English on Hyteck

Setting up an access point with OpenWRT

2026-04-12T06:10:10+02:00

My parents complained about the WiFi in their house. They had a router in the basement, an access point in the first floor and a mesh-repeater in the ground floor. However, the WiFi performance in the ground floor was abysmal. So they asked me to do something.

Devices

I had two old devices around, a FritzBox 4040 and a TP-Link TL-WR1043ND v2. The latter was already set up with OpenWRT. The Fritzbox however was bricked by past me. After reading the Debricking Guide I nearly lost hope, but then I found AVM provides a recovery tool (Windows only). Without any sarcasm: Fritzboxes are a pleasure to work with.

So after finding a usable windows laptop I first flashed the stock firmware and then used fritz-tools to flash OpenWRT. Fritz-Tools works, even if the page only mentions Gluon.

Planning

My parents for some reason decided to rent a router from the ISP. While this is obviously not ideal I decided to just work with it. So WAN connectivity and DHCP will be handled by the ISP’s router in the basement. I’ll only add two dumb access points, connected to the ISP’s router by LAN.

Configuring internet access

I mostly followed OneMarkFifty’s great video on how to do this. The OpenWRT docs article is not tht easy to follow and assumes using a static IP for the access points. However, I wanted the AP’s to get their IP via DHCP.

The first step is to connect the AP the local LAN and your computer. Make sure that both cables are connected to LAN, do not use the WAN jack. You can then access the AP’s configuration page at 192.168.1.1 Got to Network -> Interfaces and remove all interfaces except LAN, you don’t need them.

For LAN you set the following settings

Also set

DHCP Server -> General Setup -> Ignore Interface to True: This stops the AP from assigning IP addresses for IPv4
DHCP Server -> IPv6 Settings -> RA Service to Disabled
DHCP Server -> IPv6 Settings -> DHCPv6-Service to Disabled

In combination this now tells the AP to get a IP Address from DHCP and completely deactivates assigning IP addresses to clients. Instead, clients will get an IP from the main router.

Important When applying this setting, your connection to the IP will be lost as it gets a new IP. You then have 90 seconds to visit the configuration page again, otherwise the configuration will be reset. This is an important security feature, so don’t turn this off! The best way to re-access the AP is to look up the newly assigned IP in the main router and then input that in the browser.

You should now be able to browse the internet via this AP alone.

Configuring WiFi

Go to Network -> Wireless and click on “Edit” for the station you want to set up. Put in the ESSID (WiFi name), the Network (lan) and set Wireless Security. If you have multiple APs, go to WLAN roaming and set 802.11r Fast Transition to True and add a Mobility Domain.

Then apply the settings. It can take up to a minute for the Access point to be enabled on slower hardware.

Setting up additional APs

You should be able to do the same procedure for every AP you want to add. Use the same ESSID, Wireless Security and mobility domain for each AP.

Conclusion

My parents can now finally watch TV in their kitchen, powered by two previous unused devices. I’m really impressed how well it works once set up. I appreciate a lot that OpenWRT enables me to connect two devices of different manufacturers without issues. If you give it a try, let me know how it goes!

How to manually check hundreds of animal shelters - every 14 days

2025-11-08T12:05:10+02:00

I run a website called Notfellchen that list animals that are waiting for adoption. It’s currently restricted to fancy rats in Germany and that for good reason: Running this website involves checking every shelter every two weeks manually. You need to visit the website, check if there are new animals, contact the shelter and add them to notfellchen if they allow it. This takes time. A lot.

This blog post will outline some of the things I did in order to streamline this and make it possible to check every german shelter in 2.5 hours.

General process

When you establish a process. want others to help you or if you want to find inefficiencies, it’s a good idea to formalize it. So here is a rough BPMN diagram of the whole process.

Rescue save process

List of animal shelters

Focusing on the first step: We want to check the website of an animal shelter - but where do we get a list of animal shelters from? Luckily there is an easy answer: OpenStreetMap and I wrote a whole other blog post on how I imported and improved this data.

Species-specific link

Importing this data provides us (most of the time) with a link to the shelter’s website. However, rats are usually not listed on the home page but on a subsite. In order to save time, I introduced the concept of a species-specific link per organization and species.

So for the Tierheim Entenhausen this might look like this

Species	Species specific link
Cat	https://tierheim-entenhausen.de/adoption/cats
Rats	https://tierheim-entenhausen.de/adoption/small-mammals

As animal shelter pages look very different from each other, clicking this link provides an enormous time benefit compared to clicking through a homepage manually.

Org check page

I set up a special page to make it most efficient to check shelters. It’s structured in four parts:

Stats: The stats show how many animal shelters are checked in the last two weeks and how many to go.
Not checked for the longest period: Shows the animal shelters to check next, it’s therefore sorted by the date they were last checked
In active communication: A overview of the organizations where there is communication (or an attempt thereof). This can take multiple das or even weeks so the internal comment field is very useful to keep track.
Last checked It sometimes happens that I accidentally set a organization to “Checked” by accident. I added this section to make it easier to revert that.

Shortcuts

To make it even faster to work through the organizations I added some shortcuts for the most common functionality and documented the browser own shortcut to close a tab.

O: Open website of the first organization
CTRL+W: Close tab (Firefox, Chrome)
C: Mark first organization as checked

Results

After implementing all this, how long does it take now to check all organizations? Here are the numbers

Measurement
Time to check one organization (avg.)	12.1s
Organization checked per minute	4.96 org/min
Time to check all (eligible) german animal shelters (429)	1 h 16 min

This excludes the time, it takes to add animals or contact rescue organizations. One of these actions must be taken whenever an eligible animal is found on a website. Here you can see how this interrupts the process:

And here is the breakdown of time per activity. A big caveat here is, that I did not follow up on previous conversations here, therefore the contacting number is likely an underestimation.

Activity	Time spent	Percentage
Checking	54 min 44s	72.3%
Adding	11 min 15s	14.9%
Contacting	9min 41s	12.8%

To me, this looks like a pretty good result. I can’t say which optimizations brought how much improvement, but I’d argue they all play a role in reaching the 12s per rescue organizations that is checked.

In order to check all german animal shelters, one needs to put in about 2 and a half hours every two weeks. That seems reasonable to me. Further improvements of the likely do not lie in the organization check page but the contact process and adoption notice form.

For now, I’m happy with the results.

Addendum: Common annoyances

When doing this over the last few months I encountered some recurring issues that not only were annoying but also take up a majority of the time. Here are some that stood out

Broken SSL encryption So many animal shelters do not have a functioning SSL certificate. It takes time to work around the warnings.
No results not indicated More often than not, animal shelters do not have rats. However, when you visit a page like this it’s hard to know if there is a technical issue or if there are no animals for your search.
No static links Sites where you have to click through a menu to get to the right page, but you can not link directly to it.
No website Seriously, there are some animal shelters that only use Instagram or Facebook to tell people about the animals they have. This is not only a privacy nightmare, it’s also incredibly hard to find out which information is up-to-date. Furthermore, there exists no data structure, so posts about animals often miss crucial information like the sex.

While I obviously have some grievances here, I know the organizations never have enough resources, and they’d usually love to have a nicer website. Just keep that in mind too.

Postmortem - how to completely screw up an update

2025-10-19T12:05:10+02:00

The fediverse instance gay-pirate-assassins.de was down for a couple of days. This postmortem will outline what went wrong and what I did to prevent things from going that wrong in the future.

Timeline

2025-10-05 17:26: Update announcement
2025-10-05 ~17:45: Update started
2025-10-05 ~18:00: Services restart
2025-10-05 ~18:00: GoToSocial doesn’t come up
2025-10-12 ~10:00: Issue is found
2025-10-12 10:30: Issue is fixed
2025-10-12 10:31: GoToSocial is started, migrations start
2025-10-12 15:38: Migrations finished successfully
2025-10-12 15:38: Service available again
2025-10-12 18:36:Announcement sent

All times are given in CEST.

The beginning: An update goes wrong

I run a small fediverse server with a few users called. gay-pirate-assassins which is powered by GoToSocial. The (amazing) GoToSocial devs released v0.20.0-rc1 and v0.20.0-rc2. As the new features seemed pretty cool, I’m inpatient and the second release candidate seemed stable, I decided to update to v0.20.0-rc2. So I stared a backup (via borgmatic), waited for it to finish and confirmed it ran successfully. Then I changed the version number in the mash-ansible playbook I use. Then I pulled the newest version of the playbook and it’s roles because I wanted to update all services that run on the server. I checked the Changelog, didn’t see anything and then started the update. It went through and GoToSocial started up just fine.

But the instance start page showed me 0 users, 0 posts and 0 federated instances. Something has gone horribly wrong!

Migrations

It was pretty clear to me, that the migrations went wrong. The GoToSocial Migration notes specifically mentioned long-running migrations that could take several hours. I assumed that somehow, during the running database migration, the service must have restarted and left the DB in a broken state. This issue happened to me before.

Well, that’s what backups are for, so let’s pull it.

Backups

Backups for this server are done two ways:

via postgres-backup: Backups of the database are written to disk
via borgmatic: Backups via borg are written to backup nodes, one of them at my home

They run every night automatically, monitored by Healthchecks. I triggered a manual run before the update so that is the one I mounted using Vorta.

And then the realization.


mash-postgres:5432 $ ls -lh
total 2.1M
-r-------- 1 moanos root 418K Oct 05 04:03 gitea
-r-------- 1 moanos root 123K Oct 05 04:03 healthchecks
-r-------- 1 moanos root 217K Oct 05 04:03 ilmo
-r-------- 1 moanos root 370K Oct 05 04:03 notfellchen
-r-------- 1 moanos root 67K Oct 05 04:03 oxitraffic
-r-------- 1 moanos root 931 Oct 05 04:03 prometheus_postgres_exporter
-r-------- 1 moanos root 142K Oct 05 04:03 semaphore
-r-------- 1 moanos root 110K Oct 05 04:03 vaultwarden
-r-------- 1 moanos root 669K Oct 05 04:03 woodpecker_ci_server

Fuck. The database gay-pirate-assassins is not there. Why?

To explain that I have to tell you how it should work: Services deployed by the mash-playbook are automatically wired to the database and reverse proxy by a complex set of Ansible variables. This is great, because adding a service can therefore be as easy as adding

healthchecks_enabled: true
healthchecks_hostname: health.hyteck.de

to the vars.yml file.

This will then configure the postgres database automatically, based on the group_vars. They look like this

mash_playbook_postgres_managed_databases_auto_itemized:
- |-
{{
({
'name': healthchecks_database_name,
'username': healthchecks_database_username,
'password': healthchecks_database_password,
} if healthchecks_enabled and healthchecks_database_hostname == postgres_connection_hostname and healthchecks_database_type == 'postgres' else omit)
}}

Note that a healthchecks database is only added to the managed databases if healthchecks_enabled is True.

This is really useful for backups because the borgmatic configuration also pulls the list mash_playbook_postgres_managed_databases_auto_itemized. Therefore, you do not need to specify which databases to back up, it just backs up all managed databases.

However, the database for gay-pirate assassins was not managed. In the playbook it’s only possible to configure a service once. You can not manage multiple GoToSocial instances in the same vars.yml. In the past, I had two instances of GoToSocial running on the server. I therefore followed the how-to of “Running multiple instances of the same service on the same host”.

Basically this means that an additional vars.yml must be created that is treated as a completely different server. Databases must be created manually as they are not managed.

With that knowledge you can understand that when I say that the database for gay-pirate-assassins was not managed, this means it was not included in the list of databases to be backed up. The backup service thought it ran successfully, because it backed up everything it knew of.

So this left me with a three-month-old backup. Unacceptable.

Investigating

So the existing database needed to be rescued. I SSHed into the server and checked the database. It looked completely normal. I asked the devs if they could me provide me with the migrations as they already did in the past. However, they pointed out that the migrations are too difficult for that approach. They suggested to delete the oldest migration to force a re-run of the migrations.

Here is where I was confused, because this was the bun_migrations table:

gay-pirate-assassins=# SELECT * FROM bun_migrations ORDER BY id DESC LIMIT 5;
id | name | group_id | migrated_at
-----+----------------+----------+-------------------------------
193 | 20250324173534 | 20 | 2025-04-23 20:00:33.955776+00
192 | 20250321131230 | 20 | 2025-04-23 19:58:06.873134+00
191 | 20250318093828 | 20 | 2025-04-23 19:57:50.540568+00
190 | 20250314120945 | 20 | 2025-04-23 19:57:30.677481+00

The last migration ran in April, when I updated to v0.19.1. Strange.

At this point I went on vacation and paused investigations, not only because the vacation was great, but also because I bamboozeld by this state.

After my vacation I came back, and did some backups of the database.

$ docker run -e PGPASSWORD="XXXX" -it --rm --network mash-postgres postgres pg_dump -U gay-pirate-assassins -h mash-postgres gay-pirate-assassins > manual-backup/gay-pirate-assassins-2025-10-13.sql

Then I deleted the last migration, as I was advised

DELETE FROM bun_migration WHERE id=193;

and restarted the server. While watching the server come up it hit me in the face:

Oct 12 08:31:29 s3 mash-gpa-gotosocial[2251925]: timestamp="12/10/2025 08:31:29.905" func=bundb.sqliteConn level=INFO msg="connected to SQLITE database with address file:/opt/gotosocial/sqlite.db?_pragma=busy_timeout%281800000%29&_pragma=journal_mode%>
Oct 12 13:38:46 s3 mash-gpa-gotosocial[2304549]: timestamp="12/10/2025 13:38:46.588" func=router.(*Router).Start.func1 level=INFO msg="listening on 0.0.0.0:8080"

The server is starting from a completely different database! That explains why

the last migration was never done
the server showed me 0 users, 0 posts and 0 federated instances even though the postgres database had plenty of those

All of a sudden a SQlite database was configured. This happened because of this commit which introduced SQlite support and set it as default. This was not mentioned in the Changelog.

So what happened is, that the config changed and then the server was restarted and an empty DB was initialized. The postgres DB never started to migrate.

Fixing

To fix it, I did the following

Configure the playbook to use postgres for GoToSocial:

# vars.yml
gotosocial_database_type: postgres

Run the playbook to configure GoToSocial (but not starting the service)

just run-tags install-gotosocial

Check the configuration is correct
Start the service

The migrations took several hours but after that, everything looked stable again. I don’t think there are any lasting consequences. However, the server was unavailable for several days.

Learnings

I believe the main issue here was not the change in the config that went unnoticed by me. While I’d ideally notice stuff like this, the server is a hobby, and I’ll continue to not check every config option that changed.

The larger issue was the backup. Having a backup would have made this easy to solve. And there are other, less lucky problems where I’d be completely lost without a backup. So to make sure this doesn’t happen again, I did/will do the following:

1. Mainstream the config

As explained, I used a specific non-mainstream setup in the ansible playbook because, in the past, I ran two instances of GoToSocial on the server. After shutting down one of them, I never moved gay-pirate-assassins to be part of the main config. This means important parts of the configuration had to be done manually, which I botched.

So in the past week I cleaned up and gay-pirate-assassins is now part of the main vars.yml and will benefit from all relevant automations.

2. Checking backups

I was confident in my backups because

they run every night very consistently. If they fail e.g. because of a network outage I reliably get a warning.
I verified successfully run of the backup job prior to upgrading

The main problem was me assuming that a successful run of the backup command, meant a successful backup. Everyone will tell you that a backup that is not tested is not to be trusted. And they are right. However, doing frequent test-restores exceeds my time and server capacity. So what I’ll do instead is the following:

mount the backup before an upgrade
tail the backup file as created by postgres-backup and ensure the data is from the same day
check media folders for the last changed image

This is not a 100% guarantee, but I’d argue it’s a pretty good compromise for now. As the frequency of mounting backups increases and therefore becomes faster, I’ll re-evaluate to do a test-restore at least semi-regulary.

Conclusion

I fucked up, but I was lucky that my error was recoverable and no data was lost. Next time this will hopefully be not due to luck, but better planning!

Any questions? Let me know!

Trying Twenty: How does an Open Source CRM work?

2025-08-03T06:10:10+02:00

I spend my day working with Salesforce, a very, very feature-rich CRM that you pay big money to use. Salesforce is the opposite of OpenSource and the many features are expensive. Salesforce business model is based on this and on the lock-in effect. If your company invested in implementing Salesforce, they’ll likely pay a lot to keep it.

So what does an alternative look like? Let’s have a look at Twenty, an OpenSource CRM that recently reached the magic 1.0 version.

Getting started

There are two options of getting started: Register at app.twenty.com and start right away on the devs instance or self-host Twenty on your own server. I did the ladder, so let’s discuss how that. The basic steps I took were

point twenty.hyteck.de to a server
Install traefik on the server (I cheated, traefik was already installed)
Deploy this docker-compose.yml with this env file

Then visit the domain and set up the first user.

Features

Twenty offers an initial datamodel that you should be familiar from other CRMs. the standards objects are

Persons A individual person. You can attach notes, E-Mails, etc..
Companies The same for organizations. Organization websites must be unique
Opportunities The classic opportunity with customizable stages
Notes They can be attached to any of the objects above
Tasks Items to work on
Workflows Automations similar to Salesforce flows. E.g. you can create a task every time an Opportunity is created.

The basic datamodel can be extended in the GUI. Here is how my “Company” model looks like

You can add any of the following fields to an object.

Workflows

Workflows are Twenty’s way of allowing users to build automations. You can start a Workflow when a Record is created, updated or deleted. In addition, they can be started manually, on a schedule and via Webhook (yeah!).

You can then add nodes that trigger actions. Available right now are

Creating, updating or deleting a record
Searching records
Sending E-Mails This is the only option to trigger e-mails so far
Code Serverless Javascript functions
Form The form will pop up on the user’s screen when the workflow is launched from a manual trigger. For other types of triggers, it will be displayed in the Workflow run record page.
HTTP request Although possible via Code, this is a handy shortcut to trigger HTTP requests

What is currently completely missing are Foreach-loops and conditions. I can not say “If Opportunity stage is updated to X do Y else, do Z”. Without this, Workflows are really limited in their power.

What already seems quite mature though is the code option. It allows to put in arbitrary code and output a result.

I did not try a lot, but I assume most basic Javascript works. I successfully built an http request that send data to a server.

If what you’re doing is straightforward enough to not use loops and conditions or if you are okay with doing all of them in the Code node, you can do basically anything.

API

Twenty offers an extensive API that allows you to basically do everything. It’s well documented and easy to use.

Here is an example of me, syncing Rescue Organizations from notfellchen.org to Twenty.

import requests

from fellchensammlung.models import RescueOrganization


def sync_rescue_org_to_twenty(rescue_org: RescueOrganization, base_url, token: str):
 if rescue_org.twenty_id:
 update = True
 else:
 update = False

 payload = {
 "eMails": {
 "primaryEmail": rescue_org.email,
 "additionalEmails": None
 },
 "domainName": {
 "primaryLinkLabel": rescue_org.website,
 "primaryLinkUrl": rescue_org.website,
 "additionalLinks": []
 },
 "name": rescue_org.name,
 }

 if rescue_org.location:
 payload["address"] = {
 "addressStreet1": f"{rescue_org.location.street} {rescue_org.location.housenumber}",
 "addressCity": rescue_org.location.city,
 "addressPostcode": rescue_org.location.postcode,
 "addressCountry": rescue_org.location.countrycode,
 "addressLat": rescue_org.location.latitude,
 "addressLng": rescue_org.location.longitude,
 }
 headers = {
 "Content-Type": "application/json",
 "Authorization": f"Bearer {token}"
 }

 if update:
 url = f"{base_url}/rest/companies/{rescue_org.twenty_id}"
 response = requests.patch(url, json=payload, headers=headers)
 assert response.status_code == 200
 else:
 url = f"{base_url}/rest/companies"
 response = requests.post(url, json=payload, headers=headers)
 assert response.status_code == 201
 rescue_org.twenty_id = response.json()["data"]["createCompany"]["id"]
 rescue_org.save()

The Company, Business Model and Paid Features

The company behind Twenty is called “Twenty.com PBC” and mostly seems to consist of former AirBnB employees in Paris. The company is probably backed by Venture Capital. The current business model is to charge for using the company’s instance of Twenty. It starts at 9$/user/month without enterprise features. SSO and support will cost you 19$/user/month.

Selfhosting is free but SSO is locked behind an enterprise badge with seemingly no way to pay for activating it. I suspect that in the future more features will become “Enterprise only” even when self-hosting. All contributors must agree to a Contributor License Agreement (CLA), therefore I believe they could change the License in the future, including switching away from Open Source.

AI Usage

The repo contains a .cursor directory and CLAUDE.md so I assume the devs make (heavy?) use of LLM generated code. The ethical and legal problems with this are for you to decide. I don’t know what effect this has on code quality, for now I’d say things are sometimes buggy (failed upgrades) and UX could be better tested (looking at the e-mail integration) - if this is due to AI slop I don’t know.

Conclusion

Twenty is a really promising start of building a good CRM. The ease of customizing the datamodel, using the API and a solid beginning to Flows allows users to get a lot of value from it already. Flows need some more work to become as powerful as they should be and the E-Mail integration needs to get better.

Stating the obvious: This is not something that could ever replace Salesforce. However, there are many organizations that would benefit a lot from a CRM like Twenty, they simply don’t need, can’t handle or don’t want to pay for all the features other CRMs like Salesforce offer.

If Twenty continues to focus on small to medium companies and the right mix of standard features vs. custom development options I see a path where it becomes a solid choice for these companies. On the other hand there are the usual problems of VC-backed OSS development, and we shall see how it goes for them. Unless there is a strong userbase that credibly threatens a hard fork, enshittification could start soon.

Addendum: Important Features

Here is a short list of features I missed and their place on the roadmap if they have one

Compose & Send E-Mails Planned Q4 2025
Foreach loops in Workflows Q3 2025
Conditions in Flows Q4 2025

Thoughts on HTML mails

2025-07-12T12:05:10+02:00

Lately I worked on notification e-mails for notfellchen.org. Initially I just sent text notifications without links to the site. Terrible idea! An E-Mail notification I send always has Call-to-Action or at minimum a link to more information.

I left the system like this for half a year because it kinda worked for me (didn’t suck enough for me to care), and I was the main receiver of these notifications. However, as the platform is developed further and more users join I need to think about more user-centric notifications.

So what do I imagine is important to a user? *

Information benefit: An e-mail has the purpose to inform a user. This information should be immediately visible & understandable.
Actionables: Users should be able to act on the information received. This is the bright red button “DO SOMETHING NOW!” you see so often.
Unsubscribing: Informing e-mails stop is not only a legal requirement and morally the right thing to do but it also gives users agency and - I hope - increases the User Experience

With these I naturally came to the next question: Plaintext or HTML?

Some people would say Plaintext is inherently better than HTML e-mails. Many of these reasons resonate with me including:

Privacy invasion and tracking
HTML emails are less accessible
Some clients can’t display HTML emails at all
Mail client vulnerabilities

These are all valid points and are a reason I generally enjoy plaintext e-mails when I receive them. But this is not about me but users. And there are some real benefits of HTML e-mails:

Visually appealing: This is subjective but generally most users seem to agree on that
User guidance: Rich text provides a real benefit when searching for the relevant information

Be honest: Do you read automated e-mails you receive completely? Or do you just skim for important information?

And here HTML-mails shine: Information can easily be highlighted and big button can lead the user to do the right action. Some might argue that you can also a highlight a link in plaintext but that nearly always will worsen accessibility for screen-reader user.

The result

In the end, I decided that providing plaintext-only e-mails was not enough. I set up html mails, mostly using djangos send_mail function where I can pass the html message and attattching it correctly is done for me.

For anyone that is interested, here is how most my notifications are sent

def send_notification_email(notification_pk):
 notification = Notification.objects.get(pk=notification_pk)

 subject = f"{notification.title}"
 context = {"notification": notification, }
 if notification.notification_type == NotificationTypeChoices.NEW_REPORT_COMMENT or notification.notification_type == NotificationTypeChoices.NEW_REPORT_AN:
 html_message = render_to_string('fellchensammlung/mail/notifications/report.html', context)
 plain_message = render_to_string('fellchensammlung/mail/notifications/report.txt', context)
 [...]
 elif notification.notification_type == NotificationTypeChoices.NEW_COMMENT:
 html_message = render_to_string('fellchensammlung/mail/notifications/new-comment.html', context)
 plain_message = render_to_string('fellchensammlung/mail/notifications/new-comment.txt', context)
 else:
 raise NotImplementedError("Unknown notification type")

 if "plain_message" not in locals():
 plain_message = strip_tags(html_message)
 mail.send_mail(subject, plain_message, settings.DEFAULT_FROM_EMAIL,
 [notification.user_to_notify.email],
 html_message=html_message)

Yes this could be made more efficient - for now it works. I made the notification framework too complicated initially, so I’m still tyring out what works and what doesn’t.

Here is the html template

{% extends "fellchensammlung/mail/base.html" %}
{% load i18n %}
{% block title %}
 {% translate 'Neuer User' %}
{% endblock %}

{% block content %}
 <p>Moin,</p>
 <p>
 es wurde ein neuer Useraccount erstellt.

 </p>
 <p>
 Details findest du hier
 </p>
 <p>
 <a href="{{ notification.user_related.get_full_url }}" class="cta-button">{% translate 'User anzeigen' %}</a>
 </p>
{% endblock %}

and here the plaintext

{% extends "fellchensammlung/mail/base.txt" %}
{% load i18n %}
{% block content %}{% blocktranslate %}Moin,
es wurde ein neuer Useraccount erstellt.
User anzeigen: {{ new_user_url }}
{% endblocktranslate %}{% endblock %}

Works pretty well for now. People that prefer plaintext will get these and most users will have skimmable html e-mail where the styling will help them recognize where it’s from and what to do. Accessibility-wise this seems like the best option.

And while adding a new notification will force me to create

a new notification type,
two new e-mail templates and
a proper rendering on the website

this seems okay. Notifications are useful, but I don’t want to shove them everywhere. I’m not running facebook or linkedin after all.

So for now I’m pretty happy with the new shiny e-mails and will roll out the changes soon (if I don’t find any more wired bugs).

PS: I wrote this post after reading blog & website in the age of containerized socials by ava. Maybe this “Thoughts on” format will stay and I will post these in addition to more structured deep dives.

Update

I did a rework of the notification function and it’s now much cleaner now. However, it’s less readable so this blogpost will stay as-is. If you want to check out the new code have a look on Codeberg.

Improve OpenStreetMap data by using it

2025-06-28T14:05:10+02:00

Introduction

In the last month I improved the mapping of about 100 german animal shelters - not only out of the goodness of my heart, but because it helped me.

Let me explain why: I develop notfellchen.org, where users can search animals in animal shelters, specifically rats, they might want to adopt. The idea is to have a central website that allows you to search for rats in your area.

This is necessary because only a small percentage of animal shelters has rats. As a user, just checking your next shelter doesn’t work. Some users will stop after checking the second or third one and just buy from a pet shop (which is a very, very bad idea).

Now a central platform for is nice for users but has one problem: How do I, as operator of notfellchen, know where rats are?

I need to manually check every animal shelter in the country and if they have rats, ask them for permission to use images of the rats on my site. So wait I need to have is a list of animal shelters in germany and have their website, e-mail and phone number.

The source for all of this: You guessed it - OpenStreetMap 🥳

Getting the data

Downloading all german animal shelters is surprisingly easy: You use Overpass Turbo and get a .geojson to download.

here is the query I used:

[out:json][timeout:25];
// fetch area “Germany” to search in
{{geocodeArea:Germany}}->.searchArea;
// Check search area for all objects with animal shelter tag
nwr["amenity"="animal_shelter"](area.searchArea);
// print results
out geom;

Now upload it to notfellchen.org and I’ll be fine right?

Data Issues

Yeah well, this only mostly works. There were two main problems:

Missing contact data is annoying because I quickly want to check the website of animal shelters.

More annoying were what I’d call mapping errors. Most commonly an animal shelter had multiple nodes/ways tagged as amenity:animal_shelter. The highlight was the “Tierheim München” where about 10 buildings were tagged as amenity:animal_shelter and the contact data was sitting on the building with name “Katzenhaus” (“cat house”).

Now the “Tierheim München” appeared in my list 10 times but 9 of them had no contact data at all.

Correcting it

I could have corrected this only in the notfellchen database. It would have been faster and I could even automate parts of it. But I didn’t.

For each issue I found, I opened OpenStreetMap and added websites, phone numbers or even re-mapped the area. For “Tierheim München” I even opened a thread in the forum to discuss a proper tagging.

That makes sense for me because I get one important thing:

What I get out of it: Updates

What if a new shelter was added later or a shelter changed? I already profit a lot from the time people spend adding information, so why stop?

My database stores the OSM ID, so I can regularly query the data again to get updates. But that only works if I take an “upstream” approach: Fix the data in OSM, then load it into notfellchen. Otherwise, any change in my database will be overwritten by “old” OSM data.

Result

In the last month, I made 86 changes to OSM adding the following information

Type of information	Number of times added
Website	66
Phone Numbers	65
Operator	63
E-Mail	49
Fax	9

Yes I sometimes even added fax numbers. It was easy enough to add and maybe there is someone might use it.

Looking forward

I’m of course not done. Only half of the rescues known to OSM in germany are currently checked, so I’ll continue that work.

After that I’ll start adding the shelters that are just in my database. Currently, 33 animal shelters are known to notfellchen that are not known to OSM. This number will likely grow, maybe double.

A lot to do. And luckily, this work both benefits me and everyone using OSM. Happy mapping!

I did something naughty: Circumventing Authorized-Fetch as implemented by GoToSocial

2024-12-11T06:10:10+02:00

Yes the title is correct, but I had nothing malicious in mind!

What this is about

For @qzt@queereszentrumtuebingen.de we include the public feed in a sidbar on the homepage. Initially this was done using the standard API to fetch statuses /api/v1/accounts/{account_id}/statuses and worked like a charm. The problem started when GoToSocial (the fediverse server we use, similar to mastodon) implemented authorized fetch. This is a a good thing! Authorized fetch means, that every call to a endpoint needs to be authorized by an access_token. You get an access token from a fedi account. It’s what fediverse clients like Tusky or Phanpy do on your behalf to get the posts that make up you timeline.

Authorized fetch has major advantages as

data scraping can only be done by other fediaccounts
blocking can not be circumvented by using the public API

and much more. Sadly it also broke our website integration.

Possible Solutions

So what now? I initially wanted to turn of authorized fetch for @qzt@queereszentrumtuebingen.de by messing with the GoToSocial code and turning it off for the whole server. This would have been possible as this is the only user on the server. The GoToSocial devs helped me manage to find where to do that. But it’s not ideal and would make me build a custom docker image fore each update.

Next idea: The whole point of authorized fetch is, that only fedi-accounts (and apps they authorized) can access the API. So lets do that! Set up a new account, add app and authorize it as described in the GoToSocial documentation. I used #Bruno for that, that was much more comfortable than using curl for me. With that authorization code you can now get an access token for your app. Put that in the Javascript that loads posts and we are good right? Sadly no. It would totally work. But it would also allow anyone to read and post on behalf of the account. That calls for malicious actors using this for scraping or spamming.

So instead, we need a proxy that stores the access token securely and restricts the actions.

The proxy

Such a proxie must

offer the endpoint that provides the same data as the FediverseAPI
authorize itself to the FediverseAPI via access_token
restrict to read access of consenting accounts

The last point is really important, as we don’t want to allow others to use this endpoint to scrape data unauthorized.

I wrote a short FastAPI server that offers this. It only implements one method

@app.get("/api/v1/accounts/{account_id}/statuses")
async def fetch_data(account_id):
if account_id not in ALLOWED_ACCOUNTS:
raise HTTPException(status_code=401, detail="You can only use this proxy to access configured accounts")
headers = {"Authorization": f"Bearer {ACCESS_TOKEN}"}
response = requests.get(f"{EXTERNAL_API_BASE_URL}/api/v1/accounts/{account_id}/statuses", headers=headers)
return response.json()

Basically this is the whole API code, I only trimmed a few checks and error handling.

Deployment

To deploy, I put it in a docker container and started it via docker-compose. Reverse proxing is handled by Traefik, I won’t go into detail here.

services:
fediproxy.example.org:
image: docker.io/moanos/fediproxy
container_name: "fediproxy.example.org"
restart: unless-stopped
environment:
EXTERNAL_API_BASE_URL: ${EXTERNAL_API_BASE_URL}
ACCESS_TOKEN: ${ACCESS_TOKEN}
ALLOWED_ACCOUNTS: ${ALLOWED_ACCOUNTS}
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.routers.fediproxy.rule=Host(`fediproxy.example.org`)"
- "traefik.http.routers.fediproxy.service=fediproxy-service"
- "traefik.http.routers.fediproxy.entrypoints=web-secure"
- "traefik.http.routers.fediproxy.tls=true"
- "traefik.http.routers.fediproxy.tls.certResolver=default"
- "traefik.http.services.fediproxy-service.loadbalancer.server.port=8000"
networks:
- traefik
networks:
traefik:
name: "traefik"
external: true

I added a short .env to configure:

ACCESS_TOKEN=VERYSECRETTOKENTHATISDEFINETLYREAL
EXTERNAL_API_BASE_URL=https://gay-pirate-assassins.de
ALLOWED_ACCOUNTS=ZGGZF4G8NNOTREAL81Z8G7RTC

Results

Now I can again use something like the wordpress plugin Include Mastodon Feed just by pointing to the proxy: [include-mastodon-feed instance="fediproxy.example.org.de" account="ZGGZF4G8NNOTREAL81Z8G7RTC"]

Hope you enjoyed the read. Source code for the proxy can be found here: https://git.hyteck.de/moanos/FediProxy If you want to play around a bit you can use https://git.hyteck.de/moanos/include-fedi

Sloth logo of GTS by Anna Abramek, Creative Commons BY-SA license.

Rules, Terms and Privacy for GoToSocial: gay-pirate-assassins.de

2022-11-20T04:56:10+02:00

Rules

"Be excellent to each other" is easier said than done, and means different things to different people.

The following rules are a (non-exhaustive) list of behaviours that may lead to deletion of toots, silencing or suspension of accounts, at the descretion of the instance administrators, as described in our Terms

Please report behaviour that bothers you. We will keep your report confidential.

We do not tolerate discriminatory behaviour and content promoting or advocating the oppression of members of marginalised groups. These groups may be characterised by any of the following (though this list is naturally incomplete):
- ethnicity
- gender identity or expression
- sexual identity or expression
- physical characteristics or age
- disability or illness
- nationality, residency, citizen status
- wealth or education
- religious affiliation, agnosticism or atheism
We do not tolerate threatening behaviour, stalking, and doxxing
We do not tolerate harassment, including brigading, dogpiling, or any other form of contact with a user who has stated that they do not wish to be contacted.
We do not tolerate mobbing, including name-calling, intentional misgendering or deadnaming.
We do not tolerate violent nationalist propaganda, Nazi symbolism or promoting the ideology of National Socialism.
We do not tolerate conspiracy narratives or other reactionary myths supporting or leading to the above-mentioned (and/or similar) behavior.
Actions intended to damage this instance or its performance may lead to immediate account suspension.
Content that is illegal in Germany will be deleted and may lead to immediate account suspension.

Best practices

The list below is a collection of behaviour that we expect to see from our users. If you see a user go against these best practices in a way that bothers you, please file a report and we will talk to them. While these best practices are designed to be guidelines for a good communal instance, repeated malicious unwillingness to follow the best practices will be considered just like breaking a rule.

In general, use the tools provided to foster a considerate and accessible atmosphere. This includes the liberal use of content warnings (especially on potentially disturbing or controversial topics), and alt-text captioning of media files.
When possible, provide credit for creative works in your posts that are not your own.
Uninvited comments about another user's personal choices, lifestyle or family are strongly discouraged and may be considered harassment. Inappropriate sexual attention, comments about appearance and implication of physical contact will not be tolerated toward any non-consenting user.
If you post sexual content or gore, use content warnings.
If you post advertisements, use a content warning. Advertisements should not be excessive or automated.
Bots may only interact with a user when they're invited by that user to do so.
Automated posts and high-frequency posts should be unlisted (rendering visible to everybody, but not appearing on the local timeline) to keep the local timeline of our instance a place of community dialogue and human interaction. This extends to bots, feed posters, Twitter "retweets" and Twitter crossposts with broken mentions ("…@twitter.com"). Crossposter accounts that stop being active participants in our community may be removed at the discretion of the moderators.
In discussions, please remain civil, do not insult the people you're talking to. Note that irony, sarcasm, or similar modes of language don't translate well to written language and tend to escalate discussions or misunderstandings.

(These best practices were inspired by the Terms of bsd.network. Thank you!)

Resources

I am maintaining this instance on my spare time, hardware and nerves. Don't push either of those.

Terms of Service

adapted from chaos.social which was in turn adepted by the bsd.network ToS

It is our intention that you use this service for personal enjoyment and respectful, friendly interaction. To that end, we hope to foster a welcoming and inclusive environment.

The server is privately owned and open to users voluntarily, not a public space. Users wishing to join this community are expected to act without malice and in good faith. Doing otherwise may lead to removal from the service, independent of whether a user violates any rules outlined below.

The administrators and moderators of this instance are

moanos

The server hosting the instance is located in Germany.

The following statements apply regardless of privacy level and instance of the users involved. In rare cases, public or private offline conduct or conduct on a separate instance may constitute grounds for removal from the service.

Policies and Rules

Our instance is subject to a set of rules governing user behaviour. The rules are defined above.

These rules are designed to maintain a friendly and open atmosphere, and to prevent harassment and discrimination. As such, they are a set of guidelines, but by necessity incomplete. Users violating the spirit of these rules will be treated no differently than users violating a specific rule.

Please note that our rules contain a section on best practices, and users who repeatedly and despite warnings disregard these best practices may be seen to be in violation of our rules.

The moderators may remove accounts who spam the instance, or are suspected of camping just to reserve an account name. Violation of the policies and rules may also lead to account removal at the discretion of the moderators.

Data Access

Content on this instance must not be used for the purposes of machine learning or other "research" purposes without the explicit consent of the users involved.

Content on this instance beyond this page must not be archived or indexed wholesale by automated means by any user or service. Active users may export their following lists and posts through the export provided on their settings page, or the API.

Privacy Policy

Information collection

Mandatory account information: Username (always public), e-mail address, and password.
Optional account information: Display name, biography, profile information fields, profile picture, and header image. Display name, biography, profile picture and header image will always be public.
Statuses and interactions: We retain all your posts including attachments, and other interactions (such as favourites, follows and reblogs). In addition to the content and people involved, we also store the timestamps for all of the listed data entries. If these interactions impact another server (eg. following, boosting, or messaging a user on a different server), this other server will receive all required information. Public, unlisted, and pinned posts are available publicly. Follower-only posts are available to your followers, and direct messages are available to you and all people mentioned in the message. Please note that since we cannot control other servers, this means that we cannot guarantee the privacy status of your messages as soon as they leave our server.
Cookies: We use cookies to keep you logged in and save your preferences for future visits.
Other metadata: We do log and store your IP address. We retain the name of your browser application to allow you to review your currently logged in sessions for security reasons.

Information usage

Any of the information we collect from you may be used in the following ways:

To provide the core functionality of GoToSocial. You can only interact with other people's content and post your own content when you are logged in. For example, you may follow other people to view their combined posts in your own personalized home timeline.
To aid moderation of the community – when a status or account is reported, we will look into the matter as part of our moderation tasks.
The email address you provide may be used to send you information, notifications about other people interacting with your content or sending you messages, and to respond to inquiries, and/or other requests or questions.
To aid debugging and reliable providing service.

Information protection

We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information. Among other things, your browser session, as well as the traffic between your applications and the API, are secured with HTTPS, and your password is hashed using a strong one-way algorithm. You may enable two-factor authentication to further secure access to your account.

Information deletion and retention

You can request and download an archive of your content, including your posts, media attachments, profile picture, and header image.

You may irreversibly delete your account at any time.

If we judge you to be breaking our instance rules, we may irreversibly delete your account at any time.

Information disclosure

Information is not disclosed unless you explicitly permit it. The only exception is the provider of our server, who is a trusted and unavoidable third party.

Contacting or permitting contact from a user from a different instance implies your consent that the required data is shared with the server in question.

Authorization of a third-party application grants information access depending on the scope of permissions you approve. The application may access your public profile information, your following list, your followers, your lists, all your posts, and your favourites. Applications can never access your e-mail address or password.

Attribution ¶

This text was adapted from https://chaos.social/about and is free to be adapted and remixed under the terms of the CC-BY (Attribution 4.0 International).

Vim shortcuts to execute current line

2022-05-25T15:15:55+02:00

I recently had to write a lot of SQL code and thought it would be very neat to have some vim shortcuts to execute the current line or the current command. I want to share this with everyone as the second command needed some try-and-error on my part.

Adding the following to ~/.vimrc

map <F2> :.w !psql<CR>
map <F3> :.,/;/w !psql<CR>
map <F4> :w !psql<CR>

will enable you to execute the current line in psql with F2. F3 executes the current line and the next lines until a;. F4 executes the whole file.

This can easily adapted to your needs. If you have any questions or improvemnts feel free to use the chat below.

Disappearing messages with matrix

2021-12-31T20:00:00+02:00

Introduction

I am a HUGE fan of matrix. It allows me to organize my chats in a sensible way, it works with multiple identities and completly anonymous if I want it to. Spaces made Matrix my favourite messenger by far. Yet, there is one feature I have been missing: Disappearing messages!

Regarding the security and usability, only Signal is comparable to matrix. But: Signal offers the possibilty to define disappearing messages for groups and direct messages ranging from 30 seconds to 4 weeks. No Matrix client (to my knowledge) offers this functionality. Nevertheless, it is possible to configure matrix rooms to have the same feature. This needs a special server configuration and the sending of a special event in the room. This post tries to show both steps. If you do not administer a server you can probably skip to Room configuration

Be aware that this blogpost was written at the end of 2021 - Matrix develops fast and this could be subejct to changes.

Instance configuration

To make disappearing messages possible you need to enable retention on your matrix instance. Retention allows server and room admins to configure how long messages should be kept in the instances database before being purged from it. It is not part of the matrix specification, yet it is supported by synapse.

A client SHOULD not display these messages anymore after the max_lifetime is exceeded. This was NOT true for element web an desktop while staying logged in. Nevertheless, a newly logged in client did not have access to the messages.

To configure Synapse to make use of retention you will need to enable it in your homeserver.yaml

retention:
enabled: true # enables the retention, is enough to enforce it once per day
purge_jobs: # configures a job that delete the events from the database after some tome
- longest_max_lifetime: 3d
interval: 1h
- shortest_max_lifetime: 3d
interval: 1d

The example configuration creates two jobs that delete messages from the database. One only focuses on events that should be deleted after three days or less. These events will be deleted every hour. It is therefore possible for a message that was send in a room with a max_lifetime=7200000 (equals 2h) to be deleted one hour after the maximum lifetime.

Ansible

If you use the Ansible/Docker setup to deploy your server you can add the following to inventory/host_vars/matrix.example.com/vars.yml

matrix_synapse_configuration_extension_yaml: |
retention:
enabled: true
purge_jobs:
- longest_max_lifetime: 1d
interval: 2h
- shortest_max_lifetime: 1d
interval: 1d

Room configuration

If you are a user on a server that has retention enabled, you can enable disappearing messages yourself for each room. Sadly, this is still experimental - but managable! You have to craft a m.room.retention event that defines the maximum lifetime of a message. You will need to access the rooms settings in order to do this.

First you need to open the developer tools in the rooms settings.

Then click “Send custom event” to create your event

And fill the event with the appropriate max_liftime. The time is an integer in milliseconds. X hours is therefore a value of X*3 600 000. Make sure to click the red event button. The State Key can be left empty nevertheless.

Depending on your choosen lifetime the client should not show the messages anymore.

Limitations

The process of deleting messages can not be enforced. A malicious server or chat partner could ignore the request to delete the messages or they could have saved them elsewere. You should not rely on a deletion actually happening. Nevertheless I think this is a good step to take to improve your security in real life.

Further Information

Relevant part of the Synapse configuration file: https://github.com/matrix-org/synapse/blob/v1.36.0/docs/sample_config.yaml#L451-L518
Synapse documenation on message retention policies https://matrix-org.github.io/synapse/v1.41/message_retention_policies.html

What else?

Thanks to Tastytea for helping me get this to work!

Comments

If you have questions, corrections or want to leave something else, please feel free to use the comments!

Cactus comments via Matrix

2021-08-25T11:08:55+02:00

Integration

Following the quickstart documentation I tried to add cactus comments to this blog. I currently rely on infrastructure by cactus.chat as I do not host a private synapse server.

I currently implemented this as a shortcode with hard-coded site title and a variable room name.

Quickstart with HUGO

Register your site

There is a registration system, that ensures that you are moderater in your comment section(s). I order to register your site you have to send a message to @cactusbot:cactus.chat . First try help to ensure that the bot answers you, then register your site e.g. register hyteck. The bot should inform you of success and add you to a moderation room.

Embedd comment section via Shortcode

HUGO, the static site generator I use, has an option to use shortcodes that provide a nice interface to hide some HTML, CSS and JavaScript.

The shortcode chat.html must be added to layouts/shortcodes/ and looks like this

<script type="text/javascript" src="https://latest.cactus.chat/cactus.js"></script>
<link rel="stylesheet" href="https://latest.cactus.chat/style.css" type="text/css">
<div id="comment-section"></div>
<script>
initComments({
node: document.getElementById("comment-section"),
defaultHomeserverUrl: "https://matrix.cactus.chat:8448",
serverName: "cactus.chat",
siteName: "hyteck",
commentSectionId: "{{ index .Params 0 }}"
})
</script>

If you want to use this, replace the site name with the one you registered in the previous step.

You can then use it as simple as

{{< chat cactus-comments >}}

where cactus-comments is the name of the chatroom. You can decide if you want to create a new one for each post (change the name to somthing like the post title) or if you want to use only one (keep the same name).

Organisation

I try to make a comment with my main matrix account, so that I am automatically joined to the room (tbh. I don’t know if this is necessary). Then I organize the rooms by adding them to a private space.

Community

CW: Homophobia, Slur

The community in the official chat seemed helpful and nice. Nevertheless I want to mention, that the first time I tried the demo page a user (that does not seem to be associated with the develoipment or involved in the community) insulted me with a homophobic slur. The “reason” behind this were the prounouns I had in my name. I reported the comment and it was removed by a moderator. The moderator made it clear that this behaviour is agains the Code of Conduct and that the user is not active in the community. For me this is a very good indication of a functioning community, cheers!

Comments

Owncast & Streaming a talk

2021-05-20T16:08:55+02:00

I recently installed an Owncast server and wanted to share my experience. Here it is:

What is owncast?

Owncast is a streaming server that you can selfhost, a Twicht in a box as the developers call it. You host owncast on your server (a small VM with good downlink is enough) and can stream your own own content like you would do on Twicht, YouTube etc…

It has a chat, a admin panel for customization and thats it! You don’t need more to e.g. stream while you are playing minecraft or want to share a talk.

Getting started

Get the latest release on GitHub by using

$ mkdir owncast
$ cd owncast
$ wget https://github.com/owncast/owncast/releases/download/v0.0.7/owncast-0.0.7-linux-64bit.zip
$ unzip owncast-0.0.7-linux-64bit.zip
$ rm owncast-0.0.7-linux-64bit.zip

And move the webroot to your document root and make sure the permissions fit

$ cd ..
$ mv owncast /var/www/owncast
$ cd /var/www/
$ chown -R www-data:www-data owncast

Now create a new NGINX site e.g. /etc/nginx/sites-enabled/owncast with the following content

map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/stream.hyteck.de/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/stream.hyteck.de/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name stream.hyteck.de;
# Set header
add_header X-Clacks-Overhead "GNU Terry Pratchett";
add_header Permissions-Policy interest-cohort=(); #Anti FLoC
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://127.0.0.1:8080;
}
}
server {
listen 80;
listen [::]:80;
server_name stream.hyteck.de;
return 301 https://$server_name$request_uri;
}

Make sure to adjust the server name and SSL certificats (I will not go into detail on how to obtain them, but feel free to ask me!).

Start server

Now start owncast to test

$ cd /var/www/owncast
$ ./owncast/owncast

and visit https://yourdomain.org! If everything works you should see your site now. By visiting https://yourdomain.org/admin you can configure your server. The default credentials are admin and your stream key which is abc123. Change this immediately!

Before you configure, let’s make sure this runs whenever your server starts. Goback in the terminal and cancel with Ctrl+C.

Run as system service

You want to install owncast as a system service. Therfore create /etc/systemd/system/owncast.service with the following content:

[Unit]
Description=Owncast
After=network.target
[Service]
Type=simple
Restart=always
RestartSec=1
WorkingDirectory=/var/www/owncast
ExecStart=/var/www/owncast/owncast
[Install]
WantedBy=multi-user.target

Update the daemon with systemctl daemon-reload enable systemctl enable owncast and start with systemctl start owncast. Make sure everything is correct with systemctl status owncast.

Configuration

You can now change back to yourdoiman.org/admin and configure, title, logo and more.

Streaming

You can now use OBS or similar software to start streaming. Got to settings and configure your server.

Concept for talks

To livestream we have a few important things to take care of:

The speaker
The presentation
The streaming software
The streaming server
The chat

I suggest the following setup. Moderation and Speaker are in a BigBlueButton conference. The meet 15 minutes in advance, enough time to upload a presentation. Also in this room is a user called stream. This user does only listen and has OBS configured to record audio and the (fullscreen) window of the BBB room.

Before the talk starts, it is a good opportunity to play some videos via the stream, or simply put on a picture, saing the talk will start soon.

When the speaker an moderation are ready they tell the streamer and the scene is switched to the BBB room. The recording is started (if needed).

A weakness of the setup is the streaner. If they loose their network connection, the stream stops.

There is a neat project for live streaming directly from a BBB room, but it is quite complicated to set up and a crash of the BBB server would make stop the stream. Also the start of the stream is not as beautiful.

Performance

It can be hard to estimate the needed server capacities for a livestream that is why I want to share my experiences. All of this was done on a Strato Linux V40 with 16 GB of RAM, 8 vCPUs and 500 MBit/s.

On the following screenshots you see the configuration and the monitoring data of a talk with 40 participants. We pplayed high-quality videos from 17:43 to 18:05. At 18:05 we changed to the presentation. You see the decrease in CPU load, as the compression of the videos was easier with a steady picture. At 19:05 we invited the participents to join us in the BBB room, some left the stream.

The network load scales linear with the participants that are watching. You can simply calculate the needed downlink capacity with

Downlink capacity = Num. participants x Outbound Video Stream Rate

Here this was

40 participants x 1200 kbps = 48 Mbps

which matches the observed network traffic quite well.

The CPU load is determined by the compression the server has to do. The more different stream formats the server has to put out, the higher the load becomes. On the given Screenshot you see that only one downlink format was advertised, so the inbound stream had to be compresse only once. Matching imbound and outbound stream formats help reducing the server load.

If your bottleneck is the bandwidth you can try to add a second low streamrate, maybe ome clients will take that one.

Final notes

Owncast is a great project. Be aware that it is still not in version 1.0 so expect some limitations. This is e.g. the unability to block a user from chat. If you have any questions let me know in the comments below.

Transparency

2021-02-08T15:00:10+02:00

Deutsch

Wir haben die bisherigen Kosten für Server-Hardware in der Tabelle unten angegeben. Das beinhaltet nicht die Kosten für die Domain und unseren Monitoring-Server.

An alle die bisher gespendet habe: Ganz ganz vielen Dank euch!

English

We summarized the cost of hardware in the table below. This does not include costs of the domain and our monitoring server.

To everyone that contributed: Thank you so so much!

Überblick/Overview

Kosten	Spenden	Saldo
-321.63 €	235.5 €	- 86.13 €

Kostenaufstellung / Exact cost

Date	Cost (€)
27.04.2021	-25
1.04.2021	-25
26.02.2021	-25
22.01.2021	-25
22.12.2020	-24.78
25.11.2020	-24.37
22.10.2020	-24.37
22.09.2020	-24.37
22.08.2020	-24.37
22.07.2020	-24.37
22.06.2020	-25
22.05.2020	-25
22.04.2020	-25
Total	-321.63

Die wechselnden monatlichen Kosten sind durch die temporär gesenkte Mehrwertsteuer bedingt.

The altering monthly costs are explained by a decrease in sales tax in Germany.

Spenden / Donations

Date	Donation (€)
03.05.2021	7.50
06.04.2021	7.50
02.03.2021	7.50
01.03.2021	100
12.02.2021	33
12.02.2021	20
09.02.2021	50
09.02.2021	10
Total	235.5

Letzte Aktualisierung / Last update

21.05.2021

Kontak / Contact

Bei Fragen meldet euch gerne bei: bbb@hyteck.de

If you have any questions regarding this ask us via: bbb@hyteck.de

Set up and secure an MQTT broker on Ubuntu

2021-01-01T18:18:10+02:00

I had some IoT devices that I wanted to integrate in my monitoring. For this I set up a MQTT broker as the MQTT protocol is a simple solution to send data from IoT devices to a server. This tutorial is focusing on setting up the server, but I also introduce a Python based MQTT client to test our installation.

On your server, first install mosquitto, our MQTT server/broker.

sudo apt-get install mosquitto

Allow standard mqtt port in firewall (if you have ufw installed)

sudo ufw allow 1883

Now on the client side connect to the server and publish some fake sensor values. First install the mqtt client

sudo pip install phao-mqtt

and then use the following python code on your client side to send fake values to your server. You only need to change mqtt.example.com to your servers IP/domain.

import time
import paho.mqtt.client as mqtt
import numpy
import numpy as np

def calc_temp():
 temp = np.sin(time.time()%(3600)*2*np.pi)*5+20
 return temp

def on_connect(client, userdata, flags, rc):
 print("Connected with result code " + str(rc))

client = mqtt.Client()
#client.username_pw_set(username="username",password="my_super_secret_pw")
client.on_connect = on_connect

client.connect("mqtt.example.com", 1883, 60)

client.loop_start()

while True:
 time.sleep(2)
 client.publish("test/temperature", calc_temp())

You can check if the broker accepts the values by subscribing to the topic:

#!/usr/bin/env python
import paho.mqtt.client as mqtt

def on_connect(client, userdata, flags, rc):
 print("Connected with result code " + str(rc))
 client.subscribe("test/#")

def on_message(client, userdata, msg):
 print(msg.topic + " " + str(msg.payload))

client = mqtt.Client()
#client.username_pw_set(username="username",password="my_super_secret_pw")
client.on_connect = on_connect
client.on_message = on_message

client.connect("mqtt.example.com", 1883, 60)

client.loop_forever()

Now secure your broker by creating a user with a password

sudo mosquitto_passwd -c /etc/mosquitto/passwd <username>

and configure mosquitto to use it in /etc/mosquitto/conf.d/default.conf:

allow_anonymous false
password_file /etc/mosquitto/passwd

Now restart mosquitto to enable the protection

sudo systemctl restart mosquitto

Test the installation by uncommenting client.username_pw_set(username="username",password="my_super_secret_pw") and filling in your credentials. The result code 0 indicates a valid connection. 5 indicates a authentication error.

I hope this helps setting up a MQTT broker. Hopefully I will have the time to write how to connect such a broker to Grafana via Telegraf and Influx DB.

Translation for video conferences

2020-07-23T07:30:00+02:00

Although physical meetings are not possible, many groups and organizations are dependent on multilingual meetings. In videoconferencing, concepts such as a whispered translation are not intuitive. Therefore a friend and I have developed a concept for translation in videoconferencing. The concept was planned for a conference with 80 participants who will discuss and make decisions over two days either in large groups or in sub-groups. The videoconferencing software that was used was BigBlueButton (BBB).

Translation via subtitles

BBB offers the possibility to write subtitles simultaneously to video conferencing. This feature is especially aimed at hearing impaired people. For translation, one person would translate and type in one language at a time. Due to the limited typing speed, this procedure is associated with large losses of content. However, it is a great option for hearing-impaired people and can be combined with a simultaneous oral translation.

Simultaneous translation

The concept of simultaneous translation is based on the fact that there is a seperate BBB-room for each language. These are communicated to the participants in advance.

The room whose language most of the participants speak will be the main room. People who do not speak the language of the main room will still join it, as moderation tasks and the presentation will be only in this room.

All statements in the main room will be translated by overseers in the other rooms. The translators should be present in the main room with the microphone switched off. If a person from a secondary room wants to speak they indicate this in the chat of the main room, - preferably with “* (language)”. They will then be allowed to speak by the moderator and speak in their respective room. The translator will unmute their microphone in the main room and translates to the primar language.

Breakout Rooms

Breakput rooms are often formed to debate in smaller groups. To ensure a reasonable amount of translation effort, all participants and translators of one language are assigned to one breakout room (in the main room). If the Breakout Rooms become too full, Breakout Rooms can also be formed in the secondary rooms, but translators are then required for each room.

Tips and tricks

Use two translators per language. One person cannot do this even at a moderate speed of discussion. It also allows for better reproduction of conversations by alternating the translators.
Ask participants to set their names according to the “Name [pronouns] (language)” scheme. This makes it easier for moderation and translators.
Participants do not need to join the audio in the main room, but they can, so that their contributions can be heard in the original. However, they should mute the browser window of the main room.

Conclusion

Whispered translation is possible in BBB; in order to use it, the possibility must be announced in good time by the moderator and enough translators must be found. The concept of oral translation has already proven itself at a large meeting.

If you are interested in implementing the concept you are welcome to contact me at fluesteruebersetzung@hyteck.de or in the comments below.

Services

2019-11-14T09:56:10+02:00

Services

This is a non-extensive list of services I offer. All services are hosted in Germany and come with monitoring of service uptime.

Library management

The library management software ILMO is devoloped by me. It is a perfect tool for the management of small to middle-sized libraries. It offers user management, reminders on loans and an easy borrow procedure. The software is open source so you can host it yourself. If you do not want the hassle of self-hosting I offer managed hosting.

Livestreams

I offer livestreams for online talks. During the global COVID pandemic, a lot of lectures, seminars and talks had to be held online. I want to offer you a way to still reach and interact with people while maintaining a high level of data protection. This is what Owncast in combination with other solutions offers: Just reach out and we can discuss a concept that will work for you!

List of all services

I host some services that are publicly available, some that are only for friends and some that are private. Get in touch if you want me to host a service like this exclusively for yourself or your organization.

Service	Description	Access	Status
Nextcloud	Cloud storage with collaboration suite	Upon request	Live
Matrix	Encrypted chat for teams	Upon request/Einladung	Live
GoToSocial	Social Media server in the Fediverse (Mastodon-compatible)	Public	Live
Funkwhale	Music sharing & streaming	Upon request	Live
Owncast	Livestreams	Upon request	Live
Notfellchen	Find animals and give them a loving home. Not available as commercial hosting - happy to do do this non-profit.	Public	Live
Forgjo & Forgjo actions	Git hosting and automations	Invitiation-only	Live
Grafana	Display telemetry data	Private	Live
Prometheus	Monitoring system & time series database	Private	Live
Influx DB	Time series database	Private	Live
ILMO	Library management tool	Test instance offered upon request	Testing
BigBlueButton	Videoconferencing software	Public	Discontinued April 21. Use Senfcall

Usage policy (german)

Unless a contract specifies otherwise the services are provided free of charge and as-is, without warranty of any kind, expressed or implied. The usage of the services can be restricted or blocked permanently immediately and without warning.

This is especially true for anything that goes against the following rules. The rules are a (non-exhaustive) list of behaviours that may lead to deletion of content or suspension of accounts. In some cases, public or private offline conduct or conduct in using other services may constitute grounds for removal from the service.

We do not tolerate discriminatory behaviour and content promoting or advocating the oppression of members of marginalised groups. These groups may be characterised by any of the following (though this list is naturally incomplete):
- ethnicity
- gender identity or expression
- sexual identity or expression
- physical characteristics or age
- disability or illness
- nationality, residency, citizen status
- wealth or education
- religious affiliation, agnosticism or atheism
We do not tolerate threatening behaviour, stalking, and doxxing
We do not tolerate harassment, including brigading, dogpiling, or any other form of contact with a user who has stated that they do not wish to be contacted.
We do not tolerate mobbing, including name-calling, intentional misgendering or deadnaming.
We do not tolerate violent nationalist propaganda, Nazi symbolism or promoting the ideology of National Socialism.
We do not tolerate conspiracy narratives or other reactionary myths supporting or leading to the above-mentioned (and/or similar) behavior.
Actions intended to damage a service or its performance may lead to immediate suspension.
Content that is illegal in Germany will be deleted and may lead to immediate account suspension.

You can report content that goes against these rules even if you are not the affected person. The report will be kept confidential. Contact

Availability

There is no guarantee of availability, unless specified in a separate contract. There is no guarantee of data backups. Suspension of a service will usually be announced but this is not guaranteed. Join Announcements for this purpose.

Contact

See here

Introduction to git

2019-10-22T19:00:00+02:00

As you man now I work in a research lab. Nearly everyone in our lab needs to do at least some programming. There are trained software engineers next to people how write their first line of code here. As we produce a lot of code that is only scripts not many people used git or any other version control system. For all the good reasons (some are mentioned in the guide) we everybody to learn git in a way that is tradeoff between good version control and fast development. As most of us work on separate projects there is not so much need to collaborate which is reflected ind this guide as I completely excluded branching and merge conflicts. Yet I hope this will maybe help some learners of git or some people that need to introduce git to others.

I will not be updating this guide, for the newest version please visit https://github.com/GerJuli/introduction-to-git

Now enjoy the guide!

Installation

On Windows: Download git here: https://git-scm.com/download/win and install it
On Linux: execute ‘sudo apt install git’ in the terminal

Configuration

Basics

$ git config --global user.name "John Doe"
$ git config --global user.email johndoe@example.com

Run these commands without –global to apply changes only for local repository.

Advanced

Change from default editor by executing $ git config --global core.editor vim
Create aliases by:
- git config --global alias.unstage 'reset HEAD --': Introduces new command unstage
- git config --global alias.hist 'log --pretty=format:"%h - %an, %ar : %s" --graph': Is an pretty alternative to git log.
Check the configuration by $ git config --list

Getting started

Create an directory

Select an directory of your choice e.g. ~/Desktop/git-training/, open the terminal there and type

$ git init

Congratulations you have your first git repository!

Committing files

Create some text files e.g. hallo.txt or hello_world.py. To start version-controlling them add the file to git by using the command

$ git add filename

You can also add multiple files. E.g. you want to add all text files the do

$ git add *.txt

Now we can commit these changes by typing

$ git commit

This will open your preferred text editor where you can type in a commit message.

Commit messages

Commit messages are important

Why are the so important? Because it is much easier to track bugs with it, they describe the process of development, make it easier for others to work with your code (e.g. code review) and will help you in two years to understand what you did. They extend your labbook in its function.

How to write commit messages

Use present tense and use imperative
Tell why you did changes.
Limit yourself to 50 characters in the first line.
Wrap the body at 72 characters

Good commit messages

For short commits that need only few explanation it is convenient to use

$ git commit -m "Fix typo in introduction to user guide"

For long commit message you use

$ git commit

which opens a text editor and lets you describe your changes in detail. Do not forget the line between header and body of the commit message.

Summarize changes in around 50 characters or less
More detailed explanatory text, if necessary. Wrap it to about 72
characters or so. In some contexts, the first line is treated as the
subject of the commit and the rest of the text as the body. The
blank line separating the summary from the body is critical (unless
you omit the body entirely); various tools like `log`, `shortlog`
and `rebase` can get confused if you run the two together.
Explain the problem that this commit is solving. Focus on why you
are making this change as opposed to how (the code explains that).
Are there side effects or other unintuitive consequences of this
change? Here's the place to explain them.
Further paragraphs come after blank lines.
- Bullet points are okay, too
- Typically a hyphen or asterisk is used for the bullet, preceded
by a single space, with blank lines in between, but conventions
vary here

Hall of shame

Here you see some examples of bad commit messages.

“bug fix”, “more work”, “minor changes”: Bad because it contains no useful information
“Change X constant to be 10”: Bad as it does not tell why. What was changed is easy to find out by git diff.
“super long commit message goes here, something like 100 words and lots of characters woohoo!”: Bad because it is unreadable.

Storing changes on remote server

To store changes on a remote server e.g. Github you need to push your repository there. If you are doing this for the first time you first need to define where to push your repository to. Use

$ git remote add origin https://github.com/GerJuli/introduction-to-git.git

The URL can be replaced with any URL that points to an existing repository. This can even be a USB drive! Now push by using git push -u origin master. With this command you created an upstream to your remote ‘origin’ where you branch ‘master’ will be pushed. As this is set up you can use git push from now on.

Cloning existing repositories

Downloading existing repositories is called ‘cloning’. You can do this by using

$ git clone https://github.com/GerJuli/introduction-to-git.git

That is it. Now you can start working on it.

Workflow

Check status

With

$ git status

you can check the status of your current directory. This will look like this:

$ git status
On branch master
Your branch is up-to-date with 'origin/master'.
nothing to commit, working directory clean

Add file

If you now add a file to the repository e.g. README then the status changes.

$ echo 'My Project' > README
$ git status
On branch master
Your branch is up-to-date with 'origin/master'.
Untracked files:
 (use "git add <file>..." to include in what will be committed)

 README

 nothing added to commit but untracked files present (use "git add" to track)

You can also run

$ git diff

which will show you the changes that where made.

Now track the file by adding it to the staging area via

$ git add README

If you want to commit only a part of the changes you made use

git add -p

git will ask you for every “hunk”(part of the file) if you want to add it to the staging area. The main options are:

y stage this hunk for the next commit
n do not stage this hunk for the next commit
q quit; do not stage this hunk or any of the remaining hunks

Committing

The changes are now ready to be committed

$ git status
On branch master
Your branch is up-to-date with 'origin/master'.
Changes to be committed:
 (use "git reset HEAD <file>..." to unstage)

 new file: README

Now commit this change with a suitable commit message. You forgot what you changed and git diff does not work? If you already added the file to the staging area you can run

$ git diff --staged

Push to remote

Push this now to your repository with

$ git push

Show last changes

$ git log

shows you a log of recent commit messages.

If you want to have a look at the changes source use

$ git log -p

A much prettier version is

$ git log --pretty=format:"%h - %an, %ar : %s" --graph

Get latest changes

An amazing thing of git is to work together with others. This guide will not go into the details of this, yet you will often have to get the latest changes of a project.

You can do this easily by using

$ git pull

which is a short version of two different commands. It first executes git fetch that downloads the latest changes. Then it runs git merge FETCH_HEAD which tries to apply the newest changes to your local repository. This is also the difficulty of this as any file that was changed locally and in the remote repository will cause a merge conflict as git does not know which file/parts of the file to keep. The resolution of such a conflict can be complicated and goes beyond the intentions of this guide.

A brief overview can be found here.

Gitignore

Sometimes you do not want git to track every file in your repository. Typically this applies for log files, configuration files (where maybe passwords are stored) and compiled sources. For this purpose you can create the file .gitignore in your repository. This file will be read by git. An example .gitignore looks like this:

# ignore all .log files
*.log
# ignore all files in any directory named config
build/
# but do track sample.log, even though you're ignoring .log files above
!sample.log
# only ignore the TODO file in the current directory, not subdir/TODO
/TODO
# ignore all files in any directory named build
build/

You can generate gitignore files here.

Undoing things

Make changes to the last commit

You forgot to add one file to your commit? You are unhappy with your commit message? Use git --amend!

$ git commit -m 'Pretty commit message'
$ git add forgotten_file
$ git commit --amend

Do not do this if you already pushed to remote.

Unmodifying a Modified File

You made changes to a file but the changes messed everything up? You can always go back to the version of the last commit by

git checkout -- filename

Warning: This is dangerous as you delete all changes that you made locally. Do NOT use this command unless you are absolutely sure what you are doing.

Time machine

Something went terribly wrong. When using git this is no problem. Just use reflog and select the commit where still everything was alright.

$ git reflog
9bff138 HEAD@{0}: commit: Document limitations of this guide
8d9dac8 HEAD@{1}: commit (amend): Adjust script to nice print
[...]
2b66f53 HEAD@{7}: commit: Introduce git log
8835c33 HEAD@{8}: commit: Fix of formating of headings
2f0f500 HEAD@{9}: commit: Improve order of comments on workflow
249dc14 HEAD@{10}: commit (amend): Explain git diff
f5ba1d3 HEAD@{11}: commit: Explain git diff
0a2ce1c HEAD@{12}: commit: Remove trailing whitspaces
735511f HEAD@{13}: commit (initial): Initial commit

$ git reset HEAD@{index_where_everything_was_fine}
$ git reset --hard origin/master

Warning: This is dangerous as you delete all changes that you made locally. Do NOT use this command unless you are absolutely sure what you are doing.

USB sticks as remote

Sometimes (e.g. you are working on a machine that is not connected to the internet) it can be helpful to use an USB drive as remote.

How to prepare the drive

Go to the USB drive

$ cd /media/username/git-stick/

Create a directory for your repository

$ mkdir my-repo

Initialize the repo

$ cd my-repo
$ git init --bare

How to push to a USB drive

To push to a USB drive you need to add a remote. Go to your local repository and use

$ git remote add usb /media/username/git-stick/my-repo/

Be aware that your stick will have a different name and will be at a different location, depending on your operating system. You named the remote “usb” here, of course you can change that name.

Now push your repo

$ git push usb

To list all repositories just type

$ git remote
origin
usb

If you want to push to the USB drive by default you can use

$ git push -u usb master
Branch 'master' set up to track remote branch 'master' from 'usb'

What this guide does not cover

Branching
- Creating branches
- Merging branches (and merge conflicts)
- Remote branches
- Tagging
- Forks
Usage of Github
Hooks

Logo

Git Logo by Jason Long

Why Hyteck

2019-09-16T18:18:10+02:00

TL;DR

Hy - Water
Teck - Castle nearby
Summary: Bad name pun

Why the name Hyteck?

I am not very good at finding names I really like. My nickname changed several times, I was never able to stick to one. As hard as finding a nickname was finding a domainname for me.

Nevertheless I really started to like the name Hyteck. The idea came during a hackathon in Tübingen where two friends and I worked as a team on a project to help elderly adults drinking. We the decided on the teamname HyHack (Hy for Hydration).

What we first did was not so High - Tech (I will post about this sometime), yet we called it that.

I later chenged the Tech to Teck which is a local castle (my hometown is called Kirchheim under Teck) that in the german pronounciation is a Homophone of Tech.

The Hy stayed as I always had a close connection to water.

I feel like I overexplained this a bit, so poor you if you read till the end.

However, you earned a !

ILMO

2019-09-15T22:00:55+02:00

ILMO

is my first bigger FOSS-project. It aims at managing small libraries as found in a department of a university. You can finde the project on Github.

History:

I started to create ILMO for the (rather small) library in the study rooms of mediacal engineering. It contains about 300 books, 120 labcoats and safty glasses and some more stuff. As I was in charge of the lends I started to get annoyed by our paper-based solution. Especially when a bunch of people was trying to lend things it took to much time. Also reminding people to return stuff was unnecessary complicated. Therfore I started to programm this library management tool from scratch. I only reused some basic database and session functions. The project is still a field of learning how to do things for me. Nevertheless after about half a year of development and many tests the system went live in Winter 2018. Since then I fill the bugtracker and slowly improve workflows and add functions.

License

Of course the program is open-source and licensed under GPLv3.

Demo

Right now there is no public available demo but if you are interested I will lead you the way to my test server.

Using ILMO

You know someone who could use somthing like this? I would love to see this software in more libraries. Right now the programm is optimized to the needs of our student union but I would be happy to work more on this.

Hello World

2019-09-14T16:35:58+02:00

Hello world

Welcome to my new blog! I don’t know what this will all be about - but I will sort this out. As a start I decided to blog in English, but I can imagine that there will be a mix between English and German in the future.

The blog is created with the static site generator HUGO and the theme Nederburg.

About

2019-08-20T19:56:10+02:00

Hyteck

Hyteck is a company for online services that I founded. It provides smaller SaaS contracts, e.g. for Hosting ILMO. Currently available are the services listed here

About me

I work at DKMS, a nonprofit that fights blood cancer by registering potential blood stem cell donors and raising awareness and funds. My role is “Business Analyst” in our Salesforce team. That means I spend my day trying to figure out the business departments need, sketching solutions and translating between product and business teams.

After work, I spend my time with programming, activism and my pet rats.

My background

After finishing school, I studied Medical Engineering in a joint course at University Stuttgart and University Tübingen.

In March 2020 I finished my bachelor thesis “Real-time EEG analysis - Phase dependent effects of TMS on MEP” at the Institute for Neuromodulation and Neurotechnology in the University Hospital Tübingen led by Prof. Gharabaghi. After that I was working there as a researcher.

In November 2020 I started studying Medical Informatics Tübingen and finished in April 2024 with my master thesis " Development and Validation of a Software Platform for Classification and Correction of Pathological Movement in Daily Activities by Multi-modal Sensor Analysis". This work focused on helping Ataxia and Parkinson’s disease as part of a larger project in the Section for Computational Sensomotorics at the Hertie Institute for Clinical Brain Research (HIH). My advisor for this work was Winfried Ilg, and it was examined by Prof. Dr. habil. Michael Menth and Prof. Dr. Martin Giese.

Open-source work

My work on various Open-Source projects involves

Project	Description
Notfellchen	An app for helping fancy rats get adopted from rescues
ILMO	A library management tool, available as SaaS
mash-playbook	An Ansible playbook which helps you host a large catalog of FOSS services as Docker containers on your own server
https://github.com/spantaleev/matrix-docker-ansible-deploy	Matrix (An open network for secure, decentralized communication) server setup using Ansible and Docker

and many more you can find on GitHub, Codeberg. or my own Gitea server.

Commercial Services

I offer to host some Software-as-a-Service. This is especially true for [ILMO], a library management solution I developed. Commercial support for software I maintain is also available, as well bespoke software. Be aware that I have a fulltime job, and I’m limited in the time I can make for your projects.

If you are a non-profit organization, I can offer reduced pricing. If you want to see what’s possible, have a look at the documentation of the Queer Center Tübingen where I set up

a chat server (Matrix)
a cloud collaboration platform Nextcloud)
a SocialMediaServer (GoToSocial)
a shared password manager (Vaultwarden)
a automatically embedded calendar on the Website

and all is connected via SingleSignOn (Authentik) and backed up by BorgBackup.

I also host(ed) some (semi-)public services including BigBlueButton, Matrix, Nextcloud, Funkwhale and Cryptpad. All current active systems can be found in a list

Technologies I like to use

My favourite framework is Django, powered by Python. It makes development incredibly efficient and enjoyable.
I have extensive experience in Ansible and use it to deploy nearly all my services
I use JavaScript sometimes and even dabbled a bit into React
Coding started with Java, and PHP for me, however my PHP is a bit rusty now, while I regularly used Java during my studies.
For programming of real time applications, mostly for medical devices, I learned * Structured Text* (a programming language based on pascal focused on programming PLCs) and C. I don’t enjoy C that much, but I’m proud of what I managed to do anyway.
More recently I started learning Rust and implemented a smaller backend service using axum.

Contact

E-Mail: julian-samuel@gebuehr.net Public key
Matrix: @moanos:hyteck.de (Deprecated: @moanos:matrix.org)
Mastodon: @moanos@chaos.social
Twitter: j-s.gebuehr@twitter.com
Signal, Whatsapp, Phone: Available, use one of the other options to get my phone number
XMPP: moanos@anoxinon.me (Inactive)
Threema: 2A724TYR (Inactive)