Mom & Pop Network

Category: Linux

  • Running WireGuard over HTTPS via Chisel, or how to bypass your hotel’s firewall

    Right now, I am visiting Amsterdam. While Amsterdam is a nice city and I like my hotel, one of the worst parts is the hotel’s Wi-Fi.

    The Wi-Fi is heavily firewalled. Meaning only mainstream TCP services are allowed. While SSH is allowed, Wireguard isn’t.

    But I discovered Chisel, which lets you proxy TCP or UDP over HTTP and WebSocket.

    So how do you run Chisel?

    Installation

    On a web server, download the latest version of Chisel.

    While most of you are going to run Debian or Ubuntu, I run Rocky Linux as a server so Chisel can be installed with a single dnf command:

    dnf install https://github.com/jpillora/chisel/releases/download/v1.11.8/chisel_1.11.8_linux_amd64.rpm

    You can also install it as a Docker container.

    Running Chisel as a Server

    Assuming you aren’t running Docker or Windows:

    chisel server --auth user:pass --port port --backend http://example.com

    Replace the following:

    • user with your desired username
    • pass with your desired password
    • port with the TCP port you want Chisel to listen on

    You can also set up a systemd service. I am lazy so I used tmux.

    I also recommend a reverse proxy. I use Caddy, so to do it, assuming you have the DNS name domain pointed to your server, add the following server block:

    domain {
  encode gzip
  reverse_proxy 127.0.0.1:port
}

    Make sure port is the Chisel port, and then restart Caddy.

    If you use nginx or another reverse proxy, check the respective instructions.

    Running Chisel as a Client

    I am accessing Chisel on Fedora, so the dnf command also worked there.

    To run Chisel as a client, run the following in your terminal:

    chisel client --auth user:pass https://url local_port:remote_ip:remote_port/udp
    • user with your chosen username
    • pass with your chosen password
    • local_port with the UDP port you want to listen on locally
    • remote_ip with the remote IP you want to connect to
    • remote_port with the UDP port you want to connect to

    You can also remove /udp to connect via TCP.

    Conclusion

    It always sucks when the expensive hotel your family booked blocks most TCP/IP services. But the good thing about open source is that you can tunnel raw UDP and TCP inside HTTPS.

    Yes, China spends unlimited amounts of money on internet censorship. But for-profit hotels, workplaces, public libraries and ISPs who purposefully violate Net Neutrality cannot. And in the latter case, firewalling shouldn’t mean you shouldn’t be able to access your homelab.

  • Fedora Linux on an Asus Zenbook S14 UX5406AA

    I’ve been wanting a Linux Laptop with a good display for a while. For years my go-to option for non-Apple laptops was HP (mostly) but I got tired of the poor displays.

    I picked up an Asus Zenbook S14 UX5406AA today, since I wanted a good display and Best Buy was running a sale.

    I’m very impressed with the Zenbook: the hardware is way ahead of other high-end PC laptops I used; HP EliteBook/OmniBook/Spectre, Dell XPS and Lenovo ThinkPad (yes, ThinkPads are actually unreliable).

    However, to no surprise the Asus Zenbook has out-of-the-box issues with Fedora, and probably other Linux distros. It can be worked around if you don’t mind using Fedora 45 beta as of August 2026.

    Brightness

    By default, the brightness runs at 100%. This can be solved using grubby:

    grubby --update-kernel=ALL --args="xe.enable_dpcd_backlight=1"

    This makes the brightness works out-of-the-box.

    If you’re running a non-Red Hat-based Linux distribution (i.e. Arch, Ubuntu) the commands are different.

    Audio

    Audio also doesn’t work out-of-the-box on Fedora 44, even with the latest packaged kernel. This is because there’s a “ghost” Realtek audio codec when the real HD Audio codec is Cirrus Logic.

    Audio works after working to Fedora 45 beta with Kernel 7.2. Although I normally use Sony Bluetooth earbuds.

    Wi-Fi and Bluetooth

    Wi-Fi and Bluetooth should work fine.

    Suspend and Resume

    Suspend and resume should work fine once Fast Boot is disabled in the UEFI setup.

    Conclusion

    While it’s not as good out-of-the-box as a ThinkPad, XPS or even HP models (although this is current-gen hardware), the Zenbook UX5406AA is a refreshing change from other x86 laptops hardware-wise.

    Interestingly, older HP Spectre models didn’t have working suspend-and-resume but the Zenbook does (well, after disabling Fast Boot).

    I’ve wanted a Linux laptop I actually enjoy using. Yes, Apple Silicon is great. But I was longing for premium Linux hardware. I’m not the biggest fan of macOS, maybe unless the other option is meh hardware. And considering Asahi’s delays I’m not going to use Apple M2; I like new hardware. Well, as long as I don’t get ripped off by SK Hynix.

    Asus also did one thing right over Apple: The Zenbook has better oleophobic coating than MacBooks. The same can also be said about HP, though HP has poor displays versus Apple and Asus.

  • Installing Codecs on Rocky Linux 10 and Firefox

    How do you install codecs on Rocky Linux 10.

    First, install RPM Fusion. The instructions are on their website.

    Next, enable CRB:

    sudo dnf config-manager --enable crb

    Now, install the codecs via dnf:

    sudo dnf groupupdate core
sudo dnf groupupdate multimedia --setop="install_weak_deps=False" --exclude=PackageKit-gstreamer-plugin
sudo dnf groupupdate sound-and-video

    After that, the codecs should work on Firefox:

    A screenshot of Rocky Linux 10 and Firefox playing Spotify via RPM Fusion cocecs. More specifically, Emeline's song 'you should be scared'.

  • How I recovered from Mastodon/Fediverse (actually Akkoma) database corruption

    I moved domains again, this time from sour.coffee to momandpop.network. I also run Fediverse servers.

    Why so quickly? In the typical AuDHD fashion, I didn’t like sour.coffee too much.

    I run a VPS host for a living, and have two VPSes running not-Tor exit relays: one running my legacy neelc.org domain (running Rocky Linux 9) and one running the newer domains (running Rocky Linux 10).

    I decided to “migrate” to momandpop.network by setting up Akkoma on the “legacy” VPS via Docker. Initially, it went smoothly. Well, until I wanted to migrate to the non-legacy VPS.

    What did I encounter?

    db-1      | chmod: /var/run/postgresql: Operation not permitted
db-1      | 
db-1      | PostgreSQL Database directory appears to contain a database; Skipping initialization
db-1      | 
db-1      | 2026-04-05 22:03:26.747 UTC [1] LOG:  starting PostgreSQL 14.22 on x86_64-pc-linux-musl, compiled by gcc (Alpine 15.2.0) 15.2.0, 64-bit
db-1      | 2026-04-05 22:03:26.747 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
db-1      | 2026-04-05 22:03:26.747 UTC [1] LOG:  listening on IPv6 address "::", port 5432
db-1      | 2026-04-05 22:03:26.748 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
db-1      | 2026-04-05 22:03:26.750 UTC [14] LOG:  database system was shut down at 2026-04-05 20:33:08 UTC
db-1      | 2026-04-05 22:03:26.750 UTC [14] LOG:  invalid magic number 0000 in log segment 000000010000000000000001, offset 0
db-1      | 2026-04-05 22:03:26.750 UTC [14] LOG:  invalid primary checkpoint record
db-1      | 2026-04-05 22:03:26.750 UTC [14] PANIC:  could not locate a valid checkpoint record
db-1      | 2026-04-05 22:03:26.914 UTC [1] LOG:  startup process (PID 14) was terminated by signal 6: Aborted
db-1      | 2026-04-05 22:03:26.914 UTC [1] LOG:  aborting startup due to startup process failure
db-1      | 2026-04-05 22:03:26.921 UTC [1] LOG:  database system is shut down

    In short, database corruption.

    While typically you could run pg_resorewal. But when I tried that, it left Postgres in a non-operable state.

    I’m just grateful that

    • The signing keys weren’t lost
    • If you have signing keys, your “followers” will re-sync
    • Nothing of significance was posted to Fedi from my “new server”

    The second point is how some Mastodon administrators migrated to GoToSocial. I in fact initially used GTS before migrating to Akkoma.

    I had a feeling this would eventually happen, but at least it didn’t happen on an “established” server. I’m not a Postgres fan myself, I actually prefer plain-old MariaDB/MySQL.

    And if you want to follow me on Fedi/Mastodon, I’m @noc@momandpop.network.

  • Rocky Linux/RHEL 10: Fixing “Invalid UID in persistent keyring name” with AD and SSSD

    I run a Samba Active Directory in my homelab, with a Wireguard VPN to my dad’s house between my and his MikroTik routers.

    I recently reinstated the HPE ProLiant ML30 Gen9 running Rocky Linux 10 colocated at his house. With that, I rejoined the server to a new AD domain I made. I wasn’t able to log in, since the SSSD cache doesn’t get flushed.

    While I used this guide on Rocky Linux, it should be the same on AlmaLinux, CentOS or RHEL.

    Going back, the error I got was:

    Feb 13 15:11:01 oldsai.sc.lan krb5_child[2258]: Invalid UID in persistent keyring name
    Feb 13 15:11:01 oldsai.sc.lan sshd-session[2254]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=::1 user=blackbird
    Feb 13 15:11:01 oldsai.sc.lan sshd-session[2254]: pam_sss(sshd:auth): received for user blackbird: 4 (System error)

    To fix this, first stop sssd:

    systemctl stop sssd

    Clear the cache with sss_cache:

    sss_cache -E

    Now remove the stray cache files:

    /var/lib/sss/db/*

    Note: this command is important, as SSSD doesn’t flush caches upon unjoining and rejoining, even with different user IDs.

    Now start sssd:

    systemctl start sssd

    The error should go away. Keep in mind that if UIDs changed for a particular user, you will need to delete or chown their home directory.

    Source. Thanks, Jarrod Farncomb.