Hack It Yourself (Posts about linux)

Mysterious suspend when no user is logged in, Ubuntu 24.04

author — Fri, 08 Aug 2025 03:19:28 GMT

My Ubuntu 24.04 LTS server strangely suspends itself after 20 min. However, if I log in via Anydesk, then it stays on even if I minimize the Anydesk window and do not touch it for hours (it would enter into screensaver mode). If I log out my user and close Anydesk, it would auto suspend again. I've checked the following:

1) Disabled sleep / suspend / hibernation related settings in the Power settings in LxQT.

2) Checked from terminal: gsettings list-recursively org.gnome.settings-daemon.plugins.power output

3) Explicitly set relevant settings to ignore in /etc/systemd/logind.conf logind.conf

4) Nothing out of the ordinary in systemctl list-timers output

5) Nothing unusual when I followed the systemctl log journalctl -f. You can see the message `The system will suspend now! log file

UPDATE With the help of ChatGPT and Gemini, the problem is solved!

1) sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target blocks the suspend operation, even though the underlying cause is not identified.

2) Open an override file for the systemd-logind service: sudo systemctl edit systemd-logind.service and add the following to enable debug logging

[Service]
Environment=SYSTEMD_LOG_LEVEL=debug

followed by sudo systemctl restart systemd-logind.service.

Alternatively, use busctl monitor org.freedesktop.login1 to monitor requests for Suspend.

3) (2) will produce a line before "The system will suspend now!" in the log file. journalctl -b -1 | grep 'system will suspend now' -A 10 -B 10 gives

Aug 04 17:44:25 MACHINE systemd-logind[1004]: Got message type=method_call sender=:1.67 destination=:1.1 path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager member=Suspend  cookie=99 reply_cookie=0 signature=b error-name=n/a error-message=n/a

4) busctl --system list | grep ':1.67' or busctl --user list | grep ':1.67' reveals that it's /usr/lib/unity-settings-daemon/unity-settings-daemon that have been calling org.freedesktop.login1.Manager.Suspend(). Uninstalling unity-settings-daemon eliminated the problem!

5) (1) is important because otherwise I will have to do (4) after a reboot. By that time, the D-Bus sender addresses (e.g., :1.67) will point to a different process.

OpenVPN how to route Internet traffic through a client

author — Sat, 17 Aug 2019 03:35:55 GMT

My use case: I want to route all Internet traffic from machine B through machine A. However, I cannot simply install OpenVPN server on machine A as machine A is behind layers of NATs/firewalls I don't control. My current solution is to install OpenVPN server on machine C, and have both machines A and B connect to C as clients. I'm trying to set up proper routes so that all traffic from B can be routed through A. The setup on each machine and the steps I have attempted are detailed below and my remaining problem is in the second to last paragraph.

Now, machine C runs Linux and OpenVPN server in a Docker container (https://github.com/kylemanna/docker-openvpn). With redirect-gateway def1, both client machines can connect and route traffic through the server (https://ipleak.net confirms the server IP). For the following tests though, redirect-gateway def1 is removed, while topology subnet and client-to-client are added. The server has subnet IP 192.168.255.1 and public IP AAA.BBB.CCC.DDD.

machine A runs Windows and has IPEnabledRouter=1 set in HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\, Service Routing and Remote Access set to Automatic and running, and the network adapter with Internet access set to allow sharing from the OpenVPN TAP adapter. It is assigned 192.168.255.2.

machine B runs Windows and is behind a router with IP 192.168.1.100. It is assigned OpenVPN subnet IP 192.168.255.3. The following routes are added in addition to what OpenVPN sets up automatically:

Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0        128.0.0.0    192.168.255.2    192.168.255.3    259
        128.0.0.0        128.0.0.0    192.168.255.2    192.168.255.3    259
  AAA.BBB.CCC.DDD  255.255.255.255      192.168.1.1    192.168.1.100    291

From machine B, I can ping machine A at 192.168.255.2, but Internet traffic is still routed through the OpenVPN server (ipleak shows AAA.BBB.CCC.DDD). I tried adding a route: route add default gw 192.168.255.2 tun0, but this makes the clients unable to access Internet. The server route table typically looks like:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.19.0.1      0.0.0.0         UG    0      0        0 eth0
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0
192.168.254.0   192.168.255.2   255.255.255.0   UG    0      0        0 tun0
192.168.255.0   0.0.0.0         255.255.255.0   U     0      0        0 tun0

How can I make this work?

[EDIT] A little more context on the use case: I need to set up VPN for a division so that their users' home computers machine B can access third-party resources that restrict access based on IP address. The access to machine A is not blocked, but there are at least two layers of NAT/firewalls up the organization, whose admins do not want to change their setup to help with incoming connections. We therefore want to devise a working solution using `machine C** that may be a VPS as the VPN server. There is an official VPN service but since it is open to certain outside members, the third-party vendor does not wish to allow its IP access.

Solution In principle, the setup should be similar to RoutedLans, except that we cannot simply set machine A to handle 0.0.0.0. This SF answer explains why packets cannot be sent through another client as the gateway using the TUN interface. However, there is a workaround according to the first comment to this answer.

On machine C:

Add the following to the server configuration:

topology subnet
client-to-client

route 1.0.0.0 255.0.0.0
route 2.0.0.0 254.0.0.0
route 4.0.0.0 252.0.0.0
route 8.0.0.0 248.0.0.0
route 16.0.0.0 240.0.0.0
route 32.0.0.0 224.0.0.0
route 64.0.0.0 192.0.0.0
route 128.0.0.0 128.0.0.0

push "route 1.0.0.0 255.0.0.0"
push "route 2.0.0.0 254.0.0.0"
push "route 4.0.0.0 252.0.0.0"
push "route 8.0.0.0 248.0.0.0"
push "route 16.0.0.0 240.0.0.0"
push "route 32.0.0.0 224.0.0.0"
push "route 64.0.0.0 192.0.0.0"
push "route 128.0.0.0 128.0.0.0"

Set iroutes and a static IP for machine A in client-config-dir.

ifconfig-push 192.168.255.2 255.255.255.0
push "route 192.168.255.0 255.255.255.0 192.168.255.1"

iroute 1.0.0.0 255.0.0.0
iroute 2.0.0.0 254.0.0.0
iroute 4.0.0.0 252.0.0.0
iroute 8.0.0.0 248.0.0.0
iroute 16.0.0.0 240.0.0.0
iroute 32.0.0.0 224.0.0.0
iroute 64.0.0.0 192.0.0.0
iroute 128.0.0.0 128.0.0.0

On machine A:

In HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\, set IPEnableRouter=1.
Set service Routing and Remote Access to Automatic and make sure it is running.
Set the network adapter with Internet access to allow sharing from the OpenVPN TAP adapter. It appears that sharing has to be disabled and re-enabled every time the machine is rebooted.

On machine B: make sure redirect-gateway def1 is in the client configuration.

How to rsync all folders present on the destination folder

author — Sat, 03 Aug 2019 17:28:57 GMT

I have two folders FolderA and FolderB as below. I want to rsync the common subfolders. For example, I can do rsync -avzP /path/to/FolderB/* /path/to/FolderA/, which will keep SubFolder1 and SubFolder3 mirrored. My question is how I can achieve the same if FolderB is the destination without explicitly --include or --exclude individual subfolders (e.g., in case there are too many of them).

``` FolderA |--SubFolder1 |--SubFolder2 |--SubFolder3 |--SubFolder4

FolderB |--SubFolder1 |--SubFolder3 ``**

Answer by David C. Rankin If you have a large number of folders under FolderA that you do not want to sync under FolderB, then your other option is to create a text file holding the absolute path to only those SubFolderX under FolderA you want to rsync to FolderB and then use the --no-R and --files-from=folderlist options to only rsync the wanted SubFolders. This will eliminate having to specify a large number of --filter options on the command line.

For example, you can create your folderlist with:

find /path/to/FolderA -maxdepth 1 -type d > folderlist

(note: specify the absolute path above and find will produce the folderlist file containing absolute paths)

Now edit your folderlist file and remove the parent directory (e.g. /path/to/FolderA) and any SubFolders you don't want to sync under FolderB. You can now use the folderlist file to control which SubFolders under FolderA are sync'ed to FolderB without having to include a long list of filters on the command line. Your command line then becomes

rsync -uai -r --no-R --files-from=folderlist / /path/to/FolderB

(note: the '/' as source serves as a base for the paths contained in folderlist. You can change the -i option to control the level of information dumped to the screen, e.g. -v, etc... or remove it altogether to suppress any reporting other than errors)

(also note: when using --files-from, -a does not imply -r (recursive), so you will need to explicitly add -r if you need a recursive transfer)

How to force GPG to use console-mode pinentry for passwords

author — Wed, 20 Feb 2019 03:41:41 GMT

Answer to this SU question

On Ubuntu 18.04, with the default installation of gpg 2.2.4, I have

/usr/bin/pinentry
/usr/bin/pinentry-gnome3
/usr/bin/pinentry-gtk-2
/usr/bin/pinentry-x11

I was able to do the following to have a text-based PIN entry:

export GPG_TTY=$(tty)
gpg-connect-agent updatestartuptty /bye >/dev/null

Self-hosting Feedbin with Docker and OpenShift

author — Fri, 25 May 2018 17:32:49 GMT

Feedbin is an excellent RSS feed reader. You can sign up for its service and support its development. The company is gracious enough to offer its source code for DIYers to play with.

Prerequisites

API keys for Stripe and Skylight are required for running Feedbin. In addition, you need to pick a password for the PostgreSQL database. Populate the information in these two files:

db.env:

POSTGRES_PASSWORD=ChangeMe!
POSTGRES_DB=feedbin
POSTGRES_USER=feedbin

secrets.env:

PUSH_URL=http://feedbin.yourdomain.tls
SECRET_KEY_BASE=48_bit_secret
SKYLIGHT_AUTHENTICATION=
STRIPE_API_KEY=
STRIPE_PUBLIC_KEY=

Running Feedbin with Docker

You can find two Docker images here and here. The first image has to be used together with postgres, redis, memcached, elasticsearch, and nginx. The second image is all-in-one, minus postgres.

For the all-in-one image, you just need docker-compose.yml below in the same directory as the two files above. Then, run docker-compose up -d, and your Feedbin instance can be found at http://localhost:3000

docker-compose.yml:

version: '3'

services:
  db:
    image: postgres:10.4
    restart: always
    env_file:
      - db.env
    volumes:
      - db:/var/lib/postgresql/data

  app:
    image: rocwhite/feedbin-aio
    restart: always
    environment:
      - POSTGRES_HOST=db
    env_file:
      - db.env
      - secrets.env
    volumes:
      - app:/srv/apps/feedbin/current/public
    depends_on:
      - db

volumes:
  db:
  es:
  app:

With the other image, use this docker-compose.yml instead, along with a nginx.conf file.

docker-compose.yml:

version: '3'

services:
  db:
    image: postgres:10.4
    restart: always
    env_file:
      - db.env
    volumes:
      - db:/var/lib/postgresql/data

  rds:
    image: redis:3.2
    restart: always

  mcd:
    image: memcached:1.5
    restart: always

  es:
    image: elasticsearch:2.4
    restart: always
    volumes:
      - es:/usr/share/elasticsearch/data

  app:
    image: rocwhite/feedbin
    restart: always
    environment:
      - POSTGRES_HOST=db
      - MEMCACHED_HOST=mcd
      - REDIS_HOST=rds
      - ELASTIC_SEARCH_HOST=es
    env_file:
      - db.env
      - secrets.env
    volumes:
      - app:/srv/apps/feedbin/current/public
    depends_on:
      - db
      - rds
      - mcd
      - es

  web:
    image: nginx
    restart: always
    volumes:
      - app:/srv/apps/feedbin/current/public:ro
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - app

volumes:
  db:
  es:
  app:

nginx.conf:

## Lines starting with two hashes (##) are comments with information.
## Lines starting with one hash (#) are configuration parameters that can be uncommented.
##
###################################
##         configuration         ##
###################################
##
## See installation.md#using-https for additional HTTPS configuration details.

upstream app {
  server app:3000;
}

## Normal HTTP host
server {
  listen 0.0.0.0:80 default_server;
  listen [::]:80 ipv6only=on default_server;
  server_tokens off; ## Don't show the nginx version number, a security best practice
  root /srv/apps/feedbin/current/public;

  ## Increase this if you want to upload large attachments
  client_max_body_size 20m;

  ## Individual nginx logs for this vhost
  access_log  /var/log/nginx/access.log;
  error_log   /var/log/nginx/error.log;

  location / {
    ## Serve static files from defined root folder.
    ## @app is a named location for the upstream fallback, see below.
    try_files $uri $uri/index.html $uri.html @app;
  }

  ## If a file, which is not found in the root folder is requested,
  ## then the proxy passes the request to the upsteam (unicorn).
  location @app {
    ## If you use HTTPS make sure you disable gzip compression
    ## to be safe against BREACH attack.
    # gzip off;

    proxy_read_timeout      300;
    proxy_connect_timeout   300;
    proxy_redirect          off;

    proxy_set_header    Host                $http_host;
    proxy_set_header    X-Real-IP           $remote_addr;
    proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
    proxy_set_header    X-Forwarded-Proto   $scheme;
    proxy_set_header    X-Frame-Options     SAMEORIGIN;

    proxy_pass http://app;
  }

  ## Enable gzip compression as per rails guide:
  ## http://guides.rubyonrails.org/asset_pipeline.html#gzip-compression
  ## WARNING: If you are using relative urls remove the block below
  ## See config/application.rb under "Relative url support" for the list of
  ## other files that need to be changed for relative url support
  location /assets/ {
    gzip_static on; # to serve pre-gzipped version
    expires max;
    add_header Cache-Control public;
  }

  error_page 502 /502.html;
}

Running Feedbin on OpenShift

You probably need a Pro instance with > 1GB memory to run Feedbin. Once you create a new project, import db.env and secrets.env (see above) as secrets:

oc create secret generic feedbin-db --from-env-file=./db.env --type=opaque
oc create secret generic feedbin-secrets --from-env-file=./secrets.env --type=opaque

Then create a new app using the template file below.

oc new-app -f ./openshift-aio.yml

openshift-aio.yml

apiVersion: v1
kind: Template
metadata:
  name: feedbin
objects:
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: data
  spec:
    accessModes:
    - ReadWriteOnce
    resources:
      requests:
        storage: 1Gi
- apiVersion: v1
  kind: ImageStream
  metadata:
    labels:
      app: feedbin
    name: feedbin
  spec:
    lookupPolicy:
      local: false
    tags:
    - from:
        kind: DockerImage
        name: rocwhite/feedbin-aio
      importPolicy: {}
      name: latest
      referencePolicy:
        type: Source
- apiVersion: v1
  kind: DeploymentConfig
  metadata:
    labels:
      name: feedbin
    name: feedbin
  spec:
    replicas: 1
    selector:
      deploymentconfig: feedbin
    strategy:
      activeDeadlineSeconds: 21600
      recreateParams:
        timeoutSeconds: 600
      resources: {}
      type: Recreate
    template:
      metadata:
        name: feedbin
        labels:
          name: feedbin
          deploymentconfig: feedbin
      spec:
        containers:
          - name: db
            image: registry.access.redhat.com/rhscl/postgresql-10-rhel7
            env:
              - name: POSTGRESQL_DATABASE
                valueFrom:
                  secretKeyRef:
                    key: POSTGRES_DB
                    name: feedbin-db
              - name: POSTGRESQL_PASSWORD
                valueFrom:
                  secretKeyRef:
                    key: POSTGRES_PASSWORD
                    name: feedbin-db
              - name: POSTGRESQL_USER
                valueFrom:
                  secretKeyRef:
                    key: POSTGRES_USER
                    name: feedbin-db
            volumeMounts:
              - name: feedbin-data
                mountPath: /var/lib/pgsql/data
                subPath: psql-data
            resources:
              limits:
                cpu: 150m
                memory: 100Mi
          - name: feedbin
            image: rocwhite/feedbin-aio
            imagePullPolicy: Always
            env:
              - name: NUM_UNICORN_WORKER
                value: "2"
              - name: discovery.type
                value: "single-node"
              - name: PUSH_URL
                value: 'http://feedbin.yourdomain.tls
              - name: SECRET_KEY_BASE
                valueFrom:
                  secretKeyRef:
                    key: SECRET_KEY_BASE
                    name: feedbin-secrets
              - name: SKYLIGHT_AUTHENTICATION
                valueFrom:
                  secretKeyRef:
                    key: SKYLIGHT_AUTHENTICATION
                    name: feedbin-secrets
              - name: STRIPE_API_KEY
                valueFrom:
                  secretKeyRef:
                    key: STRIPE_API_KEY
                    name: feedbin-secrets
              - name: STRIPE_PUBLIC_KEY
                valueFrom:
                  secretKeyRef:
                    key: STRIPE_PUBLIC_KEY
                    name: feedbin-secrets
              - name: POSTGRES_DB
                valueFrom:
                  secretKeyRef:
                    key: POSTGRES_DB
                    name: feedbin-db
              - name: POSTGRES_PASSWORD
                valueFrom:
                  secretKeyRef:
                    key: POSTGRES_PASSWORD
                    name: feedbin-db
              - name: POSTGRES_USER
                valueFrom:
                  secretKeyRef:
                    key: POSTGRES_USER
                    name: feedbin-db
            resources:
              limits:
                cpu: 1350m
                memory: 770Mi
            volumeMounts:
              - name: feedbin-data
                mountPath: /usr/share/elasticsearch/data
                subPath: es-data
        volumes:
          - name: feedbin-data
            persistentVolumeClaim:
              claimName: data
        restartPolicy: Always
    test: false
    triggers:
    - type: ConfigChange
    - imageChangeParams:
        automatic: true
        containerNames:
        - feedbin
        from:
          kind: ImageStreamTag
          name: feedbin:latest
          # namespace:
      type: ImageChange
- apiVersion: v1
  kind: Service
  metadata:
    name: feedbin
  spec:
    ports:
    - name: web
      port: 8080
      protocol: TCP
      targetPort: 3000
    selector:
      name: feedbin
    sessionAffinity: None
    type: ClusterIP
- apiVersion: v1
  kind: Route
  metadata:
    name: feedbin
  spec:
    host:
    port:
      targetPort: web
    tls:
      insecureEdgeTerminationPolicy: Redirect
      termination: edge
    to:
      kind: Service
      name: feedbin
      weight: 100
    wildcardPolicy: None