fmac's blog

Connect FWA modem to Mikrotik router

Sat, 11 Oct 2025 00:00:00 +0000

Connect FWA modem to Mikrotik router

Due to issues outside of my control (probably the issue is Italy) I can’t get FTTH Internet connection.
The best I can have for now is FWA (Fixed Wireless Access). 300 Mbps. Nowhere close to fiber speed, but I’m not complaining.

For FWA plans, the ISP usually sells you (there’s no choice because fuck you) their shitty router and the “5G antenna” which is a PoE modem plus the antenna.

I’m fine with using their modem but using their WiFi router is just stupid. I want to get rid of it and connect the modem directly to my Mikrotik router.

Info gathering

In my case the router is a Zyxel device, so not the worst shit you might get from an ISP.
It exposes a web UI that offers a decent level of customization. At least enough for me to understand what’s going on between the two devices.

It has a bunch of interfaces already configured, most of them are useless. “FWA_data” is obviously the one I need to replicate on my Mikrotik. Let’s have a look at its details.

“Encapsulation” is set to IPoE. So it expects common IP packets, nothing more complicated such as PPPoE with credentials. Makes sense, auth should be handled by the 5G modem, where you install the SIM card.
“Obtain an IP Address Automatically”. OK, it clearly has a DHCP client on this interface.
VLAN 802.1q is enabled, and it says “10”. Clearly this interface expects tagged frames with VLAN ID 10.
“NAT” is enabled. OK, I guess we’ll add a masquerade rule.

These are the interesting parts of config I have to port to the Mikrotik.

Mikrotik setup

I have a hAP ax³. Info.
I’ll connect the modem to ether1.
Well, there is a PoE injection in the middle, but nothing to worry about. By the way, ether1 offers PoE out, so I tried to power the modem without the injector, but it wasn’t enough. Enough what? I don’t know, I didn’t investigate. I guess voltage too low. The hAP didn’t even detected the modem as a PoE device.

I’m on RouterOS 7.20.1.

First I attached a DHCP client to ether1, just to see if I get an IP.
Make sure to remove ether1 from bridges before attaching a DHCP client to it.

/ip dhcp-client
add add-default-route=no default-route-tables=main interface=ether1 use-peer-dns=no use-peer-ntp=no

And the modem really gave me an IP. I’m not sure it’s useful for anything, since the modem won’t work as gateway on this network. Maybe it’s exposing some management interface here though. But I didn’t look for it yet.

[fmac@MikroTik_hAP_ax3] > /ip/dhcp-client/print where interface=ether1
Columns: INTERFACE, USE-PEER-DNS, ADD-DEFAULT-ROUTE, STATUS, ADDRESS
# INTERFACE  USE-PEER-DNS  ADD-DEFAULT-ROUTE  STATUS  ADDRESS           
0 ether1     no            no                 bound   192.168.252.150/24

Now I know for sure that VLAN 10 is required. So let’s create VLAN10 on ether1.

/interface vlan
add comment="windtre FWA" interface=ether1 name=VLAN10 vlan-id=10

Then another DHCP client to beg for an address on VLAN 10.

/ip dhcp-client
add add-default-route=yes allow-reconfigure=no check-gateway=none comment="windtre FWA" \
    default-route-distance=1 default-route-tables=main dhcp-options=hostname,clientid disabled=no \
    interface=VLAN10 use-broadcast=both use-peer-dns=no use-peer-ntp=no

Good, we got an IP.

[fmac@MikroTik_hAP_ax3] > /ip/address/print where interface=VLAN10
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
 #   ADDRESS            NETWORK         INTERFACE
10 D 100.RE.DAC.TED/29  100.RE.DAC.TED  VLAN10

Finally add a NAT rule to masquerade.
In my case I have to make sure VLAN10 is in the WAN list.

/ip firewall nat
add action=masquerade chain=srcnat comment="WAN masquerade" out-interface-list=WAN

Test

And it works!

[fmac@MikroTik_hAP_ax3] > /tool/ping address=9.9.9.9
  SEQ HOST                                     SIZE TTL TIME       STATUS                                
    0 9.9.9.9                                    56  53 32ms468us

Deploying Anubis in front of my pastebin

Fri, 18 Apr 2025 00:00:00 +0000

Deploying Anubis in front of my pastebin

Anubis is getting a lot of attention recently. Since I love trying out new interesting projects, here I am deploying it to protect my pastebin. Not that Pasticcio really needs it, but f*ck AI bots, so…

The pastebin is a K8s Deployment. I don’t have an Ingress. HAProxy is the SSL termination, and forwards to the NodePort of the Service.
Of course Anubis must go between them.
I have to decide how to deploy Anubis: as a system service or in Kubernetes?

I could not find an official Helm chart, but they already provide the Docker image.
I’ll put down a chart. It should be pretty easy.
Spoiler: the chart

Helm chart

helm create anubis

At the moment of writing 1.16 is the latest, so let’s put it in the values.

image:
  repository: ghcr.io/techarohq/anubis
  tag: "v1.16.0"

Then a section for the custom environment:

env:
  DIFFICULTY: 4
  SERVE_ROBOTS_TXT: "true"
  TARGET: "http://pasticcio:4000"

The probes required adding a header for the client (the probe) IP. The check won’t pass without it.

livenessProbe:
  httpGet:
    path: /
    port: 8923
    httpHeaders:
      - name: x-real-ip
        value: 127.0.0.1
readinessProbe:
  httpGet:
    path: /
    port: 8923
    httpHeaders:
      - name: x-real-ip
        value: 127.0.0.1

And this is basically it.
Deployed with: helm upgrade -n pasticcio --cleanup-on-fail --install -f custom-values.yaml anubis .

Edited the HAProxy config to forward to the Anubis NodePort. Done.

Why stream error stream ID 1; CANCEL; received from peer?

Mon, 31 Mar 2025 00:00:00 +0000

Why `stream error: stream ID 1; CANCEL; received from peer`?

Few days ago my GMC Map proxy stopped working.
This is the service I made few years ago to fasten the data loading of my app.
The gmcparse program sends an HTTP GET request and matches a bunch of regexes on the response to extract useful data for the app.
All I know from the pod log is that the server is resetting connections from my client.

From gmcparse:

/ $ gmcparse 
main.go:48: INFO: Fetching https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0
main.go:52: Get "https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0": stream error: stream ID 1; CANCEL; received from peer

Request to the same URL from the same IP: no problems.

[fmac@kube1 ~]$ curl -I 'https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0'
HTTP/2 200 
cache-control: private
content-length: 575571
content-type: text/html
server: Microsoft-IIS/10.0
set-cookie: ASPSESSIONIDQGTTSSRD=JKEEPBDBOEIKLDFLAIPPNJAC; secure; path=/
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin
date: Mon, 31 Mar 2025 21:36:24 GMT

OK, they’re not blocking my IP.

Let me try locally with the same image.

docker pull camuffo/gmcmap-parser:latest
[I] fmac@absinthe ~ (main) [1]> docker run --rm -it camuffo/gmcmap-parser:latest gmcparse
main.go:48: INFO: Fetching https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0
main.go:52: Get "https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0": stream error: stream ID 1; CANCEL; received from peer

Same issue.

Does rebuilding the program with the latest Go fix it?

[I] fmac@absinthe ~/s/gqelectronics-gmcmap-parser (main)> go build main.go
[I] fmac@absinthe ~/s/gqelectronics-gmcmap-parser (main)> ./main
main.go:48: INFO: Fetching https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0
main.go:52: Get "https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0": stream error: stream ID 1; CANCEL; received from peer

No.

I wanna see what’s going on.

[I] fmac@absinthe ~ (main) [1]> yay -S zaproxy
[I] fmac@absinthe ~ (main)> export _JAVA_OPTIONS='-Dsun.java2d.uiScale=2.5' # (java lol)
[I] fmac@absinthe ~ (main)> zaproxy

doas mv zap_root_ca.cer /usr/share/ca-certificates/trust-source/anchors/
doas update-ca-trust

[I] fmac@absinthe ~/s/gqelectronics-gmcmap-parser (main)> export http_proxy=127.0.0.1:8080
[I] fmac@absinthe ~/s/gqelectronics-gmcmap-parser (main)> export https_proxy=127.0.0.1:8080
[I] fmac@absinthe ~/s/gqelectronics-gmcmap-parser (main)> ./main
main.go:48: INFO: Fetching https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0
main.go:68: INFO: Deduplicated 0 lines
main.go:70: INFO: Parsing 5102 bytes, 0 lines (\r)
main.go:172: INFO: Parsed 0 mearuments
[]

On ZAP:

Nothing unexpected here. The Java client is getting a reset as well. Not a problem with the Go client.

This is when my fear of GQ Electronics having done something sad started to grow over the expectations.

Please, don’t tell me you banned the Go user agent string.

And apparently, yes, they did.
This is very sad.
I don’t wanna think they banned this UA string because of my service. Probably they were bothered by other bots. I might end up asking them the reason behind this in the forum. In any case, since they were not so nice to whitelist my IP, from now on I’ll present myself with the motherfucking Chrome user agent string.

Let me patch the program to support customizing the UA string.

--- a/main.go
+++ b/main.go
@@ -30,14 +30,15 @@ type Measurement struct {
 }
 
 var url string
+var uaString string
 
 func init() {
        const (
                defaultUrl = "https://gmcmap.com/ajaxm.asp?OffSet=0&Limit=1000000&dataRange=1&timeZone=0"
-               usage      = "URL"
        )
-       flag.StringVar(&url, "url", defaultUrl, usage)
-       flag.StringVar(&url, "u", defaultUrl, usage+" (shorthand)")
+       flag.StringVar(&uaString, "useragent", "", "User-agent string")
+       flag.StringVar(&url, "url", defaultUrl, "URL")
+       flag.StringVar(&url, "u", defaultUrl, "URL (shorthand)")
 }
 
 func main() {
@@ -47,7 +48,22 @@ func main() {
 
        errLog.Printf("INFO: Fetching %v", url)
 
-       resp, err := http.Get(url)
+       client := &http.Client{
+               Transport: &http.Transport{
+                       Proxy: http.ProxyFromEnvironment,
+               },
+       }
+
+       req, err := http.NewRequest("GET", url, nil)
+       if err != nil {
+               errLog.Fatalf("ERROR: creating HTTP request: %v", err)
+       }
+
+       if uaString != "" {
+               req.Header.Set("User-Agent", uaString)
+       }
+
+       resp, err := client.Do(req)
        if err != nil {
                errLog.Fatal(err)
        }

commit

Let’s try this.

./main -useragent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36'

OK. I’ll fix the Dockerfile to support this and roll out.

This was really a bad surprise from GQ Electronics, since they manufactured two of my beloved dosimeters.

My first desktop PC

Sat, 29 Mar 2025 00:00:00 +0000

My first desktop PC

2025-03-29

I’ve only owned laptops all my life. Recently I felt the desire for a powerful desktop PC.

I decided to assemble it myself to save some money.
I planned to spend ~1500 euros. At the end the total spent was ~1700 euros.

Motherboard

I wanted a small board, but big enough to fit two NVMes and a decent graphic card. The Micro-ATX is best compromise for me.
Turns out my favourite form factor is the cheapest one. Happy about it.

GIGABYTE B850M AORUS ELITE WIFI6E ICE

€284,88

CPU

Knowing nothing about the state of the art of CPUs, I started from the latest and greatest Ryzen (which I believe is the 9950X3D). It costs a bit too much for me. After a bit of specs/prices comparisons I decided for the 9900X, which again is a good compromise for me.

AMD Ryzen 9900X

AM5. 12 cores up to 5.6 GHz. 120W TDP. 76MB cache.

€495,67

Cooler

I’m cooling it with some liquid.

MSI MAG CORELIQUID E240

€99

RAM

Hmm… Enough of it and fast enough sounds good.

2 x 16 GB. 6000MHz DDR5.

€89,8

Storage

I bought a new NVMe. Never had problems with Crucial.

Crucial P3 Plus 1 TB. M2 2280.

€77,99

Power supply

I don’t know exactly how much power I’ll need but 850 W will be enough.

I got one that should be good in terms of power efficiency.
Something with PLATINUM written on it should be OK. See 80 Plus.

Corsair SF850

€199,9

Case

I like seeing what’s inside. It needs glass. Also want it to be small.

Mars Gaming MC-SE

Cons: it lacks a USB C port.

€45,5

GPU

Fuck Nvidia.

The best from AMD costs too much. I got something that’s just OK. Hopefully I’ll upgrade in the future. The PCIe 5 slot on the MB is quite future proof.

Radeon RX 7600 XT (GIGABYTE board)

16 GB RAM

€357,12

Build

Looks good :D

Notes

The ATX cable and the CPU cable provided with the PSU were too short.
I had to buy two extensions.

€12,8

Moving searx from Hetzner to 1984

Tue, 25 Jul 2023 00:00:00 +0000

Moving searx from Hetzner to 1984

2023-07-25

My Searx instance started one day at Exoscale. It’s a great VPS provider, but at some point 9 €/month felt too much.

For the last few months Hetzner hosted my instance smoothly. Sadly, I recentry received this abuse report.

Dear Sir or Madam,

Thank you for your statement.

-----
I'm hosting a metasearch engine.
What is happening is supposed to happen.
-----

Then please stop hosting that service and move it to another provider.

We can give you 48 hours to confirm that, otherwise we will lock the IP.

Important: Please leave [AbuseID:<redacted>] unchanged in the subject line when replying directly to this report.

Kind regards

Abuse Team

[...]

> Dear Mr Francesco Camuffo,
>
> We have received an abuse report from anti-abuse-external@google.com.
>
> Please check the report for details and fix any (potential) problems:
>
> -----
> +-------------------------+--------------------------+----------+---------------------+
> | Source                  | Destination              | DestPort | Time_UTC            |
> +-------------------------+--------------------------+----------+---------------------+
>
>  2a01:4f8:1c17:7a52::1, 2a00:1450:4001:829::2004 ,443, 2023-07-17 22:09:54 
>
> -----
>
> We will need a reply from you within the next *24 hours*.
>
> Once you have resolved any problems or if you think there is no problem, please send us a statement. This statement should let us know what the problem was, how you resolved it and what steps you have taken to prevent it from happening again. Otherwise it should let us know why exactly you think the report is not valid.
>
> Please send us the statement via the following link: https://abuse.hetzner.com/statements/?token=<redacted>
>
> If you fail to comply within the stated deadline, the IP may be locked according to 8.4. of our Terms and Conditions (https://www.hetzner.com/legal/terms-and-conditions).
>
> Important: Please leave [AbuseID:<redacted>] unchanged in the subject line when replying directly to this report.
>
> Kind regards
>
> Abuse Team
>
> Hetzner Online GmbH
> Industriestr. 25
> 91710 Gunzenhausen / Germany
> Tel: +49 9831 505-0
> Fax: +49 9831 505-3
> abuse@hetzner.com
> www.hetzner.com
>
> Register Court: Registergericht Ansbach, HRB 6089
> CEO: Martin Hetzner, Stephan Konvickova, Günther Müller

First of all: fu*k google.
Second: I have to find a new home for my instance.

I want to stay in a nice country, so there are few options.
1984.is is definitely worth a try.
I went with the cheapest VPS they offer. 4.5 €/month is acceptable. Sadly, prices scale bad.

First thing I loved after buying: this nice plain-text email.

Dear Customer,

Your vps is now ready for install. As requested we didn't install a operating system on your vps.  You have access to the following images. If you feel your favorite image is missing let us know.  No, Windows will never be available. 🙂

Available images:
AlmaLinux-8.8
Debian GNU/Linux Bookworm 12.0
mikrotik-7.10beta8
Ubuntu 22.10-live-server
Calculate Linux Scratch 23
Android 9.0-r2
AlmaLinux-9.2
9front-9442
Kodachi 8.26
Tails 5.5
Mikrotik 7.6
Hyperbola v0.4.1[0]
hrmpf 20211227
Fedora Server 37-1.7
ClearOS 7, Community Edition
Ubuntu-22.04.1
openSUSE-Leap-15.3
Rocky-9.0-20220805.0
Trisquel 10.0.1 GNU/Linux
NetBSD-9.2
Trisquel 9.0.1 GNU/Linux
Devuan Chimaera 4.0
OpenBSD install 7.3
Parrot-security-4.11.2
OPNsense-21.7.1
Trisquel GNU/Linux
pfSense-CE-2.5.1
3CX Debian
OpenBSD install 6.9
Ubuntu-21.04
Ubuntu Server 20.10
Debian Bullseye 11.1.0
CentOS-9
Fedora Server 35-1.2
Rancher 1.0
proxmox-mailgateway_6.3-1
hyperbola-milky-way-v0.3.1
Devuian ascii 2.1
Ubuntu Server 18.04 LTS
OpenBSD install 6.6
void-live-x86_64-20191109
grml64-small_2021.07
Debian 9.3 Stretch 64bit
Alpine Linux 3.17.0
FreePBX-64bit-10.13.66
Fedora Server 23
Parabola GNU/Linux-libre 2020.08.03
Ubuntu Server 16.04 LTS
archlinux-2022.06.01
Gentoo 20220102
FreeBSD-13.2
CentOS-7-x86_64-NetInstall-2009
HardenedBSD-13-stable-bootonly
ubuntu-18.04.4
artix-base-s6-20201109
UCS 4.4
manjaro-architect-20.0.3-200607
NixOS minimal 22.05
turnkey-mattermost-16.0-buster
Ubuntu Server 20.04
CentOS-8.1.1911-x86_64
CentOS-8-x86_64-1905
Slackware 15.0
Kha-OS-Stable-Pentest-Edition.082022.Oficial
LibertBSD6.1
Ubuntu Server 19.04
Debian 10.0 Buster 64bit
guix-system-install-1.4.0
DragonFlyBSD-5.4.1
System Rescue CD 8.04-amd64

Regards, 1984 Hosting.
1984 ehf. | P.O. Box 126, 121 Reykjavik ICELAND | Sími: 00354 546 1984 | 1984@1984.is

Such a juicy selection of ISOs intrigued me. c:
Of course I went with Alpine.
By the way, here is how you could host Searxng on Alpine.

I’m currently waiting for the next report…

Hostign Searxng on Alpine

Tue, 25 Jul 2023 00:00:00 +0000

Hosting Searxng on Alpine

2023-07-25

Here’s how you could host Searxng on Alpine Linux.

Note that I don’t wish to create a venv.

[ $(id -u) -eq 0 ] || exit 1

apk add git python3 py3-gunicorn py3-pip py3-yaml

mkdir /usr/local/searx
addgroup -S searx
adduser -S -D -h /usr/local/searx -s /sbin/nologin -G searx searx
chown -R searx:searx /usr/local/searx
doas -u searx git clone https://github.com/searxng/searxng.git /usr/local/searx/searx-src
doas -u searx pip install -r /usr/local/searx/searx-src/requirements.txt

Follow the official guide for the /etc/searxng/settings.yml stuff and then try to run.

cd /usr/local/searx/
doas -u searx gunicorn -b 127.0.0.1:8001 --chdir /usr/local/searx/searx-src/searx --pythonpath /usr/local/searx/searx-src searx.webapp

Hope to see something like this:

/usr/local/searx # doas -u searx gunicorn -b 127.0.0.1:8001 --chdir /usr/local/searx/searx-src/searx --pythonpath /usr/local/searx/searx-src searx.webapp
[2023-07-25 21:40:38 +0000] [2837] [INFO] Starting gunicorn 20.1.0
[2023-07-25 21:40:38 +0000] [2837] [INFO] Listening at: http://127.0.0.1:8001 (2837)
[2023-07-25 21:40:38 +0000] [2837] [INFO] Using worker: sync
[2023-07-25 21:40:38 +0000] [2838] [INFO] Booting worker with pid: 2838

Now you got searxng running but if you want it public we should prepare filtron and morty, and make them services. 🥵

doas apk add go
go install github.com/asciimoo/filtron@latest
go install github.com/asciimoo/morty@latest
doas mv ~/go/bin/filtron ~/go/bin/morty /usr/local/bin

doas addgroup -S filtron
doas adduser -S -D -H -s /sbin/nologin -G filtron filtron
doas addgroup -S morty
doas adduser -S -D -H -s /sbin/nologin -G morty morty

Now, let me omit obvious explainations. The point is you should get to have something like this:

searx:~$ cat /etc/init.d/filtron
#!/sbin/openrc-run

supervisor=supervise-daemon
name=filtron
command="/usr/local/bin/filtron"
command_args="-api '127.0.0.1:4005' -listen '127.0.0.1:4004' -rules '/etc/filtron/rules.json' -target '127.0.0.1:8001'"
command_user="${FILTRON_USER:-filtron}"
pidfile="/run/filtron.pid"

depend() {
  need net
  after firewall
}
searx:~$ doas rc-service filtron start
 * Starting filtron ...                                                    [ ok ]
searx:~$ doas rc-update add filtron
 * service filtron added to runlevel default

searx:~$ cat /etc/init.d/morty
#!/sbin/openrc-run

supervisor=supervise-daemon
name=morty
command="/usr/local/bin/morty"
command_user="${FILTRON_USER:-morty}"
supervise_daemon_args="--env DEBUG=false --env MORTY_ADDRESS=127.0.0.1:3000 --env MORTY_KEY=<your secret key generated with `openssl rand -base64 33`>"
pidfile="/run/morty.pid"

depend() {
  need net
  after firewall
}
searx:~$ doas rc-service morty start
 * Starting morty ...                                                      [ ok ]
searx:~$ doas rc-update add morty
 * service morty added to runlevel default

searx:~$ cat /etc/init.d/searx
#!/sbin/openrc-run

supervisor=supervise-daemon
name=searx
command="/usr/bin/gunicorn"
command_args="-b 127.0.0.1:8001 --chdir /usr/local/searx/searx-src/searx --pythonpath /usr/local/searx/searx-src searx.webapp"
command_user="${SEARX_USER:-searx}"
pidfile="/run/searx.pid"

depend() {
  need net
  after firewall
}
searx:~$ doas rc-service searx start
 * Caching service dependencies ...                                                                        [ ok ]
 * Starting searx ...                                                                                      [ ok ]
searx:~$ doas rc-update add searx
 * service searx added to runlevel default

Got it?

searx:~$ doas netstat -ltp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 searx.searx.fmac.xyz:8001 0.0.0.0:*               LISTEN      4526/gunicorn: mast
tcp        0      0 searx.searx.fmac.xyz:4005 0.0.0.0:*               LISTEN      4337/filtron
tcp        0      0 searx.searx.fmac.xyz:4004 0.0.0.0:*               LISTEN      4337/filtron
tcp        0      0 searx.searx.fmac.xyz:3000 0.0.0.0:*               LISTEN      4367/morty

Cool. We can now serve this through a nice reverse proxy.

doas apk add caddy

searx:~$ cat /etc/caddy/Caddyfile
# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile

searx.fmac.xyz {
    tls {
        protocols tls1.2 tls1.3
        ciphers TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
    }

    root * /usr/local/searx/searx-src/searx

    @static {
        method GET
        path /static/*
    }
    file_server @static

    @searx {
        not path /static/*
        not path /morty/*
    }
    reverse_proxy @searx 127.0.0.1:4004 {
        header_up X-Real-IP {http.request.remote.host}
    }

    reverse_proxy /morty/* 127.0.0.1:3000 {
        header_up Host {http.reverse_proxy.upstream.hostport}
        header_up X-Real-IP {http.request.remote.host}
    }

    header * Strict-Transport-Security "max-age=63072000"
    header * Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'"
    header * Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self'; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src * data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com"
    header * X-Frame-Options "SAMEORIGIN"
    header * -Server

    encode zstd gzip

    log {
        output file /var/log/caddy/searx.fmac.xyz.access.log {
            roll_size 1gb
            roll_keep 12
            roll_keep_for 48h
        }
        level error
    }
}

searx:~$ doas rc-service caddy start
searx:~$ doas rc-update add caddy

Enjoy c:

Fuck you, Discord

Tue, 1 Nov 2022 00:00:00 +0000

Fuck you, Discord

2022-11-01

I already knew Discord is a piece of malware masked as messaging app.
I tought it was also simple to join and use, to attract joyous soydevs.

Today I couldn’t try the piece of garbage.
The reason is explained in this short timeline. T in minutes.

T+0 I create an account, process that requires my email and phone number. Sad but acceptable.
T+2 My account gets disabled for «Violation of TOS/Community Guidelines».

Not that I give a shit about Discord. My problem is that I wasn’t able to interact with the atlasgo community!

Nevertheless, I let someone at Discord know that I’m gravely disappointed.

Fuck you, Discord!
Fuck you, projects choosing discord!

mastorant

UPDATE @ 2022.11.02

Nelly kindly gave me my account back.

Yggdrasil my computers

Tue, 9 Aug 2022 00:00:00 +0000

Yggdrasil my computers

2022-08-09

Yggdrasil is a thing of beauty. A smart and easy-to-use implementation of an overlay network.
I’ve equipped most of my servers, my PCs and my phone with this daemon, building a mesh network over all my beloved computers.

I’ll keep updated this list of my nice use cases.

Workaround the lack of IPv6

I don’t have IPv6 connectivity at home. Accessing my IPv6-only VPS would not be immediate. But with yggdrasil I just need to have a route to it, via another IPv4 VPS I can peer to.
Now I can psql into my backend (which doesn’t need IPv4 at all) across a securely encrypted tunnel, provided the middle peer stays up.
It also saves me the money needed to reserve a precious IPv4 address. \o/

Naransa overview

Mon, 16 May 2022 00:00:00 +0000

Naransa overview

2022-05-16

Overview of my handmade Orange Dark Terror clone, the Naransa Dark Checco.

Unleash Linux process

Sun, 30 Jan 2022 00:00:00 +0000

Unleash Linux process

2022-01-30

If you execute ulimit -a in a shell

$ ulimit -a
-t: cpu time (seconds)              unlimited
-f: file size (blocks)              unlimited
-d: data seg size (kbytes)          unlimited
-s: stack size (kbytes)             8192
-c: core file size (blocks)         0
-m: resident set size (kbytes)      unlimited
-u: processes                       95020
-n: file descriptors                1024
-l: locked-in-memory size (kbytes)  64
-v: address space (kbytes)          unlimited
-x: file locks                      unlimited
-i: pending signals                 95020
-q: bytes in POSIX msg queues       819200
-e: max nice                        0
-r: max rt priority                 0
-N 15:                              unlimited

it shows various resource limits imposed to the process. Same limits will eventually be inherited by the shell children.

In this case, you can observe Alpine Linux being quite restrictive on the maximum locked-in-memory size (64KB). This is usually not a problem, but particular programs might have a difficult time in such restricted environment. An example is Ardour, at the time of writing, my DAW of choice. If I just run it, the first thing it does is complaining. It wants the opportunity to lock more memory.

$ ardour6
WARNING: Your system has a limit for maximum amount of locked memory!
         This might cause Ardour to run out of memory before your system runs
         out of memory. You can view the memory limit with 'ulimit -l', and it
         is normally controlled by /etc/security/limits.conf
Ardour6.9.0 (built using 6.9 and GCC version 10.3.1 20210625)

Looking for help, I couldn’t find a solution that applied to my case. Most suggestions were about editing /etc/security/limits.conf. Here you can customize global limits for the user session. A comment in the same file reads: #This file sets the resource limits for the users logged in via PAM.. If I logged in via a display manager such as LightDM, that would probably work, as PAM would happily set my custom limits. The problem is I don’t use a DM. I use a simple login shell, which doesn’t go through PAM.

I believe PRLIMIT(1) could be a workaround. This tool allows to set limits of a running process. So I prepared 2 sh lines that do the trick.

#!/bin/sh -eux
doas /usr/bin/prlimit --pid $$ --memlock=unlimited
exec "$@"

This script:

unlimits the maximum locked memory for itself ($$);
replaces itself (exec) with whatever is passed inside $@.

Because it needs root to increase a hard limit, I’ve told doas not to bother me asking for my password.

permit nopass fmac as root cmd /usr/bin/prlimit

Not ideal, but keeps it simple.

Now I just have to run Ardour with unlea.sh, and it won’t complain anymore.

$ unlea.sh ardour6
+ doas /usr/bin/prlimit --pid 7711 '--memlock=unlimited'
+ exec ardour6
Ardour6.9.0 (built using 6.9 and GCC version 10.3.1 20210625)

I can also confirm the new limits.

$ cat /proc/`pidof ardour-6.9.0`/limits
Limit                     Soft Limit           Hard Limit           Units
...
Max locked memory         unlimited            unlimited            bytes
...

Last touch, since I like to start applications with Rofi, is to edit ~/.local/share/applications/ardour6.desktop so that it will use unlea.sh.

$ cat .local/share/applications/ardour6.desktop
[Desktop Entry]
...
Exec=unlea.sh ardour6
...

Nested WireGuard tunnels to my home

Tue, 7 Dec 2021 00:00:00 +0000

Nested WireGuard tunnels to my home

2021.12.07

My setup to safely (I hope) access my home network via WireGuard VPN.

TL;DR: WG from my home to a VPS, to expose another WG endpoint bypassing CGNAT.

I love the simplicity of WireGuard. It feels to me like fresh air when compared to the disorienting huge amount of OpenVPN options, or to the weapons-grade accuracy needed to set up an IKE2/IPsec tunnel. Maybe one day I’ll try iked(8) and I’ll love it, but for now I think setting up IPsec for a road warrior device is a nighmare. I’d still like to know why a W1nd0w$ PC wasn’t liking the IKE chiper suites I was offering him a couple years ago.

I simply want a tunnel between my PC and my home network, using modern cryptography. The problem is my ISP hiding my home behind CGNAT. For my road warrior PC to be able to create the tunnel, the other WG peer must be reacheable.

First of all, since I had a nice MikroTik RB750Gr3 doing nothing, it was chosen to serve my home. RouterOS 6 doesn’t support WG. At the time of writing, ROS 7.1 beta with WG support is in testing and not very stable, but I have no choice so that’s what I’m using.

Since this MT is not directly facing WAN, it acts as a router-on-a-stick. Routing and firewall rules set on my main firewall that make all this work are beyond the scope of this post, and more related to my LAN.

Now I need a VPS to bypass CGNAT. The first way I considered was this:

    +--------+       +--------+       +--------+
    |        |       |        |       |        |
    |       ===========      ===========       |
    |       ====wg0====      ====wg1====       |
    |        |       |        |       |        |
    +--------+       +--------+       +--------+
        PC              VPS               MT

PC creates a tunnel to VPS. VPS routes packets destinated to MT into tunnel wg1. This should work, but packets are not encrypted when they are routed between wg0 and wg1.

What if I don’t trust the VPS? The next diagram shows what I ended up with.

    +--------+       +--------+       +--------+
    |        |       ===================       |
    |       ============================       |
    |       ====wg0=====================       |
    |        |       ============wg1====       |
    +--------+       +--------+       +--------+
        PC              VPS               MT

Here wg1 is used to expose another WG endpoint (on another port) of MT. When PC creates wg0, VPS doesn’t get to see the end of the tunnel, it can only see encrypted WG traffic.

To implement this, starting from MT, we have to declare:

two WG interfaces;
one peer for wg1;
one peer for each road warrior device, for wg0.

[admin@MikroTik_hEX] > /interface/wireguard/print
Flags: X - disabled; R - running
 0  R name="wg0" mtu=1420 listen-port=60000 private-key="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
      public-key="njg+gAB5Zt/NJl2U8HUA6+vTJvjOIdSLhpbw7SxpADA="

 1  R name="wg1" mtu=1420 listen-port=60001 private-key="YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY"
      public-key="XKm72iBBljwo3l2YAIvzO4RnbR5HitAh9UoelWjBQ3U="

[admin@MikroTik_hEX] > /interface/wireguard/peers/print
Columns: INTERFACE, PUBLIC-KEY, ENDPOINT-ADDRESS, ENDPOINT-PORT, ALLOWED-ADDRESS, PERSISTENT-KEEPALIVE
# INTERFACE  PUBLIC-KEY                                    ENDPOINT-ADDRESS  ENDPOINT-PORT  ALLOWED-ADDRESS  PERSISTENT-KEEPALIVE
0 wg1        q9ii3/DoyZgqYkzEiTdPM9FfraDtUJdKP1KItmh6c1U=  X.X.X.X                   60100  172.16.1.0/24    25s
;;; RW1
1 wg0        TvfgJvb9Zn37tJNxWU9Lyf+/TWQQy3rFZq4xBILCRwI=                                0  172.16.0.1/32
;;; RW2
2 wg0        AFSycdpkMPYm9Fj32MB4fjiOpP306omN06WMtzo0s3g=                                0  172.16.0.2/32

[admin@MikroTik_hEX] > /ip/address/print where interface=wg1
Columns: ADDRESS, NETWORK, INTERFACE
# ADDRESS          NETWORK     INTERFACE
1 172.16.1.254/24  172.16.1.0  wg1

I redacted portions of the config, but it’s quite clear. X.X.X.X is the public IP of VPS. MT initiates the tunnel to X.X.X.X:60100. Note that persistent-keepalive=25s is useful to persist the state that lets us traverse CGNAT. Otherwise, after some time of inactivity, firewalls on the path would drop the state, and the tunnel could not be recreated trying to send a packet from VPS to MT.

On the VPS: Alpine Linux, wireguard-tools, ifupdown-ng-wireguard.

# cat /etc/wireguard/wg1.conf
[Interface]
ListenPort = 60100
PrivateKey = ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ

# MT

[Peer]
PublicKey = XKm72iBBljwo3l2YAIvzO4RnbR5HitAh9UoelWjBQ3U=
AllowedIPs = 172.16.1.254/32

Note that there’s no wg0.conf since VPS is not aware of wg0.

With this config in place and the interface activated, MT should initiate the tunnel almost instantly, but for road warriors to be able to reach wg0 we have to forward packets into wg1.

On VPS, right after interface wg1 goes up, we tell Linux to forward packets. We also define a few iptables(8) dstnat rules to let the world access wg0 port.

# cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
    hostname <redacted>

iface eth0 inet6 static
    address <redacted>
    gateway fe80::1
    pre-up echo 0 > /proc/sys/net/ipv6/conf/eth0/accept_ra

auto wg1
iface wg1 inet static
    address 172.16.1.100/24
    requires eth0
    use wireguard

    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
    post-up iptables -t nat -A PREROUTING -p udp -i eth0 --dport 60000 -j DNAT --to-destination 172.16.1.254
    post-up iptables -t nat -A POSTROUTING -p udp -d 172.16.1.254 --dport 60000 -j MASQUERADE

    post-down iptables -t nat -D PREROUTING -p udp -i eth0 --dport 60000 -j DNAT --to-destination 1172.16.1.254
    post-down iptables -t nat -D POSTROUTING -p udp -d 172.16.1.254 --dport 60000 -j MASQUERADE
    post-down echo 0 > /proc/sys/net/ipv4/ip_forward
    post-down echo 0 > /proc/sys/net/ipv4/conf/all/proxy_arp

Now from PC our favourite WG client might be able to complete the tunnel wg0.

Resize an image to fit size

Wed, 5 May 2021 00:00:00 +0000

Resize an image to fit size

2021.5.5

It is the case that I often need to resize a bunch of PNGs of random sizes to a maximum height of 350px, preserving ratio.

Many people would use some many-MB-weighted GUI bloatware and multiple mouse clicks to achieve that (expecially on w1nd0w5). Computer users who love computers choose the CLI way.

ImageMagick is the solution, and is likely to be packaged for your OS.
Once installed, you can run convert from the shell.

Now to resize 1.png to fit the desired size you can do:

$ file 1.png         
1.png: PNG image data, 2119 x 1056, 8-bit/color RGB, non-interlaced
$ convert 1.png -resize 350x350 1-350.png        
$ file 1-350.png                         
1-350.png: PNG image data, 350 x 174, 8-bit/color RGB, non-interlaced

This is already amazing, but I need the image height to be 350px.
To do that, you specify only the height.

$ convert 1.png -resize x350 1-350.png 
$ file 1-350.png                      
1-350.png: PNG image data, 702 x 350, 8-bit/color RGB, non-interlaced

Great! Now I need to do the same thing for every image in this directory. Let’s find them.

$ ls   
1.png  2.png  3.png  4.png
$ mkdir ../out      
$ find . -type f -exec convert {} -resize x350 ../out/{} \;
$ file ../out/*                                            
../out/1.png: PNG image data, 239 x 350, 8-bit/color RGB, non-interlaced
../out/2.png: PNG image data, 178 x 350, 8-bit/color RGB, non-interlaced
../out/3.png: PNG image data, 632 x 350, 8-bit/color RGB, non-interlaced
../out/4.png: PNG image data, 204 x 350, 8-bit/color RGB, non-interlaced

Nice.

Hosting a Searx instance on OpenBSD

Sat, 6 Feb 2021 00:00:00 +0000

Hosting a Searx instance on OpenBSD

2021.2.4-2021.2.6

!!!: This post comes from my personal notes archive, so it may be confusional and/or not structured as a lesson.

Env

OpenBSD 6.8 GENERIC#4 amd64

🐡 Installation went smooth as always…

I’ve edited the default disk layout like this:

# df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/sd0a      565M   85.0M    452M    16%    /
/dev/sd0k      986M    2.0K    937M     0%    /home
/dev/sd0d      782M   10.0K    743M     0%    /tmp
/dev/sd0f      2.9G    1.0G    1.7G    38%    /usr
/dev/sd0g      619M    234M    354M    40%    /usr/X11R6
/dev/sd0h      6.9G    218K    6.5G     0%    /usr/local
/dev/sd0e      4.8G    6.9M    4.6G     0%    /var

It’s considered bad to delete some of the proposed partitions but this is an experimental install.

NOTE: I’m following https://searx.github.io/searx/admin/installation-searx.html.

Searx & gunicorn

The Searx installation guide employs uWSGI. I don’t wanna compile uWSGI plugins for OpenBSD at the moment, so to avoid errors like !!! UNABLE to load uWSGI plugin: File not found !!! I’ll install gunicorn instead and improvise.

pkg_add python py3-pip git

ln -s /usr/local/bin/python3.8 /usr/local/bin/python

ln -s /usr/local/bin/pip3.8 /usr/local/bin/pip

pip install gunicorn

Create user _searx that is going to own the gunicorn process.

mkdir /usr/local/searx
useradd -d /usr/local/searx/ -s /sbin/nologin -u 10000 _searx
chown -R _searx:_searx /usr/local/searx/

NOTE: I don’t want to use a Python virtual env for now.

cat /etc/doas.conf
permit setenv { -ENV PS1=$DOAS_PS1 SSH_AUTH_SOCK } :wheel

doas -u _searx git clone "https://github.com/searx/searx.git" \
"/usr/local/searx/searx-src"

pip install -r /usr/local/searx/searx-src/requirements.txt

Error: Please make sure the libxml2 and libxslt development packages are installed.

then

pkg_add py3-lxml

Follow the guide for the /etc/searx/settings.yml stuff.

Ok. Try.

cd /usr/local/searx/
doas -u _searx gunicorn -b 127.0.0.1:8001 --chdir /usr/local/searx/searx-src/searx --pythonpath /usr/local/searx/searx-src searx.webapp

[INFO] Listening at: http://127.0.0.1:8001 (93345)

Nice. Daemonize gunicorn. Create /etc/rc.d/gunisearx.

#!/bin/ksh

RUN_DIR="/var/run/gunisearx"
daemon="/usr/local/bin/gunicorn"
gunisearx_flags="-b 127.0.0.1:8001 --chdir /usr/local/searx/searx-src/searx --pythonpath /usr/local/searx/searx-src -p /var/run/gunisearx/gunisearx.pid -D searx.webapp"
gunisearx_user="_searx"

. /etc/rc.d/rc.subr

pexp="/usr/local/bin/python.*${pexp}"

# For the PID file.
rc_pre() {
    if [[ ! -d /var/run/gunisearx ]]; then
        mkdir $RUN_DIR
        chown -R _searx:_searx $RUN_DIR
    fi
}

rc_stop() {
    if [[ -f $RUN_DIR/gunisearx.pid ]]; then
        kill $(cat $RUN_DIR/gunisearx.pid)
        rm $RUN_DIR/gunisearx.pid
    fi
}

rc_cmd $1

Filtron

Compiled filtron on a build VM and copied to the server.

Create user _filtron that is going to own the filtron process. useradd -s /sbin/nologin -u 10001 _filtron

Daemonize filtron. Create /etc/rc.d/filtron.

#!/bin/ksh

daemon="/usr/local/bin/filtron"
filtron_flags="-api '127.0.0.1:4005' -listen '127.0.0.1:4004' -rules '/etc/filtron/rules.json' -target '127.0.0.1:8001'"
filtron_user="_filtron"

rc_bg=YES

. /etc/rc.d/rc.subr

rc_cmd $1

morty

Compiled morty on a build VM and copied to the server.

Create user _morty that is going to own the morty process. useradd -s /sbin/nologin -u 10002 _morty

Daemonize morty. Create /etc/rc.d/morty.

#!/bin/ksh

daemon="/usr/local/bin/morty"
morty_user="_morty"

rc_bg=YES

. /etc/rc.d/rc.subr

rc_cmd $1

Create a login class in /etc/login.conf to set some environment variables:

...other things...

morty:\
    :setenv=DEBUG=false,MORTY_ADDRESS=127.0.0.1\c3000,MORTY_KEY=<key generated with `openssl rand -base64 33`>:\
    :tc=daemon:

Bonus - nginx config

Nginx as reverse proxy and scores A+ at SSL Labs and observatory.mozilla.org. /etc/nginx/nginx.conf

http {

...lots of things...

server {
        listen      443 ssl;
        listen      [::]:443 ssl;
        server_name searx.fmac.xyz;

        ssl_protocols   TLSv1.2 TLSv1.3;
        ssl_ciphers     ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers   on;

        ssl_certificate     /etc/ssl/searx.fmac.xyz.fullchain.pem;
        ssl_certificate_key /etc/ssl/private/searx.fmac.xyz.key;

        ssl_session_timeout 1d;
        ssl_session_cache   shared:MozSSL:10m;
        ssl_session_tickets off;

        location / {
            proxy_pass http://127.0.0.1:4004/;

            include /etc/nginx/searx-proxy-headers.conf;
            include /etc/nginx/searx-default-headers.conf;
            add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self'; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com" always;
        }

        location /static/ {
            root /var/www/htdocs/searx/;

            include /etc/nginx/searx-default-headers.conf;
            add_header Cache-Control "public, max-age=31536000" always;
        }

        location /morty {
            proxy_pass http://127.0.0.1:3000/;

            include /etc/nginx/searx-proxy-headers.conf;
        }
    }
}

/etc/nginx/searx-default-headers.conf

add_header Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none';focus-without-user-activation 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Robots-Tag "noindex, noarchive, nofollow" always;
add_header X-XSS-Protection "1" always;

/etc/nginx/searx-proxy-headers.conf

proxy_hide_header   Referrer-Policy;
proxy_hide_header   X-Content-Type-Options;
proxy_hide_header   X-Robots-Tag;
proxy_hide_header   X-Xss-Protection;
proxy_set_header    Host $host;
proxy_set_header    Connection $http_connection;
proxy_set_header    X-Real-IP $remote_addr;
proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header    X-Scheme $scheme;

Hello world

Mon, 14 Dec 2020 00:00:00 +0000

Hello world

Please, ignore this post for now. I’m just giving a try to Hugo. Feels nice so far…

fmac's blog

Connect FWA modem to Mikrotik router

Connect FWA modem to Mikrotik router

Info gathering

Mikrotik setup

Test

Deploying Anubis in front of my pastebin

Deploying Anubis in front of my pastebin

Helm chart

Why stream error stream ID 1; CANCEL; received from peer?

Why stream error: stream ID 1; CANCEL; received from peer?

My first desktop PC

My first desktop PC

Motherboard

CPU

Cooler

RAM

Storage

Power supply

Case

GPU

Build

Notes

Moving searx from Hetzner to 1984

Moving searx from Hetzner to 1984

Hostign Searxng on Alpine

Hosting Searxng on Alpine

Fuck you, Discord

Fuck you, Discord

Yggdrasil my computers

Yggdrasil my computers

Workaround the lack of IPv6

Naransa overview

Naransa overview

Unleash Linux process

Unleash Linux process

Nested WireGuard tunnels to my home

Nested WireGuard tunnels to my home

Resize an image to fit size

Resize an image to fit size

Hosting a Searx instance on OpenBSD

Hosting a Searx instance on OpenBSD

Env

Searx & gunicorn

Filtron

morty

Bonus - nginx config

Hello world

Hello world

Why `stream error: stream ID 1; CANCEL; received from peer`?