English on Hyteck

Hosting static sites with Traefik

2023-07-16T15:10:10+02:00

Hosting Static Sites with Traefik and Static Web Server

Traefik is amazing to host complex services like with containers. On the other hand it’s harder than you’d think to host a simple static html site. I wanted to share my current approach that is based on Static Web Server Project.

Static Web Server (SWS)

Static Web Server (or SWS abbreviated) is a simple and really fast web server with the goal to serve static web files or assets. The tiny docker image is only 4 MB with a small memory footprint. We can therefore afford to run a container for each static site.

Architecture

On the server we set up all static sites in one folder called static-sites. As we run the SWS with docker-compose we add the docker-compose.yml to this folder too. The following is an example setup with two static sites on seperate domains.

| static-sites
|
| docker-compose.yml
| - domain1.example.org
| - index.html
| - domain2.example.org
| - index.html
| - fonts
| - Open-Dyslexic.odf

For each domain we add a folder. I like to name them by the domain name but this is not necessary (just remember the volume in the docker-compose.yml too).

With this done we can now fill the appropriate information in the docker-compose.yml. Copy the following and replace domain1.example.org, domain2.example.org, site-one and site-two.

version: "3.3"

services:
 domain1.example.org:
 image: joseluisq/static-web-server:2
 container_name: "domain1.example.org"
 environment:
 # Note: those envs are customizable but also optional
 - SERVER_PORT=8080
 - SERVER_ROOT=/public
 - SERVER_LOG_LEVEL=info
 volumes:
 - ./domain1.example.org:/public
 labels:
 - "traefik.enable=true"
 - "traefik.docker.network=traefik"
 - "traefik.http.routers.site-one.rule=Host(`domain1.example.org`)"
 - "traefik.http.routers.site-one.service=site-one"
 - "traefik.http.routers.site-one.entrypoints=web-secure"
 - "traefik.http.routers.site-one.tls=true"
 - "traefik.http.routers.site-one.tls.certResolver=default"
 - "traefik.http.services.site-one.loadbalancer.server.port=8080"
 networks:
 - traefik

 domain2.example.org:
 image: joseluisq/static-web-server:2
 container_name: "domain2.example.org"
 environment:
 # Note: those envs are customizable but also optional
 - SERVER_PORT=8080
 - SERVER_ROOT=/public
 - SERVER_LOG_LEVEL=info
 volumes:
 - ./domain2.example.org:/public
 labels:
 - "traefik.enable=true"
 - "traefik.docker.network=traefik"
 - "traefik.http.routers.site-two.rule=Host(`domain2.example.org`)"
 - "traefik.http.routers.site-two.service=site-two"
 - "traefik.http.routers.site-two.entrypoints=web-secure"
 - "traefik.http.routers.site-two.tls=true"
 - "traefik.http.routers.site-two.tls.certResolver=default"
 - "traefik.http.services.site-two.loadbalancer.server.port=8080"
 networks:
 - traefik

networks:
 traefik:
 name: traefik
 external: true

This assumes traefik runs in a docker-network called traefik. This network must already exist.

As a last step add at least a index.html in the appropriate folder. Then you can start the webserver with docker-compose up. Add -d to run it in the background.

Deploying static sites

Deploying files manually (via Filezilla, scp or rsync) is not something I like to do. I therefore normally set up a CI job to automatically deploy the site when I push a new commit to GitHub, either via GitHub Actions or my Woodpecker CI instance.

I order to do that I

create a new user on the server, specifically for that purpose (one per site). The command is useradd USERNAME -m
create a SSH key without a password ssh-keygen -t ed25519 -a 100 -C "COMMENT" -f FILENAME
copy the public key that was just created at FILENAME.pub on the server in the textfile /home/USERNAME/.ssh/authorized_keys
Add the private key to the secrets of your CI

A typical CI configuration will look like this with a static site and GitHub Actions

name: Deploy Production Website via SSH

on:
 push:
 branches: [main]

jobs:
 build:

 runs-on: ubuntu-latest

 steps:
 - uses: actions/checkout@v1
 - name: Deploy to Server
 uses: easingthemes/ssh-deploy@main
 env:
 SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
 ARGS: "-rltgoDzvO --delete"
 SOURCE: ""
 REMOTE_HOST: ${{ secrets.REMOTE_HOST }}
 REMOTE_USER: ${{ secrets.REMOTE_USER }}
 TARGET: ${{ secrets.REMOTE_PRODUCTION_TARGET }}
 EXCLUDE: ".github/, .gitignore"

or this, when using HUGO and Woodpecker CI

---

pipeline:
 build:
 image: klakegg/hugo 
 commands:
 - hugo

 deploy:
 image: appleboy/drone-scp
 settings:
 strip_components: 1
 host:
 - example.org
 username: moanos
 target: /home/USERNAME/static-sites/
 source: public/
 key:
 from_secret: ssh_key

not manually put the files on the server

Moitoring IoT devices with MASH - Part 1

2023-07-07T15:10:10+02:00

This article is about monitoring some IoT devices (e.g. a CO2 sensor) with a combination of Mosquitto (a MQTT broker), Telegraf (a metric collector), InfluxDB (a time-series database) and Grafana (for displaying everything nicely). All mentioned services should run on a server that can be reached from the monitoring device(s) and your PC where you want to check the data. We will use MASH (see below) to deploy the services.

In the end this will enable you to get to something like this:

While writing, I decided to split this into two parts. Part 1 will set up our server infrastructure, Part 2 will show how to integrate some real sensors.

Let’s get started with Part 1 and answer:

What is MASH?

MASH is short for “Mother of all self-hosting”. It’s a collection of ansible roles, tied together by a playbook that can help deploy and maintain a large number of services. It was inspired by the matrix-docker-ansible-deploy follows the same philosophy and is maintained partly by the same people.

MASH includes services like

Nextcloud
Authentik
Gitea
Peertube
Funkwhale

and more than 50 others at time of writing this blogpost (List of all supported services).

The motivation for this playbook is to have all services run in docker, be as configurable as possible, while maintaining easy upgrades and reproducible deployments. The documentation IMHO is very good, so if people are willing to use ansible this might be a lot easier than writing roles themself.

Architecture

In the end we will have a IoT device that sends data to a MQTT topic on the MQTT broker Mosquitto. Telegraf will listen to this topic and write this into InfluxDB. When you want to have a look at the data, you can access Grafan which will query InfluxDB.

Prerequisits

To have everything it needs to use MASH you should ensure the following things are done and working

Configure DNS

By following this guide we will set up some services which will be reachable from via web interface (Grafana and InfluxDB) while others will not (Telegraf, Mosquitto). We will set a domain name for the server itself, one for Grafana and one for InfluxDB. This allows you to move services more easily. Feel free to adjust the setup to your needs (but don’t forget to change tha _hostname variables accordingly later).

Service	Domain	Type	Target
Server general	s0.example.com	A	`<IPv4-IP>`
Server general	s0.example.com	AAAA	`<IPv6-IP>`
Grafana	grafana.example.com	CNAME	s0.example.com
InfluxDB	influxdb.example.com	CNAME	s0.example.com

Set up the services

Setting up the services will require three steps. The first will set up the general server with Mosquitto and Influxdb. Then we configure mosquitto and influxdb and use this to set up Telegraf and Grafana.

Setting up the basis, Mosquitto and InfluxDB

Setting up will be based on one configuration file of the playbook. <your-domain> is the one you set up as Server General (s0.example.com).

Execute the following these steps inside the playbook directory:

create a directory to hold your configuration (mkdir -p inventory/host_vars/<your-domain>)
copy the sample configuration file (cp examples/vars.yml inventory/host_vars/<your-domain>/vars.yml)
copy the sample inventory hosts file (cp examples/hosts inventory/hosts)
edit the inventory hosts file (inventory/hosts) to your liking

Now you are ready to modify the main configuration file atinventory/host_vars/<your-domain>/vars.yml.

Add the following to your playbook and replace the default values (IN_CAPS)

############
## Basics ##
############


# Put a strong secret below, generated with `pwgen -s 64 1` or in another way
# Various other secrets will be derived from this secret automatically.
mash_playbook_generic_secret_key: ''

mash_playbook_docker_installation_enabled: true
devture_docker_sdk_for_python_installation_enabled: true

# To ensure the server's clock is synchronized (using systemd-timesyncd/ntpd),
# we enable the timesync service.

devture_timesync_installation_enabled: true


#############
## traefik ##
#############

# Traefik will be our revers proxy that makes grafana and influxdb accessible from the outside. It will automatically obtain SSL certificates for us

mash_playbook_reverse_proxy_type: playbook-managed-traefik
# The E-Mail address that traefik will use to obtain certificates with
devture_traefik_config_certificatesResolvers_acme_email: certs@example.com

##############
## influxdb ##
##############
influxdb_enabled: true
influxdb_hostname: influxdb.example.com

influxdb_init: true
influxdb_init_username: "USERNAME"
influxdb_init_password: "SECURE-PASSWORD"
influxdb_init_org: "YOUR-ORG"
influxdb_init_bucket: "monitoring"


#################
## Mosquitto ##
#################

mosquitto_enabled: true

Installing

Before installing and each time you update the playbook in the future, you will need to update the Ansible roles in this playbook by running just roles. just roles is a shortcut to download the latest Ansible roles. If you don’t have just, you can also manually run the roles commands seen in the justfile (this gets tedious fast).

To install you should can just install-all. That’s it.

Congratulations! You installed your first services and can now visit influxdb.example.com and login with the credentials you set above!

Configuring Mosquitto and InfluxDB

Mosquitto

To configure mosquitto you only need to set up users. I would recommend to set up seperate users for telegraf and your IoT devices as you might want to restrict the IoT users permissions (not covered here).

Setting up mosquitto users can be done just run-tags mosquitto-add-user --extra-vars=username=<username> --extra-vars=password=<password>. For the setting to take effect, you must restart the container. To do that you can use just start-group mosquitto.

InfluxDB

We will now create a configuration that will automatically be read by telegraf.

Got to Load Data -> Telegraf and press Create configuration. Choose the bucket monitoring and search for the MQTT consumer as data source.

Add the following replace the [[inputs.mqtt_consumer]] with the following configuration (and make sure that you replace the example values).

[[inputs.mqtt_consumer]]
 servers = ["tcp://s0.example.com:1883"]

 ## Topics that will be subscribed to.
 topics = [
 "sensors/#",
 ]
 data_format = "value"
 data_type = "float"
 username = "USERNAME_SET_WHEN_CONFIGURING_MOSQUITTO"
 password = "PASSWORD_SET_WHEN_CONFIGURING_MOSQUITTO"

Now got to Setup Instructions and copy the INFLUX_TOKEN. It will only show once! Also copy the config URL. You will need both in the following step.

Setting up Telegraf and Grafana

You now have everything for the last step: Setting up Telegraf and grafana. We did not do this in the first step as wee needed the access tokes/configuration link which we have now. Therefore you should now add two new sections to your vars.yml.

##############
## telegraf ##
##############
telegraf_enabled: true
telegraf_influx_token: TOKEN-YOU-GOT-FROM-INFLUX
telegraf_config_link: https://influxdb.example.com/api/v2/telegrafs/0b6d11ca6bb1b000

#############
## grafana ##
#############

grafana_enabled: true
grafana_hostname: grafana.example.com
grafana_default_admin_user: USERNAME
grafana_default_admin_password: 'SECURE-PASSWORD'

grafana_provisioning_datasources:
 - name: InfluxDBs3
 type: influxdb
 access: proxy
 url: "https://{{ influxdb_hostname }}"
 jsonData:
 version: Flux
 organization: YOUR-ORG
 defaultBucket: monitoring
 secureJsonData:
 token: "TOKEN-YOU-GOT-FROM-INFLUXDB"

After that, once again do just install-all. You should now have a working setup of all services. Now

Let’s put some data in and display it

To send some data that you can display you can use the following python script. Save it as cli.py

import argparse
import paho.mqtt.client as mqtt
import random
import numpy as np
import time


def gen_time():
 return time.strftime("%H:%M:%S", time.localtime())


def gen_temp():
 """
 amplitude: amplitude of temperature changes
 mean: mean of the simulated temperature
 offset: offset of the signal in seconds
 period: periond time in seconds
 """
 amplitude = 5
 mean = 20
 offset = 0
 period = 900
 temp = np.sin((time.time() + offset) % (period) * 2 * np.pi) * amplitude + mean
 return temp


def fake(client, data_type="temperature", topic="sensors/temperature"):
 if data_type == "temperature":
 data_generator = gen_temp
 elif data_type == "time":
 data_generator = gen_time

 while True:
 print("Publishing")
 if data_type == "temperature":
 client.publish(topic, gen_temp())
 elif data_type == "time":
 client.publish(topic, gen_time())
 time.sleep(2)


def on_message(client, userdata, msg):
 print(msg.topic + " " + str(msg.payload))


def on_connect(client, userdata, flags, rc):
 print("Connected with result code " + str(rc))
 if rc == 5:
 raise ConnectionError("MQTT server refused connection")


def connect_broker(server, port, username="", password=""):
 client_id = f'python-mqtt-{random.randint(0, 1000)}'
 client = mqtt.Client(client_id)
 client.on_connect = on_connect
 client.username_pw_set(username=username,
 password=password)
 client.connect(server, port, 60)

 return client


def cli():
 parser = argparse.ArgumentParser(description='Do basic MQTT operations')
 parser.add_argument('action', choices=['sub', 'pub', 'fake'], help="")
 parser.add_argument('-t', '--topic', help="The MQTT topic")
 parser.add_argument('--type', help="The type of data to fake")
 parser.add_argument('-b', '--broker', help="Hostname of the MQTT broker")
 parser.add_argument('--port', type=int, default=1883, help="The MQTT brokers port (default: 1883)")
 parser.add_argument('-u', '--user', help="User for the MQTT broker")
 parser.add_argument('-p', '--password', help="Password of the MQTT broker")
 parser.add_argument('-d', '--payload', help="The payload to send with a set command")

 args = parser.parse_args()

 client = connect_broker(args.broker, args.port, args.user, args.password)
 if args.action == "sub":
 client.subscribe(args.topic)
 client.on_message = on_message
 client.loop_forever()
 elif args.action == "pub":
 r = client.publish(args.topic, payload=args.payload)
 print(r)
 elif args.action == "fake":
 fake(client, args.topic)


if __name__ == "__main__":
 cli()

Start the script with

python cli.py fake -t sensors/temperature -b s0.example.com -u USERNAME -p SECURE_PASSWORD`

This will fake a temperature sensor and publish the results to the MQTT topic sensors/temperature. To make sure the MQTT broker works correctly you can subscribe with

python cli.py sub -t sensors/temperature -b stats.hyteck.de -u qzt -p fisch-salz-hof

Now let’s display this data in Grafana. Add a new dashboard and then use Add->Visualization.

In the panel select InfluxDB as datasource (1+2) put in the folowing query (3).

from(bucket: "monitoring")
|> range(start: v.timeRangeStart, stop: v.timeRangeStop)
|> filter(fn: (r) => r["_measurement"] == "mqtt_consumer")
|> filter(fn: (r) => r["_field"] == "value")
|> filter(fn: (r) => r["topic"] == "sensors/temperature")
|> group(columns: ["topic"])
|> aggregateWindow(every: v.windowPeriod, fn: mean, createEmpty: false)
|> yield(name: "mean")

add a nice title (4) and apply to see tha data (5). You should now have a nice display of your fake sensor!

Some last words

Please let me know when you follow this guide - wheter sucessful or not! I would love to improve it.

I know this seems like a lot of effort to get a few numbers to display a few numbers nicely. On the other hands, once set up this setup can do a lot of stuff, from monitoring, to alerting. Upgrades should be taken care of by MASH, check out how to do that here. Also setting up more services is a breeze. Either check the list of existing services, or add a new role to the playbook. If you don’t know how, I am happy to help!

So make sure to follow my RSS feed or any of my socials to get notified when Part 2 comes around.

Troubleshooting

When something doesn’t work feel free to

Consult the docs
- Mosquitto
- Telegraf
- InfluxDB
- Grafana
Message me

Raspberry Pi as Offsite Backup

2022-10-23T10:12:54+02:00

Use Case

You have one (or more) servers at a hosting provider and a raspberry pi at home. You want to have an offsite backup of the websites, apps and databases at home.

Prerequesits

You configure your raspberry pi to be reachable from the internet using DynDNS. In the following we assume that it is reachable at offsite.example.com.

Preparing your backup raspberry pi

We want to make sure that backups on the raspberry pi can come from multiple sources and one source can not delete another.

Create an additional user

and change to that user afterwards. You can change service1 to the name of the service that this user should backup.

sudo useradd service1_backup
sudo su service1_backup
cd ~

Create an SSH key for the user

This SSH key will later be used by your server to push backups automatically. Therefore you should not set a passphrase for the key (just press enter until the key is generated)

$ ssh-keygen -t ed25519

Create your backup directory

mkdir backup && cd backup

If you want to use an external drive you can mount it to this users home directory.

Initialzie the borg repository

borg init --encryption=repokey ./

Make sure to set a strong passphrase and note it down somewhere safe. Without it you will not be able to access you backup!

Make sure the user can only access the backup directory

Put the following in ~/.ssh/authorized_keys and make sure everything is in one line. The last values are simply your public key that can be found in ~/.ssh/id_ed25519.pub

command="borg serve --restrict-to-repository /home/<user>/backup",restrict <key type> <key> <key host>

Done with the raspberry pi

Configure your server

In this guide we will use borgmatic to configure and automatically run the backup in the server.

Install borgmatic

sudo pip3 install --user --upgrade borgmatic

Configure borgmatic

The following is a small configuration example. Place it in /etc/borgmatic.d/servic1.yaml. If you need more options check out the full configuration file reference

location:
source_directories:
- /home/service1/static
repositories:
- ssh://service1_backup@offsite1.example.com/./backup
storage:
encryption_passphrase: "ThePassphraseouUsedOnYourRaspi"
ssh_command: ssh -i /etc/borgmatic.d/service1_backup_key
retention:
# Number of daily archives to keep.
keep_daily: 7
hooks:
# List of one or more shell commands or scripts to execute
# before creating a backup, run once per configuration file.
before_backup:
- echo "Starting a backup."
# List of one or more shell commands or scripts to execute
# after creating a backup, run once per configuration file.
after_backup:
- echo "Finished a backup."
after_everything:
- echo "Completed actions."
postgresql_databases:
- name: service1
# mysql_databases:
# - name: users

Place the private SSH key

The server will need the private SSH key so connect to your raspberry pi

On the raspberry pi use

cat ~/.ssh/id_ed25519

to get the private key and place it on your server in the file /etc/borgmatic.d/service1_backup_key. As this is a private SSH key it must only be readable by the user. Ro change its permissions correctly use

chown 600 service1_backup_key

Check if the backup works

Create your backup with

sudo borgmatic create --verbosity 1 --list --stats

Now check out the borgmatic configuration on how to properly set up automated backups

Done

Congrats, you should now have a fully functioning backup configuration!

Set up and secure an MQTT broker on Ubuntu

2021-01-01T18:18:10+02:00

I had some IoT devices that I wanted to integrate in my monitoring. For this I set up a MQTT broker as the MQTT protocol is a simple solution to send data from IoT devices to a server. This tutorial is focusing on setting up the server, but I also introduce a Python based MQTT client to test our installation.

On your server, first install mosquitto, our MQTT server/broker.

sudo apt-get install mosquitto

Allow standard mqtt port in firewall (if you have ufw installed)

sudo ufw allow 1883

Now on the client side connect to the server and publish some fake sensor values. First install the mqtt client

sudo pip install phao-mqtt

and then use the following python code on your client side to send fake values to your server. You only need to change mqtt.example.com to your servers IP/domain.

import time
import paho.mqtt.client as mqtt
import numpy
import numpy as np

def calc_temp():
 temp = np.sin(time.time()%(3600)*2*np.pi)*5+20
 return temp

def on_connect(client, userdata, flags, rc):
 print("Connected with result code " + str(rc))

client = mqtt.Client()
#client.username_pw_set(username="username",password="my_super_secret_pw")
client.on_connect = on_connect

client.connect("mqtt.example.com", 1883, 60)

client.loop_start()

while True:
 time.sleep(2)
 client.publish("test/temperature", calc_temp())

You can check if the broker accepts the values by subscribing to the topic:

#!/usr/bin/env python
import paho.mqtt.client as mqtt

def on_connect(client, userdata, flags, rc):
 print("Connected with result code " + str(rc))
 client.subscribe("test/#")

def on_message(client, userdata, msg):
 print(msg.topic + " " + str(msg.payload))

client = mqtt.Client()
#client.username_pw_set(username="username",password="my_super_secret_pw")
client.on_connect = on_connect
client.on_message = on_message

client.connect("mqtt.example.com", 1883, 60)

client.loop_forever()

Now secure your broker by creating a user with a password

sudo mosquitto_passwd -c /etc/mosquitto/passwd <username>

and configure mosquitto to use it in /etc/mosquitto/conf.d/default.conf:

allow_anonymous false
password_file /etc/mosquitto/passwd

Now restart mosquitto to enable the protection

sudo systemctl restart mosquitto

Test the installation by uncommenting client.username_pw_set(username="username",password="my_super_secret_pw") and filling in your credentials. The result code 0 indicates a valid connection. 5 indicates a authentication error.

I hope this helps setting up a MQTT broker. Hopefully I will have the time to write how to connect such a broker to Grafana via Telegraf and Influx DB.

Translation for video conferences

2020-07-23T07:30:00+02:00

Although physical meetings are not possible, many groups and organizations are dependent on multilingual meetings. In videoconferencing, concepts such as a whispered translation are not intuitive. Therefore a friend and I have developed a concept for translation in videoconferencing. The concept was planned for a conference with 80 participants who will discuss and make decisions over two days either in large groups or in sub-groups. The videoconferencing software that was used was BigBlueButton (BBB).

Translation via subtitles

BBB offers the possibility to write subtitles simultaneously to video conferencing. This feature is especially aimed at hearing impaired people. For translation, one person would translate and type in one language at a time. Due to the limited typing speed, this procedure is associated with large losses of content. However, it is a great option for hearing-impaired people and can be combined with a simultaneous oral translation.

Simultaneous translation

The concept of simultaneous translation is based on the fact that there is a seperate BBB-room for each language. These are communicated to the participants in advance.

The room whose language most of the participants speak will be the main room. People who do not speak the language of the main room will still join it, as moderation tasks and the presentation will be only in this room.

All statements in the main room will be translated by overseers in the other rooms. The translators should be present in the main room with the microphone switched off. If a person from a secondary room wants to speak they indicate this in the chat of the main room, - preferably with “* (language)”. They will then be allowed to speak by the moderator and speak in their respective room. The translator will unmute their microphone in the main room and translates to the primar language.

Breakout Rooms

Breakput rooms are often formed to debate in smaller groups. To ensure a reasonable amount of translation effort, all participants and translators of one language are assigned to one breakout room (in the main room). If the Breakout Rooms become too full, Breakout Rooms can also be formed in the secondary rooms, but translators are then required for each room.

Tips and tricks

Use two translators per language. One person cannot do this even at a moderate speed of discussion. It also allows for better reproduction of conversations by alternating the translators.
Ask participants to set their names according to the “Name [pronouns] (language)” scheme. This makes it easier for moderation and translators.
Participants do not need to join the audio in the main room, but they can, so that their contributions can be heard in the original. However, they should mute the browser window of the main room.

Conclusion

Whispered translation is possible in BBB; in order to use it, the possibility must be announced in good time by the moderator and enough translators must be found. The concept of oral translation has already proven itself at a large meeting.

If you are interested in implementing the concept you are welcome to contact me at fluesteruebersetzung@hyteck.de or in the comments below.