DEV Community: Jorge Rodrigues (mrscripting)

RaspberryPi cloud backup Part 3

Jorge Rodrigues (mrscripting) — Sun, 11 Sep 2022 20:14:37 +0000

Introduction

This is the third article in a series of articles that explain how you can backup an inexpensive NAS solution (built with raspberry pi) to Azure.
In the previous posts we've seen the cloud storage solutions available as well as their pricing. We've decided upon what service we would use (Azure Storage) and built the secure infrastructure using Terraform.
In this final article we will focus on the solution used to backup our files to Azure Storage using the Archive tier for reduced costs.

Backup Solution

Enter Rclone. Rclone is a command-line program to manage files on cloud storage. It is a feature-rich alternative to cloud vendors' web storage interfaces (as it is described in it's web page).

And that is what we need to automate our backups. We don't want to push the button, we want our files to backed up for several occasions during the day.

We also want to focus on security, and for that we will have to open and close the firewall on our storage account when the backup occurs.

So let's start.

The credentials

First we will need to generate a credentials file.
Open your text editor and paste the following json text:

{
    "appId": "replaceme",
    "displayName": "replaceme",
    "password": "replaceme",
    "tenant": "replaceme"
}

if you followed my previous post you remember we deployed the infrastructure using terraform, and that generated some outputs. If you stored them then you can replace the values in the text file:

Changes to Outputs:
  + appId       = (known after apply)
  + displayName = "backupapplication"
  + password    = (known after apply)
  + tenant      = "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx"

If you didn't store the values you can still obtain them either by going to the azure portal or via command line. If you don't remember the password then a new password for the service principal may have to be generated.

Now that we have the file in place let's leave it aside and start with the script.

The script

Let's use our friend bash in order to put our solution together.

Starting with the security part. We need to be able to open and close the storage firewall in order to backup our files. For that we need to authenticate against azure (with our credentials file) and add our public ip address to the firewall.

Getting the public ip. Let's use aws! You read it correctly. AWS provides a free endpoint to discover your public ip address.
So our function will look like this:

getPublicIp() {
    curl checkip.amazonaws.com
}

Now that we have a way for retrieving the public ip we need to authenticate. Using the service principle credentials we can easily retrieve an access token that will allow us to interact with the azure storage via rest api. So let's do it:

getAzureToken() {
    client_id=$1
    client_secret=$2
    tenant=$3
    scope="https%3A%2F%2Fmanagement.core.windows.net%2F.default"
    headers="Content-Type:application/x-www-form-urlencoded"
    data1="client_id=${client_id}&scope=${scope}&client_secret=${client_secret}&grant_type=client_credentials"
    data2="https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token"
    curl -X POST -H $headers -d $data1 $data2
}

As you are seeing the parameters we need are available in the file we've generated. We just have to retrieve them from the file and feed them to the function.

So now that we have the token and the public ip we can start opening and closing the communication in the azure firewall.
Let's work on the open function. We will need to call the api that allows us to interact with our storage account (represented by the resource id) and pass a json payload that specifies that the storage denies all traffic by default but allows our public ip to communicate:

addNetworkException() {
    token=$1
    subscriptionId=$2
    resourceGroupName=$3
    accountName=$4
    publicIp=$5

    headers1="Content-Type:application/json"
    headers2="Authorization:Bearer ${token}"
    url="https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${accountName}?api-version=2021-09-01"
    data="{\"properties\":{\"networkAcls\":{\"defaultAction\":\"deny\",\"ipRules\":[{\"action\":\"allow\",\"value\":\"${publicIp}\"}]}}}"
    curl -X PATCH -H "$headers1" -H "$headers2" -d "$data" "$url"
}

Closing the firewall is similar. We just have to remove the ip address from the json and pass an empty array:

removeNetworkException() {
    token=$1
    subscriptionId=$2
    resourceGroupName=$3
    accountName=$4
    publicIp=$5

    headers1="Content-Type:application/json"
    headers2="Authorization:Bearer ${token}"
    url="https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${accountName}?api-version=2021-09-01"
    data="{\"properties\":{\"networkAcls\":{\"defaultAction\":\"deny\",\"ipRules\":[]}}}"
    curl -X PATCH -H "$headers1" -H "$headers2" -d "$data" "$url"
}

Now that we have taken care of the security functions let's work on the backup itself.

Let's use our credentials file to add the azure information to our rclone configuration (This will run only once):

rclone_config() {
    echo 'Adding configuration...'
    rclone config create "$name" azureblob account="$storageaccountname" access_tier="$accesstier" service_principal_file="$credential_file"
    echo 'Config entry added!'
}

What are the function parameters?

$name - The configuration name
$storageaccountname - The name of the azure account
$accesstier - The Archive access tier will be used to store our files in a cheap way
$credential_file - The filesystem path for our manually created credentials file

Now we need the function that executes the backup:

rclone_backup() {
    echo 'Starting backup...'
    rclone sync "$sourcepath" "$name":"$container" "--azureblob-archive-tier-delete" "-v"
    if [ $? -eq 0 ]; then
        echo 'Backup completed!'
    else
        echo 'Something went wrong!'
        exit 1
    fi
}

The parameters once again.

$sourcepath - The filesystem path to your folder
$name - The rclone configuration name we used in the previous function
$container - The azure storage container name

And now let's put this all together.

getPublicIp() {
    curl checkip.amazonaws.com
}
getAzureToken() {
    client_id=$1
    client_secret=$2
    tenant=$3
    scope="https%3A%2F%2Fmanagement.core.windows.net%2F.default"
    headers="Content-Type:application/x-www-form-urlencoded"
    data1="client_id=${client_id}&scope=${scope}&client_secret=${client_secret}&grant_type=client_credentials"
    data2="https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token"
    curl -X POST -H $headers -d $data1 $data2
}

addNetworkException() {
    token=$1
    subscriptionId=$2
    resourceGroupName=$3
    accountName=$4
    publicIp=$5

    headers1="Content-Type:application/json"
    headers2="Authorization:Bearer ${token}"
    url="https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${accountName}?api-version=2021-09-01"
    data="{\"properties\":{\"networkAcls\":{\"defaultAction\":\"deny\",\"ipRules\":[{\"action\":\"allow\",\"value\":\"${publicIp}\"}]}}}"
    curl -X PATCH -H "$headers1" -H "$headers2" -d "$data" "$url"
}

removeNetworkException() {
    token=$1
    subscriptionId=$2
    resourceGroupName=$3
    accountName=$4
    publicIp=$5

    headers1="Content-Type:application/json"
    headers2="Authorization:Bearer ${token}"
    url="https://management.azure.com/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${accountName}?api-version=2021-09-01"
    data="{\"properties\":{\"networkAcls\":{\"defaultAction\":\"deny\",\"ipRules\":[]}}}"
    curl -X PATCH -H "$headers1" -H "$headers2" -d "$data" "$url"
}

rclone_config() {
    echo 'Adding configuration...'
    rclone config create "$name" azureblob account="$storageaccountname" access_tier="$accesstier" service_principal_file="$credential_file"
    echo 'Config entry added!'
}

rclone_backup() {
    echo 'Starting backup...'
    rclone sync "$sourcepath" "$name":"$container" "--azureblob-archive-tier-delete" "-v"
    if [ $? -eq 0 ]; then
        echo 'Backup completed!'
    else
        echo 'Something went wrong!'
        exit 1
    fi
}

publicIp=$(getPublicIp)

credentials=$(cat "$credential_file")

azureToken=$(jq -j '.access_token' <<<"$(getAzureToken "$client_id" "$client_secret" "$tenant")")

addNetworkException "$azureToken" "$subscriptionid" "$resourcegroupname" "$storageaccountname" "$publicIp"

config=$(rclone config dump)
if [ -z "$config" ]; then
    rclone_config
    rclone_backup
else
    rclone_backup
fi

To make it easier I've compiled it into a bash script available at

You can go over the description of each block of code and also read the script parameter description.

Using the downloaded script we can just make it executable and pass the parameters:

chmod +x linuxFSAzureBackup.sh

And then run it with the code bellow (this is a dummy example. Please replace with your own values).

./linuxFSAzureBackup.sh -n "raspberry2azure" -k "/home/pi/azurecredentials.json" -s "myspecialstorage" -r "specialresourcegroup" -i "497b54be-ccfb-47be-994d-b4d549a191cb" -a "Archive" -p "/mnt" -c "myspecialcontainer"

The parameter order:

-n The name that we will assign to the rclone configuration"
-k Path for the azure Cli generated credentials file"
-s The Azure Storage Account Name"
-r The resource Group Name where the Azure Storage Account resides"
-i The Azure subscription id"
-a The desired storage account accesstier for the backed up files"
-p The path where the items to be backed up reside"
-c The Azure Storage account container name"

These are the results:

Adding the public ip address

Copying the files

Removed the ip rule

In the end I had to create a filter file for rclone because some files were not getting copied. So that will be my next contribution for the script. But please feel free to modify it as you need.

And that's it. You can now add the script to crontab and have a cloud backup solution on your raspberry pi.

I hope you enjoyed this series of articles.

See you soon.

RaspberryPi cloud backup Part 2

Jorge Rodrigues (mrscripting) — Mon, 22 Aug 2022 11:03:05 +0000

Architecture

In our last post, we compared the costs of different cloud providers and chose Azure to store our data.

Let's now analyze the architectural drawing of our implementation.

First, we need to determine the components that will be used:

RaspberryPi as data source and computing power for script execution;
Azure Storage as our target;
Azure Active Directory to manage authentication;
A service that tells us our public IP address so we can configure it in the storage account firewall.

Communication will be over the Internet using https, as we don't want to set up additional infrastructure such as a VPN.

Infrastructure

Let's build the infrastructure. We need a pay-as-you-go subscription which includes $200 for 30 days and then we have various services that are free for a year. And guess what archive storage is one of those services, with 10 GB for free.

To set up our Azure components, we use terraform. Terraform codifies cloud APIs into declarative configuration files that we can use to specify what infrastructure we want. It also works with multiple cloud providers, so you only have to learn one language instead of multiple. Isn't that cool?

Let's install the requirements:

Az Cli will be used to login to our new account and authorize terraform.

For the windows operating system, open a powershell window as administrator and paste the command bellow:

winget install --id Microsoft.AzureCLI

For debian based linux distros:

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Now let's install terraform.

On windows through chocolatey:

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
choco install terraform

For linux:

sudo apt-get update && sudo apt-get install -y gnupg software-properties-common
wget -O- https://apt.releases.hashicorp.com/gpg | \
    gpg --dearmor | \
    sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
    https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
    sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update
sudo apt-get install terraform

You can now download the 2 files from my github called main.tf and example.tfvars

Place these 2 files into an empty directory and change your current directory in the shell to this new directory.

az login

The output should be something like this

[
  {
    "cloudName": "AzureCloud",
    "homeTenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx",
    "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "isDefault": true,
    "managedByTenants": [],
    "name": "Pay-As-You-Go",
    "state": "Enabled",
    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx",
    "user": {
      "name": "mrscriptingfakeemail@outlook.com",
      "type": "user"
    }
  }
]

Copy the id value from this output and replace the value for subscription_id in the example.tfvars file.
Copy the tenantId value from the output as well and replace the value for tenand_id in the example.tfvars file.

We are now ready to spin up our service principle, resource group and network restricted storage account.

let's run terraform:

terraform init
terraform plan -var-file="example.tfvars"

It should return the following output

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azuread_application.appregistration will be created
  + resource "azuread_application" "appregistration" {
      + app_role_ids                = (known after apply)
      + application_id              = (known after apply)
      + disabled_by_microsoft       = (known after apply)
      + display_name                = "backupapplication"
      + id                          = (known after apply)
      + logo_url                    = (known after apply)
      + oauth2_permission_scope_ids = (known after apply)
      + object_id                   = (known after apply)
      + owners                      = [
          + "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx",
        ]
      + prevent_duplicate_names     = false
      + publisher_domain            = (known after apply)
      + sign_in_audience            = "AzureADMyOrg"
      + tags                        = (known after apply)
      + template_id                 = (known after apply)

      + feature_tags {
          + custom_single_sign_on = (known after apply)
          + enterprise            = (known after apply)
          + gallery               = (known after apply)
          + hide                  = (known after apply)
        }
    }

  # azuread_application_password.appregistrationPassword will be created
  + resource "azuread_application_password" "appregistrationPassword" {
      + application_object_id = (known after apply)
      + display_name          = (known after apply)
      + end_date              = (known after apply)
      + end_date_relative     = "8765h48m"
      + id                    = (known after apply)
      + key_id                = (known after apply)
      + start_date            = (known after apply)
      + value                 = (sensitive value)
    }

  # azuread_service_principal.backupserviceprinciple will be created
  + resource "azuread_service_principal" "backupserviceprinciple" {
      + account_enabled              = true
      + app_role_assignment_required = false
      + app_role_ids                 = (known after apply)
      + app_roles                    = (known after apply)
      + application_id               = (known after apply)
      + application_tenant_id        = (known after apply)
      + display_name                 = (known after apply)
      + homepage_url                 = (known after apply)
      + id                           = (known after apply)
      + logout_url                   = (known after apply)
      + oauth2_permission_scope_ids  = (known after apply)
      + oauth2_permission_scopes     = (known after apply)
      + object_id                    = (known after apply)
      + owners                       = [
          + "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx",
        ]
      + redirect_uris                = (known after apply)
      + saml_metadata_url            = (known after apply)
      + service_principal_names      = (known after apply)
      + sign_in_audience             = (known after apply)
      + tags                         = (known after apply)
      + type                         = (known after apply)

      + feature_tags {
          + custom_single_sign_on = (known after apply)
          + enterprise            = (known after apply)
          + gallery               = (known after apply)
          + hide                  = (known after apply)
        }

      + features {
          + custom_single_sign_on_app = (known after apply)
          + enterprise_application    = (known after apply)
          + gallery_application       = (known after apply)
          + visible_to_users          = (known after apply)
        }
    }

  # azurerm_resource_group.resourcegroup will be created
  + resource "azurerm_resource_group" "resourcegroup" {
      + id       = (known after apply)
      + location = "westeurope"
      + name     = "homeresourcegroup"
      + tags     = {
          + "environment" = "homesetup"
        }
    }

  # azurerm_role_assignment.StorageBlobDataOwner will be created
  + resource "azurerm_role_assignment" "StorageBlobDataOwner" {
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = (known after apply)
      + principal_type                   = (known after apply)
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Storage Blob Data Owner"
      + scope                            = (known after apply)
      + skip_service_principal_aad_check = (known after apply)
    }

  # azurerm_storage_account.storage will be created
  + resource "azurerm_storage_account" "storage" {
      + access_tier                       = (known after apply)
      + account_kind                      = "StorageV2"
      + account_replication_type          = "LRS"
      + account_tier                      = "Standard"
      + allow_nested_items_to_be_public   = true
      + cross_tenant_replication_enabled  = true
      + default_to_oauth_authentication   = false
      + enable_https_traffic_only         = true
      + id                                = (known after apply)
      + infrastructure_encryption_enabled = false
      + is_hns_enabled                    = false
      + large_file_share_enabled          = (known after apply)
      + location                          = "westeurope"
      + min_tls_version                   = "TLS1_2"
      + name                              = "storageraspberrybackup"
      + nfsv3_enabled                     = false
      + primary_access_key                = (sensitive value)
      + primary_blob_connection_string    = (sensitive value)
      + primary_blob_endpoint             = (known after apply)
      + primary_blob_host                 = (known after apply)
      + primary_connection_string         = (sensitive value)
      + primary_dfs_endpoint              = (known after apply)
      + primary_dfs_host                  = (known after apply)
      + primary_file_endpoint             = (known after apply)
      + primary_file_host                 = (known after apply)
      + primary_location                  = (known after apply)
      + primary_queue_endpoint            = (known after apply)
      + primary_queue_host                = (known after apply)
      + primary_table_endpoint            = (known after apply)
      + primary_table_host                = (known after apply)
      + primary_web_endpoint              = (known after apply)
      + primary_web_host                  = (known after apply)
      + queue_encryption_key_type         = "Service"
      + resource_group_name               = "homeresourcegroup"
      + secondary_access_key              = (sensitive value)
      + secondary_blob_connection_string  = (sensitive value)
      + secondary_blob_endpoint           = (known after apply)
      + secondary_blob_host               = (known after apply)
      + secondary_connection_string       = (sensitive value)
      + secondary_dfs_endpoint            = (known after apply)
      + secondary_dfs_host                = (known after apply)
      + secondary_file_endpoint           = (known after apply)
      + secondary_file_host               = (known after apply)
      + secondary_location                = (known after apply)
      + secondary_queue_endpoint          = (known after apply)
      + secondary_queue_host              = (known after apply)
      + secondary_table_endpoint          = (known after apply)
      + secondary_table_host              = (known after apply)
      + secondary_web_endpoint            = (known after apply)
      + secondary_web_host                = (known after apply)
      + shared_access_key_enabled         = true
      + table_encryption_key_type         = "Service"
      + tags                              = {
          + "environment" = "homesetup"
        }

      + blob_properties {
          + change_feed_enabled           = (known after apply)
          + change_feed_retention_in_days = (known after apply)
          + default_service_version       = (known after apply)
          + last_access_time_enabled      = (known after apply)
          + versioning_enabled            = (known after apply)

          + container_delete_retention_policy {
              + days = (known after apply)
            }

          + cors_rule {
              + allowed_headers    = (known after apply)
              + allowed_methods    = (known after apply)
              + allowed_origins    = (known after apply)
              + exposed_headers    = (known after apply)
              + max_age_in_seconds = (known after apply)
            }

          + delete_retention_policy {
              + days = (known after apply)
            }
        }

      + network_rules {
          + bypass                     = (known after apply)
          + default_action             = "Deny"
          + ip_rules                   = (known after apply)
          + virtual_network_subnet_ids = (known after apply)
        }

      + queue_properties {
          + cors_rule {
              + allowed_headers    = (known after apply)
              + allowed_methods    = (known after apply)
              + allowed_origins    = (known after apply)
              + exposed_headers    = (known after apply)
              + max_age_in_seconds = (known after apply)
            }

          + hour_metrics {
              + enabled               = (known after apply)
              + include_apis          = (known after apply)
              + retention_policy_days = (known after apply)
              + version               = (known after apply)
            }

          + logging {
              + delete                = (known after apply)
              + read                  = (known after apply)
              + retention_policy_days = (known after apply)
              + version               = (known after apply)
              + write                 = (known after apply)
            }

          + minute_metrics {
              + enabled               = (known after apply)
              + include_apis          = (known after apply)
              + retention_policy_days = (known after apply)
              + version               = (known after apply)
            }
        }

      + routing {
          + choice                      = (known after apply)
          + publish_internet_endpoints  = (known after apply)
          + publish_microsoft_endpoints = (known after apply)
        }

      + share_properties {
          + cors_rule {
              + allowed_headers    = (known after apply)
              + allowed_methods    = (known after apply)
              + allowed_origins    = (known after apply)
              + exposed_headers    = (known after apply)
              + max_age_in_seconds = (known after apply)
            }

          + retention_policy {
              + days = (known after apply)
            }

          + smb {
              + authentication_types            = (known after apply)
              + channel_encryption_type         = (known after apply)
              + kerberos_ticket_encryption_type = (known after apply)
              + versions                        = (known after apply)
            }
        }
    }

Plan: 6 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + appId       = (known after apply)
  + displayName = "backupapplication"
  + password    = (known after apply)
  + tenant      = "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx"

Everything looks good so let's proceed with the deployment:

terraform apply -var-file="example.tfvars"

Take note of all the values from the outputs like appid, displayname, tenant and password (the password output is an exception and should not be used in production or any pipelines. If needed use Azure Keyvault instead)

And we are done with our infrastructure. The next step is to build a bash script that will backup our files in Azure using the output from terraform for authentication.
So don't miss part 3.

RaspberryPi cloud backup Part 1

Jorge Rodrigues (mrscripting) — Sat, 20 Aug 2022 19:11:00 +0000

NAS systems are expensive. I have a bunch of hard drives lying around from broken laptops, so why not use a relatively inexpensive Raspberrypi 4 that I already own to aggregate them and share it on my network?

And that's exactly what I did. I bought a Wavlink USB hard drive dock from Aliexpress, connected 2 hard drives and downloaded and installed openmediavault.

After combining the hard drives into one and creating a shared folder for my home network, everything worked fine.

But here's the catch. It's not the speed, because I don't need fast hard drives on my home setup. It's not the power consumption, because it consumes very low power. It's the fact that all my data is only on these hard drives. What happens if they all fail?
Sure, I can always set up a raid (on OS level since openmediavault doesn't support it). But raid isn't backup.

So I've decided that I need an inexpensive backup solution in case the hard drives stop working.
I know what you're thinking. A raspberryPi 4 with 4GB memory costs around 60€, plus the dock 40€. With all the work I have, maybe I should consider buying a NAS system. But what fun would that be, right? Right? 😅

I want to spend as little as possible per month with this backup so let's evaluate the cheapest alternative to backup a combined number of files up to 1TB of space.

So let's see the cloud options for 1TB cloud storage:

Cloud Provider Offer	Disk Space	Pricing per month (€)
Google One	2 TB	9.99
Onedrive (Microsoft 365 Personal)	1 TB	7.00
Apple iCloud	2TB	9.99
DropBox	2TB	9.99

Well, that seems a lot of money. Let's check some cold storage then since I'm ok with having to wait some time in order to retrieve my files.

Cloud Provider Offer	Disk Space Used	Pricing per month excluding communication (€)	Retrieval policy
AWS S3 Glacier Deep Archive	1TB	1.8432	For long-term data archiving that is accessed once or twice in a year and can be restored within 12 hours
Azure Block Blob General Purpose V2 Archive LRS	1TB	1.80	The rehydration request will be processed in the order it was received and may take up to 15 hours

Another important factor to consider is the pricing for the retrieval of the data for both AWS and Azure. AWS presents the pricing using an 1000 api call and Azure presents the pricing using an 10000 api call scale.

Ok, now that we know the pricing. We just need the infrastructure (let's choose azure for this use case) and a script to backup our data periodically.

So don't miss part 2.

Vscode server

Jorge Rodrigues (mrscripting) — Mon, 08 Aug 2022 13:00:00 +0000

So you have an ipad or chromebook and you want to use it for programming too? Why not use vscode for it?

Visual Studio Code is not directly available on the apple store so we will use the raspberry pi as our host for visual studio code. But instead of remoting via vnc we will use the web version of vscode.

You will need to have a fully working raspberry pi so if you are new to it just check this page and it will guide you through Setting Up Raspberry Pi

With your raspberry pi installed and fully available via ssh it’s time for us to install a ssh app from the ipad store.

You can remote into the raspberry pi using the ssh app. In this case let’s say my raspberrypi address is 10.1.1.254

ssh pi@10.1.1.254

Let’s install some requirements for installing visual studio code server.

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.35.3/install.sh | bash
nvm install 14.4.0

Install code-server using npm

npm install -g code-server

Now we need to add our code-server to systemctl. For that we are going to use the pm2 module.

sudo npm install pm2@latest -g
pm2 start code-server
pm2 startup systemd

This will produce a command copy and paste it. It should look something like this:

sudo env PATH=$PATH:/home/pi/.nvm/versions/node/v14.4.0/bin /usr/local/lib/node_modules/pm2/bin/pm2 startup systemd -u pi --hp /home/pi
pm2 save

Now restart the raspberrypi and when it starts check the service status

It should look like this:

pi@raspberrypi:~ $ systemctl status pm2-pi.service
● pm2-pi.service - PM2 process manager
   Loaded: loaded (/etc/systemd/system/pm2-pi.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2022-03-26 19:33:15 GMT; 1min 59s ago
     Docs: https://pm2.keymetrics.io/
  Process: 854 ExecStart=/usr/local/lib/node_modules/pm2/bin/pm2 resurrect (code=exited, status=0/SUCCESS)
 Main PID: 932 (node)
    Tasks: 11 (limit: 3720)
   CGroup: /system.slice/pm2-pi.service
           └─932 PM2 v5.2.0: God Daemon (/home/pi/.pm2)

So the vscode is available at localhost:8080 but we need to access it from outside. The best way to acomplish this is by installing and configuring the reverse proxy nginx.

Install it by running:

sudo apt update
sudo apt upgrade
sudo apt install nginx

Now we need to expose the website:

sudo cp /etc/nginx/sites-available/default /etc/nginx/sites-available/code-server
sudo vim /etc/nginx/sites-available/code-server

Comment the default site configuration and uncomment the virtual host configuration. Notice the location parameter is diferent. Just add the code bellow by changing the port where your code-server is listening. On our case we are using port 8081 for the nginx and 8080 for the code-server:

server {
        listen 8081;
        listen [::]:8081;

        server_name raspberrypi;

        #root /var/www/example.com;
        #index index.html;

        location / {
                proxy_pass http://localhost:8080;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection 'upgrade';
                proxy_set_header Host $host;
                proxy_cache_bypass $http_upgrade;
        }
}

Check for configuration errors, enable the newly created site and restart the nginx service:

sudo nginx -t
sudo ln -s /etc/nginx/sites-available/code-server /etc/nginx/sites-enabled/
sudo systemctl restart nginx

And that’s it. You now can use it from your ipad, computer or any other device and keep your files and extensions centralized. You can even expose it using your home router and use it on the go. But for that you’ll need to tighten security.

Although this setup automatically configures a password for the web page (you can check it at ~/.config/code-server/config.yaml) it may not be enough to secure your server. So invest some time in securing the setup.

Undo Git Commit mistakes

Jorge Rodrigues (mrscripting) — Mon, 08 Aug 2022 10:47:00 +0000

If you find yourself in a situation where you have committed to a branch using a name and email that was not your intention to use in the first place then you might think that there isn’t much you can do to fix the mistake.

The truth is that you can fix that by running the following git commands (this was done on linux shell):

git filter-branch -f --env-filter '
OLD_NAME="XXXXX"
NEW_NAME="XXXXXX"
NEW_EMAIL="XXXXXXX@XXXXXX"
OLD_EMAIL="XXXXXXs@XXXXXX"
if [ "$GIT_AUTHOR_NAME" = "$OLD_NAME" ]
then
 export GIT_COMMITTER_NAME="$NEW_NAME"
 export GIT_COMMITTER_EMAIL="$NEW_EMAIL"
 export GIT_AUTHOR_NAME="$NEW_NAME"
 export GIT_AUTHOR_EMAIL="$NEW_EMAIL"
fi
' --tag-name-filter master -- --branches --tags

Replace the fields marked with XXXX and execute this.

Don’t forget to push your code. You might have to use the –force option. After this you will have your commits fixed.

But please don’t forget, the best way to avoid this is to properly configure your name and email using git config:

git config --global user.name "Your Name"
git config --global user.email "youremail@yourdomain.com"

And it’s done. Enjoy!