Notes

• Automatic docker compose pull updates slowly fill the disk with dangling images working verified 2026-11-09

  Each docker compose pull + up -d leaves the previous image untagged (dangling). Nothing removes it, so weekly auto-updates grow /var/lib/containerd without bound. Run docker image prune --force --filter until=336h after the post-update health check passes.

• Disable USB autosuspend on Linux (USB Ethernet adapter drops after boot) working verified 2026-11-09

  Add the kernel parameter usbcore.autosuspend=-1 and regenerate the bootloader config (update-grub on Debian/Ubuntu, grubby on Fedora). Verify with cat /sys/module/usbcore/parameters/autosuspend → -1, and check that the adapter’s power/runtime_status reads active.

• Don’t pass credential-bearing URLs on the command line: they are readable in ps and /proc/<pid>/cmdline working verified 2026-08-05

  A pre-authenticated upload URL passed as a curl argument was visible to every local user for the whole multi-minute upload. Feed secrets to curl on stdin with --config - (or from a 0600 file) instead of argv.

• Expose a home server behind CGNAT through a VPS over Tailscale (Caddy for HTTPS, HAProxy for TCP) working verified 2026-11-09

  Without opening anything at home: put the home server and a public VPS on one tailnet, terminate HTTPS on the VPS with Caddy reverse_proxy to the server’s MagicDNS name, and forward raw TCP (game ports) with HAProxy in mode tcp. Do public-side rate limiting on the VPS, because the backend only sees the VPS’s tailnet IP.

• Expose local TCP services without port forwarding using frp (frps on a VPS, frpc at home) archived verified 2025-10-11

  Run frps on a public VPS (bindPort = 7000, auth.token) and frpc on any machine at home with one [[proxies]] block per service (type = "tcp", localIP, localPort, remotePort). Both run as systemd services.

• Gate automatic updates on backup freshness (bash + systemd pattern) working verified 2026-11-09

  Let an unattended update job run only if a verified local backup and an offsite-upload stamp are both younger than a threshold; otherwise skip with exit 0 and push DOWN to a heartbeat monitor. A broken backup then surfaces as a red monitor instead of an update without a restore point.

• GitHub Sponsor button not showing despite FUNDING.yml: enable hasSponsorshipsEnabled per repository working verified 2026-11-09

  A FUNDING.yml (per repo or in your account’s .github repo) is not enough. Each repository also needs its Sponsorships feature turned on, either under Settings → General → Features → Sponsorships or in bulk with the GraphQL updateRepository(input: {hasSponsorshipsEnabled: true}) mutation. The REST repo object has no such field.

• Keep a Linux laptop running with the lid closed (systemd-logind HandleLidSwitch) working verified 2026-11-09

  Set HandleLidSwitch=ignore, HandleLidSwitchExternalPower=ignore and HandleLidSwitchDocked=ignore in a drop-in under /etc/systemd/logind.conf.d/, then reboot. Check the effective config with systemd-analyze cat-config systemd/logind.conf.

• kitty terminal over SSH: ‘xterm-kitty’: unknown terminal type working verified 2026-11-09

  Remote hosts don’t have kitty’s terminfo, so nano, less, tput and line editing fail with Error opening terminal: xterm-kitty. and similar. Connect with kitten ssh (it copies the terminfo and sets up shell integration), or copy the terminfo once with infocmp -a xterm-kitty | ssh host tic -x -o ~/.terminfo /dev/stdin.

• OCI Object Storage: versioning + fixed-key overwrites quietly bill terabytes archived verified 2026-07-02

  With bucket versioning on, overwriting the same object name daily keeps every old copy as a noncurrent version. 3.26 GiB of current objects carried 1.78 TiB of versions and cost $29.93–$58.56/month. oci os object bulk-delete does not remove versions; delete by version-id.

• Unattended offsite backups with the official Proton Drive CLI working verified 2026-11-09

  Run the official proton-drive CLI from systemd on headless servers: log hosts in as a separate editor account (Proton has no scoped tokens), store the session in pass with a passphrase-less GPG key, set a readable working directory, and purge the owner’s trash yourself.

• Uptime Kuma push monitors: 24.8-day interval limit and the always-DOWN query string working verified 2026-11-09

  Uptime Kuma push intervals cannot exceed 2147483 s (~24.8 days, Node.js 32-bit timer). Monitor longer cadences with a weekly re-push of the last result. Also push to the bare /api/push/<token> URL: pasting the UI’s ?status=up&msg=OK&ping= URL and adding your own status makes every heartbeat record as DOWN.

Projects

• gamesir-connect-linux — GameSir Connect (Cyclone 2 app and firmware updates) on Linux experimental verified 2026-11-09

  Repackages GameSir’s official Windows-only GameSir Connect Electron app to run unmodified on Linux, including controller firmware updates: the vendor’s JieLi upgrade DLL runs in a Unicorn x86 emulator with device I/O routed to SG_IO.

• Hostveil — guided security hardening for self-hosted Linux servers active verified 2026-11-09

  Single Go binary that scans a self-hosted Linux server (SSH, firewall, Docker/Compose, updates, exposed ports, CVEs), gives a 0–100 score, explains each finding in plain language, and applies fixes with preview, backup and one-command rollback. Includes a TUI and a web dashboard.

• kakaotalk-linux — KakaoTalk on Linux (Proton-based installer) experimental verified 2026-11-09

  Unofficial installer that runs the official Windows KakaoTalk on Linux through umu-launcher + GE-Proton (no Steam needed), with native tray menus, the desktop file picker, an emoji/Korean-IME Wine patch, and a fix for slow logins on public Wi-Fi.

• Mini-KVM — a small x86 hypervisor on the raw KVM API for kernel developers experimental verified 2026-11-09

  About 4,200 lines of C on the Linux KVM ioctl API that boot Multiboot/ELF kernels and a stock Linux kernel to a shell, render VGA text mode, and explain guest failures (faults, descriptor tables, page-table mappings, why it triple-faulted) instead of silently resetting.

• overwatch-nexon-linux-fix — Overwatch (Nexon KR) error 0xE01300B0 on Linux active verified 2026-11-09

  Fixes Overwatch failing to start under Proton/Wine since the 2026-08-12 Nexon transfer (Blizzard error 0xE01300B0, inner exception 0xC06D007E). Wine’s crypt32 stops at a self-signed root instead of the cross-signed chain; the wrapper adds the cross-certificate to the prefix and hides that root from the game. Nothing is patched or disabled.

• PickGak (픽각) — Overwatch hero pick helper active verified 2026-11-09

  Web app that recommends which Overwatch hero to pick this match from the map, enemy comp, your team, party and preferred heroes, using official stats for Korea (Nexon), Asia, the Americas and Europe collected daily, with matchup explanations from duel data. Does not touch the game client.

• Tidy — automatically sort a Samsung Galaxy (One UI) apps screen into folders experimental verified 2026-11-09

  Android app that organizes the real One UI Home apps screen into folders for you, on-device, with preview and undo. It knows Korean apps (Toss, Baemin, KakaoTalk) and Samsung apps.

• WakeLink — let a trusted contact ring a loud alarm on your Android phone active verified 2026-11-09

  Android app plus self-hosted Go backend: someone you have mutually paired with can trigger a loud alarm on your phone even in silent or vibrate mode (no special permission), with end-to-end encrypted messages, voice and pictures, and delivery confirmation that it actually rang.