The laptop was sitting on a stand with the internal display off and an external 1920×1080 monitor running at 60 Hz. CPU utilization was very low, temperatures were around 40°C, and yet the fan would repeatedly do this:
Fan OFF
↓
10–20 seconds
↓
Fan ~3000+ RPM
↓
about 1 minute
↓
Fan OFF
↓
repeat
The noise was much worse than the workload warranted.
The eventual solution was surprisingly simple:
KDE Power Profile: power-saver
Intel EPP: power
Turbo: still enabled
Dell BIOS: Quiet
Fan at idle: 0 RPM
The important part is that Turbo remained enabled. I did not have to sacrifice the CPU’s ability to boost when actually needed.
This post documents the diagnostics because they may also be useful to other Dell/Linux users who are experiencing apparently irrational fan behaviour.
The system is:
Dell Latitude 7450
Intel® Core™ Ultra 5 125H (18 MB cache, 14 cores, 18 threads, 1.2 GHz to 3.0 GHz P-Core, 28W)
16 GB RAM
Intel Iris Xe
Kubuntu 26.04 LTS
KDE Plasma 6.6.6
Wayland
Kernel 7.0.0-31-generic
BIOS 1.32.0
The BIOS thermal mode was initially set to Optimized, with Turbo enabled. I also tested Dell’s Quiet thermal mode.
Neither Optimized nor Quiet stopped the fan cycling.
The initial sensors output looked approximately like this:
CPU package: 40–41°C
CPU cores: roughly 37–41°C
NVMe: ~33°C
Wi-Fi: ~28–29°C
Ambient: ~30–31°C
Fan: 0 RPM or ~3300 RPM
When the fan was running at more than 3000 RPM, the CPU was still only around 41°C.
That immediately suggested that this was not a conventional situation where the CPU was getting hot and the fan was sensibly responding.
The fan was being extremely aggressive relative to the temperature.
The pattern became clearer after watching the temperatures while the fan cycled.
With the normal Balanced power profile, the behaviour was essentially:
~39°C → fan off
~40–41°C → fan jumps to ~3000+ RPM
temperature falls
fan switches off
~20 seconds later the CPU reaches ~40–41°C again
fan jumps back on
So this looked very much like a threshold or hysteresis problem.
The striking part was how narrow the operating range was. The machine was spending its time crossing a very small temperature boundary and repeatedly triggering a relatively high fan state.
Changing the Dell BIOS thermal mode to Quiet did not eliminate the behaviour.
The next step was to find out whether something in Linux was explicitly controlling the fan.
There was no fancontrol, i8kmon, or NBFC process running.
The only obvious thermal daemon was:
thermald
I stopped it:
sudo systemctl stop thermald
The fan behaviour did not change.
That ruled out thermald as the source of the problem, at least in this configuration.
Linux exposed this device:
dell_smm-virtual-0
with values such as:
fan1: 3343 RPM
pwm1: 64% MANUAL CONTROL
and, when the fan was off:
fan1: 0 RPM
pwm1: 0% MANUAL CONTROL
The Dell SMM hwmon driver documentation is worth reading here because its behaviour is not the same as a normal PC PWM controller.
The Linux driver supports Dell-specific fan states and can expose the fan through the Linux thermal framework. Its documentation also explains that Dell’s SMM interface is reverse-engineered and warns that some undocumented SMM commands can have severe side effects. That is an important lesson: don’t assume that:
echo 0 > pwm1
means the same thing on a Dell laptop that it means on a normal PWM-controlled fan.
In this case, trying to write:
echo 0 | sudo tee /sys/class/hwmon/hwmon6/pwm1
did not solve anything. The value simply returned to the previous Dell SMM state.
Likewise, the interface reported:
pwm1_enable = 1
but attempting the commonly documented:
echo 2 | sudo tee /sys/class/hwmon/hwmon6/pwm1_enable
returned:
Invalid argument
This was a useful warning not to keep guessing at Dell SMM control values.
The Dell SMM hwmon module was loaded:
dell_smm_hwmon
I temporarily removed it:
sudo modprobe -r dell_smm_hwmon
The fan continued cycling.
That was an important result.
It meant that the noisy fan behaviour was not simply caused by the Linux dell_smm_hwmon driver continuously commanding the fan.
After unloading the module, the Dell DDV sensor still reported the fan:
dell_ddv-virtual-0
CPU Fan: 3236 RPM
and later:
CPU Fan: 0 RPM
and later again:
CPU Fan: 2224 RPM
So the underlying Dell firmware/embedded-controller behaviour was still present.
I then restored the module with:
sudo modprobe dell_smm_hwmon
The machine was using Intel’s intel_pstate driver:
active
and Turbo was enabled:
no_turbo = 0
The CPU exposed these Energy Performance Preference choices:
default
performance
balance_performance
balance_power
power
The Linux intel_pstate documentation explains that, on systems using hardware-managed P-states, the Energy Performance Preference is a hint to the CPU’s internal performance-selection logic. Higher energy-saving preference biases the CPU toward efficiency rather than maximum performance.
I changed the KDE power profile to:
power-saver
This resulted in the CPU policies reporting:
energy_performance_preference = power
while:
intel_pstate = active
no_turbo = 0
In other words:
Turbo was still allowed.
The important difference was how aggressively the CPU behaved during light workloads.
This was the result that finally solved the problem.
Under the previous Balanced configuration, the machine repeatedly crossed the fan trigger:
39°C → 40–41°C → fan
Under Power Saver, the laptop could sit at:
CPU: 43°C
Fan: 0 RPM
and later:
CPU: 47°C
Fan: 0 RPM
That is the crucial observation.
The fan was not simply turning on because the CPU reached 40°C.
The CPU could reach 47°C and the fan could remain completely off.
The change was the processor’s power/performance behaviour, not simply a lower temperature.
This strongly suggests that the Balanced profile was allowing short performance/power excursions that interacted badly with the Dell firmware’s fan-control behaviour. Those excursions were enough to repeatedly trigger the noisy fan state.
With the stronger energy-saving preference, the CPU stopped bouncing through whatever condition was causing the firmware to engage the fan.
For this particular Latitude 7450, the configuration that eliminated the noise was:
Dell BIOS thermal mode: Quiet
Kubuntu power profile: power-saver
intel_pstate: active
Intel EPP: power
Turbo: enabled
The laptop can still boost when needed because Turbo is not disabled.
This is therefore very different from simply putting the CPU into a permanently low-performance mode.
The goal is not:
Never let the CPU run fast.
The goal is:
Don’t let trivial desktop activity repeatedly trigger an unnecessarily aggressive fan state.
If a Latitude 7450 is exhibiting similar behaviour under Linux, I would start with temperature and power-management diagnostics rather than immediately trying to override the fan.
Check the thermal readings:
sensors
Look specifically at:
Package id 0
CPU Fan
NVMe
Dell SMM temperatures
Check whether thermald is running:
systemctl status thermald
Check the Intel P-state driver:
cat /sys/devices/system/cpu/intel_pstate/status
Check whether Turbo is disabled:
cat /sys/devices/system/cpu/intel_pstate/no_turbo
Check the available Intel energy/performance preferences:
cat /sys/devices/system/cpu/cpufreq/policy*/energy_performance_available_preferences
Check the current setting:
cat /sys/devices/system/cpu/cpufreq/policy*/energy_performance_preference
On my machine, the available options included:
default performance balance_performance balance_power power
and setting the KDE profile to Power Saver resulted in:
power
across the CPU policies.
The Linux kernel documentation specifically recommends keeping energy/performance hints consistent across CPUs when possible, because tasks can migrate between CPUs.
Full Power Saver may not be necessary for everyone.
On my 7450, the CPU supports:
balance_power
as well as:
power
That suggests a useful experiment for somebody who wants more responsiveness than full Power Saver but still wants to avoid triggering the fan.
For a temporary test:
for f in /sys/devices/system/cpu/cpufreq/policy*/energy_performance_preference; do
echo balance_power | sudo tee "$f" >/dev/null
done
Then watch the fan over several minutes.
If the fan remains quiet, balance_power may provide a better performance/noise compromise.
If the fan starts the old cycle again, power is the more reliable setting for this particular machine.
I would treat this as a per-machine experiment rather than a universal rule.
This deserves emphasis.
Linux’s Dell SMM documentation states that the SMM interface was reverse-engineered because Dell does not publish the necessary documentation. It also explicitly warns that some automatic-fan-control commands can have severe side effects on machines that do not support them.
The documentation also describes two different mechanisms for returning fan control to the BIOS, depending on the machine. A pwm1_enable=2 solution therefore cannot simply be assumed to work on every Dell.
In my case, the attempted pwm1_enable=2 write was rejected, so I stopped experimenting with undocumented SMM fan states.
That was the right decision.
Dell’s own troubleshooting documentation recommends checking the system BIOS when investigating fan noise or thermal problems.
My 7450 was already running BIOS 1.32.0, so this was not a case of simply needing an old BIOS to be updated.
Dell continues to publish BIOS updates for the Latitude 7450, so owners experiencing different symptoms should still check Dell’s current support page before assuming the firmware behaviour is fixed or identical to another machine.
The important finding from this investigation was not a magical fan command.
It was discovering that the fan problem was strongly coupled to CPU power/performance behaviour rather than simply CPU temperature.
On my Latitude 7450:
Balanced + Quiet
↓
CPU repeatedly crosses a narrow operating point
↓
fan repeatedly jumps to ~3000+ RPM
↓
noise
Changing to:
Power Saver
Intel EPP = power
Turbo still enabled
produced:
CPU can reach ~47°C
↓
fan remains at 0 RPM
↓
silence
For anyone with a Dell laptop running Kubuntu, this is therefore worth trying before resorting to aggressive fan-control hacks.
The practical lesson is:
When a Dell laptop’s fan is cycling on and off at low temperatures, look at the CPU’s Energy Performance Preference and power profile, not just CPU utilization and temperature.
On this Latitude 7450, putting Intel’s EPP into its power setting solved the problem without disabling Turbo.
The first was: build a VPN service that I would actually want to use.
The second was: find out how many people will purchase it.
Rather than simply deploying a VPN server on a rented VPS and calling it a day, I wanted to understand what was involved in operating an Internet-facing service from end to end. That meant networking, routing, isolation, access control, hardening, monitoring, key management, and, importantly, thinking about what would happen when something went wrong. Also, doing it all on a budget of about €10 (the price of a domain).
I also thought I might turn it into a small business.
That part did not exactly go according to plan.
The service has attracted very few customers. In practice, I get less than one customer per month on average. Technically, however, I have been very happy with the result. In some respects I prefer using my own VPN to several of the large commercial VPN providers I have tried.
That contrast taught me something useful: building a good security product and building a successful security business are two very different problems.
The most interesting part of the project was never the website or the payment system. It was designing the infrastructure.
Running a VPN means deliberately putting a service on the edge of a network and allowing untrusted devices to connect to it. That creates an obvious security problem if the VPN infrastructure is allowed to interact freely with the rest of the network.
I therefore treated the VPN environment as a separate trust domain rather than simply another machine on my home LAN.
The architecture uses Layer-3 separation and multiple security controls to keep the VPN service isolated from my normal devices and management environment. The goal was straightforward: if the VPN host were compromised, compromising the VPN should not automatically mean compromising everything else in the house.
That sounds obvious, but implementing it properly forces you to think about details that are easy to ignore in a lab environment.
What networks can communicate with each other?
Which routes should exist?
What happens if a firewall rule is accidentally too permissive?
How is administration performed without unnecessarily exposing management interfaces?
What happens when a component is compromised?
Which systems should trust VPN traffic, and which should treat it as untrusted traffic?
Those questions became more interesting once there were real external users connecting to the service.
A security architecture is much easier to design when the only traffic comes from you. The moment strangers are using it, assumptions have to become explicit.
A VPN service sits in an unusual position.
Clients connect to it because they want to trust it with their traffic. At the same time, from the perspective of the infrastructure, those clients are effectively untrusted Internet users.
That creates an interesting boundary.
I had to think not only about protecting the VPN from the Internet, but also about protecting the rest of my infrastructure from the VPN.
This led me towards a principle that has become increasingly important in my thinking about security:
Do not grant trust simply because two systems happen to be on the same physical network.
The physical location of a device tells you very little about what it should be allowed to access.
The project gave me a practical environment in which to apply that principle. Segmentation, routing restrictions, firewall policy, administrative isolation, service hardening and access controls were no longer abstract concepts from a security course. They were things I had to make work on a system that was actually exposed to the Internet.
The technical side was satisfying.
The business side was much harder.
Consumers already have a huge number of VPN providers to choose from. Many are backed by large companies, have substantial advertising budgets, and are household names within the VPN market.
A small independent service has an obvious disadvantage: trust.
When someone sees a VPN provider they have never heard of, the first question is not necessarily “how good is the encryption?”
It is often:
Why should I trust you?
That is a difficult question for a small provider to answer.
People are being asked to route their Internet traffic through infrastructure they do not control and operated by a company they have never heard of. The fact that the underlying technology is sound does not automatically make the product trustworthy.
I learned that technical credibility and consumer trust are separate things.
A technically competent service can still struggle to acquire customers because customers cannot easily evaluate the competence behind it.
When consumers feel they are getting the same service for free, there is obviously a challenge to convince them otherwise.
There are countless free and extremely cheap VPN services available. Some users will happily choose one despite legitimate concerns about how those services make money.
From a purely technical perspective, this can be frustrating.
You can spend considerable time designing a carefully isolated and hardened system and discover that your potential customer would rather use a free application they downloaded five minutes ago.
But that is not really a technical problem.
It is a product problem.
Users are not purchasing a firewall architecture. They are purchasing an outcome, and they need to believe that the provider behind that outcome is trustworthy.
That means branding, reputation, transparency, support, convenience and perceived legitimacy can matter just as much as the underlying infrastructure.
One of the most valuable parts of the project was that it was not purely theoretical.
There is a difference between completing a security exercise and operating an exposed service.
A lab can be reset.
A production system has consequences.
Once other people depend on a service, relatively mundane questions become security questions.
How quickly do you patch it?
What happens if an update breaks something?
How do you recover?
What information do you log?
How much information should you log?
How do you protect administrative access?
What happens if credentials are compromised?
How do you notice unusual behaviour?
What is the blast radius of a compromised component?
What assumptions are you making about the environment that might turn out to be wrong?
These are the kinds of questions that make infrastructure security interesting to me.
From a commercial perspective, Irish-VPN has not become much of a business.
The number of customers is tiny, and I have no illusion that I have somehow disrupted the commercial VPN industry.
But that does not mean I consider the project unsuccessful.
The business experiment answered one question fairly clearly: there is not enough demand for my particular service in its current form to justify treating it as a serious commercial operation.
The engineering experiment answered a different question, and that one was much more successful.
I built and operated an Internet-facing VPN service on my own infrastructure. I designed a segmented network around it, considered the trust boundaries involved, hardened the systems, and exposed the service to real external users.
That experience is considerably more interesting to me than the number of subscriptions.
If I were starting again, I would separate the engineering objective from the business objective much earlier.
The engineering project is worth doing even if nobody buys it.
The business requires an entirely different set of capabilities: distribution, branding, customer acquisition, support, payment infrastructure, compliance, reputation and trust.
Those are not extensions of the technical problem. They are different problems.
I would also be much more explicit about what the project actually is.
There is a temptation with a project like this to make it look like a conventional VPN company. But that can obscure the most interesting part.
This is, fundamentally, a personal security and infrastructure engineering project that happens to provide VPN connectivity to a small number of other people.
I think that is a more honest description, and ultimately a more interesting one.
The biggest lesson from Irish-VPN is that good engineering does not automatically produce a good business.
That sounds obvious, but building something yourself makes the distinction much clearer.
I can control the architecture.
I can control the network design.
I can control the security controls.
I can control the software and infrastructure that I operate.
I cannot control whether people trust an unknown provider, whether they recognise the brand, or whether there is enough demand for the service to become commercially viable.
For me, that makes the project valuable even if it never becomes a significant business.
I set out to build a VPN provider.
What I actually built was a practical exercise in network security, infrastructure engineering and operating a service in the real world.
That was probably the more useful outcome.
]]>That is the gap that fwupd and its Host Security ID (HSI) reporting are trying to address.
The Firmware Security page in the KDE kinfocenter program provides a useful way to turn a fairly technical set of firmware and kernel checks into something that can be understood and acted upon. Underneath the graphical presentation is the same security model exposed by fwupdmgr security, where fwupd evaluates a collection of host security attributes and assigns an HSI level plus, when appropriate, a runtime suffix. The HSI specification is intended to provide an end-user-verifiable view of platform firmware security. (kinfocenter)
On a client system, the initial assessment looked like this:
HSI-4
✔ SMAP: Enabled
✘ Encrypted RAM: Disabled
Runtime Suffix -!
✔ CET OS Support: Supported
✔ fwupd plug-ins: Untainted
✔ UEFI db: Not found
✘ Linux kernel lockdown: Disabled
✘ Linux swap: Unencrypted
✘ Linux kernel: Tainted
✘ UEFI secure boot: Disabled
This system has HSI runtime issues.
» https://fwupd.github.io/hsi.html#hsi-runtime-suffix
Host Security Events
2026-08-07 20:25:49: ✔ BIOS rollback protection changed: Disabled → Enabled
2026-08-07 20:25:49: ✔ Suspend-to-idle changed: Disabled → Enabled
2026-05-30 08:49:20: ✘ Suspend-to-idle changed: Enabled → Disabled
2026-05-17 17:10:50: ✔ TPM v2.0 changed: Not found → Found
2026-04-03 18:38:18: ✘ Kernel is tainted
The HSI number represents the core firmware security level. The runtime suffix represents security conditions that can change while the operating system is running. fwupd explicitly separates those two concepts: the core HSI level does not change simply because the OS configuration changes, but the runtime suffix can. (Fwupd)
fwupd defines HSI-4 as its “Secure State”. At this level the platform has a robust collection of firmware protections, including hardware-assisted encryption and execution protections where the platform supports them.
In the client’s case, the HSI-4 result was accompanied by:
✘ Encrypted RAM: Disabled
The fwupd HSI specification describes DRAM memory encryption as using technologies such as Intel TME or AMD SME to protect data on the external memory bus. Where supported, this can reduce the risk of an attacker extracting memory contents through physical access to the memory subsystem. fwupd considers successful detection and activation of the feature a requirement for HSI-4 on systems where the test applies. (Fwupd)
The client’s system reported:
Runtime Suffix -!
The exclamation mark means that fwupd detected a runtime security issue. The current HSI specification lists several conditions that can produce it, including Secure Boot being disabled, an untrusted or tainted kernel, kernel lockdown being disabled, unencrypted swap, and modified fwupd plug-ins. (Fwupd)
That makes the runtime section particularly valuable for Linux administrators because it connects firmware security with the configuration of the currently running operating system.
In other words, a machine can have reasonably strong firmware protections and still have a weaker runtime security posture.
For the kernel taint state, I checked the kernel’s exported taint value:
cat /proc/sys/kernel/tainted
and then looked at the kernel log for the reason:
dmesg | grep -i taint
dmesg | grep -Ei 'module|firmware|unsigned|taint'
The issue was then identified as the integrated webcam driver. It was signed when secure boot was enabled. After secure was disabled on the system, the driver was untrusted:
Kubuntu 26
│
├── Secure Boot originally enabled
│ └── MOK "dof-7340 Secure Boot Module Signature key"
│
├── Secure Boot subsequently disabled
│
└── IPU6 DKMS installed
│
└── ov02c10.ko
│
├── out-of-tree → O taint
└── signature not being trusted/required → E taint
For swap, I checked what was active:
swapon --show
cat /proc/swaps
The fwupd Linux Swap plugin checks the currently available swap partitions and files and records whether they are encrypted. (Fwupd)
In this case the system used “swap to file” and as the filesystem was unencrypted this was expected.
A dedicated swap partition used for hibernation functionality would also be flagged here if unencrypted.
Kernel lockdown was connected to the trusted boot configuration and was addressed as part of restoring Secure Boot.
The missing UEFI db result had to be interpreted in the context of the Secure Boot configuration.
Encrypted RAM was enabled in the BIOS.
The event history gave a useful timeline.
It is more useful than a single snapshot because firmware security is not static.
For example, the TPM state changed from “Not found” to “Found”, BIOS rollback protection changed, and the suspend mode changed over time. That makes the history a primitive audit trail for platform-security configuration.
The value of the Firmware Security page is that it provides a starting point for investigating the security of the machine beneath the operating system. It provides firmware details that are normally buried in UEFI setup menus: rollback protection, Secure Boot, TPM state, memory protections, SPI protections, recovery and platform trust. It also shows normal Linux runtime state: kernel lockdown, kernel taint, swap encryption and the trustworthiness of fwupd itself. These features make it a useful addition to a system security audit and to fix issues that are relevant to your threat model.
]]>Revolut has stopped accepting cash deposits in Ireland, the UK and several other European markets. The Irish service was operating through Paysafe by March 2024: Revolut’s terms from 22 March 2024 set limits for Paysafe cash top-ups in Ireland of €1,000 per transaction, €2,250 per month and €10,000 per year. Revolut charged 2.5% for the service. The UK service was also provided through Paysafe and was publicly launched in 2024. Revolut withdrew the Irish service on 26 January 2026 and the UK service on 13 February. (Revolut)
The timing is notable. Revolut had invested in a way of bringing physical cash into a predominantly digital banking model, using Paysafe rather than building branches. The customer deposited cash through the Paysafe network and the resulting transaction was credited to the Revolut account. In the UK, Revolut said 71% of surveyed customers had deposited cash with another financial institution during the previous year and 34% wanted to do so monthly. (Paysafe Ltd)
Revolut has not explained why it withdrew the service. The obvious possibilities are operational cost, reliance on an external cash network, compliance requirements, fraud controls and relatively low demand compared with electronic funding. None is confirmed by Revolut, but all are relevant to the decision.
The AML question is not whether a cash deposit can be traced. It can. Paysafe provides a transaction record, and Revolut can associate the deposit with the customer’s account and monitor subsequent activity. The limitation is earlier in the chain. A transfer from another bank normally identifies the originating institution and account; a cash deposit records the deposit itself but does not necessarily tell Revolut how the customer originally obtained the notes. That distinction is relevant when a bank assesses whether activity is consistent with the customer’s profile and whether a transaction warrants further investigation.
The operational burden is more tangible. Revolut’s cash service depended on Paysafe and a retail network outside Revolut’s own infrastructure. The bank had to integrate the service into its account, payments, reconciliation and risk systems while relying on another company to handle the physical transaction. Removing the service removes those requirements. Revolut’s current Irish help page now lists bank transfer, debit card, Apple Pay and Google Pay as the remaining funding methods. (Revolut)
That does not make digital funding intrinsically safer. It changes the fraud environment. Account takeover, stolen credentials, social engineering, authorised-payment fraud and mule accounts can all operate without cash. Electronic transactions simply provide a larger body of structured data for automated monitoring and fraud detection.
The regulatory framework adds another consideration. EU financial institutions are subject to the Digital Operational Resilience Act, which places requirements on ICT risk and third-party risk. For a service delivered through an external payment provider, the relevant issue is not merely whether the provider can process transactions, but whether the bank can manage the resilience, security and regulatory risks associated with that dependency.
Revolut’s decision is therefore not evidence that cash is incompatible with fintech. Other digital financial services still support it. Chime, for example, operates without a conventional branch network but allows cash deposits through a large US retail network. N26 operates CASH26 in selected European markets, allowing customers to deposit and withdraw cash through participating retailers. The technological model is available; the providers have simply made different commercial and operational choices.
Those choices also have to be understood in jurisdictional terms. “Digital bank” is not a single legal category. Revolut’s Irish banking service is provided by Revolut Bank UAB through its Irish branch, while US fintechs such as Chime operate through partner banks. Banking licences, deposit protection, AML obligations, payment regulation, data protection and operational-resilience requirements therefore vary according to the entity and jurisdiction involved.
Cash makes those differences visible, but the same principle applies to almost every feature of a fintech account. What appears to the customer as one application may sit on top of several regulated entities, payment systems and third-party providers. Whether a provider accepts cash is one expression of the choices made about that underlying infrastructure.
Revolut has now chosen a narrower model in the affected markets. Customers can move money in electronically, but anyone holding physical cash may need another provider to convert it into electronic funds first.
The interesting part is not that Revolut has “gone digital”. It was digital before. The interesting part is that it tried supporting cash through a third-party network, operated the service for a relatively short period, and then removed it. That makes the decision a useful case study in fintech architecture: which parts of traditional banking a digital provider is prepared to reproduce, which it is prepared to outsource, and which it ultimately decides are not worth carrying.
]]>Download the full report (PDF)
The latest version of this report can be found on the CSA site:
https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem
This lets you replace the ISP-supplied Sky Hub or Vodafone router with your own hardware for better Wi-Fi, stronger controls, VPN features, or more capable networking.
This guide applies to Sky Ireland and Vodafone Ireland full-fibre services where the fibre enters an ONT (Optical Network Terminal) and the ONT provides Ethernet to the ISP router.
Look for the wall-mounted unit where the fibre cable terminates. It is normally called an ONT and will have a fibre input and one or more Ethernet ports. The existing Sky or Vodafone router should be connected from that ONT’s Ethernet port to its WAN/Internet port.
Your replacement router must support:
Keep the ISP router somewhere safe. If you need technical support for a line problem, Sky or Vodafone may ask you to reconnect their supplied device while they test the service.
Do not disconnect or reset the fibre cable or ONT. The only cable you normally need to move is the Ethernet cable between the ONT and router.
For Sky Ireland fibre, set the WAN connection to PPPoE and add VLAN ID 10.
| Setting | Value |
|---|---|
| Connection type | PPPoE |
| Username | anything@skydsl |
| Password | anything |
| WAN VLAN ID | 10 |
| MTU | 1492 initially |
| DNS | Automatic, or your preferred DNS provider |
Sky’s authentication is commonly reported to accept placeholder PPPoE credentials, while VLAN 10 is the important network setting.
After saving the configuration, the router should obtain a public IP address and show its WAN connection as active.
Vodafone Ireland full fibre also uses PPPoE and WAN VLAN 10, but it uses fixed published PPPoE credentials.
| Setting | Value |
|---|---|
| Connection type | PPPoE |
| Username | vodafone@vodafone.ie |
| Password | broadband |
| WAN VLAN ID | 10 |
| MTU | 1492 initially |
| DNS | Automatic, or your preferred DNS provider |
The same physical arrangement applies: ONT Ethernet directly to your router’s WAN port.
You may encounter old Vodafone documentation referring to VPI and VCI values. Those relate to older DSL services over a telephone line and do not apply when you have an Ethernet connection from a fibre ONT.
PPPoE—Point-to-Point Protocol over Ethernet—is an older but still common ISP access method. It creates an authenticated connection between your router and the provider’s network.
It does not make fibre broadband inherently less reliable. Connection stability depends far more on the fibre/ONT, ISP network, router firmware, power supply, and correct WAN configuration than on PPPoE itself.
PPPoE has a small framing overhead. Traditionally, this means an MTU of 1492 rather than the standard Ethernet MTU of 1500. In normal use, that difference is negligible for streaming, video calls, browsing, online gaming, and downloads.
The main consideration is whether the router can process PPPoE at your line speed. PPPoE can require more router CPU work than a plain DHCP WAN connection, particularly at very high speeds.
For broadband packages up to around 1Gbps, a modern mid-range or high-performance router should normally be suitable. For multi-gigabit services, verify the manufacturer’s stated PPPoE throughput rather than relying only on its Ethernet port speed or Wi-Fi rating.
After installation, run a wired speed test and check the router’s CPU load. If speeds reach your subscribed rate without sustained high CPU use, the router is handling PPPoE correctly.
If the connection does not come up, start with the basics:
If you need to raise a fault with Sky or Vodafone, reconnect the original ISP router first. This makes it easier for support to verify whether the issue is with the broadband line or your own equipment.
Replacing an ISP router does not change the underlying broadband service. The ONT remains the fibre endpoint, while your own router takes over the routing, Wi-Fi, firewall, and local-network duties.
Your ability to replace an ISP router depends on the access technology, not only the retail brand.
If your service has a fibre ONT with an Ethernet port, a personal router can often connect directly to the ONT using the provider’s required WAN method, VLAN tag, and—where needed—PPPoE credentials. On cable, DSL, fixed-wireless, and mobile services, the ISP device may also perform a modem or radio function and may need to remain in place.
Important: The configurations below are common reported settings, not a substitute for ISP support. Providers can use different settings across OpenEir, SIRO, NBI, legacy services, static-IP products, and newer packages. Keep the original router so that you can reconnect it for fault diagnosis.
Virgin Media differs from most OpenEir, SIRO and NBI fibre services. On its cable network, the Virgin Hub is not merely a Wi-Fi router: it also acts as the cable modem that connects and authenticates to Virgin’s network.
You would normally keep the Virgin Hub, enable Modem Mode, and connect your own router to it by Ethernet. Configure the personal router’s WAN as DHCP / Automatic IP—not PPPoE.
Virgin cable connection
|
Virgin Hub in Modem Mode
|
Ethernet
|
Your router WAN port
|
Your home network
In this arrangement, your router still controls your home network, including Wi-Fi, firewall rules, DNS, VPN, DHCP reservations, port forwarding, and local-network features. The Virgin Hub remains only as the network termination modem.
| Provider | Usual access network | Can a personal router connect directly to the ONT? | Typical WAN configuration | Notes |
|---|---|---|---|---|
| eir | OpenEir FTTH | Usually yes | DHCP/IPoE; VLAN 10 may be required | DHCP/IPoE is generally preferable where available. PPPoE may be required for some static-IP or legacy configurations. If you use eir home phone/VoIP, keep the supplied router unless eir provides separate SIP details. |
| Digiweb | OpenEir, SIRO, NBI | Usually yes | PPPoE; commonly VLAN 10 | Reported OpenEir credentials: digiweb@nga.digiweb.ie / digiweb. Reported SIRO credentials: digiweb@siro.digiweb.ie / digiweb. Confirm the correct details with Digiweb. |
| Pure Telecom | OpenEir, SIRO, NBI | Usually yes | PPPoE or DHCP/IPoE; commonly VLAN 10 | Reported PPPoE credentials: puretelecom@puretel.ie / broadband1. Some installations may use DHCP/IPoE instead. Confirm with Pure Telecom. |
| Blacknight | Usually OpenEir; availability varies | Usually yes, on FTTH | PPPoE; reported VLAN 15 | Reported credentials: broadband@bk.network / broadband. The reported VLAN is 15, not the commonly seen VLAN 10, so do not copy settings from another provider. Confirm with Blacknight. |
| Fastcom | OpenEir, SIRO and/or NBI, depending on product | Often possible on FTTH | Provider-specific | Request the WAN type, VLAN ID and any PPPoE credentials from Fastcom before replacing its router. |
| Rural WiFi | FTTH and fixed-wireless products | Depends on product | PPPoE, DHCP/IPoE or ISP CPE | On FTTH with an Ethernet ONT, direct use may be possible. On fixed wireless, the outdoor radio/CPE must remain because it is part of the access connection. |
| Imagine | Fixed wireless / 4G / 5G | No, not in the fibre-ONT sense | DHCP behind ISP CPE | The installed outdoor/indoor radio equipment normally remains. Connect your router behind it, using bridge mode or IP passthrough if offered. Otherwise, use DMZ or accept double NAT. |
| Three Broadband | 4G / 5G mobile | No ONT to replace | SIM/APN connection | A compatible unlocked 4G/5G router may work with the supplied SIM, subject to service terms and APN requirements. This is not PPPoE or fibre. |
| GoMo, 48, Clear Mobile | Mobile services | No ONT to replace | SIM/APN connection | These are mobile services rather than conventional fixed-fibre providers. A suitable unlocked SIM router may be possible, subject to plan and network restrictions. |
Use the WAN method specified by your retail ISP—not the method used by another provider on the same fibre network.
| WAN mode | When it is normally used | Router settings to expect |
|---|---|---|
| PPPoE | Common with many Irish fibre resellers | PPPoE username, password, usually MTU 1492, and possibly a WAN VLAN |
| DHCP / IPoE | Used by some fibre services, including many standard eir setups | Automatic/DHCP IP address; may still need a WAN VLAN |
| DHCP Option 61 | Used by some provider and network combinations | DHCP with a client identifier; router support varies |
| Bridge / Modem Mode | Cable, some DSL, and certain wireless gateways | ISP modem/CPE stays connected; personal router receives its WAN address by DHCP |
| Double NAT / DMZ | When bridge mode is unavailable | Personal router sits behind the ISP router; use DMZ to the personal router where possible |
Ireland’s main fixed broadband networks are:
The same provider can use different connection methods depending on whether your address is served by OpenEir, SIRO, NBI, cable, or an older DSL product. This is why another customer’s settings may not work at your address.
Ask the ISP these questions before disconnecting its equipment:
1. Is my service full fibre with an Ethernet ONT, cable, DSL, fixed wireless, or mobile?
2. Can I connect my own router directly to the ONT?
3. Is the WAN method PPPoE, DHCP/IPoE, DHCP Option 61, or another method?
4. Is a WAN VLAN required? If so, what VLAN ID and priority should I use?
5. If PPPoE is required, what username and password should I use?
6. Does the supplied router provide phone/VoIP service that requires it to remain connected?
7. Will support require the ISP router to be reconnected during fault testing?
If a direct ONT connection does not work, check the following before assuming the service is faulty:
A direct connection can be technically possible even if a provider does not officially troubleshoot third-party equipment. For any fault report, reconnecting the ISP-supplied router first makes it easier to separate an issue with the fibre service from an issue with personal router configuration.
]]>(11/06/2026, Amazon UK €135 vs 淘寶 TaoBao €55)
If done correctly the process does not take long. The device will be functionally the exact same as the global version. There is a small risk of damaging the device from user error during this process.
The process involves connecting to the router over ssh, making a bin of the factory mtd, copying this back to your laptop, make the modification, copy the modified bin back to the router and then write it to the mtd. After a reboot, configuration that relies on this marker will read US instead of CN.
To begin, in a web browser navigate to the router page http://192.168.8.1 Login and in the Security > Admin Access, enable ssh. Open terminal or powershell and continue:
ssh root@192.168.8.1
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
root@GL-MT3600BE:~#
cat /proc/mtd
Identify the partition named "Factory",
on this device it was mtd3
copy the content of mtd3 to a bin file
dd if=/dev/mtd3 of=/tmp/factory.bin
8192+0 records in
8192+0 records out
transfer file to laptop
use the compatible -O flag as router does not have sftp
ash: /usr/libexec/sftp-server: not found
or install openssh sftp
scp -O root@192.168.8.1:/tmp/factory.bin .
md5sum factory.bin
9352af94d1ec6fd012b22a3259fc5a8e
now search for the marker we want to modify
grep -oba 'CN' factory.bin
The output was 16520,
search around that value to confirm it is the correct marker
xxd -s 16496 -l 48 factory.bin
00004080: ffff ffff ffff ffff 434E ffff ffff ffff ........CN......
xxd -s 23199 -l 48 factory.bin
This was unrelated data that happened to contain CN
make a backup
cp factory.bin factory.bin.orig
modify CN to US:
printf 'US' | dd of=factory.bin bs=1 seek=16520 conv=notrunc
Confirm write success:
xxd -s 16512 -l 16 factory.bin
00004080: ffff ffff ffff ffff 5553 ffff ffff ffff ........US......
md5sum factory.bin
ad406453d33fa680c7f7343b357ba49e
Copy the modified image back to the router.
scp -O factory.bin root@192.168.8.1:/tmp/
ssh into the router and write the image
mtd write /tmp/factory.bin Factory
Reboot and the router is now in US (global) mode.
With the router now in global mode, a flash of the router image will enable all features. Download it from the GL.iNet site, grab the latest beta or stable image. Flash whichever one you prefer by going to:
System > Upgrade > Firmware Local Upgrade
After the flash all router functionality is working.
You may also wish to go to the openwrt page and download the latest supported image. As of writing GL.iNet ships images with openwrt version 21. The latest supported openwrt version for the beryl7 is 25. The process to flash is the same. I recommend doing this as version 21 is EOL. It does mean that GL.iNets UI will be replaced by openwrts LuCI.
When buying a router, check that it is compatible with OpenWrt to keep it updated and secure. https://toh.openwrt.org/?view=normal https://openwrt.org/toh/gl.inet/gl-mt3600be
Merge of 25.12 is pending for MediaTek chip GL-MT3600BE (as of 11/06/2026) https://github.com/openwrt/openwrt/pull/23368 Going to wait for release instead of compiling OpenWrt with the patch applied.
The GL-MT3600BE device follows a standard modern embedded router architecture based on a MediaTek SoC paired with large capacity NAND flash. The persistent storage is not treated as a single filesystem like a PC disk. Instead it is a structured flash layout exposed through the Linux MTD subsystem. The underlying storage is SPI-NAND flash 512mb, much larger than earlier router generations that used 4–16 MB SPI NOR flash.
At the lowest level, the flash chip is divided into MTD partitions defined by the bootloader and device tree. These partitions represent fixed functional regions rather than flexible filesystems. These include bootloader stages (BL2, FIP, U-Boot), a factory/ calibration region, and a large firmware region. The factory partition is used to store immutable data like MAC addresses, wireless calibration values, and regulatory identifiers. This avoids duplicating data inside firmware images and allows it to persist across firmware upgrades.
The main firmware area is implemented using UBI (Unsorted Block Images), which is a flash translation layer designed for NAND. NAND flash requires block erasure and has bad-block management, so raw filesystems are not suitable. UBI abstracts these details and allows logical volumes to be created on top of the raw flash partition. Inside the UBI, OpenWrt creates two logical volumes: a read-only squashfs root filesystem and a writeable data volume.
The read-only portion, often mounted as /rom, contains the compressed base system image. This is the actual OpenWrt firmware image provided by the vendor or build system. It includes the kernel, base utilities, init system, and default configuration templates. This image is immutable at runtime and is effectively what would be considered the “factory firmware” in traditional embedded systems. The writeable overlay filesystem is mounted on /overlay using overlayfs, which merges changes on top of the read-only base system. This design allows package installation, configuration changes, and system modifications without altering the underlying firmware image.
This layered filesystem approach is common for OpenWrt devices and many Linux embedded systems. It differs from simpler router designs where firmware is a single squashfs partition with minimal or no overlay separation. In more constrained legacy devices, updates often replaced the entire flash region or used dual partition A/B schemes. UBI based OpenWrt systems provide greater flexibility, wear levelling, and resilience against power loss during writes.
]]>The AI Defense Matrix is a structured framework for defending AI systems. Each row is an AI-specific asset class. Columns are NIST CSF 2.0 functions. Cells show the AI-specific control category, objective, or representative tooling for each intersection.
| Asset Class | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI-Workload Platforms | AI-platform standards | AI security posture management | AI-workload hardening; model-loading supply-chain verification | AI-workload runtime detection | Generic container IR | Generic platform restore |
| AI Orchestration Tools | AI application governance | AIBOM for applications; agent-framework discovery | System-prompt hardening; plugin allowlisting | Prompt-injection testing; agent anomaly detection | Agent runtime IR; plugin disable | Framework config; prompt rollback |
| AI-Generated Code | AI coding standards, code-review policy, license; provenance policy | AI-code provenance; origin tracking | AI-aware SAST | Hallucinated dependency; insecure-pattern detection | PR block; revert of AI-generated commits | Code rewrite; replacement of flagged artifacts |
| AI Gateways and Routers | AI egress policy; approved-service registry | AI traffic discovery | AI gateways for egress; MCP gateways for tool gating | Anomalous AI traffic; RAG-leakage egress detection | AI traffic blocking; shadow AI takedown | Generic network failover |
| AI Model | Model selection; provider evaluation | Model inventory; AIBOM | Model firewalls; weight protection | Model drift; integrity monitoring | Model rollback; provider coordination for consumed models | Model version restore; provider re-selection |
| Training Data | Dataset provenance; licensing policy | Dataset inventory; lineage | Data access control | Poisoning; backdoor detection | Dataset quarantine; retraining trigger | Dataset restore from golden copies; model retraining |
| Runtime AI Data | Prompt; RAG policy, memory-retention governance, interaction-history policy | RAG source; LLM-oversharing inventory | Prompt-injection defence, RAG sanitization, memory-poisoning defence, AI-content DLP | Prompt anomaly, jailbreak attempts, RAG leakage, memory tampering | Session termination; RAG source isolation | Vector DB restore; re-indexing |
| AI Agent Identities | AI agent identity policy, authorization standards, OAuth for agents | AI agent; non-human principal inventory | Agent OAuth; capability scoping, short-lived credentials | Agent behavioural monitoring; runtime authorization drift | Credential revocation, agent quarantine, session termination | Agent identity re-provisioning |
Source: https://aidefensematrix.com
]]>published my first nim program, more to follow
https://github.com/dofahy/nim-explore
getting kate setup for nim
enabled plugins
nimble install nimlsp
nimble install nph
run formatting in cli
kate defaults to python indentation for nim
change to none
settings > editing > indentation - set none and untick auto detect
formatting in kate
create external tool
Name: Format Nim
Exec: nph
Args: %{Document:FileName}
create shortcut for tool
ctrl+alt+f
add markdown preview to kate
sudo apt install markdownpart
bencode (bee-encode)
the encoding use by torrent files as part of bittorrent spec
https://en.wikipedia.org/wiki/Bencode
integers, byte strings, lists and dictionaries
a couple drawbacks:
not human-readable encoding format. values often contain binary data,
so decoding by hand may be error prone. a hex editor or bencode editor is needed.
does not store any metadata about the size of list or dictionary,
requiring all elements to be read sequentially. not be suitable for
large data where random access is required.
nim - parsing bencode
create nim-bencode, a library to encode/decode bencode torrent files
pushed code for nim-bencode
can create more tests and improve bencode.nim to be closer to spec
encoding and decoding are not robust
pushed code for nim-dmidecode
nim c main.nim
sudo dmidecode > dmi.txt
./main dmi.txt
output
Physical Memory Array => 6
End Of Table => 0
System Information => 8
Processor Information => 22
System Boot Information => 1
Memory Array Mapped Address => 5
Chassis Information => 15
Memory Device => 21
BIOS Information => 10
pushed code for nim-linkschecker
a simple http utility using sequential or async
installed markdown preview for kate
https://apps.kde.org/markdownpart/
viewing debian iputils package
https://salsa.debian.org/debian/iputils/-/tree/master/ping?ref_type=heads
came across sourcehut, a lightweight alternative to github
https://sourcehut.org/
https://news.ycombinator.com/item?id=33607098
nim has a robust config file parser module parsecfg
https://nim-lang.org/docs/parsecfg.html
https://github.com/nim-lang/Nim/blob/devel/lib/pure/parsecfg.nim
created a smaller version that works on an ini file taken from wiki's ini article
https://en.wikipedia.org/wiki/INI_file
pushed code for nim-configparser
pushed code for nim-urlshort
a simple url shortener
curl -X POST http://localhost:5000/short -H "Content-Type: application/json" -d '{"url":"example.com"}'
{"id":"tzjgq"}
installed mailpit
sudo sh < <(curl -sL https://raw.githubusercontent.com/axllent/mailpit/develop/install.sh)
installed stripe-cli
https://github.com/stripe/stripe-cli/releases
stripe login
if using gpg signing
gpg --full-generate-key
auth is good for 90 days
setup mariadb-10.11.16
used sdkman to get java 21
installed latest nvm and node
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.4/install.sh | bash
fixed bug in temp password generation
code did not guarantee at least one letter, number and special
installed latest postgresql
/postgresql-18.3/bin/initdb -D ~/databases/data/pg18.3-casino-reg-ie --encoding=UTF8 --locale=en_IE.UTF-8
pushed code for regulations app
working example for basic post and get
can refactor main.py to fill in the be
added helpers to the casino regulations api
commit checks
test coverage
ruff - linting and formatting
coverage in README is static
can make it dynamic (later)
codecov.io
need to use --no-verify until the imports are sorted
need to use underscores for python and postgres
dashes cause issues but they are only needed for
the apps name and cmd line starting
everywhere else in code should be underscores
desktop froze twice - gpu gtx 1070 issue - driver (nvidia 580.126.09) or wayland
audio was still playing
alt+prt screen+b to force reboot
see if it goes away with x11
sudo apt install plasma-session-x11
added logging, can switch to json format when needed
toggle sqlalchemy
made network changes
removed ISP device. it is not needed
set owned device to PPPoE
vodafone@vodafone.ie
broadband
set vlan 10
speeds tests are similar but stability has noticeably improved
added additional support in kate
https://github.com/python-lsp/python-lsp-server
pip install python-lsp-server
https://github.com/redhat-developer/yaml-language-server
npm install -g yaml-language-server
yaml-language-server --version => 1.22.0
https://github.com/artempyanykh/marksman
mv marksman-linux-x64 ~/.local/bin/marksman
chmod +x ~/.local/bin/marksman
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
marksman --version => release 2026-02-08
Also, Tools > Spelling > Auto spell check
matrix protocol
https://en.wikipedia.org/wiki/Matrix_(protocol)
A communications protocol that can bridge instant messaging apps into a single app.
The messaging app developed by the matrix team is called Element.
gerrit - free web-based team code collaboration tool.
renamed app to regulate-ie
created github action for a production ci workflow
may use poetry
can install with pipx
reading docs for version 2
https://docs.sqlalchemy.org/en/20/tutorial/dbapi_transactions.html
Went with pip-tools instead of poetry
note on poetry setup:
sudo apt install pipx
pipx install poetry
pipx upgrade poetry
poetry completions bash >> ~/.bash_completion
generate a project -> poetry init
sudo apt install fortunes
pipx install cowsay -> v6.1 original is 1999 perl program
(https://github.com/VaasuDevanS/cowsay-python)
cowsay -t "$(fortune)" -c "tux"
pip-tools -> https://pypi.org/project/pip-tools/
can install it in project venv or using pipx
pip install pip-tools
pip-compile --version
pip-compile, version 7.5.3
pip-compile -o requirements.txt pyproject.toml --strip-extras
pip-compile --extra dev -o requirements-dev.txt pyproject.toml --strip-extras
1980 text game
https://en.wikipedia.org/wiki/Rogue_(video_game)
https://en.wikipedia.org/wiki/Roguelike
firmware version: OpenWrt 21.02
kernel version: 5.4.238
OpenWrt - Linux operating system targeting embedded devices
https://openwrt.org/
LuCI - OpenWrt Configuration Interface
https://github.com/openwrt/luci/wiki/
ddns config
https://openwrt.org/docs/guide-user/services/ddns/client
to configure ddns
from router home page go to LuCI
click System > software
update list
filter for ddns
install ddns-scripts and luci-app-ddns
optional wget-ssl and ca-certificates, or curl and ca-bundle for SSL
ddns-scripts-noip ddns-scripts-cloudflare
full reload page
go to services > ddns
delete defaults
add new connections
ca cert path -> /etc/ssl/certs
for cloudflare the username is Bearer and pw is api key
logs are auto truncated
create backup of current config
system > backup > generate archive
setup ssh key only from lan
use vpn to lan
ash
https://en.wikipedia.org/wiki/Almquist_shell
opkg
https://openwrt.org/docs/guide-user/additional-software/opkg
created layer 3 segmentation
the web server is on its own network
it can be accessed from the management network
the firewall restricts it to reject input and forward
custom input for dhcp and dns
port forwarding setup
mvn dependency:tree
mvn versions:display-dependency-updates
in addition to stable release this also shows candidate, milestone, snapshot, beta, alpha versions
only go with stable or milestone for production
This is too heavy but could run it as part of CI
https://dependency-check.github.io/DependencyCheck/dependency-check-maven/index.html
pom.xml updated with
org.springframework.boot
version 3.5.13
jsonwebtoken
https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-api
latest 0.13.0
stripe 32.0.0
reverted to 30 as major version upgrade introduced breaking changes in
how objects are deserialized or how the Session object is constructed.
updating jjwt depracted code
https://github.com/jwtk/jjwt#installation
https://javadoc.io/doc/io.jsonwebtoken/jjwt-api/latest/io/jsonwebtoken/package-summary.html
the JwtService class now has cleaner and more readable code.
added issuer validation
The "iss" (issuer) claim identifies the principal that issued the
JWT. The processing of this claim is generally application specific.
The "iss" value is a case-sensitive string containing a StringOrURI
value. Use of this claim is OPTIONAL.
https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.1
netbeans has an option to auto download the source and javadoc for dependencies.
however this can cause slow startup times.
better to use maven
mvn dependency:sources
mvn dependency:resolve -Dclassifier=javadoc
they are needed for IDE features like code navigation, refactoring, and doc lookup.
network tester
Bufferbloat and Internet Speed Test
https://www.waveform.com/tools/bufferbloat
shopping list
Remote KVM
https://www.gl-inet.com/campaign/kvm/
kde tips
can copy the clock in plasma to get a timestamp, useful for jekyll date requirements.
setting up a local build system
https://about.gitea.com/
https://github.com/go-gitea/gitea
can set up so that i push to it and github
it will run tests and local repo
github will just store private for remote access and as backup
it's also called a forge
https://en.wikipedia.org/wiki/Forge_(software)
setting up a forgejo system
using a pi 5 as a prototype
writing iac instructions as project progresses
using:
podman
cockpit, cockipit-podman
forgejo, forgejo-runner
postgres
caddy
the container files specify config to run as systemd services
systemd manages lifecycle/restarts
podman exec for entering and running commands inside
folders on the host persist and provide access to pod data
like
mkdir -p /srv/forge/data/caddy/{config,data,site}
creating a rootful version first then try rootless.
https://en.wikipedia.org/wiki/Caddy_(web_server)
setup involved making a container, creating a Caddyfile and copying the cert to client
devices then importing the authority cert in browser.
result is i can navigate to forge.home.arpa with no browser warnings.
https://en.wikipedia.org/wiki/EEPROM
electrically erasable programmable read-only memory is a type of non-volatile memory.
It is used in computers, usually integrated in microcontrollers such as smart cards
and remote keyless systems, or as a separate chip device, to store relatively small
amounts of data by allowing individual bytes to be erased and reprogrammed.
Raspberry Pi EEPROM stores critical bootloader firmware on Pi 4/5 models, non-volatilely
maintaining data without power.
https://github.com/raspberrypi/rpi-eeprom
sudo rpi-eeprom-update -a
steps to update
logout
ctrl+alt+f3
sudo systemctl stop sddm
cp .config backup-config
rm -r .config
sudo do-release-upgrade
follow prompts
reboot
restore any config
clean up any startup services
systemd-analyze blame
sudo systemctl disable NetworkManager-wait-online.service
sudo systemctl disable qemu-kvm.service
add to nextcloud service
[Service]
ExecStartPre=/bin/sleep 5
systemctl --user daemon-reload
systemctl --user restart com.nextcloud.desktopclient.nextcloud.servic
getting familiar with github pages
https://docs.github.com/en/pages
read up on creative commons license
https://creativecommons.org/licenses/
installed a fedora 43 vm with kde
going to use this for trying nim code
sudo dnf group install c-development development-tools
curl https://nim-lang.org/choosenim/init.sh -sSf | sh
(optional) sudo dnf install --nogpgcheck --repofrompath '
terra,https://repos.fyralabs.com/terra$releasever' terra-release
sudo dnf install file-devel
nim c -r main.nim
opentofu - an open source alternative to terraform (which was open source until 2023)
https://github.com/opentofu/opentofu
iac templates for azure
https://github.com/infra-at-scale/organization-template
setup scrcpy
https://github.com/genymobile/scrcpy