For some months now I’m running a private GitLab server. I really enjoy using it, especially with all the great features like the Docker Container Registry and GitLab Pages to host static pages, even with own domains. Normally I would prefer a more lightweight solution, such as Gitea but GitLab has so many advantages that, at least for me, this is currently the only way to go. However, it felt tedious setting it up, even with Docker. You have to configure GitLab to serve stuff using plain HTTP, provide different ports for different apps to be able to create own vhosts in the reverse proxy and so on. So I decided to quickly write up what I did to get it working. Maybe I’m wrong and there’s a much easier way to do it but I couldn’t find it. Additionally, in the meanwhile I switched from Caddy as a reverse proxy to Traefik since it can attach directly to the Docker daemon, listens to changes in the domain configuration, request new HTTPS certificates on the fly while new containers are spawned and - best of all - I don’t need a separate configuration file. So the guide this time is still using Docker and docker-compose, but Traefik instead of Caddy. But you can basically use any reverse proxy to set it up, like nginx-proxy.

For a project I was working on, I had a folder structure full of images and wanted to compress them to a specific maximum resolution in-place while retaining the aspect ratio using ImageMagick. The crucial point, as so often, were spaces and special characters in the folder names, making it really hard to use bash loops etc. to make this work. With the NULL character trick, luckily this works pretty well.

In the last days I tinkered a bit with things in Git that I haven’t tried yet. One was signed commits. Signed commits help other people to know that it’s actually you who committed changes. So when people trust you as a person, they can also trust your code because they can verify that it’s been actually done by you.

It’s pretty easy to set up and once configured, everything else will just happen automatically.

I maintain an archive of videos, especially documentaries from public media libraries from tv channels etc. on my NAS. Whilst I can use youtube-dl for the most part, it’s rather difficult for sites that use HTTP live streaming (HLS) to stream their content. In the most cases this is even AES-128 encrypted, which makes it difficult to download it. But since there’s players that support playback, it’s obviously possible to decode the stream on the client side. ffmpeg is the swiss army knife for video/audio encoding and muxing and therefore the perfect utility for downloading encrypted HLS content.

Even though there are like one million guides on how to secure macOS properly, I decided to throw in my 5c on this topic. In contrast to many other guides, I’d just like to provide you with the best practices that I also use. This one is about the essential things that I always do when getting a new Mac to provide better security while preserving almost all macOS features like iCloud document saving or Time Machine usage.

During a setup change I had to temporarily move my incoming mailserver to Gmail and while I am now back in my own mail server, I again had this major headache of configuring the my DNS (using BIND) because I always forget the dots in the end of CNAME and MX records because usually I dont create nameserver records for external domains… So anyway here is the final configuration I used in Hetzners Domain Robot:

In this article I will show you how to set up your own RSS feed aggregator with sync support for many third-party clients through the Fever API as a replacement for Apple News/Google News/Feedly. This article is part of the byeCloud series in which I try to replace iCloud with self-hosted services.

Choosing the right software

I fiddled around for a while with the News app for Nextcloud, ttr-rss and a few other alternatives, but ended up with Miniflux (now in version 2) because it is simple and lightweight and provides the most important thing for me, a Fever-compatible API without any plugins. Fever is a self-hosted but closed-source and paid RSS feed aggregator that has integration in quite a few third-party clients. Luckily, Miniflux provides a API that implements the Fever specs, meaning that it can be used with clients that support Fever, in my case this is Reeder for macOS and iOS, probably the best news reader you can get ;-)

As it turns out, the Apple Time Capsule only uses SMB protocol version 1 and NTLM for authentication. While this works with macOS without any changes, it often creates problem when trying to mount the the Time Capsule’s SMB share on a Linux system. With this parameters, mounting should work out of the box, given you have the cifs-utils (Debian/Ubuntu) installed:

sudo mount.cifs //10.0.0.1/Data /mnt/timecapsule/ -o password='yourpw',sec=ntlm,uid=<local user>,vers=1.0

If you have any problems or further insights, feel free to leave a comment.

In this screencast we’re exploring the way Git saves files, directories commits and tags in it’s internal data structure, how we can inspect them and how they related to each other.

This video is meant to provide additional information for people that already use Git and want to know how it works under the hood.

Actually I like this approach to learn things and I think I’ll do another screencast on this topic, maybe providing additional information about how pack files and garbage collection works, how branches are stored and how integrity of data is ensured by their filenames.

Current macOS versions are weird… Often when I connect my MacBook Pro to the two screens on my desk, the wallpaper on one of that guys is either gone or changed to a different one.

After many attempts to search them in my bunch of 2k wallpapers, I eventually gave up and wrote a script that sets the wallpaper on all my screens like this:

osascript -e 'tell application "System Events" to set picture of every desktop to ("/some/path/wallpaper.png" as POSIX file as alias)'

This is a simple call to osascript (Open Scripting Architecture… script) which evaluates the AppleScript provided by -e.