I have a GLInet travel router that is a peer connected to my Netbird network, I'd like to have any client that connects to my router to have access to the peers the travel router has access to, but still be able to access the regular internet that is being passed through by my router. Is this possible?

Ultimately I'm trying to get the TV at my girlfriend's place to be able to access my Jellyfin instance over Netbird. According to the Netbird documentation, exit nodes and routes are depricated and should not be used, but I'm struggling hard with getting it to work with Networks.

• I've created a group with my GLInet router, my Jellyfin instance, and my home server (Which hosts Jellyfin) all in the group called "Travel".
• I've created a Network called "Home" in Netbird
• Within the "Home" network I've created a resource called "Jellyfin" with the IP address set to it's Netbird IP address, and an access control group where all members of the "Travel" group have access to all ports of the "Jellyfin" resource.
• I've created two routing peers within the network, one is the GLInet router and the other is my home server. Both of these are Netbird peers with Netbird installed on them.

I am very confused overall, and could use a hand if anyone wanted to walk me through what I'm doing wrong.

I've been trying to set up hibernation on my laptop while also maintaining an encrypted root partition and swap using secure boot and my laptop's TPM. I've documented the steps I've followed below, but I still am unable to enable hibernation.

I was under the impression that the only reason you can't normally have both an encrypted harddrive and hibernation was because swap had to be encrypted as well, but if both the root partition and the swap are encrypted, I'm using UEFI secure boot, and they are automatically decrypted at boot using the TPM, shouldn't that relieve those security concerns?

After completing the below, entering systemctl hibernate errors saying hibernation is not set up for the system. Am I missing something or is it just not possible? I can confirm not needing to enter passwords for my swap or root FS due to the TPM unlock.

My personal documentation below:

Drop into root shell

sudo su -

Setup LUKS encryption with automatic unlock with TPM

Install necessary components, regenerate initramfs and reboot

dnf install -y clevis clevis-luks clevis-dracut clevis-udisks2 clevis-systemd
dracut -fv --regenerate-all && systemctl reboot

Identify swap and root partition devices, names, and luks UUIDs...

lsblk -f
cryptsetup luksUUID <UUID>

In my case, my home partition is on /dev/nvme0n1p4 and my swap is /dev/nvme0n1p3

# the encrypted home partition
clevis luks bind -d /dev/nvme0n1p4 tpm2 '{"pcr_ids":"1,4,5,7"}'

# the encrypted swap
clevis luks bind -d /dev/nvme0n1p3 tpm2 '{"pcr_ids":"1,4,5,7"}'

Set a timeout before the system asks for a password, to allow time for the TPM to load and enter the password for you systemctl edit systemd-ask-password-plymouth.service

Add the below then ctrl+o ctrl+x to save and exit

[Service]
ExecStartPre=/bin/sleep 10

Create a dracut configuration file to install the systemd-ask-password-plymouth service: vi /etc/dracut.conf.d/systemd-ask-password-plymouth.conf

Add the below, ensure there are spaces inside the quotation marks on either side of the filename

install_items+=" /etc/systemd/system/systemd-ask-password-plymouth.service.d/override.conf "

Regenerate initramfs and reboot

dracut -fv ‐‐regenerate-all && systemctl reboot

Edit crypttab file (/etc/crypttab)to specify decryption of swap file at boot, duplicate the already present line for your root FS crypttab entry and change the UUIDs to reflect the swap file, use cryptsetup luksUUID /dev/nvme0n1p3 and cryptsetup luksUUID /dev/nvme0n1p4 to get the luks UUIDs for your root and swap partitions.

<swap LUKS UUID> UUID=<swap UUID> none x-initrd.attach
<root FS LUKS UUID> UUID=<root FS UUID> none x-initrd.attach

Regenerate initramfs and reboot: dracut -fv --regenerate-all && systemct reboot

Edit fstab to include swap, append the following to /etc/fstab:

UUID=<swap UUID> none swap defaults,x-systemd.device-timeout=0 1 1

Rebind your home and swap partitions. You will have to do this every time you update the kernel.

# encrypted home partition
clevis luks regen -d /dev/nvme0n1... -s 1

# encrypted swap
clevis luks regen -d /dev/nvme0n1... -s 1

Bit of a newbie question here, but I've set up a local Forgejo server in my homelab that I'm using for personal projects. I've created some modules that I want to be able to reference in other local projects.

Trying to run

go get code.mydomainname.com/tapdattl/test

returns

go: downloading code.mydomainname.com/tapdattl/test v1.0.0
go: code.mydomainname.com/tapdattl/test@v1.0.0: verifying module: code.mydomainname.com/tapdattl/test@v1.0.0: reading https://sum.golang.org/lookup/code.mydomainname.com/tapdattl/test@v1.0.0: 404 Not Found
        server response: not found: code.mydomainname.com/tapdattl/test@v1.0.0: unrecognized import path "code.mydomainname.com/tapdattl/test": https fetch: Get "https://code.mydomainname.com/tapdattl/test?go-get=1": dial tcp <my netbird ip address>:443: connect: connection refused

However I know my Forgejo server is up, and I can push to it and clone from it and do all the normal Git workflows. But Go apparently can't talk to it.

Can anyone explain what's going on?

Thanks!!

Solved So turns out I need to store the original response and return clones. I've updated the code below to reflect that change. But feel free to use the below to deduplicate requests.

Hello,

I'm working on a small class to deduplicate API request calls. The basic function being a map of request path -> request promise. The issue I am running into is that on sequential calls I get a "response body has already been consumed" error.

From what I've read, I need to use response: (await res).clone() in the call to this.queryMap.set, however when I do that the map doesn't get updated in time to cache the calls (I think) and all 10 queries get sent to the API endpoint without being cached.

Any ideas on what I need to do?

class Deduplicator {
    queryMap = null;

    constructor() {
        this.queryMap = new Map();
    }

    async get(query, ttl = 10) {
        let now = Temporal.Now.instant();
        let cacheCheck = this.queryMap.get(query);
        if (cacheCheck == undefined || now.since(Temporal.Instant.from(cacheCheck.at)).seconds > ttl) {
            console.log("Cache miss on ", query)
            const res = fetch(query, {
                method: "GET",
            });
            this.queryMap.set(query, {
                at: now,
                response: res,
            })
            return (await res).clone(); //Previously just returned res
        } else {
            console.log("Cached response of ", query);
            return (await cacheCheck.response).clone(); //Previously just returned cacheCheck.response
        }
    }
}

Example:

let deduplicator = new Deduplicator();
for( let i = 0; i < 10; i++){
   let a = (await deduplicator.get("https://jsonplaceholder.typicode.com/todos/3", 10)).json();
   console.log('res: ', a);
}

Given the following short function

func example(foo string) error {
    if bar, err := doSomething(foo); err != nil {
        return err
    } else {
        doSomethingElse(bar)
    }
    return nil
}

Why does the linter recommend I change the if block to

    var bar whateverType
    if bar, err = doSomething(foo); err != nil {
        return err
    }
    doSomethingElse(bar)
    return nil
}

In my mind the former example restricts the bar variable to the smallest scope that is needed, and more clearly identifies doSomethingElse as something that should only happen if err != nil.

I know it's redundant, but now if I want to change it to an else if ... chain I don't have to worry about accidentally including or excluding code from that block, I already know exactly what's supposed to be in it. I just feel like it's a safer programming practice.

But looking forward to other opinions and discussion. Thanks!

Hello all, hoping to get a little assistance on a hardware issue I'm having. I've got an older framework laptop (Batch 5, ~Nov. 2021), and recently it's been having issues powering on. Regardless of the laptop's charge, it will not power on unless it's plugged in. As soon as I past the POST, I can unplug it and it will continue on battery, but in order to get it to actually power on it needs to be plugged in.

Not sure what could be causing this, maybe just a weak battery? Battery health is at 84%. Looking forward to ya'lls thoughts. Thanks!

Task

I'm working on my final project for school, we are supposed to make a web app of our choosing and there has to be specific features in it. One of it is all data must be encrypted, and the other is that we have to have a search functionality. My app (A customer support framework) has a ticket functionality where customers can submit help request tickets, the contents of these tickets need to be encrypted at rest, at the same time admins need to be able to search contents of tickets.

Current Plan

My current plan is to store an AES-256 encrypted copy of the message message.content to meet the encrypted requirement, and also store a tokenized and hashed version of the message message.hashed to meet the searchability requirement.

The tokenization/hashing method will be:

• strip the message to alphanumeric + whitespace ([a-zA-Z0-9 ])
• tokenize by splitting the message by whitespace,
• SHA-256 each token,
• rejoin all the hashed tokens into a space seperated string and stored in the message.hashed field.

Thus this is a test string becomes <hash of this> <hash of is> <hash of a> <hash of test> <hash of string>

When the user searches their search string goes through all of the steps in the tokenization/hashing method, then we query the message table for message.hashed LIKE %%<hashed string>%% and if my thinking is right, we should be able to find it.

Concerns

• Statistical analysis of hashed tokens
  • I really don't see a way around this, to make the string searchable the hashing needs to be predictable.
• message.hashed field could potentially be huge, if each word is getting a SHA256 hash, a large message could result in a very large hash string
  • maybe we just store the last 4 of the hash?
    • This would increase collisions, but the likelihood of multiple last 4's colliding in a given search string should be pretty dang small, and any collisions would likely not be valid language.
    • Would this help with the statistical analysis concern? Increasing collisions would decrease the effectiveness of statistical analysis. It would be a performance hit, but after returning all matches against the hashes I could decrypt the message.content data and search the raw search query against the unencrypted text and remove any incorrect returns caused by collisions.

I'm interested in hearing everyone's thoughts, am I being logical in my reasoning?

Question that I've been mulling over recently: My threat model dictates that I'm more likely to be surveilled by the US government than by the Chinese government. We can also assume that the Chinese government is not going to cooperate with the US government in any investigations of potential activist activity.

Would it not be best, then, to use a Chinese-made phone that, even though we know that information is going to China, we can also assume that any backdoors in the system are unknown to the US Gov?

I'm interested in everyone's take on this.