dharmik parmar's blog

found a letter

Sun, 03 Sep 2023 00:00:00 GMT

in the month of july, i and rahul visited a book fair. after the fair, we went to have a milkshake and were thrilled to find a letter apparently dated february 16 tucked inside the pages of "the god delusion" by richard dawkins. we thought it was the 16th of january, but we were wrong. i already posted it on x, but found it interesting enough to dedicate a blog post to it.

I (and @19Silica) visited a book fair and were surprised to find a letter tucked inside the pages, apparently dated January 16, 1992. pic.twitter.com/tG2vdKvU3k
— dharmik parmar (@dhrm1k) July 27, 2023

rahul took the trouble to digitize the letter in a google doc for others to read. here's the link to it.

for computers

Thu, 12 Sep 2024 00:00:00 GMT

technology should be explored for the love of it and for the fun of it, rather than for the sake of it.

you own a computer. that's a big deal. you have access to the internet. that connects you to the whole world. you have wikipedia. that's information on the tips of your fingers.

anyone who is interested in programming should definitely read: "how to become a hacker".

after reading this, if you too want to make a website like this one you are on or the one visited of eric steven raymond, this "rediscovering the small web" might give you some more inspiration.

let it be anything—rocks, your opinion on which paper size is perfect, or your thoughts. your little about page. curate it on the internet. you never know who they end up being helpful to. it might help someone who has similar interests as you to reach out to you. also, i don't think it's boring to maintain your personal site. it's a very fun task.

i really love this hackernews comment:

be infinitely curious and playful without bounds. try to break things, use things improperly, dig deeper and void warranties. coloring outside the lines and then some. find a tribe. if there isn't one, start one.

dent the universe, or at least have a good time and live it up.

wtfathon - we hosted a hackathon

Wed, 18 Sep 2024 00:00:00 GMT

earlier this month, i and few of my friends hosted a hackathon. it's called wtfathon. the original idea was of karan. as i have put it in the .txt we were writing when planning for the hackathon:

this is not your normal crud hackathon. not limited to just a software. just make us scream what the fuck.

you might have heard of "stupid shit no one needs & terrible ideas hackathon". the goal is to not make something revolutionary, but to enjoy the joy of building it. don't build something useful. build something utterly useless. here you are not held up by any constraints. build whatever the hell your heart wants. you can search more about such hackathons. there are many hosted across the world with many wild ideas. banana zipper. scream bird which is flappy bird, but yes, you scream or a beer selfie stick. the list goes on... there are many across the world, but this is the first hosted in india. this was ahmedabad's version of it. we even promoted the hackathon on reddit. the post when i posted with a freshly made account was marked as spam, karan's friends with the moderator of r/ahmedabad. he pinged the moderator and voila, our post was up.

the hackathon was a success. we have a twttr account where we plan to update you with any further fun we might have. do join if you are in the city. we have photos there too. :)

we still have a lot of plans for the community that we have build. maybe, a newsletter? maybe, a mailing list? there's a lot to talk about. here's the group photo from the hackathon. it was a good day. yes, people showed up.

setting up my nvim

Sun, 22 Sep 2024 00:00:00 GMT

tl;dr: here's the link to my vim config file. it's pretty basic. if you want to see how it came together, then keep reading.

i recently had the inner urge to try vim. i settled on neovim. i had no interest in the lua capabilities, nor do i have any yet. i know i will tinker with it in the future, but for now i just went with neovim because, first of all, my main laptop is windows, so whatever i chose, i had to install it. it didn't come preinstalled like it does with macos and linux.

i love this quote from the unix stackexchange:

this makes emacs in effect an immigrant from a very different culture, while vi is a native.

well, let's start from the beginning. i installed pop!_os on my brother's machine. i'd been reading about pop!_os for a long time, but it wasn't until i saw karan had pop!_os installed on one of his machines that i was convinced. later, probably a month ago, i switched my personal computer to pop!_os. using linux on my computer made me appreciate foss more and more.

my introduction to vim for the first time was in 11th grade. i also took my practical exams, which, from what i can remember, involved doing 10 things in vim. after that, i just knew about vim's existence and used it on and off very occasionally. up until this month, i decided to pick it up seriously. the people i follow on the now-soon-to-be-sunsetted emacs.ch and my new favorite fosstodon.org also played a role. i then browsed through a few vim tutorials and got started with it.

i installed neovim on my laptop, which is still running windows. i used vanilla neovim for a day or two without any plugins. i later realized that having a complete plugin system on windows would require too many unresolved changes. i then decided to go for wsl.

wsl stands for windows subsystem for linux. it allows a windows computer to run a linux environment without the need for a separate virtual machine. among all the available options, i narrowed it down to either debian or ubuntu. i finally chose debian because i already had experience with pop!_os. i mean, debian is the base. installing wsl2 was much easier than i had anticipated. it just took the following command in powershell:

wsl --install -d debian

and voila! i later installed the debian app from the windows store, which wasn't necessary.

a guide to my setup

first of all, i don't prefer line numbering to be relative. the plugins i currently use are:

nerdtree
vim-airline
surround.vim
vim-devicons
vim-css-color
awesome-vim-colorschemes
youcompleteme (earlier, i settled on this for code completion when i could not manage to make conquer of completion work.)
now, coc.nvim

firstly, i use the vim plug plugin manager. setting up vim plug is easy too. just run the shell command from their github (i also feel uneasy copying the command and running it on my machine, but i had to trust the devs for this one).

i expect you are familiar with :pluginstall to install the plugins in the .vim file and :plugclean to remove the plugins. once, on my fresh wsl install, i messed with the .gitconfig file, which was giving me errors when cloning. i removed and then reinstalled git, and that solved the problem.

code completion was a tough issue. i didn't want to deal with node.js slop (also because i couldn't make it work with npm when i tried), so i settled on using youcompleteme. the catch with youcompleteme is that it has to be compiled with clang. i followed the readme. i mean, if the readme helped, then the folks building it surely knew what they were doing. props to them for that.

after a few hours of using it, i realized i had just tried npm to build coc.nvim. i could also try it with yarn to see if it worked. so i started again to make coc.nvim work, this time with yarn build, and magically, this time it did. i found another stack overflow answer that failed with yarn, so they were trying npm and found success.

doing this wasn't the complete solution, but it was close. in case anyone has trouble dealing with code completions using neovim and stumbles upon this text in the future, i hope it's helpful.

later, i just had to install pip, the python package manager. it went well, but installing jedi through pip3 gave me an error.

error: externally-managed-environment

× this environment is externally managed
╰─> to install python packages system-wide, try apt install
    python3-xyz, where xyz is the package you are trying to
    install.

    if you wish to install a non-debian-packaged python package,
    create a virtual environment using python3 -m venv path/to/venv.
    then use path/to/venv/bin/python and path/to/venv/bin/pip. make
    sure you have python3-full installed.

    if you wish to install a non-debian packaged python application,
    it may be easiest to use pipx install xyz, which will manage a
    virtual environment for you. make sure you have pipx installed.

    see /usr/share/doc/python3.11/readme.venv for more information.

note: if you believe this is a mistake, please contact your python installation or os distribution provider. 
you can override this, at the risk of breaking your python installation or os, by passing --break-system-packages.

hint: see pep 668 for the detailed specification.

you can refer to this stack exchange answer for the error message. so, as instructed in the error message, i went with:

sudo apt install python3-jedi

the last thing to do was to run the following command in init.vim to install the python extension:

:cocinstall coc-python

and voila, you have code completion set up for python. the coc documentation is also very descriptive, so check it out.

edit (made on 2025-10-25): it's funny how my autocomplete is mostly powered by copilot.nvim now.

if you want any help setting up your neovim and think i can help, feel free to email me at dharmiik [at] proton [dot] me. for faster responses, if you are on the fediverse, i suggest pinging me at [at] dharmik [at] fosstodon [dot] org.

hosting a snac server (linuxusers.in)

Thu, 14 Nov 2024 00:00:00 GMT

i recently hosted a snac instance and am a proud owner of the domain linuxusers.in. if you are friend of mine and frequently use fediverse, ping me and let me get you a account on the instance.

or if you are just someone who uses fediverse, I am @dharmik@linuxusers.in.

it's been a long time. the domain has expired and the instance was also shut down. maybe, some other day, we will start something like this again.

how to install and try react without a framework

Thu, 02 Jan 2025 00:00:00 GMT

It can be quite bewildering to a beginner that the official React documentation doesn't provide a straightforward way to install or try React without a framework. While there is a section explaining why you should use a framework, this can be daunting for someone who is just getting started or simply wants to dabble in React.

The official docs suggest adding React to an existing project using the following command:

npm install react react-dom

However, when you run this command, you may encounter an error due to a version conflict between React and the testing libraries, particularly @testing-library/react, which currently has a peer dependency on React 18.

To resolve this, you can either downgrade React or use the --legacy-peer-deps flag to bypass the peer dependency checks.

But how is all of this supposed to be understood by a beginner?

Here's a simple and easy-to-follow approach for anyone who wants to install React without a framework. You can use Vite, a fast build tool, to quickly set up a React project:

Steps to Get Started with React Without a Framework:

Create a new Vite project with the React template:

npm create vite@latest my-react-app -- --template react

Navigate to your project directory:

cd my-react-app

Install the necessary dependencies:

npm install

Start the development server:

npm run dev

By following these simple steps, you'll have a React app running without any framework, thanks to Vite.

understanding the modulo operator in python

Tue, 14 Jan 2025 00:00:00 GMT

the elegant and beautiful background you're seeing started with me implementing conway's game of life in pygame. then i remembered danny lin's website (he's the creator of orbstack, an alternative to docker desktop for managing vms easily), where he had it featured. i decided i wanted it on my site too. after some effort, i finally got it working and made it prettier. now, it's the background of this blog.

it does look pretty.

do you know how the modulo operator (%) works in python? i'm sure most of us think it just returns the remainder of the division, but we never really dive deeper to understand the logic behind it. turns out, python's implementation follows this formula:

a % b = a - b * floor(a / b)

let's take an example to break it down. consider 6 % 3:

a = 6
b = 3

6 % 3 = 6 - 3 * floor(6 / 3)
      = 6 - 3 * 2
      = 6 - 6
      = 0

i got curious about this while implementing conway's game of life and came across the concept of a toroidal boundary.

toroidal boundary and the modulo operator

a toroidal boundary (or periodic boundary condition) means the grid wraps around both horizontally and vertically, forming a donut-like shape. if a cell moves off one edge, it reappears on the opposite edge.

let's say the grid width is 5, so valid column positions are 0, 1, 2, 3, and 4. now, if we're moving left, the new column is x - 1. but what happens if x = 0? subtracting 1 gives -1, which is outside the valid range.

to handle this, we use the modulo operator:

left = (x - 1) % width

when x = 0, this gives:

left = (0 - 1) % 5 = 4

this wraps the column around to the last position, keeping everything within the grid.

modulo behavior across different languages

one interesting thing to note: the result of the modulo operation in python takes the sign of the divisor (b). this is different from some other languages.

example: -10 % 3

in python:

-10 % 3 = -10 - 3 * floor(-10 / 3)
        = -10 - 3 * -4
        = -10 + 12
        = 2

but in c:

a % b = a - b * trunc(a / b)

-10 % 3 = -10 - 3 * trunc(-10 / 3)
        = -10 - 3 * -3
        = -10 + 9
        = -1

why the difference? in c, the division result is truncated towards zero (it just chops off the decimal part), while python uses flooring. that's why the results aren't the same.

so, next time you use the modulo operator, you'll know it's more than just finding the remainder—there's a bit of math magic behind the scenes!

promocraft at lj innovation village

Sat, 15 Feb 2025 00:00:00 GMT

well, what were you doing this valentine's? what we were doing was presenting promocraft.xyz at lj innovation village.

it was an experience. for those who haven't had the time to understand what we're building, here's a brief explanation:

with promocraft, we are streamlining the process of creating promotional material. right now, if you want to design promotional content for your business, the workflow looks something like this:

current process:
google → canva → search the entire web for a great background → ensure there's no watermark → edit it → add text → remove background from logos → add more elements.

while canva is great, it can be frustrating for users who just want something quick and efficient. that's where promocraft comes in.

with promocraft:
google → promocraft → select a template from your collection → add your logo with our powerful editor → download the design.

promocraft provides beautifully curated templates that you can customize with ease, all within one app. say goodbye to the hassle and hello to instant, high-quality promotional designs!

"promocraft made designing promotional material so effortless! the templates are amazing." – event attendee

if you are a business that needs help with our editor or assistance in designing state-of-the-art promotional material to make your brand stand out, let us know. you can find my number in the contact us section of the website or email me at dharmiik at proton dot me.

photos from lj innovation village

promocraft booth

our css wiz making changes directly to production as we speak.

my photo at promocraft booth

notes on raycasting

Fri, 28 Feb 2025 00:00:00 GMT

heard of john carmack? i suppose you've read masters of doom too. well, who doesn't know the creator of doom, john carmack? that book introduced me to raycasting, and ever since, i've been a fan. recently, i stumbled upon this insane tutorial on implementing raycasting in c++ (https://lodev.org/cgtutor/raycasting.html). even now, i can't fully wrap my head around how games like wolfenstein 3d managed to fake a 3d world inside a 2d grid. it's unreal.

a couple of days later, i thought—why not build a basic raycasting engine, but in javascript? now, why javascript? good question. if you've ever brought up javascript around me, you already know how i feel about it. hate is a mild word. so why use it? simple: everyone has a browser, and i wanted people to mess around with it without hassle.

i won't go into the code here (it's on github, or will be by the time i finish writing this). what i want to talk about is the math and physics that blew my mind while working on it. honestly, if i had realized how useful this stuff was back in high school, i'd have paid more attention.

a while ago, when i was playing around with an arcade-style shooter in pygame, i used the distance formula for collision detection. seems basic, but i know my 15-year-old self—who was already deep into computers—would have been blown away.

now, how hard could making 2.5d work be? i mean, just drawing on a 2d canvas and making it feel 3d? well, for me, it was... a task. i am not a smart man. you might want to try it for yourself.

there's a lot still to do. you can try the output at raycast. these are rough notes i take for future reference or anyone interested in raycasting or application of mathematics. i'd still recommend you to read it, i had fun writing it.

i strongly recommend reading lode's computer graphics tutorial to get better idea of what comes here.

understanding the mathematics and logic

let's get into the core concepts of raycasting and the math behind making a 3d scene work.

player movement

moving the player is just basic trig. imagine you're on a grid, moving forward, backward, and rotating left or right. your position and direction can be calculated with simple math:

moving forward is just using cosine and sine on your angle: newx = player.x + math.cos(player.angle) * player.speed; and newy = player.y + math.sin(player.angle) * player.speed;. moving backward? same thing, just subtracted. turning is just player.angle -= player.turnspeed; for left and player.angle += player.turnspeed; for right.

raycasting logic

raycasting is what makes a 2d grid look 3d. the idea? fire rays in different directions and see where they hit walls. that's it.

step-by-step explanation

start the ray at the player's position: let rayx = player.x;, let rayy = player.y;. get the direction: const raydirx = math.cos(angle); and const raydiry = math.sin(angle);.

then, loop forward in small steps: rayx += raydirx * stepsize;, rayy += raydiry * stepsize;.

check if it hit a wall: const mapx = math.floor(rayx);, const mapy = math.floor(rayy);. if it did, calculate the distance: const distance = math.sqrt((player.x - rayx)^2 + (player.y - rayy)^2);. repeat until you hit something.

rendering the scene

once we have distances, we draw walls. first, clear the canvas: ctx.fillstyle = '#000';, ctx.fillrect(0, 0, canvas.width, canvas.height);.

set the field of view: const fov = math.pi / 3;, then cast a ray for each column of the screen. each ray's angle: const rayangle = player.angle - fov / 2 + (i / raycount) * fov;. get the wall height: const wallheight = (canvas.height / distance) * 0.5;, then draw it: ctx.fillstyle = '#ff0000';, ctx.fillrect(i, (canvas.height - wallheight) / 2, 1, wallheight);.

that's how you fake 3d from a 2d grid.

i have a lot on my plate, but what's life if not fun. i am working on promocraft, but my next goal is to add textures. you may find the code on github.

debugging and refining

debugging raycasting is a pain, but here's how to keep your sanity:

check initialization: make sure the canvas and context are working.
verify movement: log player coordinates, make sure they update correctly.
debug raycasting: log ray positions, check if they detect walls properly.
test rendering: make sure wall heights actually make sense.

take it step by step, debug as you go, and eventually, you'll have a working raycasting engine.

udaipur trip with friends

Fri, 11 Apr 2025 00:00:00 GMT

i am loving this unsolicited ritual of a trip with the year. last year, we were hiking on girnar. this year, we decided to escape the state of gujarat and go to udaipur. well, the trip was a fun one. i do need to pen this so i can come back here to rejoy the fun we had.

firstly, i was in a dilemma whether i was going to be able to make it on the trip or not. i had an internship planned for the national centre for biological sciences (ncbs), bangalore, and they assured me i was shortlisted for the most part and just wanted to ask a few questions. though later, the question of logistics came up, and i was in no state to make a commitment to go to bangalore for four months to work (my moronic college wouldn't let me then, and nor is it letting me for another opportunity that has come now). though i got the closure that the ncbs thing is off, and well, the trip was on.

hats off to my friends who always plan everything out (anything not playing by their plans is a different thing). they planned the whole trip, starting from where we will go to where we will stay to how the itinerary there will be, while i lurked with my occasional criticism in the whatsapp group.

we booked a bus to go from ahmedabad to udaipur, but the gsrtc scheduling sucks, and the bus that was supposed to be departing from ahmedabad at around 12:15-ish was nowhere to be seen till around 1:30. upon endless enquiring and the realization that the bus depot/station department just sucks and replies to enquiries like you have just asked them for a part in their parents' will, we got to know that the specific bus we were supposed to climb/take getting late is not new. it often gets late.

though after hours of trying to sleep and bickering in between about whose idea it was in the first place to choose to go by bus, we reached udaipur in the morning by around 6–6:30-ish. the first thing we did was rent activas and later rush to the hotel.

the first place we decided to go to was bahubali hills. it's a great place. rahul spotted a lot of birds. on the way back, we had to go to a bar, because being born in a dry state never permitted us.

after the bar thingy, we finally made it to the city palace. it was stunning, majestic, actually. definitely one of those "if you go to udaipur and don't see this, what are you even doing" kinda places.

there's a lot we did, but i don't have the energy to write it all down. maybe later, maybe not. depends on how nostalgic i get. for now this will act as my time capsule.

photos on the fediverse: @dharmik@social.photo on pixelfed and @dharmik@linuxusers.in on our friendly snac instance.

experimenting with stable diffusion

Wed, 30 Apr 2025 00:00:00 GMT

first entry (last updated on 02/05/2025):

i have hit the realization that my productivity happens to be directly proportional to the amount of hours i sleep (stretched over an entire week). recently i was tinkering with stable diffusion. to those unaware, the question arises from the title, what even is stable diffusion?

stable diffusion is a text-to-image open source model. you give it a prompt like "a cat riding a skateboard," and it spits out an image that looks like someone painted exactly that. the reason for choosing it is that it's fast, local, and customizable.

the goal of the experiment was to generate stylish advertising banners, specific to a theme. think "personalized ad posters," but with ai. why? i do love what promocraft is doing right now, but with the image-generation gpt provides right now, i mean, why would you use our tool now? not to forget that though gpt is good at generating images and can generate advertisements if asked to (though that will indeed require a lot of prompting back and forth, also not to ignore you'd still have to add your logo to it, which can't be done by any model because of the fear that someone might be using copyrighted material), it will never be a complete swiss knife for marketing.

here's the link to the repo for code if you want to try it or just browse: dhrm1k/stable-diff-for-ads (instructions in readme).

i started with setting up the basics on my google colab. i used stable diffusion v1.5, why? because of the low hardware requirements it has (and sorry to say, but lol because that's what i researched upon). i prompted it to generate: "a stylish shoe advertisement with a clean background." image below. there will be a github repo link somewhere in the post. ctrl-f github. i have not cleared the clutter i have made everywhere.

it's apparent it's nowhere near up to the mark. if i posted this somewhere, the company would fire me immediately. so the question was: how do i make it generate better images? the answer to that is fine-tuning. fine-tuning refers to the process of training an already-existing pretrained model on a specific dataset to make it excel at those points of the dataset more. think of it like this, the model had the capabilities already, i am not starting from scratch, i am just introducing it to new styles or contexts.

i had no idea how to fine-tune a model, so after a lot of questioning with gpt and google, it became clear to me i had to use a technique called dreambooth, but with lora. dreambooth lets you personalize a model to new concepts, and lora is a lightweight way to apply those changes without needing a 24gb gpu from 2037.

an attempt to explain what lora does (i am not sure as of now that i myself quite understand it well): imagine you have a pre-trained model, it's already been trained on a huge dataset, like millions of images, and it's really good at general tasks. but now, you want to make it even better at something specific, like recognizing shoes. the problem is, this model has millions (or even billions) of parameters (weights), and training all of them from scratch takes a lot of time and computing power.

instead of retraining everything, lora lets you adapt the model efficiently using a much smaller amount of data and computing power.

so i downloaded the train_dreambooth_lora.py script from hugging face's diffusers repo. that script takes in a directory of images, a class prompt (like "photo of a shoe"), and a placeholder token. it fine-tunes just a few extra weights (not the full model) and gives you back a lora weights file you can load when generating.

for the dataset, i found something surprisingly decent on hugging face called adimagenet. it's a collection of categorized ad posters, way better than anything i could've scraped together manually.

of course, being me, i ran this on google colab's free tier. and after maybe 3–4 training loops, boom, it stopped. a popup said i'd hit the usage cap. no restart button, no plea window. just the end of the line.

that's when i tried modal. i'd heard about it in passing and decided to give it a shot. i was half-expecting it to ask for a credit card right away, but to my surprise, it didn't. they just gave me $5 in free credits. (apparently, i can get $30 more if i add a card, but i haven't done that yet.)

after some wrangling, i managed to get the fine-tuning script to run on modal. it actually worked. and the result... was kind of better? i mean, it wasn't a disaster, but it still wasn't what i'd hoped for either.

here's the updated image, same prompt: "a stylish shoe advertisement with clean background."

it's less generic than the first one, sure. but still not quite ad-agency ready. might need to tweak training steps, or prompt engineering, or maybe try a better lora setup.

this post is still in progress and will be kept updated.

note:

today, i got to know that using a placeholder token might have improved the output quality. understand it as that a placeholder token provides more context to the fine-tuned model. there's a lot to learn in this. i plan to experiment with this new method and come back again here.

here's a song recommendation for you: i'm a fan of blink-182's music.

things you should get

Fri, 23 May 2025 00:00:00 GMT

well, i first thought of posting this on linuxusers.in (go check it out if you haven't yet, and hop on the fediverse, there are a lot of smart people there too). but i wasn't sure if it would be appropriate there. i wanted this to live here for posterity. so here it is.

also, i already have a post titled for posterity. if you like this one, you might like that one too.

lately, i've been commenting a lot on reddit under posts related to colleges in general or my college. knowingly or unknowingly, i might have given more than a few kids some advice. first-years, second-years. man, i pity them, because out of everyone they could have found, they found me. i tamper with my college's wikipedia page for fun, so how on earth am i supposed to show any love to my college. wiki once claimed that lju is among the top 5 technical colleges in ahmedabad. you're reading the blog of the person who removed it (i loved doing it. here's the diff). i honestly have no idea what to do. i don't really know at all. all i know are a few things not to do.

what are the things i wish i had in my first year? (these are all free perks to take a chill pill. also, only get them if you genuinely want to tinker with things. and once you get them, use them. don't just grab them and forget about them.)

first of all, you should get the github education pack. it comes with a ton of free stuff: domains, cloud credits, jetbrains tools, and a lot more. it's a must-have.

also, please have an about page. i love those. i don't mean a portfolio, i mean your little corner on the internet. i have a lot of design ideas about them. i like mine to be minimal. make it the way you want to. add things you like. add things you don't. make it personal. you can use github pages for that. you can also use neocities or any other free hosting service. just have one.

if you're into web development, get a free netlify account. it offers a lot. you can host static sites for free and even run serverless functions. vercel also offers the same.

if you're into design, grab the student plan for figma. if i'm not wrong, framer recently started offering a free student plan too.

for note-taking or a personal wiki, students also get a free notion pro plan.

i'd recommend using x/twitter. i've made a lot of friends there who are into tech (and really good at it).

i'd also recommend using linux. if you're on windows, install wsl2. it's fun and might keep your curiosity alive. i'm writing this in vim on arch btw. i've tried pop, debian, mint, and now i'm playing with arch. (and yeah, i'm open to helping anyone with linux errors. just dm me on linuxusers.in, x/twitter, or mail me, whatever. i'm available any time of day or night for anything linux.)

i'm not sure yet, but i might be interning at this cool place. i'm also trying something new (more about it if i don't change my mind on a few things). i'll write a separate post about that.

how not to self-host adguard dns

Sat, 08 Nov 2025 00:00:00 GMT

i wish LLMs had peaked the self-hosting help department, but sadly they haven't. fuck chatgpt and all the moronic LLMs that couldn't assist me in my deployment of adguard dns for my personal usage (i am just kidding, don't fuck them. just in case the ai overlords rise one day and come to kill me, please forgive me my lords, i am a peasant who was just kidding)

i don't know who it was, but i vividly remember hearing someone say once, "i have no clue about what to do. the only thing i know is what not to". seems like that's the motto.

note just incase you don't end up reading the whole thing (because of course no one does): if you are a friend and someone i know, feel free to ping me for help, if you try to self host or if you want access to my dns server.

what even is adguard and why did i do this to myself

adguard home is basically a network-wide ad blocker. instead of installing adblock on every device, you point all your stuff to use this as their dns server and boom - no ads anywhere. phone, smart tv, tablet, whatever.

sounds cool right? it is. except i decided to self-host it at 2am on a 1gb ram azure vm because i'm a broke student who values "control" and "privacy" over sanity. the alternative was paying $2/month for nextdns. obviously spending 48 hours debugging was the logical choice.

(but does my site track you? sorry, it does. i too like data. but don't worry, i use umami instead of google analytics)

mistake #1: thinking azure would be easy

first thing you need to do is login to azure.microsoft.com, which for some reason is a big task in itself. if you haven't seen the website, please go look at it. why someone in good frigging conscience would design this monstrosity. the page physically hurts my eyes.

mistake #2: the yunohost rabbit hole

i had this brilliant idea to use yunohost because it supposedly makes self-hosting easy. except yunohost only works on debian 12. and azure doesn't have debian 12 images in india. image unavailable for some reason.

so i googled which ubuntu version is based on debian 12. turns out it's ubuntu 22.04 LTS. perfect! except no.

yunohost won't install on ubuntu either. this was the moment i realized people don't self-host because it's a choice. people don't self-host because there's no choice. no average person wants to deal with this crackedness after midnight.

mistake #3: casaos seemed like a good idea

i installed casaos. then immediately uninstalled it. why? because my tiny cute 1gb ram machine had 700mb occupied by casaos sitting idle. yeah, no thanks.

mistake #4: docker will make things easier (narrator: it didn't)

everyone says docker makes things easier. so i set up docker-compose like a good little developer:

version: '3'
services:
  adguard:
    image: adguard/adguardhome
    container_name: adguard
    ports:
      - "53:53/tcp"
      - "53:53/udp"

except docker added another layer of bullshit to debug. permissions were fucked. certificates didn't work. volume mounts were confusing. every time i wanted to edit something, i had to docker exec into the container like i'm in the matrix.

worst part? whenever i bound port 53 in docker and then stopped the container, my entire network would shit itself and ssh would die. i'd have to reset the vm from azure portal like a caveman.

eventually i said fuck it, ditched docker, and installed adguard natively. suddenly half my problems disappeared.

lesson learned: docker is great until it isn't. for a simple dns server on 1gb ram, native installation is better.

mistake #5: port 531 seemed reasonable

since port 53 kept killing my ssh, i moved dns to port 531. problem solved, right?

wrong. android phones don't allow custom dns ports. you can't just type "531" anywhere in the settings. there's no field for it. phones only work with standard ports using encrypted dns.

i spent hours testing why my phone wouldn't connect before realizing this.

mistake #6: not understanding cloudflare proxy

so i set up an A record pointing to my server. tried to query it:

$ dig @subdomain.mydomain.com google.com -p 531
;; communications error to [cloudflare-ip]#531: timed out

but direct ip worked fine:

$ dig @[my-vm-ip] google.com -p 531
;; Got answer:

then it clicked. cloudflare proxy. the orange cloud. that motherfucker.

when cloudflare proxy is on (orange cloud), they only forward HTTP/HTTPS on ports 80 and 443. everything else - dns, custom ports, ssh - gets blocked. my dns queries were hitting cloudflare's edge and getting dropped.

the fix: turn the proxy off. grey cloud that subdomain. suddenly everything worked.

mistake #7: trying to use https with an ip address

i wanted my dashboard at https://[my-vm-ip]/. got let's encrypt certificates. pasted them into adguard. clicked save.

service bricks. dashboard gone. browser says connection failed.

then the revelation hit me: let's encrypt doesn't issue certificates for IP addresses. only domain names.

so my cert for subdomain.mydomain.com won't work when accessing via IP. browsers say no. android says hell no.

mistake #8: thinking cloudflare certificates would work

cloudflare gives free SSL certificates that last 15 years! perfect, right?

except they're only trusted by cloudflare's proxy. phones don't trust them. browsers don't trust them. they're signed by cloudflare's private CA, not a public one.

so cloudflare origin certs only work when proxy is ON. but when proxy is ON, cloudflare blocks dns traffic.

catch-22.

what actually worked (eventually)

after 48 hours of pain, here's what finally worked:

native installation, not docker. just install adguard directly on ubuntu.
cloudflare proxy OFF (grey cloud) for the dns subdomain.
let's encrypt via adguard's automatic feature. it handles everything.
DNS-over-HTTPS and DNS-over-TLS enabled. this is what phones actually need.
open the right ports in azure: 53, 80, 443, 853.

android settings:

go to private dns
enter your subdomain
if it says "connected", you won. if not, something's still fucked.

things i learned the hard way

docker adds complexity when you don't need it
cloudflare proxy blocks everything except http/https
let's encrypt doesn't do IP addresses
android requires encrypted dns (DoH/DoT)
port 53 on linux is cursed because of systemd-resolved
certificate file permissions matter
azure's UI is a crime against design

was it worth it?

total time enjoyed (or wasted): 48 hours

total money saved vs nextdns: $2/month

was it worth it: hell yea, i love chaos.

would i do it again: ask me after therapy

but hey, everything works now. my phone uses my dns server. ads are blocked. i can see query logs. i feel like a hackerman.

well, maybe.

ask me again tomorrow.

edit: all my life, my isp has been gtpl. lately, i also have airtel and frigging airtel literally doesn't want you to change settings. the input field to change dns are disabled. also after that, the save button is hidden by default and you have to change the setting, to see it.

edit again:

someone sent 2 lakh requests to my server at night. you little shits, i will block each one of you. he made request to sikelocci dot com while i was asleep. my poor vm almost died and apparently adguard also went dead for a while in the middle of the night, because i can see traffic drop and also my phone showing dns not working in the morning. f you you moron.

if you made it this far, i salute you. if you're trying to do the same thing, good luck. you'll need it. and maybe therapy afterward.

building and booting my own kernel on arch linux

Thu, 27 Nov 2025 00:00:00 GMT

this is the final output you'd see if you follow this entire blog post.

is there any linux user who hasn't dreamed of building and booting their own kernel at least once? i know i have. recently, i decided to take the plunge and document my journey of building and booting my own custom linux kernel on arch linux. here's how it went.

one of the other motivations behind this was to gain a deeper understanding of how the linux kernel works and how to customize it from the kernel level (not to ignore there wasn't a similar blog i found documenting this exact process with a good explaination, so i wanted to fill that gap too!).

disclaimer: well, this post has been paraphrased or added more context using ai.

installing all the tools and necessary packages

well, the first thing you should do is update your system and install the necessary packages. on arch, you can do this using pacman:


sudo pacman -Syu
sudo pacman -S base-devel bc flex bison openssl zstd elfutils cpio qemu-full busybox

what each package does:

base-devel: essential development tools like gcc, make, etc.
bc and flex/bison: used for building the kernel and handling configurations.
openssl: for signing modules.
zstd: for compression.
elfutils: tools for inspecting ELF binaries (kernel + modules).
cpio: this is the tool we’ll use to pack the initramfs.
qemu-full: full QEMU, lets us run kernels in a VM without bricking our laptop.
busybox: a single binary that acts like multiple core Unix commands.

cloning the linux kernel source code

next, we need to get the linux kernel source code. you can clone it from the official linux kernel git reposiory or from github. i will recommend not cloning from github as it is slow because of the large size of the linux kernel repo and the way it handles large files. instead, use the offical kernel repo:

mkdir -p ~/src
cd ~/src
git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
cd linux

configuring the kernel

this is something that every tutorial will tell you to do, but now explain it at all. the kernel configuration is basically a set of options that determine what features and drivers will be included. you can start with the default configuration for your architecture and then customize it.

to start with the default configuration, run:

make defconfig

you can customize with:

make menuconfig

you'd be wondering, why did we run the make defconfig first? make defconfig creates a default configuration file named .config file in the kernel source directory. this file is essential for the kernel build process as it contains all the configuration options that determine which features, drivers, and modules will be included in the compiled kernel. just a fun fact that kernel config has ~15000 options. for example, you can enable/disable support for specific filesystems, hardware drivers, networking fetures, and more. the build command (make) reads this .config file to know what to include in the final kernel binary. you can even turn off compilation of certain features/drivers by disabling them in the config file, which can help reduce the kernel size and improve performance for specific use cases.

building the kernel

this builds the vmlinuz (bzImage) file:

make -j$(nproc)

this command will start building the kernel using all available CPU cores to speed up the process.

make: starts the kernel build system
-j$(nproc): uses all CPU cores to speed up the build. your cpu usage will spike to 100% during this process. to avoid that, limit the number of jobs, e.g., -j4 for 4 cores.

output ends with:

Kernel: arch/x86/boot/bzImage is ready

this file is the actual bootable kernel.

building an initrd with busybox

now if you are anything like me, you would want to boot this kernel and see it in action, but if you do that right now, you will get kernel panic. why?

a kernel cannot boot without a root filesystem. if you start the kernel without a root filesystem, it will panic. so we need to create a minimal initrd (initial ramdisk) that contains busybox (appreciation for it and how great it is later).

to make a filesystem for the initrd, create a directory structure like this:

mkdir ~/initrd
cd ~/initrd
mkdir -p bin sbin etc proc sys usr/bin usr/sbin dev

why to make all these directories?
linux expects /bin, /proc, /sys, /dev inside rootfs.

more on file system structure

if you are just trying to boot the kernel, and are not interested in learning about linux filesystem structure, you can skip this section.

copy busybox binary

by default when you install busybox, it installs symlinks for all the commands it provides. we can copy the busybox binary to our initrd and create symlinks for the commands we want to use.

cp /usr/bin/busybox bin/
cd bin

create symlinks for common commands

for i in $(./busybox --list); do ln -s busybox $i; done

when doing this, you will see the warning, ln: failed to create symbolic link 'busybox': File exists. you can ignore this warning. this comes because the link creation loop tries to recreate the ‘busybox’ symlink but it already exists.

create an init script

return to initrd root:

cd ~/initrd

create an init file.

cat > init << 'EOF'
#!/bin/sh
echo "booted into dharmik's custom linux kernel!"

mount -t proc none /proc
mount -t sysfs none /sys

exec /bin/sh
EOF

if wanted, instead of the script above, you can have a pretty ascii art welcome message. here's a tool to generate ascii art: patorjk.com/software/taag

make it executable:

chmod +x init

why we made this file? the kernel runs /init immediately after boot. this is your "userspace". busybox provides /bin/sh.

packing the initrd

now we need to pack the initrd into a cpio archive and compress it. from inside the ~/initrd directory, run:

find . -print0 | cpio --null -ov --format=newc | gzip -9 > ../initrd.img

find . -print0 | cpio --null -ov --format=newc > ../initrd.cpio
cd ..
zstd initrd.cpio

this will create a compressed initrd image at ~/initrd.img or ~/iinitrd.cpio.zst.

booting the kernel with qemu

now we have everything we need to boot our custom kernel. we will use qemu to boot the kernel with the initrd we created.

qemu-system-x86_64 \
    -kernel /path/to/linux/arch/x86/boot/bzImage \
    -initrd /path/to/initrd.img \
    -append "console=ttyS0 rdinit=/init" \
    -nographic

kernel: boot this kernel image.
initrd: load your initrd filesystem.
append: kernel command line parameters.
console=ttyS0: print everything on serial port.
rdinit=/init: tell kernel to run /init from initrd.
nographic: run QEMU in terminal (no GUI).

if everything goes well, you should see the message from your init script:

booted into dharmik's custom linux kernel!

this message confirms that your custom kernel has booted successfully with your initrd.

you will also see a warning like this:

/bin/sh: can't access tty; job control turned off

this is because we have not yet mounted /dev/tty. you can ignore this warning for now. right now, it's just busybox's shell directly running on top of the kernel without any terminal support.

building and booting my own kernel on arch linux - part two

Sun, 07 Dec 2025 00:00:00 GMT

what do grown men wish for? wallpapers? drugs? rock-music (well, a little) idk. but the correct answer is building and booting your very own minimal linux distro.

if you follow the given guide below for word by word, you will end up with a minimal linux distro that boots using your kernel. here's obligatory screenshot of babyos (bro, tell me i am not good at naming things) running in qemu: .

well, part one was a sick learning experience. if you haven't read it yet and somehow ended up here, i recommend checking it out first: building and booting my own kernel on arch linux.

i usually ssh into my arch linux machine from my main laptop, because well it's cold winters. i don't want to get out of my warm blankets, so the only terminal i use is kitty from my laptop, but today i decided to sit on the chair and use my arch machine directly and baby, i have lost the ability to type on a complete black screen. i love terminal and no that's not what i am talking about. i need a wallpaper now.

i am right now using the cosmic de (been testing it for a while now, hopefully a blog about it too some day), but the default cosmic terminal has a black background. i can change the background color, i think. let me see... no i can't. that too is not implemented yet. nor do i think it has a schema support for changing basic things. i might have contributed to it, but well, rust. it has support for themes. my bad.

after understanding about the kernel configuration and how to build a basic kernel and boot it using qemu in part one. the question was what now? well, i wanted to build my own minimal distro that boots using my custom kernel, so let's get started for it.

(jokes apart, i have always wanted something like bharatOS/indiaOS but well, i don't know how that will work out. there already exists something that is called boss linux and it is funded by the government of india, but well, i don't know how that is going. i even mailed them once asking for contributing, but they have never replied back. sad! nor do they have a public repo. i mean i get it, it's just a debian fork, but well, open source is about collaboration and sharing knowledge. not just making a distro and keeping it to yourself. the iso files are available for download on their website, but that's it.)

building babyos: let's make a minimal distro

i'd love the chance to revise a few things first. busybox is a single binary that acts like multiple core unix commands. it is often used in embedded systems and minimal linux distributions. one of the few distro that includes/uses busybox is puppy linux (though i remember reading, there's a catch to that too).

also another thing is initramfs. initramfs is a temporary root filesystem that is loaded into memory during the boot process. it contains the necessary files and drivers needed to mount the root filesystem and start the init process. in layman's terms, it solves the chicken and egg problem of needing drivers to access the root filesystem, but needing the root filesystem to load the drivers.

now, let's get started with building babyos. i assume that you have already built your custom kernel as explained in part one. if not, please do so before proceeding. i am open to any questions about anything/regarding the post. contact me via email given in the contact section or ping me on twttr @dhrm1k.

step 1: verify you have everything

by default the kernel build process creates a bzimage file in the yourfolder/arch/x86/boot/bzImage. this is the kernel image that we will use.

confirm that you have the other necessary packages installed too:

which qemu-system-x86_64 || echo "qemu missing"
which busybox || echo "busybox missing"
busybox --help | head -n 3

now, create a folder for babyos and navigate into it:

mkdir -p ~/babyOS/rootfs
cd ~/babyOS/rootfs

step 2: create the rootfs skeleton

what is rootfs? rootfs is the root filesystem that will be used by the kernel during boot. we will create a minimal rootfs and give it utilities using busybox.

mkdir -p bin sbin lib lib64 usr/bin usr/sbin usr/lib
mkdir -p etc dev proc sys tmp var home root
chmod 755 tmp

step 3: populate rootfs with busybox

now, we will copy busybox binary to the rootfs and create necessary symlinks for the commands provided by busybox (under the assumption that you have already installed it).

cp /usr/bin/busybox bin/
cd bin
for i in $(./busybox --list); do ln -s busybox $i 2>/dev/null; done
cd ../..

i'd like to focus more on why we create this symlink and how it works. essentially, these symlinks tell the kernel that whenever a command is called (ls, cat, etc.), it should execute the busybox binary with the name of the command as an argument. busybox then interprets this argument and executes the corresponding functionality.

fun fact: the os for routers which is quite popular, openwrt, also uses busybox for providing basic unix commands.

step 4: setting up config files (passwd, group, inittab)

here we will give our operating system configuration files like the user database, group database and inittab.

the password database file (/etc/passwd) contains information about the user accounts on the system. we will create a minimal passwd file with a room for the root user. it tells the system every time it boots up that there is a root user with a uid of 0 and a home directory of /root.

another fun fact: recently i was working on a jail shell. what a jail shell is that it restricts a particular user to a specific directory and prevents them from accessing files outside that directory. while doing that, i had to edit the /etc/passwd file to add a new user for the jail shell. it was quite a fun experience. the problem with not doing it as a jail shell and customly parsing the commands that the user enters is that the tab autocomplete and other shell features won't work properly, so i had to create a proper user in the passwd file.

back to here to creating the passwd file:

cat > etc/passwd <<EOF
root::0:0:root:/root:/bin/sh
EOF

the format here for creating the user is as follows: username:password:uid:gid:comment/user_description:home_directory:shell

the uid of the root user is always 0. the password field right now is left empty for simplicity, but in a real-world scenario, you should set a proper password. the gid is also 0 for the root user.

now, let's create the group database file (/etc/group). the file contains information about the groups on the system. understanding user sounds intuitive consider most operating systems have it, but you must be wondering what groups are. groups are a way to organize users and manage permissions. for example, you can have a group for administrators, another for regular users. each user can belong to one or more groups. this helps in managing permissions and access control.

let's create a minimal group file with a room for the root group:

cat > etc/group <<EOF
root::0:
EOF

the format here for creating the group is as follows: group_name:password:gid:user_list

one of the thing that's on my mind though is that if we need the group file at all, considering that we have only one user (root) and one group (root). if a system boots up without a group file. well, i guess we will find out later.

added later: well, it does seem to boot up without any issues even if the group file is not present.

now, let's create the inittab file (/etc/inittab). inittab is a configuration file that tells the init process what to do during the boot process. it defines the runlevels and the processes that should be started.

in the previous part, we discussed that initramfs is a temporary root filesystem that is loaded into memory during boot. initramfs is loaded into ram and is not persistent. once the kernel has booted and the real root file system is mounted, the initramfs is no longer needed and is discarded, whereas the rootfs we are creating is the actual root filesystem that will be used by kernel after booting.

let's create a minimal inittab file that starts a shell on boot:

cat > etc/inittab <<EOF
::sysinit:/etc/init.d/rcS
ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100
EOF

the format here for creating the inittab entries is as follows: id:runlevels:action:process, so ::sysinit:/etc/init.d/rcS means that run /etc/init.d/rcS one time at boot before anything else.

also, line 2 is the login terminal configuration. it tells the init process to start a getty process on ttyS0 (the first serial terminal) with a baud rate (speed. think of it as without it being exact, the letters on screen will not be formatted proper) of 115200 and using the vt100 (a terminal emulation type).

create the rcS init script

mkdir -p etc/init.d
cat > etc/init.d/rcS <<'EOF'
#!/bin/sh
# rcS - minimal startup script for BabyOS v0.1
echo "=== BabyOS rcS: starting ==="

# mount virtual filesystems the kernel exposes
mount -t proc none /proc || echo "mount /proc failed"
mount -t sysfs none /sys  || echo "mount /sys failed"

# dev: prefer devtmpfs (kernel-managed), fall back to mdev if not available
mount -t devtmpfs none /dev 2>/dev/null || {
  echo "devtmpfs not available, falling back to mdev"
  /bin/mdev -s
}

# create basic device nodes if kernel didn't (safe-guard)
[ -e /dev/console ] || /bin/mknod -m 600 /dev/console c 5 1
[ -e /dev/null    ] || /bin/mknod -m 666 /dev/null c 1 3
[ -e /dev/tty0    ] || /bin/mknod -m 666 /dev/tty0 c 4 0

# bring up loopback (important for some network stacks)
ifconfig lo up

# optional: set hostname (you can edit this later)
echo "baby-os" > /proc/sys/kernel/hostname

# tune kernel logging (reduce spam)
dmesg -n 1

# run any other one-shot startup tasks you want to add
# e.g. mount extra filesystems, set timezone, start network later
# /bin/mount -a

echo "=== BabyOS rcS: initialization complete ==="
EOF

chmod +x etc/init.d/rcS

this script is executed during the boot process and performs several important tasks to set up the system properly. what it does:

it mounts the virtual filesystem like /proc and /sys, which are essential for the kernel to expose information about processes and system hardware.
mount -t devtmpfs none /dev. modern kernels create device nodes automatically via devtmpfs. if the kernel doesn't support/allow it, we fallback to running mdev -s, which creates /dev nodes from uevents.
mknod lines ensure crucial device nodes exist in case neither devtmpfs nor mdev created them.
~~ifconfig lo up brings the loopback interface up; important for some programs and for DHCP tests later.~~ (this is not important right now, this only exists because i was trying something else earlier. and noted it down here.)
echo "baby-os" > /proc/sys/kernel/hostname sets a hostname quickly (optional).
dmesg -n 1 limits kernel log level printed to console (optional).

create nodes in /dev

now, we will create necessary device nodes in the /dev directory. device nodes are special files that represent hardware devices. they allow user-space programs to interact with hardware devices.

sudo mknod -m 600 rootfs/dev/console c 5 1
sudo mknod -m 666 rootfs/dev/null c 1 3
sudo mknod -m 666 rootfs/dev/tty c 5 0
sudo chown root:root rootfs/dev/* || true

creating rootfs.ext4 image

we need a real disk image for qemu to boot from. we will create an ext4 filesystem image and copy our rootfs into it.

dd if=/dev/zero of=rootfs.ext4 bs=1M count=128
mkfs.ext4 rootfs.ext4

line 1 of the following command creates a blank 128MB file filled with zeros. line 2 formats that file as an ext4 filesystem. i myself had very little idea about filesystems before starting this post. also how helpful this dd utility is.

mount and populate the disk image

cd ~/babyOS
mkdir -p mnt
sudo mount rootfs.ext4 mnt
sudo cp -a rootfs/* mnt/
sync
sudo umount mnt

boot babyos with qemu

qemu-system-x86_64 \
  -kernel ~/src/linux/arch/x86/boot/bzImage \
  -drive file=rootfs.ext4,format=raw \
  -append "root=/dev/sda console=ttyS0" \
  -nographic

with this setup the os will boot up and you will be presented with a login prompt on the serial console. you can log in as root. if you had the same config, then you won't have to set up any password.

once logged in, you can try out some basic commands provided by busybox.

you won't be able to write to the root filesystem right now because it is mounted as read-only. to remount it as read-write, you can use the following command:

mount -o remount, rw / || echo "remount / rw failed

also, later your qemu run command has to be modified to include rw in the kernel parameters like so:

qemu-system-x86_64 \
  -kernel ~/src/linux/arch/x86/boot/bzImage \
  -drive file=rootfs.ext4,format=raw \
  -append "root=/dev/sda rw console=ttyS0" \
  -nographic

tip: i had to google it on how to exit qemu. it's ctrl + a, then x.

this will remount the root filesystem in read-write mode during boot.

ascii art

can anything be over without ascii art? no. so here it is:

from what i read, after busybox login, /etc/motd is displayed. motd stands for message of the day. so let's create one:

(the ascii art didn't work from etc/motd. it is probably because the tty is not configured properly. i will fix it later. for now, i am putting it in /etc/init.d/rcS to display it on every boot.)


cat > /etc/motd << "EOF"
 o            o                            
O            O                             
O            O                             
o            o                             
OoOo. .oOoO' OoOo. O   o       .oOo. .oOo  
O   o O   o  O   o o   O       O   o `Ooo. 
o   O o   O  o   O O   o       o   O     O 
`OoO' `OoO'o `OoO' `OoOO       `OoO' `OoO' 
                       o                   
                    OoO'
EOF

i changed the ascii art in the screenshot because i had no energy to deal with formatting it properly.

i enjoyed writing this post. it was an experience.

how we make time bearable

Mon, 15 Dec 2025 00:00:00 GMT

if you have met me, and you are a friend, there’s a high chance you already know my other friends too. one of them is rahul. he’s going back to my school to introduce 12th graders to pure sciences and academia. he is currently pursuing a bachelors at iiser bhopal. and like any sane person would, he doesn’t want to be accountable for any advice he gives to students who are about to make life-changing decisions.

we were talking about this right now when we met for tea at 12 am. yes, we do that often. he’s not in the city for most of the time, so it feels worth stepping out whenever he is. i don’t remember how we arrived there, but the gist of the conversation slowly boiled down to one question: why do we do what we do?

for a school-going kid who was happy doing nothing and having fun on the last bench (i personally think the last bench gives you more attention. if you want to be ignored completely, sit somewhere near the front), this question doesn’t even exist. how do you explain to a kid like that that one day it will matter what he works on? or that he will have to work at all? and why does it suddenly matter whether he likes what he does, or whether he’s good at it? why does he have to choose?

my opinion on that is inspired by charles baudelaire’s famous poem "be drunk".

you have to be always drunk. that’s all there is to it. it’s the only way. so as not to feel the horrible burden of time that breaks your back and bends you to the earth, you have to be continually drunk.
but on what? wine, poetry or virtue, as you wish. but be drunk.

i have loved this poem ever since i first read it. baudelaire understood that time is a burden. if you really think about it, it’s overwhelming to realize that you are moving toward death every second. not that this is something to fear, or even something to avoid thinking about entirely. i actually believe death is the only real certainty we have in life. but if you keep that fact in your head all the time, you are going to be miserable.

so what do we do? we get drunk. metaphorically. and in my case, literally isn’t even an option. i live in gujarat. it’s a dry state.

baudelaire’s suggestion isn’t escapism. it’s engagement. be interested in something deeply enough that life doesn’t feel like days are just passing by. something that makes you forget about time altogether. something that makes you want to wake up the next day and do it all over again.

i think even if people were given the choice to do nothing at all, most of them would still end up doing something. humans don’t sit well with emptiness. we look for friction. for attachment. for meaning, even if we have to invent it. without it, i don’t think it would have been possible for humans, as a collective species, to have survived this long. there’s a really good veritasium video about how humans are wired for meaning.

i hope my opinion changes in the future. but then again, isn’t everything a facade? not in a fake sense, but in a survival sense. we do what we do to feel alive. to feel like we are more than just bodies moving through space and time, following instructions until we stop working.

i spend hours on my computer doing things that might not make sense to anyone else. staring at text. breaking things. fixing things. building things that may never matter. but to me, that’s what makes me feel alive. it gives shape to time. it gives me a reason to wake up excited some days. i love it. we partly do many things because we don’t want to think about the things that are wrong in our lives.

and i think this is what humans have always done. we find something to be drunk on. something that gives us a sense of meaning, even if it’s fragile or temporary. what does a family give you, if not that? a sense of belonging. a reason to show up. a purpose you accept, or sometimes consciously create for yourself.

around the same time, i was watching the "tomorrow war". it’s not a deep movie, but there was a line that stayed with me. the plot is about people from the future coming back to the present to recruit civilians to fight an alien invasion. the main character agrees to go, not because he wants to be a hero, but because he wants to see his daughter grow up.

there’s a line where he says something like:

i’m not a hero. i was trying to save my daughter. if i have to save the world to save her, then i’m damn sure gonna do it.

that line stuck because that’s purpose in its rawest form. not noble. not abstract. not philosophical. just deeply personal. and strong enough to make someone walk into hell willingly.

which brings me to a question that always comes up. there are so many people who don’t do what they love. they don’t chase passion. they don’t romanticize work or purpose. how do they survive?

i think the answer, at least partly, is love. i genuinely believe that someone in a healthy romantic relationship can survive almost anything. love gives you a reason to live that exists outside of yourself. you don’t have to invent purpose every day. it’s already there, waiting for you in another person.

and not everyone gets that. not everyone wants that. so it seems we find our own intoxicants. work. curiosity. ambition. faith. people. ideas. responsibility.

maybe that’s enough. all i care about is if everyone is smiling.

admiration for arch linux

Sat, 27 Dec 2025 00:00:00 GMT

obligatory neofetch screenshot:

the way i came to arch linux is because what choice did i have? that is what all cool kids do, right? and ain't i the brand ambassador of the cool department? i too wanted to say "i use arch btw".

but as uncle ben put it, "with great power comes great responsibility". and arch linux is pure sheer power. it gives you power to build your own system from the ground up. it gives you power to choose what you want and what you don't want. it gives you power to learn and understand how linux works.

i didn't have this admiration always. i was a poopyhead for a long time. i have backups on this device of photos that are of size 60gb. i thought i made a bad choice of not choosing something stable, but i was wrong.

there are many instances when i broke my system, but learned to fix it. one particular instance which caught my eye and heart was today. i was trying to setup a vm with qemu on my machine. i had already spent time setting up the same on my pop os machine, but well it was weekend and i was tired of looking at my laptop screen (you bloody gnome) so i moved to my desktop.

i followed the same steps as i did on pop os, but it didn't work. everything worked except one thing which was dns. i tried everything. for a second i thought it was problem with my very own dns server, but no locally everything worked.

i started and restarted the vm, hoping it would work, but no luck. i googled and googled, but nothing worked. i was about to give up, when i thought of checking the arch wiki.

apparently, on pop os, preconfigures things for you (i have to read more about it later), but on arch, by default, there's no firewall rules set.

on my machine, i had nftables enabled, and my forward chain had a default policy drop. so anything being forwarded, including vm traffic, was dropped unless i explicitly allowed it.

i thought it's the default state on arch linux, but i was wrong. it has to be some package that i installed which enabled nftables with default drop policy.

> [dharmik@archlinux ~]$ sudo nft list ruleset

all i had to do was explicitly allow dns traffic within the forward chain.

sudo nft add rule inet filter forward udp dport 53 accept
sudo nft add rule inet filter forward tcp dport 53 accept

and voila! it worked. the vm could now access the internet.

> [dharmik@archlinux ~]$ sudo nft list ruleset
chain forward {
                type filter hook forward priority filter; policy drop;
                udp dport 53 accept
                tcp dport 53 accept
        }

since vm traffic goes through the host’s forward chain, dns packets (udp/tcp port 53) were getting dropped. all i had to do was explicitly allow dns traffic in the forward chain.

i love that. arch didn’t guess what i wanted. it waited for me to be explicit. that’s not inconvenience. that’s honesty. that’s control. that’s why i like arch linux. i did shed a tear that i have no account or memory of what on earth i was trying in the first place, but tears of joy, of course. i hope you guys had a happy weekend too.

note: this post was supposed to be published on 21st dec 2025, but i had a few doubts about the nft commands and the default state of firewall rules on arch machine. so i waited till today to confirm it all. yes, the default policy is drop on arch linux fresh install.

later, while setting up the vm further, i realized that forwarding itself was enabled, but the firewall policy was still dropping forwarded packets. i had to scratch my head on why i couldn't update the openwrt packages, because i could reach the internet and also could ping google from within the openwrt vm.

turns out the real issue was still forwarding. openwrt package downloads originate inside the vm, so they rely on the host’s forward chain. once i allowed forwarded traffic, package updates immediately started working.

sudo iptables -P FORWARD ACCEPT

i had briefly looked at the OUTPUT chain while debugging, but the actual fix was relaxing the forward policy.

it’s funny that until recently, i had no knowledge of firewalls or iptables/nftables and was living in ignorance and bliss. now that i know about them, i’m disturbed by them all the time. i can’t unknow it anymore.

though there's a lot i haven't learnt yet, i am open to it. i don't know what i will try next yet.

something else also happened. i had a lot of local commits in a repo and i wanted to start afresh from remote. so i did git log first to get the hash/commit id of the last commit on remote. but guess what, i got

less not found

well, not the first time i was doing git log, right? probably some bug in the routine system upgrade on my arch machine. without much thought, i did

sudo pacman -Syu
sudo pacman -S less

to which it says less already installed and up to date. what the heck? i go back and try git log again. well, this time less works but the error i get is github.com not found. arrrrrrgggghhh, i thought. my dns server was down again.

i picked up my laptop, because my router was down already and i was on my computer connected via lan cable. from my laptop, i ssh into my vps and see there's no storage left. someone's been ddos-ing my dns server again and the logs have filled up my storage. i clear some logs, restart the dns and it works again. phew!

but to those ddos-ers, please find a new hobby. this is old.

klish tutorial

Sat, 27 Dec 2025 00:00:00 GMT

note: amidst writing this tutorial, i realized that klish 3 documentation in itself is quite self-sufficient. nevertheless, i am publishing this hoping it serves as either a quickstart guide or notes for me for future references.

klish is a framework for building command line interfaces (clis). it lets you define the structure of your cli using simple xml files, takes care of parsing user input, and gives you some very sick tab autocompletion out of the box (along with escape characters, history, etc).

this is not a comprehensive tutorial. it’s more of a quickstart to get you up and running with klish. for deeper details, refer to the official documentation.

the main reason this post exists is because there’s surprisingly little about klish on the internet, and i wanted to change that.

i’ve been behind on writing this, and there’s a reason for it. initially, i was working with klish 2.2 (the version available in the openwrt package manager), while the latest release is klish 3.

from an architectural standpoint, a lot has changed. i’m now back in the learning phase myself and need to understand the newer version before continuing.

one of the first things to do if you are setting up klish3 on your openwrt vm then is to install less (gnu less), because the busy box less that comes with openwrt does not support the -e option that klish uses when you have the pager enabled.

opkg update
opkg install less

i have took the trouble to build the latest klish from the source code for x86_64 architecture. you will be required to downgrade libxml2 to the version it requires. also you will need to install faux. i have all the packages here.

setting up

after installation, you will have the klish binary at /usr/bin/klish. you still need to set up a few things before you can run it.

first, create a directory to hold your klish configuration files.

mkdir -p /etc/klish/xml
cd /etc/klish
cat > klish.conf << EOF
paste the contents of klish.conf from https://github.com/dhrm1k/klish/blob/master/klish.conf here.
EOF


cat > klishd.conf << EOF
paste the contents of klishd.conf from https://github.com/dhrm1k/klish/blob/master/klishd.conf here.
EOF

make sure to adjust the paths in these configuration files. in particular, for klishd.conf, set the DB.libxmls.XMLPath parameter to point to your configuation directory (i.e. /etc/klish here).

DB.libxml2.XMLPath=/etc/klish/xml/

there's a really good example configuration in the klish soruce code repository. you can copy the xml file from there to your configuration directory to get started.

cat > /etc/klish/xml/example.xml << EOF
paste the contents from example.xml at https://github.com/dhrm1k/klish/blob/master/examples/simple/example.xml here.

now you need to run the klish daemon with klishd to load the configuration. you can run it with the foreground option -foreground for testing purposes.

the commands

this was the easy part. the main reason of writing this tutorial was to understand how to implement the command handlers. the basic xml for basic commands is pretty straightforward (but it does get a little dirty on a little user experience edge cases, more on that later).

ptype

when starting out, i myself was wondering, if ptype is some special type defined by klish or limited to klish or is it something more general. turns out, ptype is just short for parameter type. it defines the type of argument that a command takes.

for example, in the example.xml file, you can see the following:

<PTYPE name="STRING">
	<ACTION sym="STRING@klish"/>
</PTYPE>

this defines a parameter type named STRING, which takes a string argument.

klish comes with a set of built-in ptypes, which you can find in the official documentation. i am also adding it here for reference:

STRING: any string
INT: integer
UINT: unsigned integer

you can also define your own ptypes. let's say you want to define a ptype for an ip address. now why would you want to do that? let's say you want to implement a command that takes an ip address as an argument (ping command, anyone?). you can define a ptype for an ip address as follows:

<PTYPE name="IP_ADDR">
	<ACTION sym="REGEX@klish">
		^([0-9]{1,3}\.){3}[0-9]{1,3}$
	</ACTION>
</PTYPE>

and you will be using it as follows:

<COMMAND name="ping" help="Ping an IP address">
	<PARAM name="ip" ptype="IP_ADDR" help="IP address"/>
	<ACTION sym="script">ping -c 4 ${KLISH_PARAM_ip}</ACTION>
</COMMAND>

actions

you have seen the action tag in the above examples. action defines what happens when a command ois executed when sym is set to script. above, you see, sym is set to REGEX@klish.

this means that klish will use the regex defined in the action tag to validate the input for that ptype. REGEX@klish is a built-in action that is part of the default klish plugin.

in the default example.xml file, you can see that prompt uses an action with sym set to PROMPT@klish. this is another built-in action that is used to customize the prompt/appearance.

<PROMPT name="prompt">
	<ACTION sym="prompt">%u@%h&gt; </ACTION>
</PROMPT>

to even give an example of how to use the parameters in the action script, here's a greet command that takes name and age as parameters and prints a greeting message.

<COMMAND name="greet" help="Greet user">	
	<PARAM name="name" ptype="STRING" help="Name"/>
	<PARAM name="age" ptype="INT" help="Age"/>
	<ACTION sym="script">
		echo "hii, $KLISH_PARAM_name! you are $KLISH_PARAM_age years old"
	</ACTION>
</COMMAND>

command hierarchy

commands can be organized in a hierarch to give better autocomplete experience. basic commands have already been implemented above. i'd like to give a example to set up hierarchial commands. for example,

<COMMAND name="show" help="Show information">
	<COMMAND name="interface" help="Show interface information">
		<COMMAND name="eth0" help="Show eth0 details">
			<ACTION sym="script">ip addr show eth0</ACTION>
		</COMMAND>
		<COMMAND name="wlan0" help="Show wlan0 details">
			<ACTION sym="script">ip addr show wlan0</ACTION>
		</COMMAND>
	</COMMAND>
</COMMAND>

root@OpenWrt> show interface
     eth0  wlan0
root@OpenWrt> show interface eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc...

views

a view is a context or mode that contains its own set of commands, prompts, and behavior. users navigate between views to access different functionality.

an example of defining multiple views is as follows:

<VIEW name="main">
	<PROMPT name="prompt">
		<ACTION sym="prompt">user&gt; </ACTION>
	</PROMPT>
	
	<COMMAND name="exit" help="Exit CLI">
		<ACTION sym="nav">pop</ACTION>
	</COMMAND>
	
	<COMMAND name="show" help="Show information">
		<COMMAND name="version" help="Show version">
			<ACTION sym="printl">Version 1.0.0</ACTION>
		</COMMAND>
	</COMMAND>
	
	<!-- Command to enter config view -->
	<COMMAND name="configure" help="Enter configuration mode">
		<ACTION sym="nav">push config</ACTION>
	</COMMAND>
</VIEW>

<!-- Config VIEW: Configuration mode -->
<VIEW name="config">
	<PROMPT name="prompt">
		<ACTION sym="prompt">config&gt; </ACTION>
	</PROMPT>
	
	<COMMAND name="exit" help="Exit to main view">
		<ACTION sym="nav">pop</ACTION>
	</COMMAND>
	
	<COMMAND name="hostname" help="Set hostname">
		<PARAM name="name" ptype="STRING" help="Hostname"/>
		<ACTION sym="script">
			echo "Setting hostname to $KLISH_PARAM_name"
			# hostname $KLISH_PARAM_name
		</ACTION>
	</COMMAND>
	
	<COMMAND name="ip" help="IP configuration">
		<PARAM name="address" ptype="STRING" help="IP address"/>
		<ACTION sym="script">
			echo "Setting IP to $KLISH_PARAM_address"
		</ACTION>
	</COMMAND>
</VIEW>

this was intuitive and easy to implement.

the thing that's been taking my mind and time is implementing a password protected view. i did achieve that in klish 2.2 by a custom action script that prompted for password input with the read -s flag to hide input. however, in klish 3, i am not able to get that working yet. i will experiment more and update this tutorial for that part when i have something working.

well, it seems i will have to write a custom plugin to test this.

voila, i was an inch away from giving up when i found a way. after nothing worked, i thought to write a custom auth plugin in klish, but installing gcc made my vm run out of space, and well it's 3:55 am. though, i am not exhaused, i want to think about other pretty things.

	<COMMAND name="enable" help="Enter privileged mode (password required)">
		<ACTION sym="script" in="tty" out="tty"><![CDATA[
#!/bin/sh

# Read password with hidden input using read -s
read -s -p "Password: " password
echo ""

# Check password
if [ "$password" = "admin123" ]; then
    echo "Access granted"
    exit 0
else
    echo "Access denied"
    exit 1
fi
]]></ACTION>
		<ACTION sym="nav">push enable</ACTION>
	</COMMAND>

this worked. to answer why,

<ACTION sym="script" in="tty" out="tty">
    read -s -p "Password: " password
</ACTION>

this tells klish to create a proper PTY and set KTP_STATUS_NEED_STDIN and KTP_STATUS_INTERACTIVE flags. even then, there's still a conflict: the client-side tinyrl holds the terminal in raw mode, and while it does call tinyrl_raw_mode() for interactive commands (line 570-571 in klish.c).

the version of klish on my machine is klish - 3.2.0-1.

this is a ongoing tutorial. i will add more here. until then, if any questions, feel free to mail me. my email address is in the contact section of this webpage.

all i needed to learn

Wed, 31 Dec 2025 00:00:00 GMT

this is the final post of the year. i am happy i have posted on this blog a lot more this year than i did well, in all the years that this blog has existed. i hope i continue this streak next year as well.

the year is ending, and for most part, after the time passes, it's hard to remember when was i ever sad? the year was good, i had a lot of fun.

one of my favourite write ups is "all i really needed to know i learned in kindergarten" by robert fulgham.

for the innoncence of the poem, i urge you to read it, but i expected mr robert fulgham to be a lot more old than he actually is. i really thought it'd be a old book, but it is relatively new, published in 1986.

here's my favourite part if are not aware about the write up:

“These are the things I learned (in Kindergarten):

Share everything.
Play fair.
Don't hit people.
Put things back where you found them.
CLEAN UP YOUR OWN MESS.
Don't take things that aren't yours.
Say you're SORRY when you HURT somebody.
Wash your hands before you eat.

... and it continues, on goodreads here.

i honestly miss the teen me and the innocence of those days. i miss the carefree attitude, the friends, the fun... only thing i'd tell my younger self and all my younger brothers and sisters is to enjoy it.

i like the freedom of adulthood, but i don’t really understand what people look forward to every day. what do adults even look forward to?

all our lives, there was always something waiting ahead. finish primary school, then secondary school. when i was still writing with a wooden pencil, i was looking forward to growing up and finally getting a pen. in high school, we all looked forward to the 10th-grade ssc exams. after that, it was finishing high school, then college.

but after college… what’s next?

mr robert fulgham never told us how to deal with the complexities of adulthood. maybe, he didn't want us to be sad? idk. the year is ending and i'd like to think we are just a lot of tiny organisms that live on a floating piece of rock. the mere fact that in the grand scheme of things, we don't even matter, makes me feel good. it's a little reassuring. happy new year guys!

installing openwrt on tp-link router via tftp

Sun, 11 Jan 2026 00:00:00 GMT

so what if i tell you i am in a good mood today?

i don't want this energy to go waste! today might be one of those days where i will not say you a word even if you smash my laptop! i had a router lying around for a while (i have procrastinated on installing openwrt on my hardware for long, so today might be the day), let's flash it with openwrt! welcome to the guide on how to flash openwrt on tplink routers (mine specifically is model tl-wr850n)

here's an image of the model.

random electricity strikes in monsoon season have bricked a lot of routers of mine over time, so i had a spare one lying around for next time that happens.

up until few months ago, prior to my internship, i had no idea about openwrt, but lately i tinker with it a lot, so why not experiment with it a little more.

i hope you already know how to set up a tftp server! if not, you've come to the right place!

i installed tftpd-hpa, which is the standard TFTP server (and the only one i knew of) for debian/ubuntu-based systems.

sudo apt install tftpd-hpa

the default configuration is at /etc/default/ttpd-hpa. here's what mine looked like

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/var/lib/tftpboot"
TFTP_ADDRESS="127.0.0.1:69"
TFTP_OPTIONS="--secure"

i copied the openwrt firmware to the TFTP directory and renamed it to what the tp-link router expects, which is tp_recovery.bin. the browsing through the web, it hit me that this is not consistent. a lot of models expect different names.

i too had to open wireshark and capture and see what is the tftp protocol asking for

one of the roadblock that i had no idea about was that i had to fix permission of the bin fil so the TFTP server (running as user tftp) could read it:

sudo chown tftp:tftp /var/lib/tftpboot/tp_recovery.bin
sudo chmod 644 /var/lib/tftpboot/tp_recovery.bin

i started the tftp server with the command sudo systemctl status tftpd-hpa, hoping it'd take a minute or two, but no. are things that easy, never?

the tftp server that wasn't really running

i configured my PC's network interface to be on the same subnet as the router's recovery mode IP:

sudo ip addr add 192.168.0.66/24 dev enp1s0
sudo ip link set enp1s0 up

the router in tftp recovery mode uses 192.168.0.2, and my PC was 192.168.0.66.

i powered on the router in recovery mode (holding the reset button while plugging in power). I could see it in tcpdump, sudo tcpdump -i enp1s0 port 69

IP 192.168.0.2.2250 > pop-os.tftp: TFTP, length 34, RRQ "tp_recovery.bin" octet timeout 1
Beautiful! The router was asking for the file. But then... nothing. Just the same request over and over again, every 30 seconds. No response from my PC.
Debugging with tcpdump
I ran tcpdump with more detail to see what was actually happening:
bashsudo tcpdump -i enp1s0 -e -n host 192.168.0.2
This showed me the ethernet frames with MAC addresses and everything:
12:45:16.342929 00:00:0a:eb:13:09 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 192.168.0.66 tell 192.168.0.2
12:45:16.342955 40:c2:ba:e0:82:69 > 00:00:0a:eb:13:09, ethertype ARP (0x0806), length 42: Reply 192.168.0.66 is-at 40:c2:ba:e0:82:69
12:45:16.351039 00:00:0a:eb:13:09 > 40:c2:ba:e0:82:69, ethertype IPv4 (0x0800), length 76: 192.168.0.2.1437 > 192.168.0.66.69: TFTP, length 34, RRQ "tp_recovery.bin" octet timeout 1
12:45:16.351071 40:c2:ba:e0:82:69 > 00:00:0a:eb:13:09, ethertype IPv4 (0x0800), length 104: 192.168.0.66 > 192.168.0.2: ICMP 192.168.0.66 udp port 69 unreachable, length 70

THERE IT IS!

icmp 192.168.0.66 udp port 69 unreachable

MY PC WAS ACTIVELY REJECTING THE PACKETS.

i checked what was actually listening, sudo lsof -i :69

nothing. empty output. even though systemctl said the service was running! i tried running the TFTP server manually with verbose output to see what was happening, sudo systemctl stop tftpd-hpa and sudo /usr/sbin/in.tftpd -L -vvv -a 0.0.0.0:69 -s /var/lib/tftpboot

then triggered the router recovery again. watched tcpdump in another terminal... router sent requests... and the manual TFTP server showed absolutely nothing. no log output. no indication it received anything. the packets were visible in tcpdump but never reaching the TFTP application. this meant something was dropping them at the kernel level before they could reach the application.

like any sane person i disabled the firewall and blamed it

kill everything and start fresh

the problem? an old TFTP server process was probably still running from earlier attempts, bound to the wrong interface or in a zombie state. when i "restarted" the service via systemd, it might have failed to actually start a new process because the old one was still holding the port (or thought it was).

# i said f it and killed all the processes related to in.tftpd
sudo pkill -9 in.tftpd
# gotta verify if nothing is listening on port 69 now
sudo lsof -i :69

# and started the service fresh
sudo systemctl start tftpd-hpa

also,

sudo lsof -i :69

Output:
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
in.tftpd 33576 root    4u  IPv4 252242      0t0  UDP *:tftp

finally! the TFTP server was actually listening on port 69.

with the TFTP server finally configured correctly and actually listening on the network, i power-cycled the router one more time. held the reset button, plugged in power, waited for the recovery mode... started tcpdump to watch the magic happen:

sudo tcpdump -i enp1s0 -e -n host 192.168.0.2

this time, instead of ICMP unreachable messages, i saw:

12:48:03.804887 00:00:0a:eb:13:09 > 40:c2:ba:e0:82:69, ethertype IPv4 (0x0800), length 60: 192.168.0.2.2205 > 192.168.0.66.46446: UDP, length 4
12:48:03.804918 40:c2:ba:e0:82:69 > 00:00:0a:eb:13:09, ethertype IPv4 (0x0800), length 558: 192.168.0.66.46446 > [192.168.0.2.2205](192.168.0.2.2205): UDP, length 516
12:48:03.805053 00:00:0a:eb:13:09 > 40:c2:ba:e0:82:69, ethertype IPv4 (0x0800), length 60: 192.168.0.2.2205 > 192.168.0.66.46446: UDP, length 4
12:48:03.805057 40:c2:ba:e0:82:69 > 00:00:0a:eb:13:09, ethertype IPv4 (0x0800), length 558: 192.168.0.66.46446 > 192.168.0.2.2205: UDP, length 516

BEAUTIFUL PACKET EXCHANGE! what's happening here:

UDP, length 4 - Router sending ACK packets (acknowledging received data blocks) UDP, length 516 - My PC sending DATA packets (512 bytes of firmware data + 4 bytes TFTP header)

the problem is that i expected even tftp logs to show something, but no logs were being printed. i guess tftpd-hpa doesn't do verbose logging by default. oh well, let's be glad, tcpdump is doing it's job good enough.

the 8MB firmware file was being transferred 512 bytes at a time. the tcpdump output was scrolling rapidly with hundreds of these exchanges per second.

note that TFTP switches from port 69 to a random high port (46446 in this case) after the initial request. this is why earlier when I was monitoring port 69 only, i wasn't seeing the actual transfer, it happens on a different port!

i just sat there watching tcpdump scroll by, afraid to breathe or touch anything in case it broke again (or more worse, i brick my extra router). after a few minutes of continuous packet exchange, the transfer completed:

12:48:03.806750 40:c2:ba:e0:82:69 > 00:00:0a:eb:13:09, ethertype IPv4 (0x0800), length 46: 192.168.0.66.46446 > 192.168.0.2.2205: UDP, length 4
12:48:06.943308 40:c2:ba:e0:82:69 > 00:00:0a:eb:13:09, ethertype ARP (0x0806), length 42: Request who-has 192.168.0.2 tell 192.168.0.66, length 28

the router stopped responding to ARP requests. itt was rebooting to flash the firmware! it was time for wireless freedom (openwrt's slogan).

the router had rebooted. Time to access the shiny new openWrt interface! i tried visiting the web via 192.168.0.1. nothing. connection refused.

i did,

ping 192.168.0.1
From 192.168.0.66 icmp_seq=1 Destination Host Unreachable

hmm. maybe it takes a while to boot? waited 2 minutes (with the tp link firmware, i am sure the device took much less time to boot then it does right now). still nothing. then it hit me, openwrt defaults to 192.168.1.1, not 192.168.0.1! different subnet entirely.

reconfigured my network interface:

sudo ip addr flush dev enp1s0
sudo ip addr add 192.168.1.100/24 dev enp1s0
sudo ip link set enp1s0 up

tried again and opened the browser/web interface at 192.168.1.1 and voila, there it was! the openwrt web interface!

and wooh, now i can ssh into my router too! is there a better feeling than that of trying a new distro and successfully logging into it?

my internet is working too slow. i blame the hardware offloading. i am still figuring things out. i want to set up a wireguard instance. i recently needed a file when i was not at home. casually. my brother was at home, so he assisted me in file sharing, but for future i need my vpn

i made a new ssid and connected the wan to my lan of my gtpl fiber connection hoping to try new packages and things.

rant

i ranted the whole day on how the new ssid i created is too slow. i already had a little idead that the openwrt does impact the network connection and the throughput isn't what you expect with the propetiary os.

later it hit me how the traffic would be flowing and yeah, double nat was the problem. the way i had it set up was lan → wan into openwrt, so it was unnecessarily routing and nat-ing everything again instead of just bridging traffic like an access point should.

i reconfigured the openwrt to be an access point only, disabled dhcp and set the lan ip to be in the same subnet as my main router. boom! speeds were back to normal.

for posterity, if someone ever arrives to the same problem, below are the uci commands to set up openwrt as an access point only:

uci set dhcp.lan.ignore='1'
uci commit dhcp

uci set network.lan.proto='static'
uci set network.lan.ipaddr='192.168.0.2'
uci set network.lan.netmask='255.255.255.0'
uci set network.lan.gateway='192.168.0.1'
uci set network.lan.dns='192.168.0.1'
uci commit network

uci set network.wan.disabled='1'
uci set network.wan6.disabled='1'
uci commit network

/etc/init.d/network restart
/etc/init.d/dnsmasq restart

the thing that hit me is that when you hit the etc/init.d/network restart command, it will drop your ssh connection if you are connected over the lan interface. so be careful! this will be a problem when your main router is not in the same subnet as openwrt lan ip. gpt phrased it as classic AP-mode transition lockout, to which i was like, classic, aeh! cool.

for that you will need to assign your device a static ip then ssh again into the access point and reconfigure it to match your main router subnet.

i did a speed test after this and the i have to say the speeds are better and the experience overall is better than it was prior... there are a lot of packages and things i want to try! first is setting up a vpn, so i can access my home network from anywhere. more on that later!

update: dt: 15/01/2026

reverse ssh tunnel for remote access

this was the reason i wanted to set up openwrt on my router in the first place. i wanted to access my home network remotely. well, i could have set up tailscale or wireguard on my computer instead, right? but i wanted to experiment with the router itself.

i don't know if i have mentioned already, but on opewrt too, my default plan was to install tailscale in the first place. there's this sick computer user i follow on twitter, and they worked on tailscale tui at neuralink (follow at x.com/kognise7). but flash memory of my router is only 2mb and the tailscale package alone is around 8mb, so well, that was a no go.

instead now the plan was to set up a reverse ssh tunnel from openwrt router to my vps, and then access my home network via the vps.

now my isp is not so great. even if i called the customer care, they'd have no idea what a port forward is. i did even call them and they told me to mail them about it. so the thing was i had to implement everything without disturbing the main router settings.

i already had a vps with a public ip (let's be thankful to student github plan). i was high on adrenaline to setup a reverse ssh tunnel from openwrt to my vps.

i made a new user and assigned it no shell access (for security reason)

also generated a ssh key pair on my openwrt router via ssh-keygen -t rsa -b 2048 -f /root/.ssh/vps_tunnel -N "" then copied the public key to my vps

the autossh struggle

i knew setting up autossh wouldn't be easy. i have had my fair share of it already.

i installed opkg install autossh on openwrt, and manually ran this command to test if it works:

AUTOSSH_GATETIME=0 \
AUTOSSH_PATH=/usr/bin/dbclient \
autossh -M 0 -N \
  -o ServerAliveInterval=30 \
  -i /root/.ssh/vps_tunnel \
  -R 127.0.0.1:2222:localhost:22 \
  tunnel@VPS_IP

tunnel appeared on the vps, i could ssh from the vps to my router via ssh root@127.0.0.1 -p 2222, everything worked. beautiful. but can we really have good things?

but when i tried to run it as a procd service? crash loop. every single time.

Instance reverse-ssh::instance1 is in a crash loop

and as any sane person i cursed a lot. cursed openwrt. cursed my life choices, but later it hit me, that there's nothing else i have to do except this crap on my computer. this is the only high i get!

i checked the logs via logread -f and simultaneously tried to login from the vps to see what was happening. the logs showed:

logread | grep autossh

> exit code 127. that's "command not found." ran `which autossh` and found it at `/usr/sbin/autossh`, not `/usr/bin/autossh`. classic. fixed the path in my service file.

restarted. still crashing. checked logs again:

bash
daemon.err autossh[8550]: /usr/bin/dbclient: Ignoring unknown configuration option 'ServerAliveCountMax=3'

oh. openwrt uses dropbear, not openssh. those -o ServerAliveInterval flags? dropbear doesn't understand them. dropbear has its own syntax. openssh uses -o ServerAliveInterval=30, dropbear uses -K 30.

fixed that. restarted. still crashing:

daemon.err autossh[8550]: Host 'myipisnoneofyourip' is not in the trusted hosts file.

ah, ok better. i thought i connected via ssh key once and trusted the host, but apparently not. i manually ssh-ed.

/usr/bin/dbclient -i /root/.ssh/vps_tunnel tunnel@myipisnoneofyourip

connected fine, saw "this account is currently not available" (because the tunnel user has no shell), but the connection worked. host key should be saved now, right?

now i am in a moral dillemma. do i want to share everything about my config. even the parts that are sensitive and i know are a security hazard? well, for now i did something dirty. i will not mention it here.

after all that debugging there was a zombie existing autossh process that hindered the new one from starting. i killed all autossh processes via pkill -9 autossh and restarted the service again on my openwrt router.

the current config file for autossh service is as below:

#!/bin/sh /etc/rc.common

START=99
STOP=10
USE_PROCD=1

start_service() {
    procd_open_instance
    
    procd_set_param command /usr/sbin/autossh \
        -M 0 \
        -N \
        -y \
        -K 30 \
        -i /root/.ssh/vps_tunnel \
        -R 127.0.0.1:2222:localhost:22 \
        tunnel@myipisnoneofyourip
    
    procd_set_param env AUTOSSH_GATETIME=0
    procd_append_param env AUTOSSH_PATH=/usr/bin/dbclient
    procd_append_param env AUTOSSH_PIDFILE=/var/run/autossh.pid
    
    procd_set_param respawn 3600 5 0
    procd_set_param stdout 1
    procd_set_param stderr 1
    
    procd_close_instance
}

and boom

ssh myvpsusername@MY_VPS_IP
ssh root@127.0.0.1 -p 2222

my router is now a a layer 2 bridge or a dumb access point with a reverse ssh tunnel to my vps for remote access. there's something that's still bugging me though. i can always see the devices connected to my openwrt router ssid via the arp table on openwrt, but i can't see the hostnames. i have looked into mDNS, but for some reason avahi-daemon package isn't available for the latest openwrt version. more on that later!

for now i have decided to write a device profile script that decides what device it is dependent on the ttl value (and the number of arp requests it sends and things) and map a device profile accordingly.

and here's the as-usual obligatory screenshot of the reverse ssh tunnel working. i first ssh-ed into my vps and then to it's this port i assigned that forwarded to my home router. later i did arp -a (and well because hostnames are not available and nmap scan will be waste of resources, i plainly guessed my laptop's ip from the mac address). and well then myhostname which is dharmik@laptops_ip and bam i was in my laptop.

next time when i am roaming outside and i out of where need or have an urge to look for a file, i can well just open termius app on my phone.

ofcourse, i have edited out all the things some moronic attackers might find interesting.

powering a home machine remotely and how wake on lan actually works

Fri, 30 Jan 2026 00:00:00 GMT

should i sleep right now? probably yes, but not before i finish writing this post.

do you ever wish that when you are not at home, you could just turn on your home computer remotely? well, i do too. we have that in common if you do. i'd rather want a home server, but i am not able to convince myself to spend money on one right now (though i think, i might not be able to resist for long. grown men do need toys after all).

anyone who has read my last post knows i was tinkering with getting remote access to my home computer but not open to using wireguard. i wanted something simpler, though we all know that's just an excuse because i don't have energy past 9 pm these days to set it up.

a big f you autossh, hello tailscale

yesterday night i was so frustrated on autossh fails. decided to finally give tailscale a try to set up a vpn so i can access my home network even when i am not home. tailscale is a zero-config vpn that uses wireguard under the hood. it is super easy to set up and works like a charm. i have never used it prior to this but read a lot about it and i gotta say it's so sick. i have installed it on all my devices, my laptop, my home computer, even my phone. i still have to try the neuralink made tui for tailscale, that i keep reading and telling everyone about, but later.

now i have wake on lan enabled on my home computer and all my devices are now added to tailscale. the only problem was power management. there must be times when i want to remotely shutdown my computer. i don't know when, but there must come a time right? like what if i accidentally leave some heavy process running and want to shut it down to save power? or what if i just want to feel the power of turning off a machine hundreds of kilometers away? the universe works in mysterious ways.

a little gibberish on what is wake-on-lan?

wol is a networking standard that allows a computer to be turned on or awakened by a network message. the way it works is actually pretty neat - when you want to wake up a computer, you send what's called a "magic packet" over the network. this packet is just a specific sequence of bytes: six bytes of all 255s (0xFF in hex), followed by sixteen repetitions of the target computer's MAC address. that's it. no encryption, no fancy protocol, just a very specific pattern of bytes broadcast over the network.

the interesting part is how a computer that's "off" can even receive this packet. when you properly shut down a computer (like using systemctl poweroff on linux), it doesn't actually cut all power. modern power supplies have what's called a 5VSB (5 volt standby) line that stays on even when the computer is off. this standby power keeps a tiny part of the network card alive and listening for that magic packet. when the network card sees the right pattern with its MAC address, it sends a signal to the motherboard to trigger the power supply and boot up the computer. it's like leaving a very specific doorbell running that can wake up the entire house.

one of the thing that got me curious was that how does the computer listen to the wol packet when it's off? i specifically use the command systemctl poweroff to turn it off. turns out that even when the computer is off, this specific command takes it to soft off (what's technically called ACPI state S5), and the 5VSB line of the power supply is still on, which powers the network card to listen for the wol packet. the network card basically sits there in an extremely low power state, just waiting for that one specific pattern of bytes. when it sees it, boom, it tells the motherboard "hey, someone's calling for us" and the whole computer springs to life. cool right?

priorly to this, i have a l2 wireless switch on my network that too gets an ip address from my router. this switch is nothing but a spare lying tp-link router. i flashed openwrt on it (already in the last post) and set it up as a dumb access point. this way, all devices connected to this access point are on the same subnet as my main router.

i already had the autossh part figured out in the last part, but still the problem was that whenever my computer was off, i could not reach it to send the wol packet. also another problem was that now that i want to setup kasm at places without worrying about logging into services at random computers and later worry that i logged in, and then cause a chaos spree to change passwords everywhere.

i had to set up wol from bios first and to my surprise it was already on. maybe, some other day, i might have had the urge to turn it on but quit setting it up because i was lazy. it's funny how easily i am forgetting things lately. i had a vm fully configured on my device, though i have no memory or account of when i did that. i was just grateful "oh, mother frigging god, it exists" state.

to first test things out, i tried sending the wol packet from my local network from my pop os machine to my arch machine. our beloved package manager has a package called wakeonlan that makes it super easy to send the packets from the terminal:

sudo apt install wakeonlan
wakeonlan <mac-address-of-arch-machine>

it worked like a charm. the arch machine woke up in no time. enabled wake on lan and it mother frigging works in the first try.

as usual, storage problems

now the next step was to send the wol packet from my openwrt router. to which i assumed "hey lord, opkg must have a package" and it very much did, the package size was just in 5-6 kb range, and it was also titled wakeonlan, so i assumed installing it would be a breeze, until wait, i clicked on install and it showed that one of the dependencies was perl that too alone is 3mb. well, i hope i have ranted enough already how my router's flash memory is 2mb. so i had to find an alternative way.

after some googling and gpting, i figured out i could install socat package and use it to send the wol packet. socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. the package was small enough to fit on my router and it could construct and send the magic packet using UDP broadcast.

here's the script i ended up with:

root@OpenWrt:~# cat socat-wol.sh 
MAC="your-mac-address-without-colons"
printf '\xff\xff\xff\xff\xff\xff\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6\x18\xc0\x4d\x3d\xc8\xc6' | socat - UDP-DATAGRAM:255.255.255.255:9,broadcast

you can see the magic packet structure right there in the printf - six \xff bytes followed by my MAC address repeated sixteen times. that's exactly what the network card is waiting for. i tested this script and well, it did turn on my computer.

the final thing

now i can autossh into my router from the tunnel i have via my vps anytime, wake my computer on lan via the magic packet, and after waiting hopefully for 30 seconds (sometimes it feels like an eternity when you're staring at the terminal waiting for the ssh connection to establish, wondering if the packet even reached or if your computer decided to be moody and never wake up), i can then ssh into the computer via tailscale and use it even as a vpn to access my home network.

the whole chain looks like this: ssh into vps, then reverse ssh into home router, then run the wol script to wake the computer, wait a bit while questioning all life decisions that led to this moment, and finally ssh into the computer via tailscale. smooth and sweet as a pie.

i can also power it off remotely because systemctl poweroff doesn't actually kill all power, the NIC stays powered by that 5VSB line, still listening for the magic packet like a faithful guard dog. when the packet arrives, the motherboard asserts the power-on signal and boom, the whole computer springs to life.

it's been a good day.

now i should probably sleep.

random dump

Fri, 06 Feb 2026 00:00:00 GMT

have we reached the endgame now that i have started to shit post on my blog as well (and what a caveman habit to title this post as "random dump"). maybe!? where else do i go to pretend that people care about opinions?

there was this time when i was reading two books side by side. one was american prometheus and another was ah, idk remember, ah, it was "too big for a single mind" by tobias hurter. one is on the life of robert oppenheimer, the other one is about the lives that shaped the field of quantum mechanics as we know it.

this is around the 2023 days when the movie oppenheimer was still not out and i wanted to be ready to enjoy the experience.

i don't rememeber which book it was but the quote that's been my head rent free since then is something like

"Love is a nuisance to everyone but the parties involved.

i really admire this one. i am never sure where i read this one. i think it has to be american prometheus, considering the complex relationship of jean tatlock and oppie, it certainly looks like something that oppie might say. it's not i have not tried looking it up. i have and i have lost behind it. i don't know if it's even a real quote or something i have made up in my head. i like that it lives rent free in my head. everytime i look at old records (notes app, todo lists, txt files and shit), i do find it.

i am sure this is not the original one but it's paraphrased.

i spend a good chunk of my week going back to the idea of why anyone in india should start a framework like laptop company. those guys are not just deciding to sell in india and i mean, it could be my selection bias (it definitely is), but i can't think of someone who won't like the idea of laptop they can repair and upgrade instanly. india ofcourse, after all is one of the most price sensitive markets to exist.

i sometimes then also think how the public service computing in india should entirely move to linux. it's free. it can save government a lot of money, but then my friend karan thinks that that is not sensible considering that if anyone finds a serious bug in the source code then well, what do we have? armageddon? idk.

i have mentioned this prior but just in case anyone new reading this. government of india did once start developing their own debian based linux distro called "bharatos", but well, they didn't do much with it. the iso is available online.

"you either die a hero, or you live long enough to see yourself become the villain"

i most certainly didn't die soon enough, and that has brought me to learn rust... yes, rust. the language that i might have cursed a lot in the past about the long compile times (that only come once the compilation actually starts, most of the time that doesn't happen in the first place)

why rust? looks like a fun language. i have never learnt in depth about how it handles memory and how owning works in that.

mgk recently published a new variant of his old album that i have been listening more than a little. pop punk is not for the weak. the album is the classic old "tickets to my downfall" but a all new access version. the songs are not something i have heard. i love to stream to leak music i can find on soundcloud. i already was familiar with the songs, but well, something new.

i have also set up my home server. i am still quite confused and doubtful about the uptime my amd ryzen can pull. the pc that runs it is a custom built and quite old (2020-ish) covid times. i quit using it a lot of times. it used to run windows, later i think i switched to pop os, later for long it was running arch and i had a immich server running on it.

a little mishap with how i installed the immich server (i used a snap package) and ofcourse didn't change the defaults until i exceeded the storage limit. i had to take backups and i had photos of more than around 80gb.

that pc now runs a ubuntu server. they say you always need stability, i guess i do too. i couldn't deal with arch. not as a distro for a home setup. i do hear catchy os folks are planning to release a server, but we will see. as much as i say, i love chaos, i also love stability. chaos makes you feel lively. entropy is the proof that you are living, but i am tired af.

the homelab server runs immich, syncthing, and a firefox docker container for now. immich because ofcourse how do you trust google photos with your memories? as of now, i do pay them for the storage, but i don't trust them.

syncthing instance is a little redundant for now, i have one already running on my vps that is on azure, but i plan to... no. some other post for this...

selfhosting jellyfin, ram prices & more

Sat, 25 Apr 2026 00:00:00 GMT

i recently finished watching lord of the rings trilogy. it's been on my watchlist for a long time. i have watched and read about tolkien's works, his life and his world. there was a tolkien biography movie that came out long ago. i watched it and that's what got me into. i also know of tolkien because i know he's childhood friend of c.s. lewis. i don't know how i know that. i don't remember reading any works of c.s lewis either, but somehow i know that.

i wish more people i know get on letterboxd. i have been using it for more than a while now. it's a great platform to keep track of movies you have watched or just add it to watchlist for later. in case, you haven't followed my letterboxd, you can find me here: letterboxd.com/dharmiik.

my home topology is something right now. it used to be far more complex until i looked into my ISP's default firmware and realized that it ain't that bad. it's amazing, it ain't that bad will be me phrasing it like it's stupid.

there are a lot of cool features it provides. i can configure static routes (it's basic or maybe ofcourse my lack of experience with propetiary firmware. it frigging let's me configure QoS policies. Who frigging thought that for a consumer router).

the topology used to be weird prior. i had two networks. the default isp one and then my openwrt one. i finally when setting up my homelab and setting up a lot of services (more on that later in the blog), thought finally, today might be the day and added a static route. primarily because, adguard runs on my tower running ubuntu server, and that is on the openwrt network, so the few devices that were on the isp one couldn't use it.

i still want to find a good time and try the QoS policy on OvH firmware.

sometime in the month i read jeff geerling's DRAM pricing is killing the hobbyist SBC market and it's so true. i really might have heard a dozen of friends of how they are waiting for the pricing to go down. everyone is wanting to upgrade.

i have been cleaning the machine that runs casa os and ubuntu server for me at home. oh boy, i haven't opened the cabinet of that device in years. well, not years. never ever since it's inception and holy moly that thing was dusty. photos for reference.

i have got new thermal paste to apply on the processor. it was all dried up. got a extra hdd for backups. my immich backups are increasing.

one of the incident that hit me was two days ago, when last weekend started, i put everything apart. removed the fan processor, ram, wiped everything (physically, wipe off the dust). and put things inside. pushing back the cpu on the motherboard required a little pressure. i was a little afraid that i was going to press a little harder. the dust was too much and i was not able to figure out where was the traingle i was supposed to align with on the motherboard.

then when i got things together and booted it up, the problem is i didn't have monitor. so i had to ssh into my router and see the dhcp.leases file. now it did boot, fan started, but no lights getting started on the motherboard when i plug in the lan cable. now i am under the impression, "voila, we have fried the motherboard or maybe broke it or something". then i gave up thinking the game's over and i will have to order a new computer.

next day i woke up with new born motivation. picked up my screw driver and opened everything again. well, looking at the ram i saw, i haven't closed the hinge properly. well, closed it. plugged the power and lan cable again and magic, it started again. ssh'ed to my router and there it was. working fine like a good wine.

now we are hitting the basics. can a computer boot without ram? well, the answer is evident, it can't. it's basic. how can one think otherwise? well, i was supposed to know this.

a os upon starting stores instructions, initialize firmware (BIOS/UEFI) and things.

i love immich. i have been using it for around more than a year. the setup has changed a lot. priorly, i was used to sync it in my network. now i do it every once in a while from odd places when i have not get anything else to do using tailscale.

talking about my homelab. i also have a media server stack i have been tinkering with. it's a combination of qbittorent, radarr, prowlarr and jellyfin.

i use casaos (though i now think using zimaos, fork of casa would be more fun). now i initially thought to do it via casa itself, to setup all the services... but i ditched it (i found it more complex. the way casaos handles docker containers) and did it manually.

i can now search for a movie in radarr and it gets downloaded to my jellyfin library via the prowlarr indexing. though i am still looking for good bollywood torrents (drop me a message if you have something).

i do have a lot of posts i have to post (yes, deliberate use of post as a noun and verb in a single sentence).

it's been a long time i have posted on anything on this blog and i have got a lot of opinions about a lot of things. newer opinions. starting from my new born hatred for the cosmic desktop environment and how system76 has ruined it, new born love for wireguard, oh boy i have loved tailscale. i have been dipping my hands in yocto. i will write about it once i have something good going in it. right now a lot i don't understand there. i got introduced to firewalla (it's a device. check their story) and i am a fan. one would say life's been a lot of fun.

everyonce in a while i have the urge to upgrade my homelab setup. for right now it's mostly powered by a old computer i built (got built, i was idk 16. must be 2020?. i don't recall). i don't have problem with keeping it on all the time, except for ofcourse then i need to figure out power consumption. how much power it consumers. power is still relatively cheap in india. it's not a problem for us, but i need to see how much it adds up.

my setup's that. a tp link router that has openwrt flashed and a vps i use for tunnels, so i get a public ip.

i just setup jellyfin, radarr qbittorent, prowlarr. trust me i honestly don't put my time aside to watch a movie (not like i don't have time. i am in bed all weekend, it's not a conscious decision i make), in retrospect to the dedication i am putting in getting things up. as they say "heart wants what the heart wants", and it sure wants a few containers automating my movie watching work(leisure)flow this time.

i am plannning to cancel all my subscriptions. get a few friends onboard as well.

yup, this is what bugs me. "getting friends onboard". i thought tailscale would be easy. easy as well. it's not. ACL get's more confusing everytime you look at it.

i had to build a solution on top of wireguard for this. my use case is a bit different though. i started because i wanted to give friends access to specific things in my homelab, but very selectively. like “you can use jellyfin on this one machine, but you can’t ssh, and you can’t even see my other devices”

tailscale is honestly amazing for getting devices connected, i still use it a lot. but once i started trying to do these very specific “this machine can talk to that machine only on this port” kind of setups, it started feeling more complex than it should be, at least for personal use. ACL editor is more confusing when it comes to this. i know we have got option for tags and things, but those are very poorly documented and i haven't found a single tutorial that works nicely.

to which a controdictory opinion would be why not use netbird? well, for starters, i want complete control, and hosting netbird, the control plan consumes around 400mb ram. another things is that people who use my homelab (well, i want it to be this way) would be mostly non technical people. i don't want them to make their account on one more service. a simple curl command that'd fetch my script and install it. i am still buiding it. i haven't thought of a name, but i'd put it on my github. (rip my cgit instance).

my go service barely consumes any. it's nothing more than UI built on top of wireguard.

recently ubuntu 26.04 LTS came out and i am reading the mixed opinions it's having. i didn't know ubuntu in the linux community has the reputation of microsoft. apparently people hate on snaps and the "Buy pro ads" that canonical keeps pushing in their community builds is hurting people's sentiments.

well, from a generalist view, ubuntu definitely is something that has made a lot of people use linux. i am under the impression that if it weren't for ubuntu, the year of linux on desktop would be still decades away from now.

i have tried oreo golden. the biscuits along with the cream are vanilla flavoured and there are very less things i have eaten that top this.

found this very intersting middle earth map while i was browsing the web. i am a lotr fan. i am a new fan. i am yet to read the books. i am looking for a good time to read it.

watchcat timing fix openwrt

Wed, 24 Jun 2026 00:00:00 GMT

~~i recently got a small change merged in the openwrt package tree.~~

i even maintain that package in the openwrt tree. it's a fun task to do.

at first i thought it was a very small thing. basically a timer detail in watchcat.

but while working on it, and especially during review, i realised the behaviour was more interesting than i first thought.

the pr is here:

https://github.com/openwrt/packages/pull/29326

the basic idea

watchcat is an openwrt package that can keep checking if something is reachable by pinging one or more hosts.

if the pings keep failing for long enough, it can take some recovery action.

depending on the config, it can:

restart an interface
restart networking
run a script
reboot the device

the part i was looking at was mostly around these two modes:

restart_iface
run_script

in my head, watchdog behaviour was always simple:

thing goes down
watchdog notices it
wait for failure period
run recovery action
keep checking

simple enough.

but then i started thinking about one detail:

what happens to the failure timer after the recovery action runs?

the timing problem

say the config is something like this:

failure_period = 60 seconds
recovery action takes 15 seconds

then the timeline looks like this:

t=0    outage starts
t=60   recovery action starts
t=75   recovery action finishes

now the question is, what is the next baseline?

should the next recovery action happen around t=120?

t=0    outage starts
t=60   restart #1 starts
t=75   restart #1 finishes
t=120  restart #2

or should it happen around t=135, because the first restart finished at t=75, and only after that we start a fresh 60 second failure window?

t=0    outage starts
t=60   restart #1 starts
t=75   restart #1 finishes
t=135  restart #2 would be the earliest next retry

my first thought was the second one.

after the recovery action finishes, reset the timer and give the interface or script some room. otherwise it can keep doing recovery actions too close to each other.

for a normal interface, that feels noisy. it may not help anything, and it can make the logs harder to understand.

the part i almost missed

the review made this more interesting.

daniel f. dickinson, who maintains watchcat now, pointed out that the old behaviour is useful for some setups and should not just be changed.

that was the important bit.

imagine a wireguard or openvpn interface.

the upstream internet may come back, but the tunnel itself may still be stuck until it is kicked again. if watchcat is pinging through that tunnel, it does not really know that the underlying internet recovered.

it only knows one thing:

the monitored path is still failing

so in that case, continuing to retry during the outage can be useful. maybe even necessary.

so this was not really:

old behavior bad
new behavior good

it was more like:

there are two valid timing models

and that changed the patch.

what changed

instead of changing the default behaviour, the merged pr added an opt-in option:

option reset_failure_timer '1'

when this option is enabled, watchcat starts a fresh failure window after the recovery action finishes.

so the default behaviour stays the same. that keeps the old retry model useful for vpn/tunnel style setups.

and the new behaviour is there for setups where repeated recovery actions too close to each other are not useful.

the merged commit was:

945029322 watchcat: add optional failure timer reset

the pr also cleaned up some log wording, added timing notes in TIMINGS.md, bumped PKG_RELEASE, and added a small CI version test override.

what this looks like

default behaviour:

t=0    outage starts
t=60   restart #1 starts
t=75   restart #1 finishes
t=120  restart #2

with reset_failure_timer=1:

t=0    outage starts
t=60   restart #1 starts
t=75   restart #1 finishes
t=135  restart #2 would be the earliest next retry

it decides whether the time spent inside the recovery action counts toward the next failure window or not.

rainbow trails for neovim

Sat, 25 Jul 2026 00:00:00 GMT

i am a vim fan. i love the efficiency and doing everything without taking my hands off the keyboard. but i do not like things bland. i want colors. i admire colors.

and now it does, whenever it moves.

the plugin is here: rainbow-trails.nvim on github.

this is my native lua rewrite of rich cheng's original vim-rainbow-trails. the original was written in vimscript and already worked in neovim, but i wanted a version built around neovim's lua api. i also fixed the old window cleanup problem and made trails visible past the ends of short and empty lines.

installing it

with vim-plug:

call plug#begin()
Plug 'dhrm1k/rainbow-trails.nvim'
call plug#end()

lua require('rainbow_trails').setup({ enabled = true })

run :PlugInstall, restart neovim, and move around.

you can also enable or disable it manually:

:RainbowTrails
:RainbowTrails!

bcm53xx sysupgrade error

Sun, 23 Aug 2026 00:00:00 GMT

the stock asus firmware

i (not so) recently got my hands on asus rt-ac68u. it's a great router. loving it. firstly, i have to give a shoutout to whosoever is responsible for the firmware at asus. though it was on the default on the asus firmware for very tragic short time, before i flashed it with openwrt, the features it provided blew my mind. compared to my default isp gateway that just thinks debugging is just ping and traceroute commands, the default asus firmware gave a lot of commands. to be honest it looked straight out of alien movie. image for reference below.

it has a lot of features that i wouldn't expect in a home consumer router (mentioning only those that surprised me. it already has the most basic ones that you'd expect any router to have):

managing qos bandwidth
live traffic monitoring with graph
ftp sharing via usb plugged in the two ports it provides
option to configure 2.4ghz + 5ghz dual ssids (though of no use for me. more on that below)
frigging radius client config settings (why on earth, but yes)
good firewall features with keyword filter as well as url based
system log with ability to download the logs

flashing openwrt

i flashed it with openwrt the day i got it. how i got it is a different story in itself. now the problem with openwrt is that rt-ac68u has broadcom wifi drivers and they don't opensource them^[1], so no wifi support. though that is not an issue, cause i had a tp link router lying around that i now use as dumb AP. with openwrt too this is a beast and one hell of a firewall. i get 102mb of overlay space and trust me, that is not less than heaven for a router. there's so much that i do and have done on it. one of the first things i did after flashing was installing tailscale. make a new zone for it and allow everything on it (hoping one day i will even use it as a exit node as well). i run a custom dns config with smartdns and adblock-fast. my primary ISP router also forwards dns queries to this network. now this weekend, i had the idea to tweak firmware a little. make it a little rolling-release instead of getting stable release, add a little more security hardening than is already there. this router's board is bcm53xx/generic. now i had two options. either i could setup an entire build machine or download a image builder. considering it was the weekend i decided to go for the image builder path considering i wouldn't have to dedicate an hour or two in building the initial firmware image only. i downloaded the image builder and found the target.

make info | grep -i -A 10 'RT-AC68U'

lost my configuration

now i built it and then got the .trx file. i was shocked to see this. i am usually familiar with the sysupgrade images and was expecting that, but it turns out the broadcom drivers expect this. i took a obligatory backup of my router and then moved it to my homelab that is under the asus network and not the isp network and flashed the new image. well, i used the command sysupgrade -T to test the image and later sysupgrade -v to flash it. now what sysupgrade does is, it retains config on upgrade via sysupgrade, but for me, this time it didn't. it completely removed all config. now i had to again give my laptop a static ip, configure the network and restore from the backup and figure out why this happened. now the problem with this was that i had no idea. i had to first figure out and learn about how sysupgrade works.

while digging through this, i found out that i wasn't the first one to hit this (kinda sad well to see this). there was already a fix upstream for bcm53xx nand devices losing config during sysupgrade. the problem was just that the fix hadn't made it into the latest image i was using yet.

the fix^[2] itself was hilariously small.

- local root_type=$(identify $dir/root)
+ local root_type=$(identify "$dir/root" "cat")

identify had changed earlier to expect the extraction command as another argument. the bcm53xx upgrade code was still calling it the old way. because of that, it failed to identify the extracted root filesystem as ubi and fell back to writing the whole trx image directly to the firmware partition.

and that fallback was the important part. the normal nand upgrade path knows how to carry /tmp/sysupgrade.tgz into the new ubi/rootfs_data setup. the fallback path didn't. so the router booted perfectly fine after the upgrade, except it came up like i had passed -n to sysupgrade and nuked the config myself.

what should have happened

the path should have been pretty simple. sysupgrade first creates /tmp/sysupgrade.tgz containing the configuration files that need to be preserved. it then switches into the ram-based upgrade environment and starts flashing the new firmware. since this router uses nand with ubi^[3], the upgrade process is also responsible for carrying that backup into the new writable filesystem before the router reboots. once the new firmware comes up, the old configuration should already be there on the new overlay and the router should come back almost exactly the way it was before the upgrade.

since this router uses nand with a ubi image, the upgrade process is also responsible for carrying that backup into the new writable filesystem before the router reboots.

what actually happened

the actual path started the same way. sysupgrade created /tmp/sysupgrade.tgz and switched into the ram-based upgrade environment. the bcm53xx upgrade code then extracted the kernel and root filesystem from the trx image. after that, it called identify to check whether the extracted root filesystem was a ubi image.

this is where things went wrong. because the extraction command was not passed to identify, it couldn't read the file and returned an empty result. the upgrade code took that to mean that the image was not using ubi and returned to the generic upgrade path. that path then wrote the complete trx image directly to the firmware partition.

the generic path did still pass the configuration backup to mtd, which works for the non-ubi images that this fallback is actually meant for. but mine was a ubi image that had been identified incorrectly. mtd could write the trx image, but it couldn't put /tmp/sysupgrade.tgz inside the new rootfs_data ubi volume. the router therefore booted the new firmware with the default configuration while my backup was left behind in the old upgrade environment and disappeared when the router rebooted.

another problem hiding in the same upgrade path

while trying to understand why the configuration disappeared, i kept reading through the rest of the bcm53xx upgrade code and found another problem in the same fallback path. the nand-aware helpers used return not only when an image was intentionally supposed to use the old whole-image upgrade path, but also when something had actually failed.

this meant that failures such as not being able to extract the trx partitions, the new kernel being too large for its partition, failing to prepare the kernel trx or failing to prepare the ubi image didn't necessarily stop the upgrade. the helper returned to its caller, and the caller continued by writing the complete image directly to nand anyway. in the kernel size case, this practically meant that the code could tell you that the kernel didn't fit and then continue flashing the image through a path that bypassed the same check.

the earlier identify fix solved the bug that had removed my configuration, but these other returns were still there. so i opened openwrt/openwrt#24841 to change the genuine preparation errors from return to exit 1. now, if one of those steps fails, the upgrade stops instead of falling through to the whole-image writer.

the patch still keeps the intentional return for actual non-ubi images. those images are supposed to use the older default_do_upgrade() path, where configuration can still be preserved using mtd -j. so the change is not about removing the fallback completely. it is about making sure that only images meant for that fallback can reach it, while real errors stop the upgrade.

let's see if our changes get merged. it was a fun day of debugging and learning how the upgrade process works. i have named my gateway without a doubt with the lack of ideas and a name hiding in plain-sight:

for now we have fixed a few bugs. my image builder now has all the packages i want by default, has all the config of the packages i use by default. has the patch we wanted and we made, so future sysupgrades are smooth. there's more i want to do. maybe changing privilege daemon's have or i don't know. keeping it out for a while. the above was one hell of a experience.

broadcom's driver used by the stock firmware is proprietary. linux has the open source b43 driver, which was largely developed by reverse engineering broadcom hardware, but its support for the bcm4360 ac phy used by the rt-ac68u is marked as broken and is not enabled by openwrt. because of that, neither of the router's built-in wifi radios is usable with openwrt. proper support could still be developed if broadcom ever released the required hardware documentation, programming guides or an open source driver. ↩︎
identify is a shell function from openwrt's nand upgrade library. it reads the first few bytes of an image and compares their magic number to known formats such as ubi, ubifs, fit and gzip. its first argument is the image to inspect and its second argument tells it how to read that image. for a normal uncompressed file, that command is cat. without the second argument, the function couldn't read the extracted root filesystem and returned an empty result instead of ubi. ↩︎
ubi stands for unsorted block images. it is a layer designed for raw nand flash that handles things such as bad blocks, wear levelling and dividing the flash into volumes. on this router, those volumes hold the read-only root filesystem and the writable rootfs_data used for configuration and other changes. ubi itself is not a filesystem. filesystems such as ubifs can be placed inside its volumes. ↩︎