Andrei Telteu

How to configure Headscale and Traefik to proxy any service

Sat, 25 Jan 2025 20:04:00 +0200

Andrei Telteu https://telteu.ro/posts/headscale-with-traefik/ -

Requirements:

a linux server with a public IPv4 address
docker and docker compose installed
a domain/subdomain with a A DNS record pointing to your IP

I will use example.com as the domain name in this example, please replace it with your domain/subdomain.

Traefik

Ssh to your public server where you want to host your vpn, make a folder called traefik with the following files: mkdir traefik && cd traefik

1. An empty `letsencrypt` folder: `mkdir letsencrypt`

2. An empty file `touch dynamic.yml` (for future expansion)

3. The static config: `nano static.yml`

 1api:
 2 insecure: true
 3 dashboard: true
 4
 5providers:
 6 docker:
 7 exposedByDefault: false
 8
 9entryPoints:
10 web:
11 address: ":80"
12 http2:
13 maxConcurrentStreams: 250 # fix for network error on the proxy to my immich instance
14 http3:
15 advertisedPort: 443
16 # http:
17 # redirections:
18 # entryPoint:
19 # to: websecure
20 # scheme: https
21 forwardedHeaders:
22 trustedIPs:
23 - 10.0.0.0/8
24 - 172.16.0.0/12
25 - 192.168.0.0/16
26 - fc00::/7
27 proxyProtocol:
28 trustedIPs:
29 - 10.0.0.0/8
30 - 172.16.0.0/12
31 - 192.168.0.0/16
32 - fc00::/7
33 websecure:
34 address: ":443"
35 http2:
36 maxConcurrentStreams: 250 # fix for network error on the proxy to my immich instance
37 http3:
38 advertisedPort: 443
39 forwardedHeaders:
40 trustedIPs:
41 - 10.0.0.0/8
42 - 172.16.0.0/12
43 - 192.168.0.0/16
44 - fc00::/7
45 proxyProtocol:
46 trustedIPs:
47 - 10.0.0.0/8
48 - 172.16.0.0/12
49 - 192.168.0.0/16
50 - fc00::/7
51
52certificatesResolvers:
53 myresolver:
54 acme:
55 email: "your-email-goes-here@tutorial.example"
56 storage: "/letsencrypt/acme.json"
57 httpChallenge:
58 entryPoint: web

Replace your-email-goes-here@tutorial.example with your email address. Let’s Encrypt send you notifications when your ssl certificate expires.

4. The docker compose config: `nano compose.yml`

 1services:
 2
 3 traefik:
 4 image: "traefik:v3.2"
 5 container_name: "traefik"
 6 restart: "always"
 7 ports:
 8 - "80:80"
 9 - "443:443"
10 networks:
11 - pub
12 volumes:
13 - "./letsencrypt:/letsencrypt"
14 - "/var/run/docker.sock:/var/run/docker.sock:ro"
15 - "./static.yml:/etc/traefik/traefik.yml:ro"
16 - "./dynamic.yml:/etc/traefik/dynamic.yaml:ro"
17 labels:
18 - "traefik.enable=true"
19 - "traefik.http.routers.dashboard.rule=Host(`example.com`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api/overview`) || PathPrefix(`/api/version`) || PathPrefix(`/api/http`) || PathPrefix(`/api/entrypoints`) || PathPrefix(`/api/tcp`) || PathPrefix(`/api/udp`))"
20 - "traefik.http.routers.dashboard.entrypoints=websecure"
21 - "traefik.http.routers.dashboard.tls.certresolver=myresolver"
22 - "traefik.http.routers.dashboard.service=api@internal"
23 # # if you want to password protect your traefik dashboard uncomment the following and change the user:pass
24 #- "traefik.http.routers.dashboard.middlewares=auth"
25 #- "traefik.http.middlewares.auth.basicauth.users=" # to create user and pass: bash -c 'echo $(htpasswd -nB admin) | sed -e s/\\$/\\$\\$/g'
26
27networks:
28 pub:
29 external: true

Create the pub network first using the command docker network create pub

Now we can start the traefik instance: docker compose up -d

HeadScale

Let’s make a separate folder for headscale: cd .. && mkdir headscale

1. 2 empty folders: `mkdir data && mkdir tailscale-client`

2. The headscale config: `nano config.yml`

 1---
 2# The url clients will connect to.
 3server_url: https://example.com
 4
 5# Address to listen to / bind to on the server
 6listen_addr: 0.0.0.0:8080
 7
 8# Address to listen to /metrics, you may want
 9metrics_listen_addr: 127.0.0.1:9090
 10
 11# Address to listen for gRPC.
 12grpc_listen_addr: 127.0.0.1:50443
 13
 14# Allow the gRPC admin interface to run in INSECURE mode.
 15grpc_allow_insecure: false
 16
 17noise:
 18 # The Noise private key is used to encrypt the traffic
 19 private_key_path: /var/lib/headscale/noise_private.key
 20
 21# List of IP prefixes to allocate tailaddresses from.
 22# Each prefix consists of either an IPv4 or IPv6 address,
 23prefixes:
 24 v6: fd7a:115c:a1e0::/48
 25 v4: 100.64.0.0/10
 26 # Strategy used for allocation of IPs to nodes, available options:
 27 # - sequential (default): assigns the next free IP from the previous given IP.
 28 # - random: assigns the next free IP from a pseudo-random IP generator (crypto/rand).
 29 allocation: sequential
 30
 31# DERP is a relay system that Tailscale uses when a direct connection cannot be established.
 32derp:
 33 server:
 34 enabled: false
 35 # Region ID to use for the embedded DERP server.
 36 region_id: 999
 37 region_code: "headscale"
 38 region_name: "Headscale Embedded DERP"
 39 # Listens over UDP at the configured address for STUN connections - to help with NAT traversal.
 40 stun_listen_addr: "0.0.0.0:3478"
 41 # Private key used to encrypt the traffic between headscale DERP and Tailscale clients.
 42 private_key_path: /var/lib/headscale/derp_server_private.key
 43 # This flag can be used, so the DERP map entry for the embedded DERP server is not written automatically,
 44 automatically_add_embedded_derp_region: true
 45 # For better connection stability (especially when using an Exit-Node and DNS is not working),
 46 ipv4: 1.2.3.4
 47 ipv6: 2001:db8::1
 48 # List of externally available DERP maps encoded in JSON
 49 urls:
 50 - https://controlplane.tailscale.com/derpmap/default
 51 # Locally available DERP map files encoded in YAML
 52 paths: []
 53 # If enabled, a worker will be set up to periodically refresh the given sources and update the derpmap
 54 auto_update_enabled: true
 55 # How often should we check for DERP updates?
 56 update_frequency: 24h
 57# Disables the automatic check for headscale updates on startup
 58disable_check_updates: false
 59# Time before an inactive ephemeral node is deleted?
 60ephemeral_node_inactivity_timeout: 30m
 61database:
 62 type: sqlite
 63 # Enable debug mode. This setting requires the log.level to be set to "debug" or "trace".
 64 debug: false
 65 gorm:
 66 prepare_stmt: true
 67 parameterized_queries: true
 68 skip_err_record_not_found: true
 69 slow_threshold: 1000
 70 sqlite:
 71 path: /var/lib/headscale/db.sqlite
 72 write_ahead_log: true
 73
 74 ### TLS configuration Let's encrypt / ACME
 75acme_url: https://acme-v02.api.letsencrypt.org/directory
 76acme_email: "your-email-goes-here@tutorial.example"
 77tls_letsencrypt_hostname: ""
 78# Path to store certificates and metadata needed by letsencrypt
 79tls_letsencrypt_cache_dir: /var/lib/headscale/cache
 80
 81# Type of ACME challenge to use, currently supported types: HTTP-01 or TLS-ALPN-01
 82tls_letsencrypt_challenge_type: HTTP-01
 83# When HTTP-01 challenge is chosen, letsencrypt must set up a verification endpoint, and it will be listening on:
 84tls_letsencrypt_listen: ":http" # :http = port 80
 85tls_cert_path: ""
 86tls_key_path: ""
 87
 88log:
 89 format: text # text or json
 90 level: info
 91
 92policy:
 93 mode: file
 94 path: ""
 95
 96dns:
 97 magic_dns: true
 98 # Defines the base domain to create the hostnames for MagicDNS.
 99 base_domain: head.local
100 nameservers:
101 global:
102 - 1.1.1.1
103 - 1.0.0.1
104 - 2606:4700:4700::1111
105 - 2606:4700:4700::1001
106 split: {}
107 search_domains: []
108 # Extra DNS records
109 extra_records: []
110
111unix_socket: /var/run/headscale/headscale.sock
112unix_socket_permission: "0770"
113logtail:
114 # Enable logtail for this headscales clients.
115 enabled: false
116# Enabling this option makes devices prefer a random port for WireGuard traffic over the default static port 41641.
117randomize_client_port: false

It’s the default config, I removed some comments and replaced server_url, acme_email and the base_domain from dns section. This last config is the Magic DNS that headscale uses to create a DNS entry for every device you connect to your tailscale vpn.

3. The docker compose config: `nano compose.yml`

 1services:
 2
 3 headscale:
 4 container_name: headscale
 5 image: headscale/headscale
 6 command: serve
 7 restart: always
 8 ports:
 9 - "8080:8080"
10 networks:
11 - pub
12 volumes:
13 - "./data:/var/lib/headscale"
14 - "./config.yml:/etc/headscale/config.yaml"
15 cap_add:
16 - NET_ADMIN
17 - SYS_MODULE
18 sysctls:
19 - net.ipv4.ip_forward=1
20 - net.ipv4.conf.all.src_valid_mark=1
21 labels:
22 - "traefik.enable=true"
23 - "traefik.http.routers.headscale.rule=Host(`example.com`)"
24 - "traefik.http.routers.headscale.entrypoints=websecure"
25 - "traefik.http.routers.headscale.tls.certresolver=myresolver"
26 - "traefik.http.services.headscale.loadbalancer.server.port=8080"
27
28 headplane:
29 container_name: headplane
30 image: ghcr.io/tale/headplane:0.3.2
31 restart: unless-stopped
32 ports:
33 - '3000:3000'
34 networks:
35 - pub
36 depends_on:
37 - headscale
38 volumes:
39 - "./config.yml:/etc/headscale/config.yaml"
40 environment:
41 HEADSCALE_URL: 'http://headscale:8080'
42 API_KEY: ""
43 CONFIG_FILE: "/etc/headscale/config.yaml"
44 COOKIE_SECRET: 'put-some-random-string-here-32j564b64kl6n34lk'
45 DISABLE_API_KEY_LOGIN: 'true'
46 COOKIE_SECURE: 'false'
47 HOST: '0.0.0.0'
48 PORT: '3000'
49 labels:
50 - "traefik.enable=true"
51 - "traefik.http.routers.headplane.rule=Host(`example.com`) && PathPrefix(`/admin`)"
52 - "traefik.http.routers.headplane.entrypoints=websecure"
53 - "traefik.http.routers.headplane.tls.certresolver=myresolver"
54 - "traefik.http.services.headplane.loadbalancer.server.port=3000"
55 #- "traefik.http.routers.headplane.middlewares=auth" # uncomment this only if you generated a password in traefik step 4
56
57 # client:
58 # container_name: tailscale-client
59 # image: tailscale/tailscale
60 # restart: unless-stopped
61 # environment:
62 # - "TS_AUTHKEY="
63 # - "TS_STATE_DIR=/var/lib/tailscale"
64 # - "TS_USERSPACE=false"
65 # - "TS_EXTRA_ARGS=--login-server=https://example.com --advertise-exit-node --hostname=server-client --shields-up=false"
66 # networks:
67 # - pub
68 # volumes:
69 # - "./tailscale-client:/var/lib/tailscale"
70 # - "/dev/net/tun:/dev/net/tun"
71 # cap_add:
72 # - net_admin
73 # - sys_module
74
75networks:
76 pub:
77 external: true

We can start headscale now: docker compose up -d

- https://telteu.ro/posts/headscale-with-traefik/ - Andrei Telteu 2024

Should you self-host open-source services or pay for hosted versions ?

Fri, 22 Nov 2024 00:04:22 +0000

Andrei Telteu https://telteu.ro/posts/selfhost-vs-hosted-saas/ -

Featured image by ChatGPT/DALL-E

I was watching this video on using a paid hosted version of an open-source software instead of self-hosting it:

There are both benefits and risks to each approach that you should take in consideration when you make a choice like this.

This also depends on how this service affects your business:

A. If this service is critical to your business: (like for example the in browser IDE that the above video mentions for his e-learning platform)

you should self host if possible.
you should know the ins and outs of. Gain as much knowledge as you can.
you should spend as much time as needed for this integration to be frictionless and perfect.

Arguments:

This is the core of your business ! It should be the feature that differentiates you from any other competitor.
If something goes wrong and you have to change this service, there will be a very high impact on your customers. Maybe you can’t find a good enough alternative, or one with the same features/customizations. The vendor lock-in here has a high impact.
You are free to change/improove any of the features of said service given enough dev time and a permissive code license.

B. If the service is not critical: (like your support ticket system, chat support, invoicing system, payment provider, knowledge base, blog, license management, etc)

you should use a hosted version / Software As A Service / external solution.
you should spend as little time as needed.

Arguments:

It it not the core of your business, it does not matter that much.
If something goes wrong and you have to change this service there will be very little impact on your customers. Many of them won’t even notice. If you can’t find an alternative with the same features, it doesn’t matter that much.

The risks involved for hosted versions / SaaS

I want to present to you some scenarios in which the hosted version can affect your startup:

The external company can go bankrupt and you have to migrate off it as quick as possible.
You don’t know their financial situation.
The external company can focus on a new product and deprecate / stop support for your version.
You don’t know their roadmap.
When you evolve and want to add/improve a feature you are limited to the customization provider and the external prover’s willingness to work with you to change something for you.
This can change over time as you grow or your external provider grows.
The external company can shift its focus on enterprise and increase prices overnight by 100x.
You don’t know their leadership.
For example this 120k$ forced bill from CloudFlare ( ThePrimeagen video here )
The external company can get hacked and your customers data can be leaked. Even if the external service does not host any of your customers data, if they get hacked, the bad actor can modify the service to steal customers data without you taking any action (like upgrading a npm dependency like in the case of a supply chain attack).
You don’t know the security measures that all your external services apply to their business.
When the external provider of one of your CORE features has an outage, you have an outage that you can’t do anything about.

The benefits of Self-Hosting !

When you need a feature/customization that is not supported by your external solution: you just fork it and invest dev time into it. (If the license supports it)
When something breaks, code regression: you have the power to rollback. You don’t have to wait for the external provider to fix it.
When you have an outage because of a bad config: you have the power to fix it and change your deployment procedure to never happen again.
When you have an outage because of your hosting provider: you can change your hosting.

Conclusion

My point is that the CORE features of your business should be as close to your control as possible. Too many external dependencies increase your overall risk because companies are not your buddies from high school, companies evolve, companies change, companies get bought out, companies get hacked, and so on.

For your startup the risks are worth the time saved ?
At the stage you are at ?
What about at a later stage ?

- https://telteu.ro/posts/selfhost-vs-hosted-saas/ - Andrei Telteu 2024

MiniPC rack Part 1: the pc and case

Tue, 19 Nov 2024 00:16:30 +0000

Andrei Telteu https://telteu.ro/posts/minipc-rack-part-1/ -

Hardware

I was looking start my homelab with a mini pc and I finally found a good deal on the second hand market:

HP EliteDesk 705 G4 with AMD Ryzen 5 2400GE, 16GB RAM DDR4 2666 Mhz (sodimm/laptop), with 90W power supply for only 450 lei (~90€ / ~95$).

It offers a very good price to performance ratio because the CPU has 4 cores 8 threads at 3.8 GHz. The CPU performance is the most important thing for me.
I got one for testing, and then I get 2 more:

Then I found another deal for TeamGroup 512 GB NVMe M.2 SSD for only 120 lei (~24€ / ~25$) (new/sealed).

Perfect !

Software

I started researching for a good and free VM hypervisor, easy enough to configure and use.
I tried out Proxmox but then I found XCP-NG with XEN Orchestra on Lawrence Systems’s youtube channel and the search was over. It has multiple features that convinced me it is the best choice for me:

Free and open source
User interface easy and somewhat similar to VPS providers’s interfaces
Ability to replicate and migrate VMs on different hosts
Snapshots

3D Printing the case

After a while I found a good deal on a 3D Printer and I started learning how to 3D print, mess around with settings, then I learned how to model basic small and simple parts.

I started searching around on yeggi.com (search engine for 3D models) for compatible cases for this MiniPC and I found the best one:

“HP Mini Staggered Rack Mount” by @dsluo_362876

The idea is great: incorporate the MiniPC and it’s power supply in the same case. The execution is great ! The model is very good quality.

One problem: My 3D printer BambuLab A1 Mini has a small bed size at 180x180x180 mm and I have to rotate the model at 45 degrees, and cut the very thick top part of the case.

Problem solved ! It fits perfectly in the bed ! It’s print time !

I stopped the print after 2-3 cm just to make some fitment checks make sure I dont print the whole thing for nothing it it does not fit.
This is a very good practice and I recommend you do the same !
Good thing I did this because I found out that the power supply I have is bigger in every dimension than the one the author had. He wrote the power supply dimensions in the model description but I did not read it.

I’m stuck! I need to modify the model to fit my power supply but I don’t know how to do it and I don’t have the source files, I only have the STL mesh file.

To be continued… check part 2

- https://telteu.ro/posts/minipc-rack-part-1/ - Andrei Telteu 2024

How to control a Noctua PWM fan from Raspberry Pi

Mon, 18 Nov 2024 00:14:52 +0200

Andrei Telteu https://telteu.ro/posts/how-to-control-a-noctua-nf-a20-pwm-fan-from-raspberry-pi/ -

I am making my homelab and I need to control the Noctua NF-A20 PWM chromax.black.swap 200x200mm fan from Raspberry Pi, and this is how I’ve done it.

Parts you need:

Some Raspberry Pi
The Noctua NF-A20 PWM fan (should work with other 12V noctua fans as well)
A multimeter
LM2577 DC-DC Step Up Booster Converter
NPN Transistor
1K Ohm Resistor

Diagram:

Let’s start from the Pi:

1- Connect a wire from GPIO pin 16, or any simple gpio pin, to the 1k resistor, and then the other end of the transistor to the middle pin of the transistor.

2- A wire from the right pin of the transistor to any ground pin of the Pi. The face of the transistor is the flat one.

3- A wire from the left pin of the transistor to the “IN-” 5V negative input of the power convertor.

4- A wire from one of the 5V Pi pins (top right) to the “IN+” 5V positive input of the power convertor.

5- Important: adjust the converter to 12V or lower.
Do NOT connect the fan right now because you can permanently damage it because of high voltage.
    A- Turn on the converter by connecting a ground pin from the Pi directly to the Power Converter’s “IN-” connector OR by runing the code from the next section and just calling speed(fan, 100) / time.sleep(180).
    B- Connect a multimeter to the converter’s “OUT+” and “OUT-” and select voltage measurement on the multimeter (usually marked as “2V”).
    C- On the converter turn the small yellow screw until the multimeter shows 12V or a bit smaller to be safe. I have mine at 11.5V.

D- When you are done disconnect the multimeter and the ground wire, or turn off the script.

The pinout from the noctua fan I found here: https://faqs.noctua.at/en/support/solutions/articles/101000081757-what-pin-configuration-do-noctua-fans-use-

5- Wire from power convertor “OUT-” (12V negative) to noctua pin 1.

6- Wire from power convertor “OUT+” (12V positive) to noctua pin 2.

5- Wire from noctua pin 4 to Pi GPIO pin 12. This pin has PWM capability .

The code:

I used the code from this tutorial published on the-diy-life.com by Michael Klements ( original code ), and I modified it to use the transistor to turn off the fan, because the fan PWM does not scale down to 0 RPM. The minimum rotational speed is 20% (350RPM).

 1#!/usr/bin/env python3
 2import RPi.GPIO as GPIO
 3import time
 4import signal
 5import sys
 6
 7# The Noctua PWM control actually wants 25 kHz (kilo!), see page 6 on:
 8# https://noctua.at/pub/media/wysiwyg/Noctua_PWM_specifications_white_paper.pdf
 9PWM_FREQ = 25 # [Hz] PWM frequency
10FAN_PIN = 12 # BCM pin used to drive PWM fan
11TRAN_PIN = 16 # NPN Transistor
12
13def speed(fan, percent):
14 print("set fan to", percent)
15 if (percent < 20):
16 GPIO.output(TRAN_PIN, False)
17 fan.ChangeDutyCycle(20)
18 else:
19 GPIO.output(TRAN_PIN, True)
20 fan.ChangeDutyCycle(percent)
21
22try:
23 signal.signal(signal.SIGTERM, lambda *args: sys.exit(0))
24 GPIO.setwarnings(True)
25 GPIO.setmode(GPIO.BCM)
26 GPIO.setup(TRAN_PIN, GPIO.OUT)
27 GPIO.setup(FAN_PIN, GPIO.OUT, initial=GPIO.LOW)
28 fan = GPIO.PWM(FAN_PIN, PWM_FREQ)
29
30 # do a few cycles just for testing
31 speed(fan, 100)
32 time.sleep(30)
33
34 speed(fan, 50)
35 time.sleep(30)
36
37 speed(fan, 0)
38 time.sleep(30)
39
40 speed(fan, 20)
41 time.sleep(30)
42
43 speed(fan, 70)
44 time.sleep(30)
45
46 speed(fan, 100)
47 time.sleep(30)
48
49except KeyboardInterrupt:
50 pass
51
52finally:
53 GPIO.cleanup()

Done. Happy tinkering !

- https://telteu.ro/posts/how-to-control-a-noctua-nf-a20-pwm-fan-from-raspberry-pi/ - Andrei Telteu 2024

How to Use Templ With Goravel

Mon, 18 Nov 2024 00:12:52 +0200

Andrei Telteu https://telteu.ro/posts/how-to-use-templ-with-goravel/ -

Install the framework and tools

First let’s install Goravel . It’s a batteries included Go Web Framework for developers familiar with the Laravel Framework.

Steps from Getting started documentation :

 1// Download framework
 2git clone https://github.com/goravel/goravel.git
 3rm -rf goravel/.git*
 4
 5// Install dependencies
 6cd goravel
 7go mod tidy
 8
 9// Create .env environment configuration file
10cp .env.example .env
11
12// Generate application key
13go run . artisan key:generate

Now install templ for html templates and air for hot reloading:

1go install github.com/a-h/templ/cmd/templ@latest
2go install github.com/cosmtrek/air@latest

Configure a simple frontend template structure

(work in progress - I will update with global variables and script push)

• Add this line in your /.gitignore file: *_templ.go

• Delete resources/views/welcome.tmpl

• Create 2 folders in resources/views, home and parts

• In the folder resources/views/parts create 3 files:

1. resources/views/parts/header.templ

1package parts
2
3templ Header() {
4 <h1>Header</h1>
5}

2. resources/views/parts/footer.templ

1package parts
2
3templ Footer() {
4 <footer>
5 <p>&copy; 2024 MyProject</p>
6 </footer>
7}

3. resources/views/parts/template.templ

 1package parts
 2
 3templ Template() {
 4 <!DOCTYPE html>
 5 <html>
 6 <head>
 7 <title>My Page</title>
 8 <meta charset="utf-8"/>
 9 <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
10 <meta name="viewport" content="width=device-width, initial-scale=1"/>
11 <!-- Your styles go here -->
12 </head>
13 <body>
14 @Header()
15 { children... }
16 @Footer()
17 <!-- Your scripts go here -->
18 <script src="//unpkg.com/alpinejs" defer></script>
19 </body>
20 </html>
21}

• Create your homepage component: resources/views/home/index.templ

 1package home
 2
 3import "goravel/resources/views/parts"
 4
 5templ Index() {
 6 @parts.Template() {
 7 <h1>Homepage</h1>
 8 <div>Templ is awesome</div>
 9 }
10}

Their documentation for children components is here . They have an example for a layout structure but I find this method better.

Use this homepage component in your controller

I made this new file app/http/controllers/controller.go where I can store some helpers available to any controller.

 1package controllers
 2
 3import (
 4 "github.com/a-h/templ"
 5 "github.com/goravel/framework/contracts/http"
 6)
 7
 8func RenderTempl(c http.Context, comp templ.Component) http.Response {
 9 c.Response().Status(200)
10 c.Response().Header("Content-Type", "text/html")
11 comp.Render(c, c.Response().Writer())
12 return nil
13}

This helper renders the provided templ component in the response buffer along with a 200 status header. Let’s use it in app/http/controllers/home_controller.go

 1package controllers
 2
 3import (
 4 "goravel/resources/views/home"
 5 "github.com/goravel/framework/contracts/http"
 6)
 7
 8type HomeController struct {
 9 //Dependent services
10}
11
12func NewHomeController() *HomeController {
13 return &HomeController{
14 //Inject services
15 }
16}
17
18func (r *HomeController) Index(ctx http.Context) http.Response {
19 // doing awesome stuff here
20 return RenderTempl(ctx, home.Index())
21}

Now set this new route:

 1package routes
 2
 3import (
 4 "goravel/app/http/controllers"
 5 "github.com/goravel/framework/facades"
 6)
 7
 8func Web() {
 9 homeController := controllers.NewHomeController()
10 facades.Route().Get("/", homeController.Index)
11}

Configure hot reloading with Air

Goravel already comes with the configuration file (.air.toml) you need for this, we only need to add the templ generate command in the cmd parameter, like this:

1[build]
2 bin = "./storage/temp/main"
3- cmd = "go build -o ./storage/temp/main ."
4+ cmd = "templ generate && go build -o ./storage/temp/main ."

If you are using Windows add .exe to main in both bin and cmd parameters:

1[build]
2 bin = "./storage/temp/main.exe"
3 cmd = "templ generate && go build -o ./storage/temp/main.exe ."

Done ! Happy coding !

- https://telteu.ro/posts/how-to-use-templ-with-goravel/ - Andrei Telteu 2024

Docker Compose helper script

Mon, 18 Nov 2024 00:10:52 +0200

Andrei Telteu https://telteu.ro/posts/docker-compose-helper-script/ -

Make a new file at the root folder called dc without extension.

Content example. Modify for your needs.

 1#!/bin/bash
 2trap "exit" 0
 3DC="docker compose" # add `-f docker/compose.yml` if it's in another folder
 4
 5if [ $# -eq 0 ]; then
 6 $DC ps -a
 7
 8elif [ $1 == "up" ]; then
 9 $DC up -d
10
11elif [ $1 == "php" ]; then
12 if [ $# -gt 1 ]; then
13 $DC exec php su app -c "${*:2}"
14 else
15 $DC exec php su app
16 fi
17
18elif [ $1 == "c" ]; then
19 $DC exec php su app -c "composer ${*:2}"
20
21elif [ $1 == "ci" ]; then
22 $DC exec php su app -c 'composer install'
23
24elif [ $1 == "recreate" ]; then
25 $DC up -d --force-recreate ${*:2}
26
27elif [ $1 == "build" ]; then
28 $DC up -d --force-recreate --build ${*:2}
29
30else
31 $DC $*
32fi

Give execute permission with chmod +x ./dc

And now you can run:

./dc - to show all containers with status
./dc up - to start in detached mode
./dc ci - to run composer install in the php container as user app
./dc c require spatie/image - to run any composer command inside php container
./dc php - interactive exec inside php container
./dc php ls -alh - run any command inside php container
./dc recreate - applies any modifications to docker-compose.yml
./dc recreate php - applies modifications to compose, only for php container
./dc build - if you have a custom dockerfile, does run dc up with a fresh build.
./dc logs -n 10 -f php - any other docker-compose command works as expected.

- https://telteu.ro/posts/docker-compose-helper-script/ - Andrei Telteu 2024

Incremental file and MySQL backup

Mon, 18 Nov 2024 00:09:52 +0200

Andrei Telteu https://telteu.ro/posts/incremental-backup-files-and-mysql/ -

1. Install

Install autorestic: https://autorestic.vercel.app/installation

Let’s use /root/backup to store our env file and autorestic config, make a data folder inside to store the actual backups inside, and a temporary database folder for MySQL dumps.

1mkdir /root/backup
2mkdir /root/backup/data
3mkdir /root/backup/database
4cd /root/backup

2. Environment

Create the environment file nano .autorestic.env and fill the access data to the database:

1AUTORESTIC_LOCAL_RESTIC_PASSWORD=
2
3AUTORESTIC_PROD_DB_MYSQL_HOST=localhost
4AUTORESTIC_PROD_DB_MYSQL_PORT=3306
5AUTORESTIC_PROD_DB_MYSQL_DATABASE=
6AUTORESTIC_PROD_DB_MYSQL_USER=
7AUTORESTIC_PROD_DB_MYSQL_PASS=

Generate a unique key / password in AUTORESTIC_LOCAL_RESTIC_PASSWORD. This is used to encrypt and decrypt all backups. Also please save backup this key in a different location as well (password manager or something).

3. MySQL Backup

Make a bash script for MySQL backup: nano backup-db-hook.sh

 1#!/usr/bin/bash
 2BACKUP_PATH=./database
 3mkdir $BACKUP_PATH
 4
 5export $(cat .autorestic.env | xargs)
 6MYSQL="$(which mysql)"
 7MYSQLDUMP="$(which mysqldump)"
 8GZIP="$(which gzip)"
 9MYSQL_PERMS=" --protocol tcp "
10MYSQL_PERMS+=" -h $(echo $AUTORESTIC_PROD_DB_MYSQL_HOST) "
11MYSQL_PERMS+=" -P $(echo $AUTORESTIC_PROD_DB_MYSQL_PORT) "
12MYSQL_PERMS+=" -u $(echo $AUTORESTIC_PROD_DB_MYSQL_USER) "
13DB="$AUTORESTIC_PROD_DB_MYSQL_DATABASE"
14export MYSQL_PWD="$AUTORESTIC_PROD_DB_MYSQL_PASS"
15DUMP_OPTIONS="--single-transaction --no-tablespaces"
16
17echo "$(date +"%d-%m-%Y %H:%M:%S") Backing up $DB to $BACKUP_PATH"
18TABLES="$($MYSQL $MYSQL_PERMS $DB -Bse 'SHOW TABLES FROM '$DB)"
19for TABLE in $TABLES ; do
20 echo "$(date +"%d-%m-%Y %H:%M:%S") Backing up $TABLE"
21 FILE="$BACKUP_PATH/${TABLE}.sql.gz"
22 $MYSQLDUMP $MYSQL_PERMS $DUMP_OPTIONS $DB $TABLE | $GZIP -9 > $FILE
23done
24echo "$(date +"%d-%m-%Y %H:%M:%S") ...done!"

(credits to jeremyharris/backup.sh for separate db tables script)

4. Config

Make a config file: nano auto.yml

 1version: 2
 2
 3backends:
 4 local:
 5 type: local
 6 path: /root/backup/data # where you want to store all backups
 7
 8global:
 9 forget:
10 keep-daily: 7
11 keep-weekly: 4
12
13locations:
14 prod:
15 from: /var/www/html # where the website files are
16 to: local
17 cron: '0 1 * * *' # at 01:00
18 forget: "yes" # or "prune". Yes must be in quotes, otherwise it's a boolean
19 options:
20 backup:
21 exclude:
22 - 'vendor'
23
24 prod-db:
25 from: /root/backup/database/
26 to: local
27 cron: '0 0 * * *' # at 00:00
28 forget: "yes"
29 hooks:
30 before:
31 - bash backup-db-hook.sh

Note: The backend name must match with the env restic password name: (like EXAMPLE)
AUTORESTIC_EXAMPLE_RESTIC_PASSWORD=
backends:
example:
type: local

5. Initialize repository

1autorestic check

This will check your config and initialize a new repository in the backup destination folder or remote location.

6. Cron Job

Add the cron job. autorestic recommends every 5 minutes.

crontab -e

1*/5 * * * * cd /root/backup; /usr/local/bin/autorestic -c /root/backup/auto.yml --ci cron --lean

Notes:

Backup your key (env RESTIC_PASSWORD) somewhere else (like a password manager). If you lose it, your backups are useless.
Use autorestic exec -av snapshots while in the /root/backup folder to see the list of backups.

1## list of backups
2autorestic -c auto.yml exec -av snapshots
3
4## choose one snapshot id, then list all the files within it
5autorestic -c auto.yml exec -av -- ls --long 041c88da
6
7## now you can choose to restore only one file for example, in the relative folder ./restore/
8autorestic -c auto.yml exec -av -- restore --target=./restore/ --include=/root/backup/database/example.sql.gz 041c88da

- https://telteu.ro/posts/incremental-backup-files-and-mysql/ - Andrei Telteu 2024

MySQL dynamic max_connections setting

Mon, 18 Nov 2024 00:08:54 +0200

Andrei Telteu https://telteu.ro/posts/mysql-dynamic-max-connections/ -

Put the following script in a .sh file, for example in /root/watch-mysql.sh

 1#!/usr/bin/bash
 2trap "exit" 0
 3
 4MAXCONN=1000 # set this to whatever base max_connections you have defined in your my.conf setting
 5while true; do
 6 #mysql -e "SHOW VARIABLES LIKE 'max_connections';"
 7 THREADS=`mysqladmin status | awk '{print $4}'`
 8 THREADSINT=`echo "$THREADS" | bc`
 9 #echo "Load is: $THREADS"
10 NEWMAX=$MAXCONN
11 if [[ $THREADSINT -ge 1 ]]; then
12 NEWMAX=1000
13 fi
14 if [[ $THREADSINT -ge 600 ]]; then
15 NEWMAX=2000
16 fi
17 if [[ $THREADSINT -ge 1400 ]]; then
18 NEWMAX=3000
19 fi
20 if [[ $THREADSINT -ge 2400 ]]; then
21 NEWMAX=4000
22 fi
23 if [[ $THREADSINT -ge 3400 ]]; then
24 NEWMAX=5000
25 fi
26 if [[ $NEWMAX -ne $MAXCONN ]]; then
27 mysql -e "set global max_connections = $NEWMAX;"
28 #echo "increased: $NEWMAX"
29 MAXCONN=$NEWMAX
30 fi
31 sleep 3
32done

If mysqladmin status gives error “connect to server at ’localhost’ failed”, make sure you have your credentials stored in ~/.my.cnf

I have a separate mysql server, runing PerconaDB inside docker, so in my case my ~/.my.cnf looks like this:

[client]
protocol=tcp
port=3306
user=root
password="secret"

You can run this script on startup by creating a systemd service or by using supervisor .

An easier setup is by runing a cron job every minute. If you do a while loop in a cron job, you will end up with unlimited proceses spawned and we don’t want that. Instead we will replace while with a for loop:

# replace `while true; do` with
for i in {1..20}; do

For loop for 20 iterations because each loop sleeps for 3 seconds. So 20 * 3 = 60 seconds assuming our code does not take too long to execute.

Now run command crontab -e and add a cron job for this:

* * * * * bash /root/watch-mysql.sh

- https://telteu.ro/posts/mysql-dynamic-max-connections/ - Andrei Telteu 2024

Solid JS full year calendar

Mon, 18 Nov 2024 00:07:59 +0200

Andrei Telteu https://telteu.ro/posts/solidjs-full-year-calendar/ -

 1import { Component, For } from "solid-js";
 2import moment from "moment";
 3// import "moment/dist/locale/ro"; // if you need to change the locale
 4// moment.locale("ro");
 5
 6const FullCalendar: Component = () => {
 7 const weekdays = moment.weekdaysMin();
 8 const months = moment.months();
 9 const fullYear = Object.fromEntries(
10 months.map((monthName, monthIndex) => {
11 return [
12 monthName,
13 new Array(6).fill(1).map((i, rowIndex) => {
14 return weekdays.map((dayName, colIndex) => {
15 const day = moment()
16 // .year(2024) // if you need to change the year
17 .month(monthIndex)
18 .date(rowIndex * 7)
19 .weekday(colIndex);
20 return day.month() == monthIndex ? day.format("D") : "";
21 });
22 }),
23 ];
24 })
25 );
26
27 return (
28 <div class="solidcalendar-container">
29 <For each={Object.keys(fullYear)}>
30 {(monthName) => (
31 <div class="solidcalendar-month">
32 <div class="solidcalendar-monthname">{monthName}</div>
33 <div class="solidcalendar-weekdays">
34 <For each={weekdays}>
35 {(weekDayName) => (
36 <div class="solidcalendar-weekday solidcalendar-column">
37 {weekDayName}
38 </div>
39 )}
40 </For>
41 </div>
42
43 <For each={fullYear[monthName]}>
44 {(days) => (
45 <div class="solidcalendar-week">
46 <For each={days}>
47 {(day) => (
48 <div class="solidcalendar-weekday solidcalendar-column">
49 {day}
50 </div>
51 )}
52 </For>
53 </div>
54 )}
55 </For>
56 </div>
57 )}
58 </For>
59 </div>
60 );
61};
62
63export default FullCalendar;

- https://telteu.ro/posts/solidjs-full-year-calendar/ - Andrei Telteu 2024