automation tools like GitHub Actions or GitLab CI/CD.</p>
UV provides a packaging Guide to assist you with this: https://docs.astral.sh/uv/guides/package/</a></p>
Locally</a></h2>
Locally is quite simple, you just need the UV tool and a PyPI token.</p>
First, build your package and then publish it:</p>
uv</span> build</span></span>
</span>
uv</span> publish</span> -</span>-token</span> <</span>toke</span>n</span>></span></span></code></pre>GitHub Workflow</a></h2>
You can use the following GitHub workflow to publish a package to PyPI. It triggers the push-pypi</code> job when a tag is pushed. The version in the tag updates the pyproject.toml</code> file before building and publishing.</p>
---</span></span>
on</span>:</span></span>
  p</span>ush</span>:</span></span>
    b</span>ranches</span>:</span></span>
      -</span> "</span>*</span>"</span></span>
    t</span>ags</span>:</span></span>
      -</span> "</span>v*.*.*</span>"</span></span>
</span>
j</span>obs</span>:</span></span>
  p</span>ush-pypi</span>:</span></span>
    r</span>uns-on</span>:</span> u</span>buntu-latest</span></span>
    i</span>f</span>:</span> g</span>ithub.event_name == 'push' && startsWith(github.ref, 'refs/tags')</span></span>
    p</span>ermissions</span>:</span></span>
      c</span>ontents</span>:</span> r</span>ead</span></span>
      i</span>d-token</span>:</span> w</span>rite</span></span>
    s</span>teps</span>:</span></span>
      -</span> u</span>ses</span>:</span> a</span>ctions/checkout@v4</span></span>
      -</span> u</span>ses</span>:</span> a</span>ctions/setup-python@v5</span></span>
        w</span>ith</span>:</span></span>
          p</span>ython-version</span>:</span> '</span>3.13</span>'</span></span>
</span>
      -</span> n</span>ame</span>:</span> I</span>nstall uv</span></span>
        u</span>ses</span>:</span> a</span>stral-sh/setup-uv@v5</span></span>
</span>
      -</span> n</span>ame</span>:</span> I</span>nstall python dependencies</span></span>
        r</span>un</span>:</span> u</span>v sync --all-extras --dev</span></span>
</span>
      -</span> n</span>ame</span>:</span> S</span>et release env, replace 'v' in tag</span></span>
        r</span>un</span>:</span> e</span>cho "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" | sed "s/v//g" >> $GITHUB_ENV</span></span>
</span>
      -</span> n</span>ame</span>:</span> R</span>eplace version in pyproject.toml</span></span>
        r</span>un</span>:</span> |</span></span>
          sed -i 's/^version = "[^"]*"/version = "${{env.RELEASE_VERSION}}"/' pyproject.toml</span></span>
</span>
      -</span> n</span>ame</span>:</span> B</span>uild package</span></span>
        r</span>un</span>:</span> u</span>v build</span></span>
</span>
      -</span> n</span>ame</span>:</span> P</span>ublish package</span></span>
        r</span>un</span>:</span> u</span>v publish</span></span></code></pre>GitLab CI/CD</a></h2>
Here's a GitLab CI/CD job that runs when a tag is pushed. It updates the pyproject.toml</code> version, builds, and publishes the package to PyPI.</p>
---</span></span>
s</span>tages</span>:</span></span>
  -</span> r</span>elease</span></span>
</span>
p</span>ush_pypi</span>:</span></span>
  s</span>tage</span>:</span> r</span>elease</span></span>
  r</span>ules</span>:</span></span>
    -</span> i</span>f</span>:</span> "</span>$CI_COMMIT_TAG</span>"</span></span>
    -</span> i</span>f</span>:</span> $</span>CI_COMMIT_BRANCH</span></span>
      w</span>hen</span>:</span> n</span>ever</span></span>
  i</span>mage</span>:</span> "</span>docker.io/python:3.13-slim</span>"</span></span>
  s</span>cript</span>:</span></span>
    -</span> p</span>ip install uv</span></span>
    -</span> p</span>rojectversion=$(echo $CI_COMMIT_REF_NAME | sed 's/v//')</span></span>
    -</span> s</span>ed -i "s/^version = \".*\"/version = \"$projectversion\"/" "${CI_PROJECT_DIR}/pyproject.toml"</span></span>
    -</span> c</span>at "${CI_PROJECT_DIR}/pyproject.toml" | grep version</span></span>
    -</span> u</span>v build ${CI_PROJECT_DIR}</span></span>
    -</span> u</span>v publish --token "$PYPI_TOKEN"</span></span></code></pre>


Python Cloudflare DDNS Updater
2025-01-09T00:00:00+00:00
Using the Cloudflare API, this script updates a DNS record with the current IP address. It also sends a notification to Uptime Kuma via a webhook.</p>
import</span> requests</span></span>
import</span> argparse</span></span>
import</span> socket</span></span>
</span>
def</span> send_webhook_notification</span>(</span>webhook_url</span>,</span> status_code</span>,</span> message</span>)</span>:</span></span>
    payload</span> =</span> {</span>"</span>status</span>"</span>:</span> status_code</span>,</span> "</span>message</span>"</span>:</span> message</span>}</span></span>
    try</span>:</span></span>
        response</span> =</span> requests</span>.</span>post</span>(</span>webhook_url</span>,</span> json</span>=</span>payload</span>)</span></span>
        response</span>.</span>raise_for_status</span>(</span>)</span></span>
    except</span> requests</span>.</span>exceptions</span>.</span>RequestException</span> as</span> e</span>:</span></span>
        print</span>(</span>f</span>"</span>Failed to send webhook notification: </span>{</span>e</span>}</span>"</span>)</span></span>
</span>
def</span> get_current_ip</span>(</span>ip_type</span>)</span>:</span></span>
    if</span> ip_type</span> ==</span> "</span>ipv4</span>"</span>:</span></span>
        return</span> requests</span>.</span>get</span>(</span>"</span>https://api.ipify.org</span>"</span>)</span>.</span>text</span></span>
    elif</span> ip_type</span> ==</span> "</span>ipv6</span>"</span>:</span></span>
        return</span> requests</span>.</span>get</span>(</span>"</span>https://api6.ipify.org</span>"</span>)</span>.</span>text</span></span>
    else</span>:</span></span>
        raise</span> ValueError</span>(</span>"</span>Unsupported IP type!</span>"</span>)</span></span>
</span>
def</span> update_dns_record</span>(</span>api_token</span>,</span> zone_id</span>,</span> dns_record_id</span>,</span> ip_address</span>,</span> ip_type</span>)</span>:</span></span>
    headers</span> =</span> {</span></span>
        "</span>Authorization</span>"</span>:</span> f</span>"</span>Bearer </span>{</span>api_token</span>}</span>"</span>,</span></span>
        "</span>Content-Type</span>"</span>:</span> "</span>application/json</span>"</span></span>
    }</span></span>
    data</span> =</span> {</span></span>
        "</span>type</span>"</span>:</span> "</span>A</span>"</span> if</span> ip_type</span> ==</span> "</span>ipv4</span>"</span> else</span> "</span>AAAA</span>"</span>,</span></span>
        "</span>name</span>"</span>:</span> dns_record_id</span>,</span></span>
        "</span>content</span>"</span>:</span> ip_address</span>,</span></span>
        "</span>ttl</span>"</span>:</span> 1</span>,</span>  #</span> Automatic TTL (Time To Live)</span></span>
        "</span>proxied</span>"</span>:</span> False</span></span>
    }</span></span>
    url</span> =</span> f</span>"</span>https://api.cloudflare.com/client/v4/zones/</span>{</span>zone_id</span>}</span>/dns_records/</span>{</span>dns_record_id</span>}</span>"</span></span>
    try</span>:</span></span>
        response</span> =</span> requests</span>.</span>put</span>(</span>url</span>,</span> json</span>=</span>data</span>,</span> headers</span>=</span>headers</span>)</span></span>
        response</span>.</span>raise_for_status</span>(</span>)</span></span>
        return</span> response</span>.</span>json</span>(</span>)</span></span>
    except</span> requests</span>.</span>exceptions</span>.</span>RequestException</span> as</span> e</span>:</span></span>
        print</span>(</span>f</span>"</span>Failed to update DNS record: </span>{</span>e</span>}</span>"</span>)</span></span>
        return</span> None</span></span>
</span>
def</span> main</span>(</span>)</span>:</span></span>
    parser</span> =</span> argparse</span>.</span>ArgumentParser</span>(</span>description</span>=</span>"</span>Cloudflare DDNS Updater</span>"</span>)</span></span>
    parser</span>.</span>add_argument</span>(</span>"</span>--api-token</span>"</span>,</span> required</span>=</span>True</span>,</span> help</span>=</span>"</span>Cloudflare API token</span>"</span>)</span></span>
    parser</span>.</span>add_argument</span>(</span>"</span>--zone-id</span>"</span>,</span> required</span>=</span>True</span>,</span> help</span>=</span>"</span>Cloudflare Zone ID</span>"</span>)</span></span>
    parser</span>.</span>add_argument</span>(</span>"</span>--dns-record-id</span>"</span>,</span> required</span>=</span>True</span>,</span> help</span>=</span>"</span>Cloudflare DNS Record ID</span>"</span>)</span></span>
    parser</span>.</span>add_argument</span>(</span>"</span>--ip-type</span>"</span>,</span> choices</span>=</span>[</span>"</span>ipv4</span>"</span>,</span> "</span>ipv6</span>"</span>]</span>,</span> required</span>=</span>True</span>,</span> help</span>=</span>"</span>Type of IP (ipv4 or ipv6)</span>"</span>)</span></span>
    parser</span>.</span>add_argument</span>(</span>"</span>--webhook</span>"</span>,</span> required</span>=</span>True</span>,</span> help</span>=</span>"</span>Uptime Kuma Webhook URL</span>"</span>)</span></span>
    </span></span>
    args</span> =</span> parser</span>.</span>parse_args</span>(</span>)</span></span>
</span>
    ip_address</span> =</span> get_current_ip</span>(</span>args</span>.</span>ip_type</span>)</span></span>
    if</span> not</span> ip_address</span>:</span></span>
        send_webhook_notification</span>(</span>args</span>.</span>webhook</span>,</span> "</span>fail</span>"</span>,</span> "</span>Could not determine IP address.</span>"</span>)</span></span>
        return</span></span>
</span>
    result</span> =</span> update_dns_record</span>(</span>args</span>.</span>api_token</span>,</span> args</span>.</span>zone_id</span>,</span> args</span>.</span>dns_record_id</span>,</span> ip_address</span>,</span> args</span>.</span>ip_type</span>)</span></span>
</span>
    if</span> result</span> and</span> result</span>.</span>get</span>(</span>"</span>success</span>"</span>)</span>:</span></span>
        send_webhook_notification</span>(</span>args</span>.</span>webhook</span>,</span> "</span>success</span>"</span>,</span> "</span>DNS updated successfully.</span>"</span>)</span></span>
    else</span>:</span></span>
        send_webhook_notification</span>(</span>args</span>.</span>webhook</span>,</span> "</span>fail</span>"</span>,</span> "</span>Failed to update DNS.</span>"</span>)</span></span>
</span>
if</span> __name__</span> ==</span> "</span>__main__</span>"</span>:</span></span>
    main</span>(</span>)</span></span></code></pre>


Makefiles in projects
2024-08-22T00:00:00+00:00
Makefiles are a great way to automate tasks in a project. They are a simple way to define a set of rules to build, test, and deploy a project. In this post, we will see how to use Makefiles in a Python project.</p>
What is a Makefile?</a></h2>
Makefile is a special file containing a set of directives used to build software. It's essentially a script that helps automate common development tasks through a consistent interface.</p>

Task Automation</strong>: Define repeatable commands as simple targets</li>
Dependencies</strong>: Specify relationships between tasks</li>
Incremental Builds</strong>: Only rebuild what's necessary based on file changes</li>
Cross-platform</strong>: Works on Unix-like systems and Windows (with tools like WSL)</li>
</ul>
Basic Makefile Syntax</a></h2>
target</span>:</span> dependencies</span></span>
    commands</span></span></code></pre>

target</strong>: The name of the task</li>
dependencies</strong>: Other targets that must run first</li>
commands</strong>: The actual commands to execute (must be indented with tabs)</li>
</ul>
Python Makefile</a></h2>
Below is a comprehensive Makefile for a modern Python project using uv</a> for dependency management.</p>
PROJECT_NAME</span> :=</span> "myproject"</span></span>
</span>
#</span># Show help by default</span></span>
.DEFAULT_GOAL</span> :=</span> help</span></span>
</span>
#</span># Help target that reads from comments</span></span>
help</span>:</span></span>
 @grep</span> -E</span> '^[a-zA-Z_-]+</span>:</span>.</span>*</span>?</span>#</span># .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'</span></span>
</span>
all</span>:</span> setup lint typing test </span>#</span># Run all essential checks</span></span>
</span>
setup</span>:</span> #</span># Install dependencies and set up pre-commit</span></span>
 uv sync</span></span>
 uv run pre-commit install</span></span>
</span>
lint</span>:</span> #</span># Run code linting with ruff</span></span>
 ruff check</span></span>
</span>
format</span>:</span> #</span># Format code with ruff</span></span>
 ruff format</span></span>
</span>
typing</span>:</span> #</span># Run static type checking</span></span>
 python -m mypy . --ignore-missing-imports --exclude ".*venv.*/"</span></span>
</span>
test</span>:</span> #</span># Run unit tests with pytest</span></span>
 uv run pytest tests/ -v --cov=</span>$(</span>PROJECT_NAME</span>)</span> --cov-report=term-missing</span></span>
</span>
run</span>:</span> #</span># Run the project</span></span>
 uv run python -m </span>$(</span>PROJECT_NAME</span>)</span></span>
</span>
clean</span>:</span> #</span># Remove build artifacts and cache files</span></span>
 rm -rf build/ dist/ *.egg-info .coverage .mypy_cache .pytest_cache .ruff_cache</span></span>
</span>
build-container</span>:</span> #</span># Build container image</span></span>
 podman</span> build</span> -t</span> $(</span>PROJECT_NAME</span>)</span>:</span>test .</span></span>
</span>
run-container</span>:</span> build-container </span>#</span># Run container image</span></span>
 podman</span> run</span> --rm</span> $(</span>PROJECT_NAME</span>)</span>:</span>test</span></span>
</span>
pre-commit</span>:</span> #</span># Run pre-commit on staged files</span></span>
 uv run pre-commit run</span></span>
</span>
pre-commit-all</span>:</span> #</span># Run pre-commit on all files</span></span>
 uv run pre-commit run --all-files</span></span></code></pre>


SSH into a tmux session on a server
2024-07-25T00:00:00+00:00
When working on remote servers, loosing SSH connections can be frustrating 
Add this to your ~/.bashrc or ~/.zshrc, then simply 
  </span>        </span> </span>      </span>   }</span></span></code></p 
  From podman-compose to Kubefiles
 2024-02-02T00:00:00+00:00

and disrupt your workflow. Here's a simple bash function that automatically starts or reattaches to a tmux session when connecting to a server, while also syncing your local tmux configuration.</p> use ssht <hostname></code> to connect. Your session will persist even if your connection drops.</p> #E1E4E8); background-color: light-dark(#FFFFFF, #24292E);">function</span> ssht</span>(</span>)</span> {</span></span> local</span> tmux_config_path</span>=</span>"</span>$</span>{</span>HOME</span>}</span>/.config/tmux/tmux-server.conf</span>"</span></span> local</span> remote_tmux_config_path</span>=</span>"</span>~/.tmux.conf</span>"</span></span> #</span> copy the local tmux config file to the remote server</span></span> if</span> [[</span> -f</span> "</span>$</span>tmux_config_path</span>"</span> ]]</span>;</span> then</span></span> scp</span> "</span>$</span>tmux_config_path</span>"</span> "</span>$</span>1</span>:</span>$</span>remote_tmux_config_path</span>"</span></span> ssh</span> -</span>t</span> "</span>$</span>@</span>"</span> "</span>chmod 750 </span>$</span>remote_tmux_config_path</span>"</span></span> else</span></span> echo</span> "</span>Local tmux config file not found at </span>$</span>{</span>tmux_config_path</span>}</span>"</span></span> fi</span></span> #</span> set the window name to the host name</span></span> if</span> [</span> -n</span> "</span>$</span>TMUX</span>"</span> ]</span>;</span> then</span></span> local</span> host</span>=</span>$(</span>echo</span> "</span>$</span>@</span>"</span> |</span> awk</span> '</span>{print $NF}</span>'</span> |</span> sed</span> '</span>s/@.*//</span>'</span>)</span></span> tmux</span> rename-window</span> "</span>$</span>host</span>"</span></span> fi</span></span> #</span> ssh into the remote server and start tmux</span></span> ssh</span> -</span>t</span> "</span>$</span>@</span>"</span> "</span>tmux attach || tmux new-session</span>"</span></span> re>

Kubefiles provide a powerful way to define and manage podman pods and containers in a single configuration file. One of their key advantages is their compatibility with Kubernetes.</p>
Deploy your compose file</a></h2>

Start your containers using podman-compose:</li>
</ol>
podman-compose</span> up</span> -</span>d</span></span></code></pre>

Verify deployment:</li>
</ol>
podman</span> pod</span> ls</span>    #</span> Check pod status</span></span>
podman</span> ps</span>        #</span> Check container status</span></span></code></pre>Generate the Kubefile</a></h2>
Once your pod is running, generate the Kubefile:</p>
podman</span> kube</span> generate</span> <</span>pod_nam</span>e</span>></span> -</span>f</span> kube.yaml</span></span></code></pre>
Replace <pod_name></code> with your actual pod name from podman pod ls.</p>
The generated file includes:</p>

Pod specifications</li>
Container configurations</li>
Volume mappings</li>
Network settings</li>
Resource limits</li>
</ul>
Start the Kubefile</a></h2>
The following command will start the pod using the Kubefile, the already running containers will be replaced by the new ones defined in the Kubefile:</p>
podman</span> kube</span> play</span> -</span>-replace</span> -</span>-service-container=true</span> -</span>-network=podman</span> /path/to/kube.yaml</span></span></code></pre>
Parameters explained:

--replace</code>: Replaces existing containers

--service-container=true</code>: Creates service containers

--network=podman</code>: Uses the podman default network</p>
Validate the deployment</a></h2>
podman</span> pod</span> ls</span>    #</span> Check pod status</span></span>
podman</span> ps</span>        #</span> Check container status</span></span></code></pre>


Running Podman Kubefiles at Startup with Systemd & Quadlets
2024-02-01T00:00:00+00:00
Podman Quadlets provide a modern approach to managing containers as systemd services. This integration allows for better container lifecycle management and automated startup on boot. Unlike traditional container management methods, Quadlets offer a more standardized and system-integrated way to handle containers.</p>
What are Quadlets?</a></h2>
Quadlets are configuration files that define how containers should run as systemd services. They combine the simplicity of systemd unit files with Podman's container management capabilities, offering:</p>

Automatic container startup on system boot</li>
Integrated logging with journald</li>
Dependency management through systemd</li>
Clean service management interface</li>
</ul>
Pre-requisites</a></h2>

Podman installed on your system</li>
systemd as init system</li>
Basic understanding of systemd services</li>
</ul>
When using rootless podman, you need to create a specific directory structure:</p>
mkdir</span> -</span>p</span> ~/.config/containers/systemd</span></span></code></pre>
With rootfull podman the directory is under /etc/containers/systemd</code>.</p>
This directory will store your Quadlet configuration files.</p>
Implementing Quadlets</a></h2>
Quadlet files for Pods must follow these rules:</p>

File extension must be .kube</li>
Located in ~/.config/containers/systemd</li>
Follow systemd unit file syntax</li>
</ul>
Here's an example Quadlet configuration for running Home Assistant:</p>
[</span>Install</span>]</span></span>
WantedBy</span>=</span>default.target</span></span>
</span>
[</span>Unit</span>]</span></span>
Description</span>=</span>Home Assistant Container</span></span>
After</span>=</span>network-online.target</span></span>
</span>
[</span>Kube</span>]</span></span>
Yaml</span>=</span>/opt/container/homeassistant/kube.yaml</span></span>
Network</span>=</span>proxy</span></span>
</span>
[</span>Service</span>]</span></span>
Restart</span>=</span>always</span></span>
TimeoutStartSec</span>=</span>900</span></span></code></pre>

[Install]: Defines when the service should start</li>
[Unit]: Contains metadata and dependencies</li>
[Kube]: Specifies the Kubernetes YAML file location</li>
[Service]: Defines service behavior</li>
</ol>
All the options for the quadlet file can be found in the podman documentation</a>.</p>
Managing Quadlets</a></h2>
Starting the Service</a></h2>
After creating your Quadlet file, enable and start the service:</p>
#</span># Reload systemd to recognize new service</span></span>
systemctl</span> -</span>-user</span> daemon-reload</span></span>
</span>
#</span># Start the service</span></span>
systemctl</span> -</span>-user</span> start</span> homeassistant</span></span></code></pre>Monitoring and Troubleshooting</a></h2>
View container logs using either Podman or systemd:</p>
#</span># View status of systemd service</span></span>
systemctl</span> -</span>-user</span> status</span> -</span>u</span> homeassistant</span></span>
</span>
#</span># View container logs through Podman</span></span>
podman</span> pod</span> logs</span> homeassistant</span></span>
</span>
#</span># View service logs through systemd</span></span>
journalctl</span> -</span>-user</span> -</span>u</span> homeassistant</span></span></code></pre>


Network scanning to fileshare with CanonScan 5600F
2023-06-26T00:00:00+00:00
We had an old CanonScan 5600F scanner lying around and wanted to have scanning to a fileshare on a button press.</p>
With a raspberry pi connected via usb to the scanner, scanbd and a little script we were able to achieve this.</p>


</div>
Required Packages</a></h2>
We need to to install the scanbd (Scanner Button Daemon) to act on button press.
Additionally we need the sane packages to detect the scanner.</p>
sudo</span> apt</span> install</span> sane</span> sane-utils</span> sanebd</span></span></code></pre>Configuration</a></h2>
Copy the sane configuration to the scanbd configuration.</p>
cp</span> -</span>r</span> /etc/sane.d/</span>*</span> /etc/scanbd/sane.d/</span></span></code></pre>
Modify /etc/sane.d/dll.conf</code> so that only net</code> is used and not commented out.</p>
#</span> genesys</span></span>
net</span></span>
#</span> canon</span></span></code></pre>
Test if the scanner is detected</p>
root@scanner:/opt/insaned#</span> SANE_CONFIG_DIR=/etc/scanbd</span> scanimage</span> -</span>L</span></span>
device</span> '</span>genesys:libusb:001:004</span>'</span> is</span> a</span> Canon</span> CanoScan</span> 5600F</span> flatbed</span> scanner</span></span></code></pre>Start & enable the scanbd service</a></h3>
sudo</span> systemctl</span> enable</span> -</span>-now</span> scanbd</span></span>
sudo</span> systemctl</span> enable</span> scanbd</span></span></code></pre>Edit the button configuration</a></h3>
/etc/scanbd/scanbd.conf</code></p>
The scan</code> action runs a the script. The path of the script or the content can be changed.</p>
action</span> scan</span> {</span></span>
        filter</span> =</span> "</span>^scan.*</span>"</span></span>
        numerical-trigger</span> {</span></span>
               from-value</span> =</span> 1</span></span>
               to-value</span>   =</span> 0</span></span>
               }</span></span>
        desc</span>   =</span> "</span>Scan to file</span>"</span></span>
        script</span> =</span> "</span>/usr/local/bin/scan-to-share</span>"</span></span>
       }</span></span></code></pre>
At the bottom</p>
#</span> devices</span></span>
#</span> each device can have actions and functions, you can disable not relevant devices</span></span>
include(scanner.d/canon.conf</span>)</span></span></code></pre>Debugging</a></h2>
systemctl</span> stop</span> scanbd</span></span>
SANE_CONFIG_DIR</span>=</span>/</span>e</span>t</span>c</span>/</span>s</span>c</span>a</span>n</span>b</span>d</span> scanbd</span> -</span>f</span></span></code></pre>
More verbose:</p>
systemctl</span> stop</span> scanbd</span></span>
SANE_CONFIG_DIR</span>=</span>/</span>e</span>t</span>c</span>/</span>s</span>c</span>a</span>n</span>b</span>d</span> scanbd</span> -</span>f</span> -</span>d7</span></span></code></pre>Scan script</a></h2>
#!</span>/usr/bin/env bash</span></span>
set</span> -</span>xeo</span> pipefail</span></span>
</span>
log_file</span>=</span>"</span>/var/scans/scan.log</span>"</span></span>
echo</span> "</span>Starting script</span>"</span> |</span> tee</span> -</span>a</span> "</span>$</span>log_file</span>"</span></span>
</span>
#</span> Set the image scanning parameters</span></span>
resolution</span>=</span>3</span>0</span>0</span></span>
file_ending</span>=</span>j</span>p</span>g</span></span>
format</span>=</span>j</span>p</span>e</span>g</span></span>
mode</span>=</span>c</span>o</span>l</span>o</span>r</span></span>
</span>
file_data</span>=</span>$(</span>date</span> +</span>'</span>%Y_%m_%d-%H_%M_%S</span>'</span>)</span></span>
filename</span>=</span>"</span>$</span>file_data</span>.</span>$</span>file_ending</span>"</span></span>
temp_path</span>=</span>"</span>/tmp/</span>$</span>filename</span>"</span></span>
dest_path</span>=</span>"</span>/var/scans/scanned/</span>$</span>file_data</span>.pdf</span>"</span></span>
</span>
echo</span> "</span>Destination path </span>\"</span>$</span>dest_path</span>\"</span>"</span> |</span> tee</span> -</span>a</span> "</span>$</span>log_file</span>"</span></span>
echo</span> "</span>Starting scan with resolution </span>$</span>resolution</span>, format </span>$</span>format</span> & mode </span>$</span>mode</span>"</span> |</span> tee</span> -</span>a</span> "</span>$</span>log_file</span>"</span></span>
</span>
export</span> SANE_CONFIG_DIR</span>=</span>/</span>etc</span>/</span>scanbd</span></span>
scanimage</span> -</span>-format</span> "</span>$</span>format</span>"</span> -</span>-resolution=</span>"</span>$</span>resolution</span>"</span> -</span>-mode</span> "</span>$</span>mode</span>"</span> -</span>v</span> -</span>p</span> ></span> "</span>$</span>temp_path</span>"</span></span>
img2pdf</span> "</span>$</span>temp_path</span>"</span> -</span>o</span> "</span>$</span>dest_path</span>"</span></span>
rm</span> "</span>$</span>temp_path</span>"</span></span>
chmod</span> 777</span> "</span>$</span>dest_path</span>"</span></span></code></pre>OCR Script</a></h2>
We want to seperate the scanning script with the ocr script, because scanbd runs the scan script until it is finsihed, before it can run the next script. While it is running, the scanner is blocked.</p>
Create a file at /usr/local/bin/scan-ocr</code>.</p>
#!</span>/usr/bin/env bash</span></span>
set</span> -</span>xeo</span> pipefail</span></span>
</span>
log_file</span>=</span>"</span>/var/scans/ocr.log</span>"</span></span>
local_scans_dir</span>=</span>"</span>/var/scans/scanned</span>"</span></span>
local_ocr_dir</span>=</span>"</span>/var/scans/ocr</span>"</span></span>
tesseract_language</span>=</span>"</span>deu</span>"</span></span>
</span>
if</span> [</span> !</span> -d</span> "</span>$</span>local_scans_dir</span>"</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Error: Local scans directory </span>$</span>local_scans_dir</span> does not exist.</span>"</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
if</span> [</span> !</span> -d</span> "</span>$</span>local_ocr_dir</span>"</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Error: Local OCR directory </span>$</span>local_ocr_dir</span> does not exist.</span>"</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
ls</span> -</span>la</span> "</span>$</span>local_scans_dir</span>"</span></span>
</span>
for</span> file</span> in</span> "</span>$</span>local_scans_dir</span>"</span>/</span>*</span>.</span>p</span>d</span>f</span>;</span> do</span></span>
  name</span>=</span>$(</span>basename</span> "</span>$</span>file</span>"</span>)</span></span>
  new_path</span>=</span>"</span>$</span>local_ocr_dir</span>/</span>$</span>name</span>"</span></span>
  if</span> !</span> [</span> -f</span> "</span>$</span>new_path</span>"</span> ]</span>;</span> then</span></span>
    echo</span> "</span>Starting OCR on </span>$</span>file</span> to </span>$</span>new_path</span>"</span> |</span> tee</span> -</span>a</span> "</span>$</span>log_file</span>"</span></span>
    ocrmypdf</span> -</span>l</span> "</span>$</span>tesseract_language</span>"</span> -</span>-force-ocr</span> "</span>$</span>file</span>"</span> "</span>$</span>new_path</span>"</span> &&</span> rm</span> "</span>$</span>file</span>"</span></span>
  fi</span></span>
done</span></span></code></pre>systemd Service and Timer</a></h3>
To run the ocr script periodically, we can use a systemd timer.</p>
Service</a></h4>
Create a new service file at /etc/systemd/system/scan-ocr.service</code></p>
[</span>Unit</span>]</span></span>
Description</span>=</span>OCR for Scans</span></span>
</span>
[</span>Service</span>]</span></span>
Type</span>=</span>simple</span></span>
ExecStart</span>=</span>/usr/local/bin/scan-ocr</span></span></code></pre>Timer / Cron</a></h4>
Create a new timer file at /etc/systemd/system/scan-ocr.timer:</p>
[</span>Unit</span>]</span></span>
Description</span>=</span>Runs the OCR every minute</span></span>
</span>
[</span>Timer</span>]</span></span>
OnBootSec</span>=</span>1min</span></span>
OnUnitActiveSec</span>=</span>1min</span></span>
</span>
[</span>Install</span>]</span></span>
WantedBy</span>=</span>timers.target</span></span></code></pre>
Enable & Start the timer</p>
sudo</span> systemctl</span> daemon-reload</span></span>
sudo</span> systemctl</span> enable</span> -</span>-now</span> scan-ocr.timer</span></span></code></pre>Verify</a></h3>
sudo</span> systemctl</span> status</span> scan-ocr.timer</span></span>
sudo</span> systemctl</span> status</span> scan-ocr.service</span></span></code></pre>
To manually start or stop the orc service sudo systemctl start scan-ocr.service</code> can be used.</p>
Access the logs with journalctl -u scan-ocr</code></p>


A Simple Way to Switch Kubeconfig Files with kswitch
2023-01-09T00:00:00+00:00
If you work with multiple Kubernetes clusters, you probably have several kubeconfig</code> files. Switching between them can be a pain. This post shows you a simple script that uses fzf</code> (a command-line fuzzy finder) to make switching between your kubeconfig</code> files fast and easy.</p>
What You Need</h2>
Make sure you have these two tools installed:</p>

kubectl</a>: The command-line tool for Kubernetes.</li>
fzf</a>: A tool for quickly searching for things on the command line.</li>
</ul>
The Script</h2>
Save the following script in a file. A good name for it is kswitch</code> in your home directory (~/kswitch</code>).</p>
#!</span>/usr/bin/env bash</span></span>
</span>
SEARCH_PATH</span>=</span>"</span>$</span>HOME</span>/.kube/</span>"</span></span>
IGNORE_LIST</span>=</span>(</span>)</span></span>
</span>
ignore</span>=</span>(</span>)</span></span>
for</span> i</span> in</span> "</span>$</span>{</span>IGNORE_LIST</span>[</span>@</span>]</span>}</span>"</span>;</span> do</span></span>
    ignore</span>+=</span>(</span>"</span>!</span>"</span> "</span>-path</span>"</span> "</span>$</span>i</span>"</span>)</span></span>
done</span></span>
</span>
if</span> [[</span> $</span>#</span> -eq</span> 1</span> ]]</span>;</span> then</span></span>
    selected</span>=</span>"</span>$</span>1</span>"</span></span>
else</span></span>
    files</span>=</span>$(</span>find</span> "</span>$</span>SEARCH_PATH</span>"</span> -</span>mindepth</span> 1</span> -</span>maxdepth</span> 1</span> -</span>name</span> '</span>*config*</span>'</span> -</span>type</span> f</span> "</span>$</span>{</span>ignore</span>[</span>@</span>]</span>}</span>"</span> 2</span>></span>/dev/null</span>)</span></span>
    selected</span>=</span>$(</span>fzf-tmux</span> -</span>p</span> 85%</span> -</span>-reverse</span> -</span>-preview</span> '</span>cat {}</span>'</span> <<<</span>"</span>$</span>{</span>files</span>[</span>@</span>]</span>}</span>"</span> |</span> sort</span> -</span>u</span>)</span></span>
fi</span></span>
</span>
if</span> [[</span> -z</span> "</span>$</span>selected</span>"</span> ]]</span>;</span> then</span></span>
    echo</span> "</span>No kubeconfig selected.</span>"</span></span>
    exit</span> 0</span></span>
fi</span></span>
</span>
export</span> KUBECONFIG</span>=</span>"</span>$</span>selected</span>"</span></span>
export</span> KUBE_CONFIG_PATH</span>=</span>"</span>$</span>selected</span>"</span></span>
</span>
selected_name</span>=</span>$(</span>basename</span> "</span>$</span>selected</span>"</span> |</span> tr</span> .</span> _</span>)</span></span>
echo</span> "</span>Selected kubeconfig: </span>$</span>selected_name</span>"</span></span>
</span>
contexts</span>=</span>$(</span>kubectl</span> config</span> get-contexts</span> -</span>-kubeconfig=</span>"</span>$</span>selected</span>"</span> -</span>o</span> name</span>)</span></span>
</span>
if</span> [[</span> -z</span> "</span>$</span>contexts</span>"</span> ]]</span>;</span> then</span></span>
    echo</span> "</span>No contexts found in </span>$</span>selected</span>!</span>"</span></span>
    exit</span> 1</span></span>
fi</span></span>
</span>
context_count</span>=</span>$(</span>echo</span> "</span>$</span>contexts</span>"</span> |</span> wc</span> -</span>l</span>)</span></span>
</span>
if</span> [[</span> "</span>$</span>context_count</span>"</span> -eq</span> 1</span> ]]</span>;</span> then</span></span>
    selected_context</span>=</span>"</span>$</span>contexts</span>"</span></span>
    echo</span> "</span>Automatically selecting the only available context: </span>$</span>selected_context</span>"</span></span>
else</span></span>
    selected_context</span>=</span>$(</span>echo</span> "</span>$</span>contexts</span>"</span> |</span> fzf-tmux</span> -</span>p</span> 60%</span> -</span>-reverse</span>)</span></span>
    if</span> [[</span> -z</span> "</span>$</span>selected_context</span>"</span> ]]</span>;</span> then</span></span>
        echo</span> "</span>No context selected.</span>"</span></span>
        exit</span> 0</span></span>
    fi</span></span>
fi</span></span>
</span>
kubectl</span> config</span> use-context</span> "</span>$</span>selected_context</span>"</span> -</span>-kubeconfig=</span>"</span>$</span>selected</span>"</span></span></code></pre>How to Set It Up</h2>
To make the script work, you need to create an alias</code>. An alias is a shortcut for a longer command.</p>
Add this line to your shell startup file (either ~/.bashrc</code> or ~/.zshrc</code>):</p>
alias</span> kswitch</span>=</span>'</span>source ~/kswitch</span>'</span></span></code></pre>
Why source</code>?</strong> The source</code> command runs the script in your current terminal session. This is important because it allows the script to set the KUBECONFIG</code> environment variable for you.</p>
After adding the alias, reload your shell by closing and reopening your terminal or by running source ~/.bashrc</code> (or source ~/.zshrc</code>).</p>
How to Use It</h2>

Run kswitch</code> in your terminal. A menu will appear, letting you choose a kubeconfig file and then a context.</li>
You can also run kswitch /path/to/your/kubeconfig</code> to select a specific file directly.</li>
</ul>

Flush DNS Cache</a></h3>
If you need to clear the DNS cache:</p>
`sudo</span> resolvectl</span> flush-caches</span></span></code></pre>`

Publish to PyPI</a></h2>
To publish your package to PyPI, you can do it manually or use automation tools like GitHub Actions or GitLab CI/CD.</p>
UV provides a packaging Guide to assist you with this: https://docs.astral.sh/uv/guides/package/</a></p>

`How to Use It</h2> Run kswitch</code> in your terminal. A menu will appear, letting you choose a kubeconfig file and then a context.</li> You can also run kswitch /path/to/your/kubeconfig</code> to select a specific file directly.</li> </ul>`

chaops

Managing DNS Records with deSEC.io and Terraform

Why deSEC.io?</a></h2>
deSEC</a> is a free, non-profit DNS hosting service based in Germany. It supports DNSSEC out of the box and has a clean REST API.</p>

Running TeamSpeak 6 Server with Podman Rootless & Auto-Updates

Running systemd-resolved to cache DNS queries with NetworkManager

Using Podman Quadlets for Dynamic DNS with desec.io

Python Cloudflare TTL Changer

Podman hoarder kubefile with traefik

Podman authentik kubefile with traefik

Transitioning from pip Requirements to UV

Python Cloudflare DDNS Updater

Makefiles in projects

SSH into a tmux session on a server

From podman-compose to Kubefiles

`Validate the deployment</a></h2> podman</span> pod</span> ls</span> #</span> Check pod status</span></span> podman</span> ps</span> #</span> Check container status</span></span></code></pre>`

Running Podman Kubefiles at Startup with Systemd & Quadlets

Network scanning to fileshare with CanonScan 5600F

A Simple Way to Switch Kubeconfig Files with kswitch

chaops

Managing DNS Records with deSEC.io and Terraform

Running TeamSpeak 6 Server with Podman Rootless & Auto-Updates

Running systemd-resolved to cache DNS queries with NetworkManager

Using Podman Quadlets for Dynamic DNS with desec.io

Python Cloudflare TTL Changer

Podman hoarder kubefile with traefik

Podman authentik kubefile with traefik

Transitioning from pip Requirements to UV

Python Cloudflare DDNS Updater

Makefiles in projects

Basic Makefile Syntax</a></h2> target</span>:</span> dependencies</span></span> commands</span></span></code></pre> target</strong>: The name of the task</li> dependencies</strong>: Other targets that must run first</li>

SSH into a tmux session on a server

From podman-compose to Kubefiles

Running Podman Kubefiles at Startup with Systemd & Quadlets

Pre-requisites</a></h2> Podman installed on your system</li> systemd as init system</li>

Implementing Quadlets</a></h2> Quadlet files for Pods must follow these rules:</p> File extension must be .kube</li> Located in ~/.config/containers/systemd</li>

Network scanning to fileshare with CanonScan 5600F

A Simple Way to Switch Kubeconfig Files with kswitch

How to Use It</h2> Run kswitch</code> in your terminal. A menu will appear, letting you choose a kubeconfig file and then a context.</li> You can also run kswitch /path/to/your/kubeconfig</code> to select a specific file directly.</li> </ul>

`How to Use It</h2> Run kswitch</code> in your terminal. A menu will appear, letting you choose a kubeconfig file and then a context.</li> You can also run kswitch /path/to/your/kubeconfig</code> to select a specific file directly.</li> </ul>`