Miek Gieben

Uncloud Image Pruning

Thu, 14 May 2026 22:04:39 +0200

Currently uc doesn’t have a prune subcommand to prune images, and even if it had it would still be a manual operation. It would be better to automate this. This post shows how.

First create an image with this Dockerfile:

FROM --platform=$BUILDPLATFORM alpine:latest
RUN apk add curl

RUN <<EOF
echo \
'#/bin/bash

if ! [[ -S /var/run/docker.sock ]]; then
    echo "Docker socket /var/run/docker.sock not found" >&2
    exit 1
fi

curl -s -X POST --unix-socket /var/run/docker.sock http://localhost/images/prune

while true; do
    sleep 24h
    curl -s -X POST --unix-socket /var/run/docker.sock http://localhost/images/prune
done
' > /prune
EOF
RUN chmod +x /prune

WORKDIR /
CMD "/prune"

Build and push that image to a registry and then use this Uncloud compose.yaml to deploy:

Uncloud Prometheus

Sun, 26 Apr 2026 18:22:52 +0200

Prometheus metrics are being worked on by me, and will hopefully soon be merged in Uncloud.

The uncloudd metrics endpoint is exposed into the cluster network, so this makes it possible for a Prometheus service running inside the cluster to scrape it. For this it just needs to be able to access the API to get all machines in the cluster. This can be done by mounting the uncloud socket inside the container, and using uc with structured output.

Uncloud L4

Sat, 25 Apr 2026 13:21:52 +0200

Natively Uncloud doesn’t do L4 forwarding. This is an open issue as we are figuring out how to actually do this. But it turns out you can already do this with the current code - well almost.

Buckle up, because there is quite some stuff you may need:

A patched Uncloud, see this PR for that.
A custom Caddy build, with the L4 plugin.
A DNS server, I use atomdns of course.

Note I use a fork + merge requests I need that is available at: https://github.com/miekg/uncloudplus .

Uncloud Private Registries

Tue, 14 Apr 2026 19:31:00 +0200

While pushing this PR, the answer was that this was already working! But kind of unintuitive, but smart as it re-uses whatever docker setup you got (i.e. credentials helpers).

So to get this working you:

% docker login registry.science.ru.nl
Username: bla
Password:
...

And then use uc deploy -f .../compose.yml just like you did before. Now it should pull from the private repo and things “just work”.

See this guide for canonical text on this.

Testscript highlighting in Neovim

Thu, 09 Apr 2026 20:38:06 +0200

This is a good article on how to use testscript in Go(lang). It also goes as far as adding a syntax file. But I’m 100% into Neovim, so this needs to be tree-sitter grammar on my system.

Well… this was a journey and I needed claude.ai for a lot of stuff to pull it off. I also wanted to insert Go syntax highlighting for Go blocks, like in this file.

This is working on Fedora 43 and Ubuntu 26.04 and depends on a up-to-date tree-sitter-cli as this is the main way of generating the parser.

Uncloud

Mon, 16 Mar 2026 14:00:40 +0100

I’m playing with Uncloud to see if it is something we can use at $WORK. Pretty impressed with it already, as I’ve written something worse pgo, that was (obviously) not good enough. Uncloud does: implement a subset of the Docker(-compose) API, uses gRPC and wireguard to create mini network; just brilliant. Haven’t seen prometheus metrics yet, although Caddy is used for the proxy, but more prometheus metrics would make sense. (Which you can then observe through a cluster hosted prometheus…?)

Forgejo Go Benchstat

Fri, 30 Jan 2026 17:53:04 +0100

For the longest time I wanted to see the performance impact of my changes. This desire goes back years, back to the early days of CoreDNS. And now I finally have it.

It does require running your own forgejo-runner on your own hardware to have any meaningful data. Without further adu:

# On https://codeberg.org/miekg/dns/actions you can see the run and copy and paste a new.txt if performance is
# better. Put this contents in old.txt
on: [push, pull_request]

jobs:
  test:
    runs-on: atoom-tiny
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: ${{ vars.GOVERSION }}
      - run: |
          apt-get update
          apt-get -y install dnsperf jq
          go install golang.org/x/perf/cmd/benchstat@latest
          (cd cmd/reflect; go build)
          HOSTNAME=atoom-tiny
          # Sleep here so we have the machine to ourselves.
          sleep 60
          (cd cmd/reflect; make new.txt)
          REF=$(echo ${{ forgejo.ref }} | cut -d/ -f3)
          echo ${{ forgejo.api_url}}/repos/${{ forgejo.repository }}/issues/${REF}/comments
          echo "{\"body\": $(cd cmd/reflect; make stat | jq -sR .)}" | \
                          curl --json @- \
                          -H 'Authorization: token ${{ forgejo.token }}' \
                          ${{ forgejo.api_url}}/repos/${{ forgejo.repository }}/issues/${REF}/comments

See https://codeberg.org/miekg/dns for all other bits that are needed.

Create a Pull Request from Git in Forgejo

Wed, 28 Jan 2026 06:50:48 +0100

Recently I’ve started to move all my project to Codeberg. This is working great, but one of the things I really missed where the git-push options from GitLab where you can create a PR just by pushing a branch upstream.

Thanks to my whining about this on Mastodon I got this reply about an create-pr-action.

Well, putting this all together, I right now have this script (with little, or no error checking) that does the heavy lifting of creating a PR using Forgejo’s API. This needs an API token with read/write rights on your repo (and only that):

2025 Fotos 0xf7.8 feest

Sat, 01 Nov 2025 00:00:00 +0000

De fotos van het 0x7f.8 feest op 1 november 2025 in Groenewoud met al onze vrienden.

Groesbeek's Gruwelijkste 2025

Sun, 21 Sep 2025 00:00:00 +0000

Op zondag 21 September Groesbeek’s Gruwelijkste (11e editie, de laatste) gereden. De 75 km.

PAM unixsock

Fri, 14 Mar 2025 12:14:47 +0100

Ever felt the need to do something with PAM, like implementing 2FA in SSH? You are left with a few bad choices, among others you’ll need to write something (complex) in C. I rather not do that, so I’ve created pam-unixsock.

This is tiny, the most trouble I had with concatenating strings with a space in between, because, you know, C. Anyway tiny. It doesn’t do much and gets you into another language quickly!

Format Go HTML templates

Wed, 19 Feb 2025 15:20:33 +0100

Because I was fed up with the lack of options (none), I write a tool that can format Go HTML templates: you can find it here. Includes screenshots!

Formatting Go text templates is pure madness, but the above code works well on HTML templates. If have find issues or need more functionality open a PR against the repo.

Have this in neovim:

au FileType gohtmltmpl command! Fmt silent %!gotmplfmt
au FileType gohtmltmpl let &l:formatprg="gotmplfmt"

Update 2025-05-31

In my new neovim setup (with conform.lua) I have this:

Matchup in Neovim for Go templates

Sat, 07 Dec 2024 12:04:24 +0100

After dealing with Go templates (also HTML templates) for more than a year and keep loosing track of where each block {{end}}s I finally did something about it.

But that didn’t work that good. So I’ve switch to the match-up plugin, which is better than the built-in matchit that I was using previously. With Neovim I’m using this setup:

Plug 'andymass/vim-matchup'

And this extra bit of config:

require'nvim-treesitter.configs'.setup {
  matchup = {
    enable = true,
  },
}

This in itself does not make template matching work, for this I just copied the Hugo template matcher (which is just like Go templating) to the correct place. Doing this with some automation from inside Neovim:

Kong Go CLI manual pages

Fri, 08 Nov 2024 11:38:55 +0100

I’m using Kong the CLI argument parser to create manual pages from the arguments and help described in the Kong structure that tells your CLI how to parse its command line.

With a lot of use from the reflect package (this was before I discovered kong actually has an API you can use), I’m creating manual pages from the kong CLI definition, while having great fun with parsing enum, default and other tags to make the manual page really readable.

Kong Go CLI

Fri, 01 Nov 2024 11:38:55 +0100

I’m a fan of Kong the CLI argument parser, I use it to automatically create manual pages, (bash) completion and do a lot of validation inside it. (This guy also has other really interesting packages, and he’s a huge fan of Go’s struct tags).

I wanted to do validation inside Kong as well, for this Kong has validation, which is just a method (Validate() error) on a type. Now most types I have are just string or any other builtin type. For validation to work, all these types must be re-typed to another type on which the method can be applied, which is annoying. I wanted a better way…

eBPF from Go - IV - Code generation

Mon, 28 Oct 2024 15:47:08 +0200

Played more with TinyGo, but it always generates code for (minimal) reflection - i.e. the reflect package, because it requires that for its map implementation. I could skip or not generate that, but then that would mean using a map would be … weird? Anyhow it looked that even TinyGo does too much for eBPF. So plan D: generate eBPF code (and Go code) using Go. Cilium has done a lot of work in this regard.

eBPF from Go - III - Reducing the SSA

Mon, 30 Sep 2024 15:47:08 +0200

Again some progress. I’m mostly focussing on removing code from the SSA representation (-internal-dumpssa), so that I can work with a clean slate. As BPF is so limited almost none of the features from Go make sense, although in some far fetched future it would be super cool to have channels and goroutines to something in BPF - but not today. First need to get to “Hello World”.

I’m building this code:

Groesbeek's Gruwelijkste 2024

Sun, 15 Sep 2024 00:00:00 +0000

Op zondag 15 September Groesbeek’s Gruwelijkste (10e editie) gereden. De 75 km.

eBPF from Go - II

Fri, 30 Aug 2024 15:47:08 +0200

Following up from the previous blog post… I’ve got a JSON file with the string ‘bpf’ in the correct place. Let’s see what tinygo thinks of that:

% ./build/tinygo build -o miekg/main.bpf -target bpf ./miekg/main.go
No available targets are compatible with triple "bpf-unknown-unknown"

clang indeed does not list bpf as a valid target, so this needs to be added.

The llvm build is configured from the main GNUMakefile, with -DLLVM_TARGETS_TO_BUILD.... Using grep and find I found the “llvm/test/CodeGen” directory, which, in addition to all listed targets also has a BPF directory. Let’s add BPF to that list and recompile.

eBPF from Go; First Steps

Thu, 29 Aug 2024 20:04:35 +0200

So I had this itch that I wanted to make a Go program compile to eBPF and be able to load that program in the Linux kernel by use of bpftool.

As I say in github.com/miekg/ebpf

eBPF in C? What am I, a farmer?

After much reading about eBPF and thinking about how that would work from Go, I figured that would involve writing a Go compiler.

So I could:

hack the official Go compiler and (try to) add a eBPF target (which would probably never be added as an official target because of all the constraints eBPF has).

eBPF in Go

Thu, 22 Aug 2024 18:46:57 +0200

What if I could program eBPF in pure Go? I want to use eBPF and lots of current tooling exist, but I like Go. I don’t want to use clang to create the ELF binary that then gets loaded into the Linux kernel. I want to use Go to create that ELF file. The heavy lifting of loading and inspecting can be done via bpftool (although I’m aware that Go programs exist that do this), but bpftool looks like the standard way of interacting with the kernel’s eBPF subsystem.

De Haan 2024

Thu, 08 Aug 2024 00:00:00 +0000

Vakantie in het Belgische De Haan samen met Toni.

Rügen 2024

Fri, 02 Aug 2024 00:00:00 +0000

Twee weken vakantie in het Duitse Rügen.

Charlie 2024

Wed, 22 May 2024 00:00:00 +0000

12e verjaardag van Charlie.

Center Parcs 2024

Mon, 01 Apr 2024 00:00:00 +0000

Met Inbal en Yaniv naar Center Parcs in Zandvoort.

Printing from Android

Sat, 24 Feb 2024 20:03:54 +0100

Quick note to self.

Printing from Android requires IPP. If your printing does not support this protocol out of the box you will not be able to directly print from Android devices.

CUPS can then be used to translate between IPP and JetDirect (in my case). Install and configure CUPS and then on Android configure the printer. The later means connecting to a printer by IP address. In that form enter the following:

Config Management, part III: Rolling Back

Fri, 02 Feb 2024 15:20:33 +0100

The second part.

In the previous part we looked how a micro language would look like, now I want to focus on what it means to roll back to a previous version. First take a look at an instruction that have no obvious reverse: CHMOD

When rolling back CHMOD you want to revert to the previous permissions. This would work automatically if there was an older CHMOD that would also set the permission, but in a lot of situations you probably just go with the (package) defaults. This implies you don’t know what a CHMOD reversal would be, and that implies we need to track that, like in a proper journal. As said each instruction has an implicit condition, if that condition doesn’t hold, it executes the instruction, we can utilize that state and save it in the journal. Let’s see in detail how this would work with something like CHMOD.

Config Management, part II: Microcode Language

Thu, 01 Feb 2024 15:20:33 +0100

The first part.

This cfg mgmt system uses a micro language to perform the changes on the target system. This language is limited in its scope and has the following “instructions”:

INSTRUCTION	ARITY	ARGUMENTS	REMARK
REM	1	TEXT	a comment
MKDIR	2	MODE PATH	create a directory
COPY	2	SRC-PATH DST-PATH	copy a file
CHMOD	2	MODE PATH	set the mode
CHOWN	2	USER/ID PATH	set the owner
CHGRP	2	GROUP/ID PATH	set the group
RM	1	PATH	rm the file
EXEC	1	CMD	install a package

These micro-instruction basically all call a simple system call to make the changes. Note, except for the latter this is the Unix API of everything is a file. EXEC is now only used to install/deinstall a package; of course such a generic instruction is ripe for abuse…

OSC52: My Cut & Paste Journey

Wed, 31 Jan 2024 11:03:41 +0000

In the olden days with X11, you could just do x11-forwarding in SSH and remote cut and paste would work. Now with Wayland, this is all broken and supposedly “there are better ways of doing it”. One of those is OSC52 support in terminals, but not in VTE based ones, like Tilix, which is was my default terminal. (See https://gitlab.gnome.org/GNOME/vte/-/issues/2495 for the 5(!) year old bug).

So I wanted this to work, which meant changing terminal and configuring Neovim - where the latter was way more complex, hard to debug and reason about.

Config Management

Mon, 29 Jan 2024 14:20:33 +0100

this project needs a name and a domain.

After many years of playing with YAML in k8s, I’ve returned to using CFEngine (at work). The last config management software before that was Puppet. An issue I see with all modern config management tooling is the lack of monitoring and the impossibility to cleanly roll back. In k8s it works better, but that’s only for pods running in k8s (which are stateless), not the underlying machines.

Graaf

Thu, 28 Dec 2023 18:11:35 +0100

Graaf is a Go program that translates simple dashboards written in YAML to Grafana JSON. It has an extensive manual page that explains its usage. This is also known as Grafana as code, but then for real.

The following is a dashboard with 4 panels that I use for my own monitoring.

title: Overview i
uid: dashboard-overview
panels:
  - timeseries:
      title: 'Network Bytes [5m] - edgemax.i'
      y:
        unit: Bps
      exprs:
        - expr: 'rate(ifHCOutOctets{ifAlias="eth0",job="edgemax"}[5m])'
          legend: '{{ifAlias}} transmit'
        - expr: 'rate(ifHCInOctets{ifAlias="eth0",job="edgemax"}[5m])'
          legend: '{{ifAlias}} receive'
          transform: negative-y
  - timeseries:
      title: 'HTTPS Queries [5m]'
      y:
        unit: rps
      exprs:
        - expr: 'sum by (host) (rate(caddy_http_request_count_total{job="caddy"}[5m]))'
          legend: '{{host}}'
        - expr: 'sum (rate(caddy_http_request_count_total{job="caddy"}[5m]))'
          legend: total
          transform: negative-y
  - timeseries:
      title: 'DNS Queries [5m]'
      y:
        unit: rps
      exprs:
        - expr: 'sum by (zone) (rate(coredns_dns_requests_total{job="nsdns",zone!="dropped"}[5m]))'
          legend: '{{zone}}'
        - expr: 'sum (rate(coredns_dns_requests_total{job="nsdns"}[5m]))'
          legend: total
          transform: negative-y
        - expr: 'sum (rate(coredns_dns_requests_total{job="nsdns",zone="dropped"}[5m]))'
          legend: dropped
          transform: negative-y
  - timeseries:
      title: 'Network Bytes [5m] - nuc.i'
      y:
        unit: Bps
      exprs:
        - expr: 'rate(node_network_transmit_bytes_total{job="node",device="eno1"}[5m])'
          legend: '{{device}} transmit'
          threshold: 'ok{value="0"}'
        - expr: 'rate(node_network_receive_bytes_total{job="node",device="eno1"}[5m])'
          legend: '{{device}} receive'
          transform: negative-y

This dashboard is 47 lines, the generated JSON dashboard is 500 lines, a ~10-fold reduction in cruft. Not bad!

Gallery Shortcode

Tue, 21 Nov 2023 16:27:45 +0100

I’m using the following shortcode (saved as gallery.html) in Hugo to generate a gallery containing both video and photos. Comments in the code.

May it be helpful for you. It comes (of course) with no support. The cover photo handling is done by my Hugo theme (terminal) btw.

<!--
    All img/*.{webm,ogv} video files are taken and simularly the caption file is used
    to generate a video control.
-->

{{- $videos := .Page.Resources.Match "img/*.webm" -}}
{{- $videos = $videos | append ( .Page.Resources.Match "img/*.ogv" ) -}}
{{- range $videos -}}
    {{- $caption := "" -}}
    {{- $captionfile :=  printf "%s.%s" ( strings.TrimSuffix (path.Ext .RelPermalink) .RelPermalink ) "txt" -}}
    {{- if os.FileExists $captionfile -}}
        {{ $caption = os.ReadFile $captionfile | markdownify -}}
    {{- end -}}
    {{- $type := printf "%s/%s" "video" (slicestr (path.Ext .RelPermalink) 1) -}}
    {{- $type = replace $type "ogv" "ogg" -}}
    <figure>
    <video controls preload="auto" width="100%" playsinline class="html-video">
        <source src="{{ .RelPermalink }}" type="{{ $type }}">
    </video>
    {{- if $caption -}}
        <figcaption>
            <p>{{ $caption }}</p>
        </figcaption>
    {{- end -}}
    </figure>
{{ end }}

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.1/css/lightbox.min.css" integrity="sha256-tBxlolRHP9uMsEFKVk+hk//ekOlXOixLKvye5W2WR5c=" crossorigin="anonymous" />
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js" integrity="sha256-CSXorXvZcTkaix6Yvo6HppcZGetbYMGWSFlBw8HfCJo=" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.1/js/lightbox.min.js" integrity="sha256-CtKylYan+AJuoH8jrMht1+1PMhMqrKnB8K5g012WN5I=" crossorigin="anonymous"></script>

<!--
    The galleries must be all lowercase otherwise the caption are not found.
    We use a flexport to show 3 photos in a row, and that should work in mobile as well.
    Thumbs are generated on the fly.

    Each gallery is placed under a content/galleries as:

        content/galleries/album1
            /index.md - normal index stuff, with the 'gallery 'short code in it.
            img/      - symlink to all photos (and captions)
            cover.jpg -> img/cover.jpg  - if exist, this will be used as the cover image.
            video.webm -> see snippet above

    In the photo directory a .txt file with the same basename as the photo is used as
    a caption. This is in markdown format. The cover.jpg (or whatever extension) is skipped
    when generating the gallery.

    Clicking used the lightbox JS to show a slideshow like thing - I may selfhost the javascript
    at some point.
-->

{{ $image := (.Page.Resources.ByType "image") }}
{{ $i := 0 }}
{{ with $image }}
    {{ range . }}
    {{ if not ( hasPrefix .Name "cover." ) }}
        {{ if not ( hasPrefix .Name "img/cover." ) }}
            {{ if eq (mod $i 3) 0 }}
                <div class="flex-container">
            {{ end }}
            {{ $resized := .Fill "300x230 q70" }}
            {{ $caption := "" }}
            {{ $captionfile :=  printf "%s.%s" ( strings.TrimSuffix (path.Ext .RelPermalink) .RelPermalink ) "txt" }}
            {{ if os.FileExists $captionfile }}
                {{ $caption = os.ReadFile $captionfile | markdownify }}
            {{ end }}
            <div style="width:{{ $resized.Width }}px">
                <figure>
                    <a href="{{ .Permalink }}" data-lightbox="x" data-title="{{ $caption }}">
                    <img loading="lazy" src="{{ $resized.Permalink }}" />
                </a>
                {{ if $caption }}
                  <figcaption>
                    <p>{{ $caption }}</p>
                  </figcaption>
                {{- end }}
                </figure>
            </div>
            {{ if eq (mod $i 3) 2 }}
                </div>
            {{ end }}
            {{ $i = add $i 1 }}
        {{ end }}
    {{ end }}
    {{ end }}
{{ end }}

Lego 2023

Sat, 18 Nov 2023 00:00:00 +0000

Lego Stad Brickmegen.

ASCII art in motd

Wed, 15 Nov 2023 06:17:36 +0000

I wanted a nicer login experience (see image above) when logging into my server.

For this I used the following sites, tools and steps.

https://www.svgrepo.com/
https://asciiart.club/
Little Go program from below

Steps:

Search a nice SVG image at “svgrepo” and save it;
Upload it to “asciiart”, and generate an ASCII art you are happy with;
Download the BBCode variant of the image and (if you want colors) run the program to translate [color=#...] to terminal control characters.
```
go run replace.go <image> && cat out
```

The used program is hacky, but does the job. Also used “inkscape” to fiddle with another logo, and made that output something decent as well.

Nice Morning View

Mon, 13 Nov 2023 19:05:54 +0100

A foggy morning view.

DNSSEC Too Complex

Sat, 04 Nov 2023 15:18:59 +0100

Deploying DNSSEC.

Even though I co-authored RFC 4641, laying out how you should run DNSSEC - I think in retrospect that BCP is way too complex, ah the sin of youth.

You should (if you want to run DNSSEC) run with a single key (called common-signing-key; CSK) and never roll your keys. This is what CoreDNS’ sign plugin implements and what I use.

Also see this Mastodon post.

Groesbeek's Gruwelijkste 2023

Sun, 17 Sep 2023 00:00:00 +0000

Op 17 September Groesbeek’s Gruwelijkste gereden. De 75 km.

Nvim Debian Pkg

Sun, 10 Sep 2023 11:20:31 +0200

NVIM stopped making Debian packages a while back, so here is a short note on how to do this yourself. Had a hard time finding this info, hence reproduced here. Assuming you’ve got the source.

make CMAKE_BUILD_TYPE=Release
cd build && cpack -G DEB
sudo dpkg -i nvim-linux64.deb

… and of course you then find the authoritative text.

If you use RelWithDebInfo an ever growing log file will be created in ~/.local/state/nvim/log.

Zomer 2023

Thu, 10 Aug 2023 00:00:00 +0000

Onze zomer naar Engeland en Oost-Duitsland.

Freedom Internet IPv6 with Ubiquity Edge Router

Fri, 13 Jan 2023 15:25:09 +0100

Had a pretty hard time getting IPv6 going with Freedom Internet (a Dutch ISP), so this is mostly a “note to myself”. Turns out I wasn’t going crazy and for (some?) reason the wizard doesn’t set the default route for IPv6.

Basically what I did is: follow the Basic Setup wizard and enable IPv6 where you see it. This doesn’t not make IPv6 work in this case. So I needed to do the following from the command line when ssh-ed into the router (after configure):

Provisioning Services

Tue, 15 Nov 2022 07:35:00 +0000

There is a large gap between folks running their own machines and provisioning those and folks running Kubernetes and having Gitops at their disposal. In the latter case you can just put some YAML in Git and apply it in Kubernetes. Folks running their own machines on the other hand… are not so lucky.

Several “solutions” have existed for years, the umbrella term being “provisioning systems”, cfengine (one of the first), puppet, ansible and more. These work, but are (too?) powerful in that they allow actions and edits on the system being provisioned. This creates (hidden) problems when you’re asking yourself questions like: “Is the system’s state correct and in sync?”; “Can we easily rollback to a previously working version?”; “What content should file /path/to/file actually have?”.

Tweets of November 12 2022

Sat, 12 Nov 2022 00:00:00 +0000

Replying to @lucasdicioccio

I happened to have an account laying around https://mastodon.cloud/@miek

Sat Nov 12 07:28:19 +0000 2022