Git on Janik von Rotz

Git and Jujutsu

Thu, 09 Apr 2026 07:30:58 +0200

To know how to git is to know pain. I wouldn’t describe myself as a master of git. Never done the bisect and rebase onto stuff. Because git is my daily driver on the command line I am always interested to learn how to use it better.

One thing that seems to be a good fit for git is jujutsu. It showed up in my feed once again.

In software engineering git has become single most important tool. But as mentioned some parts of git are and will always be a hassle. One such thing is rewriting the history and it seems jujutsu solves exactly that.

Lets head over to https://docs.jj-vcs.dev/latest/install-and-setup/ and install jujutsu. In my case installing a new tool means extending the https://codeberg.org/janikvonrotz/dotfiles repo.

The jujutsu cli can be invoked with jj. Lets do our first commit in the Odoo-Build repo.

When I checked the status of the repo I got this:

*[main][~/Odoo-Build]$ jj status
Error: There is no jj repo in "."
Hint: It looks like this is a git repo. You can create a jj repo backed by it by running this:
jj git init

Ok, so jj does not work directly with a git repo.

*[main][~/Odoo-Build]$ jj git init
Done importing changes from the underlying Git repo.
Setting the revset alias `trunk()` to `main@origin`
Hint: The following remote bookmarks aren't associated with the existing local bookmarks:
  chore-task-script-style-guide@origin
  main@origin
Hint: Run the following command to keep local bookmarks updated on future pulls:
  jj bookmark track chore-task-script-style-guide --remote=origin
  jj bookmark track main --remote=origin
Initialized repo in "."
Hint: Running `git clean -xdf` will remove `.jj/`!

Not sure what bookmarks are, but they seem important. Let’s check status again.

*[main][~/Odoo-Build]$ jj status
Working copy changes:
M bin/upgrade-odoo
Working copy  (@) : yxssyntv 7e4c4ccf (no description set)
Parent commit (@-): kwlvwrwt 8d967000 main main@origin | fix(upgrade-odoo): correct typo in drop-database condition

And now the commit!

*[main][~/Odoo-Build]$ jj commit
Working copy  (@) now at: xtkvuony 270d625b (empty) (no description set)
Parent commit (@-)      : yxssyntv 3a37f97a feat(odoo-upgrade): improve script
Warning: Name and email not configured. Until configured, your commits will be created with the empty identity, and can't be pushed to remotes.
Hint: To configure, run:
  jj config set --user user.name "Some One"
  jj config set --user user.email "someone@example.com"

Mhm, so jujutsu is not aware of the git config. Switching into the dotfiles project.

Defined a config.toml and symlinked it.

Then I looked up the flow to commit to main:

jj log
jj commit -m "msg"
jj bookmark set --revision @- main
jj git push -r @-
jj op log

I assume this is done once. Lets try it.

*[main][~/dotfiles]$ jj st
Working copy changes:
A jujutsu/config.toml
Working copy  (@) : qwsmynwm 5dbd8abe (no description set)
Parent commit (@-): psztsywm 2f76627e main main@origin | feat(prompts): create symlink to jujutsu config after installation

*[main][~/dotfiles]$ jj commit -m "feat(jujutsu): add config"
Working copy  (@) now at: xmpwvrys 48e0daa3 (empty) (no description set)
Parent commit (@-)      : qwsmynwm 698ba34e feat(jujutsu): add config

[698ba34][~/dotfiles]$ jj bookmark set --revision @- main
Moved 1 bookmarks to qwsmynwm 698ba34e main* | feat(jujutsu): add config

[698ba34][~/dotfiles]$ jj git push -r @-
Warning: Non-tracking remote bookmark main@origin exists
Hint: Run `jj bookmark track main --remote=origin` to import the remote bookmark.
Nothing changed.

Something has been committed. But remote tracking did not work.

Trying to push through…

[698ba34][~/dotfiles]$ jj git push
Warning: Non-tracking remote bookmark main@origin exists
Hint: Run `jj bookmark track main --remote=origin` to import the remote bookmark.
Nothing changed.

[698ba34][~/dotfiles]$ jj bookmark track main --remote=origin
Started tracking 1 remote bookmarks.

[698ba34][~/dotfiles]$ jj git push
Changes to push to origin:
  Move forward bookmark main from 2f76627e4984 to 698ba34edd9c
git: Enumerating objects: 5, done.
git: Counting objects: 100% (5/5), done.
git: Delta compression using up to 16 threads
git: Compressing objects: 100% (3/3), done.
git: Writing objects: 100% (4/4), 438 bytes | 438.00 KiB/s, done.
git: Total 4 (delta 1), reused 0 (delta 0), pack-reused 0 (from 0)
[698ba34][~/dotfiles]$

It worked! Obviously, I lack the understanding of what went on. I have to understand what bookmarks are and how the interaction with git remotes works.

There is a guide on how to interact with GitHub: https://docs.jj-vcs.dev/latest/github/

And here is an explainer on bookmarks: https://docs.jj-vcs.dev/latest/bookmarks/

Also I think it is worth trying jujutsu without git. In that regards gerrit seem very interesting: https://gerrithub.io/Documentation/intro-how-gerrit-works.html

Git Cheat Sheet

Thu, 25 Nov 2021 11:58:06 +0100

A simple git cheat sheet.

Commit

Change last commit message.
git commit --amend

Remote

List remotes.
git remote -v

List remote branches.
git branch -r

Add multiple push urls.

git remote set-url origin --push --add <a remote>
git remote set-url origin --push --add <another remote>

Add upstream.
git remote add upstream ssh@example.com/ORIGINAL_OWNER/ORIGINAL_REPOSITORY.git

Update fork.\

git fetch upstream
git merge upstream/main

Resolve history mismatch.\

git fetch --all
git reset --hard origin/master

Branching

Move commit to another branch.\

git checkout -b $BRANCH

git switch master
git reset --hard HEAD~1
git push -f

Fetch branch without checking out.
git fetch origin master

Prune local remote branches .
git remote prune origin

Pull all remote branches.\

git branch -r | grep -v '\->' | while read remote; do git branch --track "${remote#origin/}" "$remote"; done
git fetch --all
git pull --all

Delete local branches except master.
`git branch | grep -v “master” | xargs git branch -D

Delete local branches that do not exist on remote.\

git fetch -p && git branch --merged | grep -v '\*' | xargs -n 1 git branch -d

Staging

Save unstaged changes.\

git stash
git stash apply

Stash a specific file.
git stash file path/to/file

Remove untracked local files and directories.
git clean -df

Stash with name.
git stash save "$DESCRIPTION"

Log

Search the git log.
git log --all --grep='Build 0051'

Submodule

Create local config.
git submodule init

Clone submodules.
git submodule update

Initialize and pull git submodules recursively.
git submodule update --init --recursive

Show remote of submodules.
git config --file=.gitmodules -e

Remove a submodule.\

# Remove submodule from .git/config
git submodule deinit -f path_to_submodule

# Remove submodule from .gitmodule and remove directory 
git rm --cached path_to_submodule

# Remove submodule form .git/modules directory
rm -rf .git/modules/path_to_submodule

# Remove submodule
rm -rf path_to_submodule

Get current branch of submodules.
git submodule foreach 'git status' | grep 'On branch' -b1

Remove all submdoules.\

# Deinit all submodules from .gitmodules
git submodule deinit .

# Remove all submodules (`git rm`) from .gitmodules
git submodule | cut -c43- | while read -r line; do (git rm "$line"); done

# Delete all submodule sections from .git/config (`git config --local --remove-section`) by fetching those from .git/config
git config --local -l | grep submodule | sed -e 's/^\(submodule\.[^.]*\)\(.*\)/\1/g' | while read -r line; do (git config --local --remove-section "$line"); done

# Manually remove leftovers
rm .gitmodules
rm -rf .git/modules

Diff

Setup merge tool.
git config merge.tool vimdiff

Show changed files only.
git diff --name-only HEAD HEAD~1

Show changes for one file only.
git diff HEAD HEAD~1 path/to/file

Show diff for commit and its ancestor .
git diff 0690a1046771702ec50c3ccf9e834d33debeb2f0^ 0690a1046771702ec50c3ccf9e834d33debeb2f0

Config

Set default editor.
git config --global core.editor "vim"

Pull Requests

You can checkout a single pull request reference by doing.\

# Replace $PR with the pull request number.
git fetch origin pull/$PR/head
git checkout FETCH_HEAD

If you want to fetch them all.\

git fetch origin +refs/pull/*/merge:refs/remotes/origin/pr/*

For which you can then checkout the pull request by doing.\

git checkout origin/pr/$PR

If you want to automatically fetch pull requests you can add it to your repo’s config.\

git config --add remote.origin.fetch +refs/pull/*/merge:refs/remotes/origin/pr/*/merge
git fetch

Rebase

Squal the last three commits.\

git rebase -i HEAD~3

Then use keywords pick to select final commit and squash for the once to be merged.

Remove zip files from git history.\

git filter-branch --tree-filter 'rm -f path/to/folder/*.zip' HEAD
git push origin --force --all

Understand Git

Thu, 18 Nov 2021 08:29:50 +0100

Everybody who works with a computer must understand the basics of git and how to collaborate with git.

Git has become the de facto standard for software version control (SVC). Almost any code or documentation is stored in a git repository. It is so important that I believe everybody, who is working a computer, must understand the concept of SVC / git.

Obsidian and Vuepress: include markdown files

Fri, 29 Oct 2021 19:21:40 +0200

I am using Obisidan to manage markdown files and Vuepress to publish them. With the help of a script build.js the Obsidian vault is converted into a publishable format for Vuepress. Obsidian supports embeding markdown files using the ![](file.md) syntax. Here I’ll show you how this feature can be enabled for Vuepress.

First we need to support including markdown files for Vuepress. Install the markdown-it extension.

npm install --save markdown-it-include

And enable it (Vuepress v1).

.vuepress/config.js

module.exports = {
	// ...
    extendMarkdown: (md) => {
        md.use(require('markdown-it-include'))
    }
}

Before the Vuepress build is created the build.js file is executed.

// ...

function convert(content,file) {
    // ...
	
    // convert include markdown links
    // ![title](file.md) -> !!!include(file.md)!!!
    const mdInclude = /(!\[.*?\]\(.*?\.md\))/g
    matches = content.match(mdInclude) || []
    for (i = 0; i < matches.length; i++) {
        let match = matches[i]
        
        let include = match.match(/!\[.*\]\((.*\.md)\)/)[1]
        include = sanitizeName(include)
                
        content = content.replace(match, `!!!include(${include})!!!`)
    }
	
	//...
	
	return content
}

// ...

This is just an excerpt. The script does a lot more. It renames files, moves assets, builds indexes and overall tweaks the markdown files to work with Vuepress.

Have look here for a full example.

Sync Obsidian mobile app with Working Copy git repo

Tue, 31 Aug 2021 09:55:35 +0200

I’m using the Obsidian note taking app for almost anything. Having everything stored in plain text Markdown files makes it easy to sync the Obsidian vault with any file sync provider. However, getting the Obsidian vault on the mobile phone without their syncing service is not so easy. In this guide I will explain how you can sync the Obsidian vault to your phone using git and Working Copy.

This guide assumes that you have the following setup:

Obisidan vault commited with git
Remote repository on GitHub, GitLab or somewhere else
iPhone and Working Copy app with access to remote repository

Lets start

Open the Obsidian mobile app and create a new vault with the same name as your desktop vault

Go to settings, open the advanced options and set for Override config folder the value .obsidian-mobile

Open Working Copy on your phone, open the repo and click on the top right icon.

Select Setup Folder Sync and choose the Obsidian vault folder.

Now Working Copy will sync the repo with the Obsidian vault folder.

Reopen the Obsidian vault on your phone and check if the app indexes the new files.

Now you can update files with the Obsidian mobile app and commit the changes with Working Copy.

The Obsidian mobile and destkop app will store their config separately.

Git pull overwrite local changes

Thu, 07 Jan 2021 10:23:38 +0100

A new year a new post. Instead of a new years resolution I’ve got a git wisdom for you. If you ever have to reset your repository/life use this command:

git fetch --all
git reset --hard origin/master
git pull origin master

It will fetch the latest changes, reset the local repo and then pull the master branch.

Undo a pushed git merge

Tue, 11 Sep 2018 18:37:25 +0200

First of all the solution to the problem I am tackling should not exist in the first place. If you have to revert a merge on a git branch, think about alternatives. If not other option is left, I’ll show you how you can undo a merge with git revert.

First checkout your branch that has been targeted by the merge.

git checkout master

Have a look into the git log and look for the hash of the merge commit.

git log

Now undo the merge using the revert command.

git revert -m 1 COMMIT_HASH

As mentioned undoing is a dangerous process. Depending on how far the merge commit is from the head of your branch you end up with a lot of conflicts.

Check the git repo for conflicts.

git status

Once you have resolved the issues you can commit the revert commit.

git commit

Congrats! You did something were bad 😠

Git branch typing completion and other useful stuff

Fri, 22 Jun 2018 09:11:28 +0000

Recently I was looking a way to have auto completion with git when checking out a branch. The solution was kind of obvious. The github git mirror repository has a folder containing experimental tools. One of these tools is a shell scripts that enables completion for various git sub commands. Exactly what I was looking for.

If you also want to make use of this feature, you can download the script with the command below:

curl https://raw.githubusercontent.com/git/git/master/contrib/completion/git-completion.bash -o ~/.git-completion.bash

Scripts for other shells are available.

If you are bash user like I am, you can enable the completion script in your bash profile with the following command:

test -f ~/.git-completion.bash && . $_

Using pass in teams

Tue, 03 Apr 2018 08:29:22 +0000

Introduction

Pass is the standard password manager for Unix systems. It follows the Unix philosophy.

Pass saves passwords in text files and encrypts them using a gpg key. The folder structure containing the encrypted files is the pass store. Sharing a pass store without handing over the gpg key requires a gpg key exchange. Git is integrated into the pass cli and is used as version control system.

This document is a guideline for users which require access to a shared pass store and is also a documentation of how to set up a shared pass store. The first part elaborates the process of creating a shared pass store and the second part shows how collaboration from the perspective of a user looks like.

Variables

In the document you will find different variables starting and ending with _ underscore. Below is a description of what those variables mean.

$PROJECT_NAME: A unique name for the shared pass store folder.
$GIT_REMOTE_URL_: Remote url of the shared pass store git repository.
$PERSONAL_MAIL: Personal mail address which is used as gpg key id.
$TEAM_MAIL: Shared team mail address which is used for the shared gpg key id.

Setup a shared pass store

Install pass using the package manager of your choice and setup a new personal store.

Install pass using yum.
yum install pass

If you do not have a personal gpg key, create one. Make sure to set a correct mail address.
gpg --gen-key

Initialize a personal pass store.
pass init $PERSONAL_MAIL

Passwords are encrypted with a gpg key. In a team environment the gpg key should not impersonate somebody but rather the team itself. That is why a new gpg key is required.

gpg --gen-key
# Real name:
> $TEAM_MAIL
# Email address:
> $TEAM_MAIL
# Confirm
> O
# Enter the password
> _PASSWORD_

Create a new pass store in a subfolder.
pass init -p $PROJECT_NAME $TEAM_MAIL

Add the gpg test password to the new store.
pass generate $PROJECT_NAME/sharedpass 20

Setup a git repo for the shared pass store.

cd ~/.password-store/$PROJECT_NAME
git init
git add .
git commit -m "Init $PROJECT_NAME password store"
git remote add origin $GIT_REMOTE_URL_
git push --set-upstream origin master

Add the gpg public key to the store.

mkdir .gpg-keys
gpg --output .gpg-keys/$TEAM_MAIL.gpg --export $TEAM_MAIL
git add $TEAM_MAIL.gpg
git commit -m "Add $TEAM_MAIL public key"
git push

The remote repo can be cloned as a subfolder into the existing pass store folders. Git will treat the subfolder as a git submodule.

Request access to shared pass store

In the following steps we assume that another member of the team requires access to the shared pass store.

Clone the shared pass store repository.
git clone $GIT_REMOTE_URL_ ~/.password-store/$PROJECT_NAME

The shared pass store is now available as subfolder to your personal pass store. If you have enabled git for the personal pass store the subfolder will be treated as git submodule. Changes in the shared pass store will not affect your personal store.

In order to be able to decrypt the passwords in the shared pass store, the store key must be signed by the personal gpg key.

List your gpg keys.
gpg --list-key

Add the personal key to the shared pass store.
echo "$PERSONAL_MAIL" >> ~/.password-store/$PROJECT_NAME/.gpg-id

And export the public gpg key.
gpg --output ~/.password-store/$PROJECT_NAME/.gpg-keys/$PERSONAL_MAIL.gpg --export $PERSONAL_MAIL

Then submit a request by committing the gpg id.

cd ~/.password-store/$PROJECT_NAME
git add .
git commit -m "Request access for $PERSONAL_MAIL"
git push

The receiver of this request is the owner of the shared pass store signer key $TEAM_MAIL.

Grant access to users

The owner of the signer key must sign all keys of new team members.

First import the new keys.

cd ~/.password-store/$PROJECT_NAME/.gpg-keys
gpg --import $PERSONAL_MAIL.gpg

Then sign the imported key.

gpg --local-user $TEAM_MAIL --sign-key $PERSONAL_MAIL
gpg --edit-key $PERSONAL_MAIL
# Confirm
> y
# enter the passphrase for $TEAM_MAIL
> save

Reinitialize the password store.
pass init -e -p $PROJECT_NAME $(cat ~/.password-store/$PROJECT_NAME/.gpg-id)

Push the changes.

cd ~/.password-store/$PROJECT_NAME
git push

The user should now be able the decrypt the password using the $PERSONAL_MAIL key.

Contribute to a shared pass store

New password insertions must be encrypted with the $TEAM_MAIL gpg key.

The gpg key can be imported from the shared pass folder.

cd ~/.password-store/$PROJECT_NAME/.gpg-keys
gpg --import $TEAM_MAIL.gpg

In order to encrypt new pass entries, you must trust the key.

gpg --edit-key $TEAM_MAIL.gpg
> trust
> 5
# exit the cli

Now you can start creating new entries using the pass cli.

Notes

If there is a gpg registry you can obtain the public keys from there. There would be no need to exchange public key as files.

Updates

2019-10-16 Edit: Renamed the variables with a ‘$’ prefix. Ensuring bash compatiblity.
2019-10-16 Edit: Updated guide for latest pass version.

Sources

Official pass homepage

Medium - Using pass in a team

Setup SSH on Windows 10

Fri, 19 Jan 2018 11:55:48 +0000

I have started a new job and as usual had to set up a new computer. Using Windows in a Unix environment seems like a bad choice at first. However, Microsoft has changed strategy and embraced the Unix world with projects such as Windows Subsystem for Linux (WSL) or Windows SQL Server support for Linux. In result you can install bash with WSL and use the native ssh client. But there is also another way. If you install Git for Windows a ssh binary is shipped as well. This binary and other tools such as ssh-keygen are not available from the command line by default. I want show you how to fix this, setup a keypair and start using ssh in a Windows environment.

First install Git for Windows.

Then add the folder C:/Program Files/Git/usr/bin to the PATH systen environment variable.

Open a PowerShell session.

Try out ssh. It should be available now.

Create a new ssh keypair by entering ssh-keygen -t rsa -b 4096 -C _COMMENT_

The keys are stored under /c/Users/_USERNAME_/.ssh/id_rsa.

Make sure to create a backup of your private key and encrypt your drive.

Meteor productive deployment blank page

Tue, 21 Jun 2016 10:16:07 +0000

First some background. I’ve built a Meteor app and decided to deploy it to Heroku. There are many short and simple guides out there on how to do that. As I did so and opened the App for the first on Heroku I simply received a blank page. Where did my javascript code go? Heroku logs didn’t tell much.

After googling this issue I was told that Heroku launches the App in productive mode or at least the buildpack I’ve used does so. So I tested this locally with meteor --production and surprise got a blank page as well. So what does this flag change in the build process? It simply minifies the javascript code. So that is the problem. As my app is built with React written in ES6 the minification probably doesn’t work. The solution is quite simple, remove the Meteor package standard-minifier-js from the project.

Download full playlists and all songs by an artist from SoundCloud

Tue, 13 May 2014 07:53:13 +0000

Introduction

First of all I want to apologise for what I’m writing about in this post. SoundCloud is a music platform where you can listen to almost every song for free. This is a great network and only works as long users don’t download the songs from SoundCloud. Great artists advertise their content to get more attention, the last thing they want is that you’ll download their songs. However there’s no way to prevent people from doing so, as you will see not even the guys behind SoundCloud can prevent their content from being downloaded. I’d ask you to donate for or buy the songs from the artists you like on SoundCloud.

Requirements

Instructions

Clone the Soundcloud music downloader repository from GitHub.

cd /usr/local/src
sudo git clone https://github.com/lukapusic/soundcloud-dl.git

Run the the installer script. This will install the required ubuntu packages and create a config file in your home folder.

cd soundcloud-dl/
sudo ./install
Set path : /home/[username]

Switch to your home folder and start downloading from a SoundCloud url.

cd ~
./usr/local/src/scdl [url]

Install Node

Thu, 27 Mar 2014 16:46:14 +0000

This post is part of my Your own Virtual Private Server hosting solution project.
Get the latest version of this article here: https://gist.github.com/9346588.

Introduction

Node.js is a cross-platform runtime environment for server-side and networking applications.

Requirements

Installation

You can install Node.js either from website or the from the git repo.

Install from source

Download Node.js with wget.

cd /usr/local/src
sudo wget http://nodejs.org/dist/node-latest.tar.gz

Unpack Node.js.

sudo tar -xzf node-latest.tar.gz
cd node-<version>

Install Node.js.

sudo ./configure
sudo make
sudo make install

Check version of Node.js and npm.

node -v
npm -v

Install with Git

Clone the Node.js repo.

cd /usr/local/src
sudo git clone git://github.com/joyent/node.git

Or use the https url if ssh is not possible.

sudo git https://github.com/joyent/node.git

Check git tags to find the latest version.

cd node
git tag

See the latest stable version on http://nodejs.org/.

Checkout the latest version.

sudo git checkout vX.X.X

Install Node.js.

sudo ./configure
sudo make
sudo make install

Check version of Node.js and npm.

node -v
npm -v

Update

Depending on how you’ve installed Node.js theres an update strategy.

from source

Repeat the installation process above.

with Git

Pull down the latest source code.

cd /usr/local/src/node
sudo git checkout master
sudo git pull origin master

Check git tags to find the latest version.

git tag

See the latest stable version on http://nodejs.org/.

Compile the latest version.

sudo git checkout vx.x.x
sudo ./configure
sudo make
sudo make install

Step by Step: Install Ghost Blog

Mon, 03 Mar 2014 16:34:55 +0000

Latest Version of this guide: https://gist.github.com/8542013

Finishing this guide you"ll get:

A running Ghost installation
Amazon SES mail configuration
Simple ssh hardenings
Nginx proxy
Node.js configured with forever

Specification of latest running installation:

Date: 21.01.2014
OS: Ubuntu 64 bit - 12.04.4 LTS
Provider: Amazon EC2
Mail service: Amazon SES
Browser: Google Chrome - 31.0.1650.63
Ghost: 0.4
Node: 0.10.24
npm: 1.3.21

Requirements

Server is behind a firewall, that only allows http, https and ssh
The server is accessed with ssh keys (user password authentication must be disabled)
Server is not accessed with the root user
You"re able to edit files with VI

Ubuntu

Update Ubuntu

sudo apt-get update && sudo apt-get upgrade

Install additional packages

sudo aptitude install build-essential zip git

SSH

Change the default ssh port and disable root login

sudo vi /etc/ssh/sshd_config
Set Port [custom ssh port number]
Set PermitRootLogin no

Restart the ssh service

sudo /etc/init.d/ssh restart

Update firewall rules now to enable ssh connection with your custom port

Reconnect your ssh host with the new port number

ssh -p [custom ssh port number] user@host

Fail2Ban

Install Fail2Ban

sudo apt-get install fail2ban

Copy the configuration file

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit the config file

sudo vi /etc/fail2ban/jail.local

Make the following changes:

[ssh]
port     = [custom ssh port number]

And

[ssh-ddos]
enabled  = true
port     = [custom ssh port number]

Finish editing and restart fail2ban service

sudo service fail2ban restart

Network

Edit the network configuration file

sudo vi /etc/sysctl.conf

Paste the this configuration file to improve network security

#
# /etc/sysctl.conf - Configuration file for setting system variables
# See /etc/sysctl.d/ for additional system variables
# See sysctl.conf (5) for information.
#

# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
# Turn on Source Address Verification in all interfaces to
# prevent some spoofing attacks
net.ipv4.conf.default.rp_filter=1
net.ipv4.conf.all.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 5

# Do not accept ICMP redirects (prevent MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0 
net.ipv6.conf.default.accept_redirects = 0

# Do not send ICMP redirects (we are not a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Do not accept IP source route packets (we are not a router)
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Log Martian Packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Ignore ICMP broadcast requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore Directed pings
net.ipv4.icmp_echo_ignore_all = 1

Node.js

You can install node either from website or the from the git repo.

Install from source

Download Node.js with wget

wget http://nodejs.org/dist/node-latest.tar.gz

Unpack Node.js

tar -xzf node-latest.tar.gz
cd [node folder]

Install Node.js

sudo ./configure
sudo make
sudo make install

Check version of Node.js and npm

node -v
npm -v

Install with Git

Clone the Node.js repo

cd /usr/local/src
sudo git clone git://github.com/joyent/node.git

Check git tags to find the latest version

cd node
git tag

See the latest stable version on http://nodejs.org/

Checkout the latest version

sudo git checkout vX.X.X

Install Node.js

sudo ./configure
sudo make
sudo make install

Check version of Node.js and npm

node -v
npm -v

Update Node.js

Depending on how you"ve installed Node.js theres an update strategy

from source

Repeat the installation process above

with Git

Pull down the latest source code

cd /usr/local/src/node
sudo git checkout master
sudo git pull origin master

Check git tags to find the latest version

git tag

See the latest stable version on http://nodejs.org/

Compile the latest version

sudo git checkout vx.x.x
sudo ./configure
sudo make
sudo make install

Nginx

Install Nginx

sudo apt-get install nginx

Create a Nginx site configuration file

sudo touch /etc/nginx/sites-available/ghost.conf
sudo vi /etc/nginx/sites-available/ghost.conf

Paste this config

server {
	listen 80;
	server_name [example.com];

	location / {
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header   Host      $http_host;
		proxy_pass         http://127.0.0.1:2368;
	}
}

Create a symlink to your config file

sudo ln -s /etc/nginx/sites-available/ghost.conf /etc/nginx/sites-enabled/ghost.conf

Restart Ngnix

sudo service nginx restart

In case you"ll get this error

Restarting nginx: nginx: [emerg] could not build the server_names_hash, you should increase server_names_hash_bucket_size: 64

sudo vi /etc/nginx/nginx.conf
Set server_names_hash_bucket_size 128;
sudo service nginx restart

Ghost

Create the website folder

sudo mkdir -p /var/www/
cd /var/www/

Download Ghost with wget

sudo wget https://ghost.org/zip/ghost-latest.zip

Unpack Ghost

sudo unzip -d ghost ghost-latest.zip
cd ghost/

Install Ghost

sudo npm install --production

In case of errors for sqlite3 installation

npm install sqlite3 --build-from-source

Install forever

sudo npm install forever -g

Configure Ghost (productive environment only)

sudo cp config.example.js config.js
sudo vi config.js
Set url: "http://[example.com]",

Start Ghost

sudo NODE_ENV=production forever start index.js

Start Ghost without forever

sudo npm start --production

Check if Ghost is running

forever list

Stop Ghost

forever stop index.js

Open your browser on http://[example.com]/ghost

Ghost Mail

Ghost uses Nodemailer to send e-mails, this modules has to be configured. Ghost supports various mail providers, you can see all of them in the Ghost mail documentation

SES

Amazon’s SES (Simple EMail Service) provides a reliable service to send mails.

Requirements

Amazon Account
Verified domain and mail address on SES

Create a new user in the IAM service console and store the access keys in a secure place.

Allow new user to send mail via SES with this policy configuration

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ses:SendRawEmail",
      "Resource": "*"
    }
  ]
}

Edit the Ghost config

sudo vi config.js

Add this mail configuration

mail: {
    transport: "SES",
    options: {
        AWSAccessKeyID: "[acccess key]",
        AWSSecretKey: "[secret key]"
    }
},

Update mail settings

http://[example.com]/ghost/settings/general/
Set Email Address: [verified SES mail address]

sudo vi config.js

And add this mail configuration

mail: {
	fromaddress: "[verified SES mail address]",
}

Now you should be able to reset your Ghost password

However at the time of writting this mail configuration doesn"t seem to work despite it"s an offical Ghost configuration

In case you"ll get this error when trying to reset your password

Email Error: Email failed: 400 Sender MessageRejected Email address is not verified. 5a07d838-8381-11e3-ad96-5f67c4a04b97

Replace the the Ghost mail configuration with

mail: {
    transport: "SMTP",
    fromaddress: "[verified SES mail address]",
    host: "ssl://[SES smpt server address]",
    options: {
        port: 465,
        service: "SES",
        auth: {
            user: "[acccess key]",
            pass: "[secret key]"
        }
    }
},

You can get your smtp settings here

Source

Install Node
Install Node on Ubuntu
Install Ghost
Deployment of Ghost
sqlite3 troubleshooting
nginx fix hash buck size
Install Ghost on Ubuntu, Nginx and MySQL
Fail2Ban SSH Hardening
Amazon EC2 Node Stack
SES mail configuration

Backup Public GitHub Gists

Thu, 19 Sep 2013 12:52:32 +0000

To manage my code snippets I’m using GitHubGist connected with Gistbox.

Sadly none of this services providing a backup nor a download function for the gist files. That’s why I came upwith the idea to download them with PowerShell script.

For first my script only can download public gists, because I don’t know how to implement an authentication, luckily each of my gists is public. I recommend you to do the same, it’s the idea of OpenSource.

So here’s the script:

[System.Reflection.Assembly]::LoadWithPartialName("System.Web.Extensions")

function Get-GitHubGists{

    param(
        [string]$UserUrl
    )

    # set up request
    $WebRequest = [System.Net.WebRequest]::Create($UserUrl)
    $WebRequest.Method ="GET"
    $WebRequest.ContentLength = 0

    # get response
    $WebRequest = $WebRequest.GetResponse()
    $WebRequest = new-object System.IO.StreamReader($WebRequest.GetResponseStream())
    $WebResponse = $WebRequest.ReadToEnd()

    # convert json
    $JavaScriptSerializer = New-Object System.Web.Script.Serialization.JavaScriptSerializer
    $GitHubGists = $JavaScriptSerializer.DeserializeObject($WebResponse)

    # download github gists
    $GitHubGists | %{

        if(Test-Path $_.id){

            cd ($_.id)
            Write-Host "Update GitHubGist: $($_.description)"
            git pull
            cd ..

        }else{

            Write-Host "Cloning GitHubGist: $($_.description)"
            git clone ($_.git_pull_url)
        }
    }
}

Get-GitHubGists -UserUrl https://api.github.com/users/janikvonrotz/gists?page=1
Get-GitHubGists -UserUrl https://api.github.com/users/janikvonrotz/gists?page=2
Get-GitHubGists -UserUrl https://api.github.com/users/janikvonrotz/gists?page=3

Latest version: https://gist.github.com/6622205

Git on Janik von Rotz

Git and Jujutsu

Git Cheat Sheet

Commit

Remote

Tags

Branching

Staging

Log

Submodule

Diff

Config

Pull Requests

Rebase

Understand Git

Obsidian and Vuepress: include markdown files

Sync Obsidian mobile app with Working Copy git repo

Git pull overwrite local changes

Undo a pushed git merge

Git branch typing completion and other useful stuff

Using pass in teams

Introduction

Variables

Setup a shared pass store

Request access to shared pass store

Grant access to users

Contribute to a shared pass store

Notes

Updates

Sources

Setup SSH on Windows 10

Meteor productive deployment blank page

Download full playlists and all songs by an artist from SoundCloud

Introduction

Requirements

Instructions

Install Node

Introduction

Requirements

Installation

Install from source

Install with Git

Update

from source

with Git

Step by Step: Install Ghost Blog

Ubuntu

SSH

Fail2Ban

Network

Node.js

Install from source

Install with Git

Update Node.js

from source

with Git

Nginx

Ghost

Ghost Mail

SES

Source

Backup Public GitHub Gists