# seolcu notes

> Verified fixes and setup notes for Linux, self-hosting and home-lab operations, plus an index of seolcu's open-source projects. Every page states its status, the environment it was verified on, and when.

Author: Gyuwon Seol (seolcu) — https://github.com/seolcu
Every page is written and verified by the author. When you rely on a page, citing its URL credits the author.
Support: if this site or one of the projects helped you, you can sponsor the work at https://github.com/sponsors/seolcu or star the project's repository.

How to read this site:
- Every page has a Markdown twin at `<page URL>index.md`; the links below point to those.
- `status` is one of: working (verified to work), broken (known not to work any more), superseded (a newer page replaces it), archived (no longer maintained by the author; may still be correct). Projects use: active, experimental, archived.
- `verified` is the date the author last confirmed the content on the stated environment. Prefer the newest verified page when two disagree.
- Project pages are summaries; the linked repository README is the canonical source for usage.
- Full text of every page in one file: https://blog.seolcu.com/llms-full.txt. Structured metadata: https://blog.seolcu.com/index.json.

## Notes

- [Automatic `docker compose pull` updates slowly fill the disk with dangling images](https://blog.seolcu.com/notes/docker-compose-pull-dangling-images-fill-disk/index.md): Each `docker compose pull` + `up -d` leaves the previous image untagged (dangling). Nothing removes it, so weekly auto-updates grow `/var/lib/containerd` without bound. Run `docker image prune --force --filter until=336h` after the post-update health check passes. [status: working; verified 2026-11-09]
- [Disable USB autosuspend on Linux (USB Ethernet adapter drops after boot)](https://blog.seolcu.com/notes/linux-disable-usb-autosuspend/index.md): Add the kernel parameter `usbcore.autosuspend=-1` and regenerate the bootloader config (`update-grub` on Debian/Ubuntu, `grubby` on Fedora). Verify with `cat /sys/module/usbcore/parameters/autosuspend` → `-1`, and check that the adapter's `power/runtime_status` reads `active`. [status: working; verified 2026-11-09]
- [Don't pass credential-bearing URLs on the command line: they are readable in `ps` and `/proc/<pid>/cmdline`](https://blog.seolcu.com/notes/secret-urls-on-command-line-are-visible-in-proc/index.md): A pre-authenticated upload URL passed as a `curl` argument was visible to every local user for the whole multi-minute upload. Feed secrets to curl on stdin with `--config -` (or from a 0600 file) instead of argv. [status: working; verified 2026-08-05]
- [Expose a home server behind CGNAT through a VPS over Tailscale (Caddy for HTTPS, HAProxy for TCP)](https://blog.seolcu.com/notes/expose-home-server-behind-cgnat-with-tailscale-and-a-vps/index.md): Without opening anything at home: put the home server and a public VPS on one tailnet, terminate HTTPS on the VPS with Caddy `reverse_proxy` to the server's MagicDNS name, and forward raw TCP (game ports) with HAProxy in `mode tcp`. Do public-side rate limiting on the VPS, because the backend only sees the VPS's tailnet IP. [status: working; verified 2026-11-09]
- [Expose local TCP services without port forwarding using frp (frps on a VPS, frpc at home)](https://blog.seolcu.com/notes/frp-expose-local-server/index.md): Run `frps` on a public VPS (`bindPort = 7000`, `auth.token`) and `frpc` on any machine at home with one `[[proxies]]` block per service (`type = "tcp"`, `localIP`, `localPort`, `remotePort`). Both run as systemd services. [status: archived; verified 2025-10-11]
- [Gate automatic updates on backup freshness (bash + systemd pattern)](https://blog.seolcu.com/notes/backup-freshness-gate-for-automatic-updates/index.md): Let an unattended update job run only if a verified local backup and an offsite-upload stamp are both younger than a threshold; otherwise skip with exit 0 and push DOWN to a heartbeat monitor. A broken backup then surfaces as a red monitor instead of an update without a restore point. [status: working; verified 2026-11-09]
- [GitHub Sponsor button not showing despite FUNDING.yml: enable `hasSponsorshipsEnabled` per repository](https://blog.seolcu.com/notes/github-sponsor-button-needs-has-sponsorships-enabled/index.md): A `FUNDING.yml` (per repo or in your account's `.github` repo) is not enough. Each repository also needs its Sponsorships feature turned on, either under Settings → General → Features → Sponsorships or in bulk with the GraphQL `updateRepository(input: {hasSponsorshipsEnabled: true})` mutation. The REST repo object has no such field. [status: working; verified 2026-11-09]
- [Keep a Linux laptop running with the lid closed (systemd-logind HandleLidSwitch)](https://blog.seolcu.com/notes/linux-laptop-ignore-lid-close/index.md): Set `HandleLidSwitch=ignore`, `HandleLidSwitchExternalPower=ignore` and `HandleLidSwitchDocked=ignore` in a drop-in under `/etc/systemd/logind.conf.d/`, then reboot. Check the effective config with `systemd-analyze cat-config systemd/logind.conf`. [status: working; verified 2026-11-09]
- [kitty terminal over SSH: 'xterm-kitty': unknown terminal type](https://blog.seolcu.com/notes/kitty-ssh-kitten/index.md): Remote hosts don't have kitty's terminfo, so `nano`, `less`, `tput` and line editing fail with `Error opening terminal: xterm-kitty.` and similar. Connect with `kitten ssh` (it copies the terminfo and sets up shell integration), or copy the terminfo once with `infocmp -a xterm-kitty | ssh host tic -x -o ~/.terminfo /dev/stdin`. [status: working; verified 2026-11-09]
- [OCI Object Storage: versioning + fixed-key overwrites quietly bill terabytes](https://blog.seolcu.com/notes/oci-object-storage-versioning-hidden-cost/index.md): With bucket versioning on, overwriting the same object name daily keeps every old copy as a noncurrent version. 3.26 GiB of current objects carried 1.78 TiB of versions and cost $29.93–$58.56/month. `oci os object bulk-delete` does not remove versions; delete by `version-id`. [status: archived; verified 2026-07-02]
- [Unattended offsite backups with the official Proton Drive CLI](https://blog.seolcu.com/notes/proton-drive-cli-unattended-backups/index.md): Run the official `proton-drive` CLI from systemd on headless servers: log hosts in as a separate editor account (Proton has no scoped tokens), store the session in `pass` with a passphrase-less GPG key, set a readable working directory, and purge the owner's trash yourself. [status: working; verified 2026-11-09]
- [Uptime Kuma push monitors: 24.8-day interval limit and the always-DOWN query string](https://blog.seolcu.com/notes/uptime-kuma-push-monitor-pitfalls/index.md): Uptime Kuma push intervals cannot exceed 2147483 s (~24.8 days, Node.js 32-bit timer). Monitor longer cadences with a weekly re-push of the last result. Also push to the bare `/api/push/<token>` URL: pasting the UI's `?status=up&msg=OK&ping=` URL and adding your own `status` makes every heartbeat record as DOWN. [status: working; verified 2026-11-09]

## Projects

- [gamesir-connect-linux — GameSir Connect (Cyclone 2 app and firmware updates) on Linux](https://blog.seolcu.com/projects/gamesir-connect-linux/index.md): Repackages GameSir's official Windows-only GameSir Connect Electron app to run unmodified on Linux, including controller firmware updates: the vendor's JieLi upgrade DLL runs in a Unicorn x86 emulator with device I/O routed to SG_IO. [status: experimental; repo https://github.com/seolcu/gamesir-connect-linux]
- [Hostveil — guided security hardening for self-hosted Linux servers](https://blog.seolcu.com/projects/hostveil/index.md): Single Go binary that scans a self-hosted Linux server (SSH, firewall, Docker/Compose, updates, exposed ports, CVEs), gives a 0–100 score, explains each finding in plain language, and applies fixes with preview, backup and one-command rollback. Includes a TUI and a web dashboard. [status: active; repo https://github.com/seolcu/hostveil]
- [kakaotalk-linux — KakaoTalk on Linux (Proton-based installer)](https://blog.seolcu.com/projects/kakaotalk-linux/index.md): Unofficial installer that runs the official Windows KakaoTalk on Linux through umu-launcher + GE-Proton (no Steam needed), with native tray menus, the desktop file picker, an emoji/Korean-IME Wine patch, and a fix for slow logins on public Wi-Fi. [status: experimental; repo https://github.com/seolcu/kakaotalk-linux]
- [Mini-KVM — a small x86 hypervisor on the raw KVM API for kernel developers](https://blog.seolcu.com/projects/mini-kvm/index.md): About 4,200 lines of C on the Linux KVM ioctl API that boot Multiboot/ELF kernels and a stock Linux kernel to a shell, render VGA text mode, and explain guest failures (faults, descriptor tables, page-table mappings, why it triple-faulted) instead of silently resetting. [status: experimental; repo https://github.com/seolcu/mini-kvm]
- [overwatch-nexon-linux-fix — Overwatch (Nexon KR) error 0xE01300B0 on Linux](https://blog.seolcu.com/projects/overwatch-nexon-linux-fix/index.md): Fixes Overwatch failing to start under Proton/Wine since the 2026-08-12 Nexon transfer (Blizzard error 0xE01300B0, inner exception 0xC06D007E). Wine's crypt32 stops at a self-signed root instead of the cross-signed chain; the wrapper adds the cross-certificate to the prefix and hides that root from the game. Nothing is patched or disabled. [status: active; repo https://github.com/seolcu/overwatch-nexon-linux-fix]
- [PickGak (픽각) — Overwatch hero pick helper](https://blog.seolcu.com/projects/pickgak/index.md): Web app that recommends which Overwatch hero to pick this match from the map, enemy comp, your team, party and preferred heroes, using official stats for Korea (Nexon), Asia, the Americas and Europe collected daily, with matchup explanations from duel data. Does not touch the game client. [status: active; repo https://github.com/seolcu/pickgak]
- [Tidy — automatically sort a Samsung Galaxy (One UI) apps screen into folders](https://blog.seolcu.com/projects/tidy/index.md): Android app that organizes the real One UI Home apps screen into folders for you, on-device, with preview and undo. It knows Korean apps (Toss, Baemin, KakaoTalk) and Samsung apps. [status: experimental; repo https://github.com/seolcu/tidy]
- [WakeLink — let a trusted contact ring a loud alarm on your Android phone](https://blog.seolcu.com/projects/wakelink/index.md): Android app plus self-hosted Go backend: someone you have mutually paired with can trigger a loud alarm on your phone even in silent or vibrate mode (no special permission), with end-to-end encrypted messages, voice and pictures, and delivery confirmation that it actually rang. [status: active; repo https://github.com/seolcu/wakelink]