Notes on seolcu notes

Automatic `docker compose pull` updates slowly fill the disk with dangling images

Mon, 09 Nov 2026 00:00:00 +0000

Each docker compose pull + up -d leaves the previous image untagged (dangling). Nothing removes it, so weekly auto-updates grow /var/lib/containerd without bound. Run docker image prune --force --filter until=336h after the post-update health check passes.

Don't pass credential-bearing URLs on the command line: they are readable in `ps` and `/proc//cmdline`

Mon, 09 Nov 2026 00:00:00 +0000

A pre-authenticated upload URL passed as a curl argument was visible to every local user for the whole multi-minute upload. Feed secrets to curl on stdin with --config - (or from a 0600 file) instead of argv.

Expose a home server behind CGNAT through a VPS over Tailscale (Caddy for HTTPS, HAProxy for TCP)

Mon, 09 Nov 2026 00:00:00 +0000

Without opening anything at home: put the home server and a public VPS on one tailnet, terminate HTTPS on the VPS with Caddy reverse_proxy to the server’s MagicDNS name, and forward raw TCP (game ports) with HAProxy in mode tcp. Do public-side rate limiting on the VPS, because the backend only sees the VPS’s tailnet IP.

Gate automatic updates on backup freshness (bash + systemd pattern)

Mon, 09 Nov 2026 00:00:00 +0000

Let an unattended update job run only if a verified local backup and an offsite-upload stamp are both younger than a threshold; otherwise skip with exit 0 and push DOWN to a heartbeat monitor. A broken backup then surfaces as a red monitor instead of an update without a restore point.

GitHub Sponsor button not showing despite FUNDING.yml: enable `hasSponsorshipsEnabled` per repository

Mon, 09 Nov 2026 00:00:00 +0000

A FUNDING.yml (per repo or in your account’s .github repo) is not enough. Each repository also needs its Sponsorships feature turned on, either under Settings → General → Features → Sponsorships or in bulk with the GraphQL updateRepository(input: {hasSponsorshipsEnabled: true}) mutation. The REST repo object has no such field.

OCI Object Storage: versioning + fixed-key overwrites quietly bill terabytes

Mon, 09 Nov 2026 00:00:00 +0000

With bucket versioning on, overwriting the same object name daily keeps every old copy as a noncurrent version. 3.26 GiB of current objects carried 1.78 TiB of versions and cost $29.93–$58.56/month. oci os object bulk-delete does not remove versions; delete by version-id.

Unattended offsite backups with the official Proton Drive CLI

Mon, 09 Nov 2026 00:00:00 +0000

Run the official proton-drive CLI from systemd on headless servers: log hosts in as a separate editor account (Proton has no scoped tokens), store the session in pass with a passphrase-less GPG key, set a readable working directory, and purge the owner’s trash yourself.

Uptime Kuma push monitors: 24.8-day interval limit and the always-DOWN query string

Mon, 09 Nov 2026 00:00:00 +0000

Uptime Kuma push intervals cannot exceed 2147483 s (~24.8 days, Node.js 32-bit timer). Monitor longer cadences with a weekly re-push of the last result. Also push to the bare /api/push/<token> URL: pasting the UI’s ?status=up&msg=OK&ping= URL and adding your own status makes every heartbeat record as DOWN.

Disable USB autosuspend on Linux (USB Ethernet adapter drops after boot)

Sat, 11 Oct 2025 00:00:00 +0000

Add the kernel parameter usbcore.autosuspend=-1 and regenerate the bootloader config (update-grub on Debian/Ubuntu, grubby on Fedora). Verify with cat /sys/module/usbcore/parameters/autosuspend → -1, and check that the adapter’s power/runtime_status reads active.

Expose local TCP services without port forwarding using frp (frps on a VPS, frpc at home)

Sat, 11 Oct 2025 00:00:00 +0000

Run frps on a public VPS (bindPort = 7000, auth.token) and frpc on any machine at home with one [[proxies]] block per service (type = "tcp", localIP, localPort, remotePort). Both run as systemd services.

Keep a Linux laptop running with the lid closed (systemd-logind HandleLidSwitch)

Sat, 11 Oct 2025 00:00:00 +0000

Set HandleLidSwitch=ignore, HandleLidSwitchExternalPower=ignore and HandleLidSwitchDocked=ignore in a drop-in under /etc/systemd/logind.conf.d/, then reboot. Check the effective config with systemd-analyze cat-config systemd/logind.conf.

kitty terminal over SSH: 'xterm-kitty': unknown terminal type

Sat, 11 Oct 2025 00:00:00 +0000

Remote hosts don’t have kitty’s terminfo, so nano, less, tput and line editing fail with Error opening terminal: xterm-kitty. and similar. Connect with kitten ssh (it copies the terminfo and sets up shell integration), or copy the terminfo once with infocmp -a xterm-kitty | ssh host tic -x -o ~/.terminfo /dev/stdin.