DEV Community: Wervice

A recap about the Zentrox development

Wervice — Sat, 28 Sep 2024 16:25:26 +0000

What am I working on?

I am working on a project called Zentrox. Zentrox is an open source tools to remotely adminster your linux home lab servers/devices.
https://github.com/wervice/zentrox

How far am I with Zentrox?

Zentrox is still its beginnings. I am currently working on creating a test release so people can actually try the project for the first time. It currently does not support as many features as some other applications for server admin.

Where am I going with my project?

Zentrox is supposed to get more features like a media center, package update automation and more. It is only developed by me, so I can not guarantee that I will add a feature. The project lacks documentation as well, but having learned from my re-write to Rust, I will add docs.

What technologies does Zentrox use (+ Some well deserved credits).

Backend

Zentrox backend was originally written in JavaScript with Node.JS as its runtime. This became annoying to develop and pretty slow, which is why I decided to re-write it in Rust 🦀 - Yes I re-wrote several thousand lines of undocumented JavaScript code to Rust, as a hobby project.

So, what framework do I use? Zentrox uses the actix_web framework which is a great library. My DevExp. with this tool was nice. It has good documentation and powerful tools. It was easy to implement for me as I was previously using Express.JS and Flask (Python). Actix also has other helper libraries for files, cookies, sessions,... which I use in my project as well.

Frontend

The frontend of Zentrox is written using React. Of course I did not write this frontend without any frameworks. I use Next.JS by Vercel as a framework. Zentrox also uses a UI library called shadcn. Shadcn is an amazing library. It made devloping frontend a lot easier when you do not have to build everything from the ground up. I'd also like to give some credit to Radix UI, as this is what Shadcn uses for its components. :-)

How does Zentrox work?

⚠️ The following text is technical.

Zentrox has three parts. The frontend (FE), the backend (BE) and the application programming interface (API). The API is only used to communicate between frontend and backend and is not meant for use with extensions, but I am not trying to prevent that either. It will just require authentication on the server-side to work.

Auth

When you first set up Zentrox by running install.bash, you are asked to set an admin username and password. You can also enable two factor authentication using OTP there.

⚠️ 🤓

You password is then hashed using OpenSSL. It uses the Sha512 algorithm with salting and PBKDF2.
This makes it hard for hackers to brute-force your password.
The same happens when logging in with the login-provided password.
This process makes the login a bit slower than with blank Sha256 (the previous attempt), but I consider the lag to be negligible.
I used this document from OWASP as a reference.

When the user now logs in the stored password and entered password are compared, and if enabled the OTP token is also checked. The an encrypted cookie is stored on the users side that links to a database with a token that will then verify if a user is logged in. The cookie will not contain any sensitive data from then on.

As soon as the user logs out, the cookie is invalidated and the token invalidated.

Privilege escalation

Some things like managing the firewall require admin permissions. My inital attempt was to create another system user for zentrox with a password known to the Zentrox password.
Instead of going this route, I am simply using sudo and writing the password to sudos' stdin.

Vault

Vault is a key component of Zentrox. It is a self-hosted encrypted data storage. The files are located in ~/zentrox_data.
But how does it work? To use Vault, a user has to create a new vault by setting a password. The user can then upload a file to vault. The file gets encrypted using AES 256 GCM. Before this can happen, the encryption key is derived from the password using salted argon2. This makes brute-forcing and dictionary attacks very time consuming and expensive. The uploaded file is stored with an encrypted file name.

This entire procedure only provides protection from the file being viewed. It does not yet protect against ransomware or wipers.

Dead code

I've been working on Zentrox for ~6 months at the time of writing this article. Initially, Zentrox was meant to be a way to link my existing Codelink projects together by providing a hub for the applications. Thus Zentrox started a sub-project of Codelink and was later split off, because it went in a different direction than what I planned.
Today, the Codelink project is not maintained, as Zentrox occupied my time working on hobby projects.

users.c

I wanted Zentrox to be able to create system users on its own. I was unable to get useradd and adduser to work like I planned. This was necessary as I was using vsftpd and wanted to use a system user instead of a vsftpd virtual user.

So, I did the most rational thing that I could have done there. /s
I started learning C, to write a program that modifies the /etc/shadow and /etc/passwd files of a users machine. (We are in the section "Dead Code", this code never made it into any releases and I always had a disclaimer in the repo or Zentrox about this code.).

Here is an image of the C code:

I realized that it would probably not be such good of an idea to modify system files using self-built code and I purged the entire idea. I learned some C on the way there and I think that pretty cool!

Mapbase

I was looking for an easier way to store Zentrox configuration and some variables than making a file for every variable, because that was how I did it for a long time.
I settled on making my own little key-value store/database. I called it Mapbase and wrote it in Go. This was a fun experience, but has now been replaced with a .toml file, as Mapbase is not really that different from toml, but was a bit tedious to work with especially considering it added yet another language to Zentrox. Here is a meme showing what the Zentrox language statistics looked around that time (Go not included):

The old frontend

The old frontend was nice, but I removed it because it became anoying to work with. It has now been replaced with the React frontend I described in the beginning of this post.
It once looked like this:

Thanks to everyone who made be aware of bugs and things not to do :-)

Please let me know what you think about Zentrox and this post in the comments. Have a nice day.

Working on a single board computer

Wervice — Sun, 19 May 2024 14:17:05 +0000

A few weeks ago, I got my Raspberry Pi 5 or more specifically, a starter set including it, a fan, SD Card and case.
I ran some stress tests on the device to see how performant the device really is. I was shocked by how easily it handled most of the tasks that were thrown at it, like video playback, stress command or simple browsing. I didn't write those measurements down, so I cannot add them to this post. Anyway, there are other websites that probably have done a better job at analyzing the Pi than I did.

At this time, my development environment was a Fedora laptop with many packages and system changes. This became a problem when working on one of my side projects called Zentrox.

To replace/extend this environment, I decided to set my Raspi up as a development system. This was actually pretty easy, and if you want to, you can follow me along here.

Install Raspbian and enable SSH
Which tools am I using very often?
1. Neovim
2. Tmux
3. Btop
4. Chrome
5. Compilers, interpreters, git, ssh, fish...
6. Docker
Which of these tools should run on the raspi?
1. Neovim
2. Tmux
3. Compilers and interpreters
4. Docker
How do I get thes tools running on the raspi?
1. Copy Neovim and Tmux config to the raspi (using ssh file transfer)
2. Install btop, nodejs,...
3. Get docker running

After I installed, updated and configured all applications and packages the raspi now easily runs my project(s), gcc,...

The only thing missing is proper pip3 functionality. Every time I try to install a Python package, I am hit with this error:

A few screenshots of the working setup (taken in Windows Terminal on W11 over SSH)

I hope you liked this post. Feel free to add an emotion, leave a comment (constructive or not), and maybe star Zentrox.

How I wrote a package manager in JavaScript

Wervice — Thu, 18 Apr 2024 13:00:00 +0000

Firstly, you will probably be asking yourself: Why did he do this?
I have been working on a project called Zentrox for a few weeks by now. Zentrox is a server administration tool, that gives you a dashboard in the web browser.
The dashboard should include information about the storage, the users, file sharing protocols and the installed packages.

The first step to creating this package manager was figuring out, how I was going to do this. So, I wrote some boilerplate HTML code and some CSS for the front-end. At this time, I already had an Express.js server and some front-end code.
Still, I didn't know, how to manage the packages and what I actually wanted to do in detail. So I chose to write the following functions:

listing all packages in the repositories
listing all packages on the system
installing a package
removing a package
getting an icon for an installed package

Then, I went on Google and looked for things like “JavaScript package manager”, “Package manager for JavaScript” or “DNF API Python”. The only one that really lead to a result (that is not NPM, …) was the DNF API for Python. I tried to write a small python script, but it didn't work. Also, I didn't find an API for other package managers like DNF or pacman.
So, I started by writing a JavaScript, that uses exec to run some commands. One command was (and still is): dnf list. The problem with this was, that I didn't know the result and also did not want to write some complicated async or callback code.

While browsing the Node documentation, I found a function named execSync. This function does exactly what I want. It executes the command in a synchronous order.

Now, the only thing stopping me from doing the first four tasks was figuring out the commands to install, remove and list packages under apt, DNF and pacman.
Those were pretty easy to figure out. Then I wrote a condition that detects which distro the manager is running on.

After I tested it on my one system, it turned out to be working just fine.

So, the next step was adding support for icons of installed packages.

I did some research and figured out, that packages that have an icon, probably also have a .desktop file in /usr/share/applications. This file will then contain a name, an icon, and the path to the binary.

With this new knowledge, I wrote a script that reads the name and icon path of an application from its desktop file.

Some packages do not include an icon in the corresponding desktop file, though. Nonetheless, every desktop file will contain a name and execution path. These can be used to get an icon from the installed icon pack on the system.

To get to these icons, I first need to know where they all are. Most of the time, the location for icons on Linux is /home/username/.icons or /local/share/icons.

Now, I just had to write a script that reads these folders, selects a pack, looks the name up and then returns the icon to me.

The problem was, that there may be an icon pack, that does not contain the icon at all. So, I also wrote some code, that detects that.

At this point, I had all the planned functions done and published it on GitHub. I also wrote about it on Reddit.

Very soon, there was one thing, that was (rightfully) criticized by several Redditors. I did not sanitize the sudo password required to install and remove packages.

I added a few .replaceAll to the code. Then it was just fine. After connecting it with the front-end and testing it on a Manjaro and Debian distro, I wanted to call it a day.

The issue was, that it was terribly slow. So, instead of running the command used to list all available packages every time, when the app is opened, I made a background worker, that caches it to another file in an interval of 1h.

So, every time the package manager is loaded, the cached data is used. Now, the only this that is slowing it down is the command used to list installed packages.

The last thing to do was integrating it into my project.
I added a section called “Packages” in my Zentrox dashboard.
You can find it here: wervice/zentrox

The final product looks like this:

If you want to, you can install Zentrox on your system and test the package manager.

Please tell me, if you spotted a problem.

Chosing the right code editor: A quick guide

Wervice — Wed, 17 Apr 2024 14:16:00 +0000

There are many code editors out there. Some of them have specialised for one language or a development stack. Others are good for general development.

So, lets start with the first editor:

Visual Studio Code

Visual Studio Code is a code editor developed by Microsoft. It comes with most features you may want for coding out of the box.
It is commonly used in web development, but you can also use it for other stacks like writing Python scripts.
It has its own extension store. There you can find many add-ons. These will add support for other programming languages, give you new themes or help you while coding.

If you do not want to use something developed by Microsoft, you can use the alternative VSCodium.

VSCode is often recommended for beginners, because it is very ease to use. Nonetheless, you can also use it as a professional.

You can also try the web version.

Screenshot of my VSCode configuration with the Catppuccin theme installed

Visual Studio

Visual Studio is a very feature rich IDE. It is often used to write Windows applications in C#, C++ or C. It also supports other languages.

Visual Studio is developed by Microsoft as well. It may use a lot of storage on your system.

I would recommend Visual Studio for developing native Windows apps.

Neovim

Neovim is another very popular code editor. It is an open source project. Neovim runs in the terminal.
It uses the Vim keybindings. They can be tricky to get used to. In my experience, you can learn the keybindings in just a few days.

You can extend Neovim using extensions written in a programming language called Lua.
In addition to that, it is very light on system resources.

Neovim may help you get more productive. I am currently using it because of this reason.

Screenshot of my Neovim configuration with Catppuccin theme and NVChad

Emacs

Just like Neovim, Emacs is an open source code editor. It is very feature rich.
Sometimes, people even call it an operating system (for fun).
You can extend it almost to infinity with browsers, terminals and more.
Emacs also has its own set of shortcuts, that may be confusing in the beginning.

I would recommend Emacs, if you want a very extensible code editor.

Sublime Text

Sublime Text is a proprietary text editor. It is similar to VSCode, since it has some features by default and an integrated extension manager.

In my experience, it is heavier on resources and more complicated to use than VSCode.

Also, it should be noted, that you are supposed to buy it, but you can "try" it for how long you want.

I would recommend this, if you are looking for something similar to Visual Studio Code.

Notepad++

Notepad is a text/code editor. I comes with some simple features for coding out of the box. The interface is very minimal. It uses normal keyboard shortcuts, like CTRL+S or CTRL+C.
You can change the look for the editor using themes.

This editor is good, if you want to start coding with a light editor.

Eclipse IDE

Eclipse is an IDE specialized for Java development. Java is a language used to write Android apps, server back-ends and desktop applications.

I would recommend it for developing Java code.

More editors are...

BlueJ (Java development)
GNU Nano (Terminal based text editor)
XCode (Swift development under OSX)

Conclusion

Since there are so many code editors, it may be hard to decided among them. I would recommend a general purpose editor, if you do not focus on one language.
You may consider some editors easier to use than others.

Sometimes, there are also extensions for other code editors to bring the best of two editors together.

I wish you lots of fun choosing and using an editor.