Posts on nemunaire's blog

Serving custom Go import paths for many modules with nginx

blog@nemunai.re (nemunaire) — Thu, 23 Apr 2026 08:44:00 +0000

When publishing Go code, the usual practice is to distribute the sources directly from the forge that hosts them: github.com/org/project, framagit.org/org/project, and so on. It is convenient, but it durably ties the import path to the chosen provider. The day you migrate from one forge to another, all your users have to update their imports, and every historical fork keeps pointing at the old address.

Fortunately, the go-import mechanism lets you decouple the import path from the actual hosting location of the code. All it takes is exposing, on a domain of your choosing, an HTML page containing a <meta name="go-import"> tag that describes where the sources live.

Complexity Has Become the Lazy Solution

blog@nemunai.re (nemunaire) — Fri, 13 Mar 2026 15:08:00 +0700

In software engineering, complexity is often seen as a sign of competence.

Indeed, a simple system looks suspicious, while a complex system looks serious.

What is the value of a decade of success?

In my final year of engineering school, I built a CTF platform. At the time, no software like CTFd existed. Everything had to be built from scratch.

It took me a lot of thinking to arrive at an architecture that looks simple in hindsight: serve static files, generated on demand, to reduce the attack surface. Standard Unix services glued the components together. Low-level containers isolated services from one another.

The pragmatic architecture of my production projects

blog@nemunai.re (nemunaire) — Thu, 05 Mar 2026 15:00:00 +0000

Reading some discussions between developers or software architects, one might think that the smallest web application today requires a distributed infrastructure, a Kubernetes cluster, and several specialized cloud services.

Yet many web services (including those that receive several thousand visitors per day) can work perfectly well with a much simpler architecture.

Here is a hands-on account of the infrastructure I use for my production projects, some of which exceed 5,000 daily visitors, and which I also applied for years during a cybersecurity competition with more than 250 on-site participants.

Southern China for Digital Nomads: Between Wonder and Survival

blog@nemunai.re (nemunaire) — Thu, 05 Feb 2026 10:30:00 +0000

Southern China is not an obvious destination for digital nomads. When you think of digital nomadism, you imagine Bali, Lisbon, or Chiang Mai. Not Shenzhen, Guangzhou, or Huizhou. And yet, I spent three weeks exploring these three Chinese cities, one week in each, and it’s an experience I won’t soon forget!

This article is obviously not a tourist guide, but rather an account of what it’s really like to live and (try to) work in Southern China when you have the freedom to choose your workplace. With the difficulties, the surprises, and especially that Great Firewall I’ll be talking about.

Hathoris: Bringing Back the Simplicity of HiFi Systems in the Digital Age

blog@nemunai.re (nemunaire) — Sat, 26 Apr 2025 14:12:03 +0000

Remember when listening to music was as simple as pressing a single button? Those days when you’d walk into a room, flip a switch on your amplifier, and instantly be surrounded by your favorite tunes? There was something magical about that simplicity—no computers to boot up, no apps to navigate, no complex digital interfaces to wrestle with.

The Problem with Modern Audio Systems

As our music collections went digital and streaming services became the norm, we gained incredible access to virtually unlimited music libraries. But something was lost along the way: simplicity.

Master Your AI: Explore Local AI with OVH for Just 1 Dollar

blog@nemunai.re (nemunaire) — Wed, 04 Sep 2024 11:12:00 +0000

Today, generative AIs meet many uses, and it would be a shame not to take advantage of them. However, in the age of the GDPR, it’s legitimate to question the exposure of customer or partner data when relying solely on AI providers whose data processing remains opaque.

Having myself participated in the construction of one of these new virtual assistant services, I offer here a simple guide to starting up a machine and evaluating the performance of your AI application, or to offering your employees access to sovereign AI, with the aim of easily comparing the different models available.

Cloud-init to deploy LocalAI in the cloud in 5 minutes

blog@nemunai.re (nemunaire) — Tue, 27 Aug 2024 13:12:00 +0000

It’s possible to use generative AI without sharing your data with companies or states that raid our data.

The world of free software is full of applications for evaluating and using generative AI. After extensive testing, I present here the cloud-init file for deploying your own LocalAI instance in under 5 minutes.

Why LocalAI?

LocalAI is a free software application designed to offer a local, self-hosted alternative to AI service providers. The application features an API compatible with that of OpenAI. The idea is to be able to replace calls to OpenAI from any existing application in the blink of an eye: simply change the domain to which the API points.

Duplicate window display on 2 screens with X.org

blog@nemunai.re (nemunaire) — Sat, 09 Dec 2023 11:34:00 +0000

As an engineering school teacher and technical lecturer, I’m often asked to give demonstrations, in addition to the classic slide show. Like any organized lecturer, I can’t do without my notes, elapsed time, etc., which are given to me by presenter screen software. This kind of software requires an extended display, i.e. the computer screen and the video projector display 2 different things.

The disadvantage of demonstrations is that the application window you want to show cannot be displayed on both screens at the same time. I’ve tried to solve this problem, in particular to avoid having to do demos while craning my neck, as the window necessarily had to be on the video projector screen, which is really not comfortable.

Unveiling Whiteout Files: Do you know how file deletions are handled between layers of a Docker image?

blog@nemunai.re (nemunaire) — Thu, 09 Nov 2023 15:35:00 +0000

Union file systems are a mechanism for merging two or more file systems, to present them unified, under a single mount point for the user.

The main idea behind this mechanism is to be able to alter the contents of the first file system (e.g. the contents of a CD-ROM) by writing all changes (additions, deletions, modifications) to the second (which could be a disk partition, a USB stick, …).

Unify HTTP requests and GRPC calls on a single domain for more flexible configuration: example with Woodpecker

blog@nemunai.re (nemunaire) — Fri, 27 Oct 2023 09:35:00 +0000

I installed the continuous integration service Woodpecker, to replace DroneCI, which the company that bought it decided to bury. As Woodpecker is a fork of the latest free version of Drone, its use is broadly similar.

However, the teams have taken different directions on certain aspects, and communication with agents/runners, which used to be via websockets, is now carried out in Woodpecker using the GRPC protocol.

The solution proposed by the Woodpecker documentation is to use 2 domains: one will be used for the web interface and the REST API, the second will be used for GRPC. Is this really necessary?

Using Waveshare e-ink screens without Raspberry Pi

blog@nemunai.re (nemunaire) — Wed, 02 Aug 2023 11:37:00 +0000

When it comes to e-ink displays, Waveshare is a rare manufacturer that allows you to buy displays of any size. Advertised as ESP32, Arduino and Raspberry Pi compatible, they are in fact compatible with any development board exposing the SPI protocol.

Since Raspberry Pi boards have become hard to find in recent months, we’ll take a look in this article at how to use another Linux-based board to run a Waveshare display.

Gamification of a Linux system administration course

blog@nemunai.re (nemunaire) — Wed, 07 Jun 2023 16:07:00 +0000

System administration isn’t something that’s obvious to everyone, and it’s a subject that, when it’s more to do with the basics of networking and Linux, can seem a lot more daunting than learning about the latest trendy technologies (Docker, Terraform, Kubernetes, etc.).

Also, with the bombardment of information and easy access to computer content and tutorials often more interesting than “classic” lectures, students are less and less attentive, present or participating.

Self-hosting: for a decentralized and responsible Internet

blog@nemunai.re (nemunaire) — Mon, 22 May 2023 10:05:00 +0000

In an idealized world, we would all be free to access any service, made available by a community motivated by the common good rather than by the penurious enrichment of a few. However, we don’t live in that world.

Today, everything is monetized: the smallest product or service only exists if it brings in enough money, without regard for the common good. The apparent gratuity of digital services is often accompanied by a more discreet but lucrative counterpart: the exploitation of our personal data.

Give IPv6 connectivity to its Docker containers using an IPv6 block from its ISP

blog@nemunai.re (nemunaire) — Thu, 04 May 2023 15:10:00 +0000

It may seem surprising that a modern service like Docker does not offer IPv6 in containers by default, especially when in a network with IPv6.

In fact, for the same reason we saw in the introductory article, since the containers are in a virtual network, they cannot be reached by the box/router distributing the IPv6 subnet.

The same phenomenon can be observed with IPv4: each container has an IPv4 in a subnet separate from the one in which our host machine is located.

Use the additional IPv6 blocks of the Free and Orange network

blog@nemunai.re (nemunaire) — Wed, 05 Apr 2023 14:43:00 +0000

With Free and Orange, when IPv6 is not disabled, the Freebox (and some Livebox) provide a /64 IPv6 range to the connected equipment. But it turns out that it is a /60 range that is available and usable by each subscriber. This represents a total of 8 addressable /64 networks. Let’s see what it can be used for and how to use it.

IPv6 reminders

Contrary to IPv4, with IPv6 one avoids making NAT, i.e. one allocates to each machine on the network an IPv6 address directly routable on Internet. Of course it is always necessary to go through the router (the box) which is then used as a simple gateway to the Internet.

Multi-Hosts TLS Certificate

blog@nemunai.re (nemunaire) — Wed, 09 Feb 2022 00:00:00 +0000

It is sometimes convenient to have a domain distributed over two or more machines. This technique, as old as DNS, is interesting to spread the load between multiple hosts, or to provide a bit of high availability. Indeed, if a host becomes inaccessible, at least half of the requests will continue to be successful.

However, since TLS connections have become the norm, and certificates should be renewed automatically, it could be hard to control the validation and the distribution.

I will present you a technique which, with the help of a finely configured web server, allows to get a different certificate on each machine, but usable for the same subdomain.

RTL8153B support for 4.9 kernel

blog@nemunai.re (nemunaire) — Sun, 17 Mar 2019 00:00:00 +0000

If you buy a recent USB to Ethernet adapter, embedding a Realtek chip, you possibly face, like me, the following error, when connecting it:

r8152 4-1.1:1.0 (unnamed net_device) (uninitialized): Unknown version 0x6010
r8152 4-1.1:1.0 (unnamed net_device) (uninitialized): Unknown Device

Support for the user namespace in grsecurity kernel

blog@nemunai.re (nemunaire) — Wed, 31 Oct 2018 00:00:00 +0000

Grsecurity has completely disabled, on purpose, the user namespace code for the kernel.

As the goal of this namespace is to gain (virtualy) root privilegies inside a namespace (in theory, it shouldn’t give more priviledgies than the one you initialy have outside of your namespace), there are some interesting use cases, or, in my case I need to perform some demo in front of my students.

Slow memhog for testing cgroups

blog@nemunai.re (nemunaire) — Tue, 04 Oct 2016 00:00:00 +0000

Testing the cgroup memory is not something as easy as we can think. It can’t be only question of malloc(100000) in a loop, as the Linux kernel overcommit memory allocation: so even if we get effectively a 100000 bytes long memory space, this doesn’t decrease the physical available memory. To do so, this space need to be changed pages by pages, that can be tedious to do. And quite uncertain, because the kernel can take advantage of the swap partition…

Use Gitolite Access Control In Gitweb

blog@nemunai.re (nemunaire) — Thu, 24 Sep 2015 00:00:00 +0000

Are you using gitolite and gitweb? Two nice and lightweight projects, but perhaps you are tired to manage access control in gitweb?

Here is some simple tricks to use gitolite access list directly into gitweb, automatically.

PGP key

blog@nemunai.re (nemunaire) — Mon, 29 Jun 2015 00:00:00 +0000

My personal PGP key is the following: 0x842807a84573cc96.

pub   4096R/4573CC96 2014-06-23 [expires: 2022-06-30]
      Key fingerprint = E722 B5B7 3CA7 FA93 5FC1  AA09 8428 07A8 4573 CC96
uid                  Pierre-Olivier Mercier <nemunaire@nemunai.re>
sub   4096R/9D2855C3 2014-06-23 [expires: 2022-06-30]

Linux Kernel Configurations

blog@nemunai.re (nemunaire) — Mon, 20 Apr 2015 00:00:00 +0000

My favorite distribution is Gentoo, for 7 years now. It allows me to have all the flexibility I need (the perfect world between stability with only legacy packages or recent ones on a constantly broken system; as in Gentoo, you always have choice) and it teaches me so many things each day.

As I’m used to control everything, here is a list of kernels’ configurations I use currently.

My private SSH keys managment

blog@nemunai.re (nemunaire) — Thu, 19 Feb 2015 00:00:00 +0000

I always have a different SSH key pair per machine. The aim is to really never copy my private key from a machine to another over network or USB stick.