Nasqueron Agora - User contributions [en]

Operations grimoire/Deploy with Terraform

2026-09-20T20:41:01Z

Dereckson: /* Standard operations */

== Overview ==

In addition to Salt, Nasqueron manages Infrastructure as Code using Terraform and OpenTofu. We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform.

We provide a <code>tf</code> wrapper that automatically runs OpenTofu or Terraform based on the directory and mounts the encrypted state directory on the fly.

<div class="alert">It's important to work on Complector, so that all deployments use the shared Terraform state.</div>

=== Paths ===

Terraform states are stored on a local backend. To protect sensitive infrastructure state (which often contains plaintext secrets and topology data) at rest, we use a split-architecture approach combining [[Operations grimoire/ZFS|ZFS]] and [[Operations grimoire/PEFS|PEFS]] (Private Encrypted File System).

{| class="wikitable"
|+ Paths for Terraform / OpenTofu deployment
|-
! Path
! Type
! Purpose
! Filesystem Properties
|-
| <code>/opt/salt/nasqueron-operations/terraform/</code>
| Standard Dir
| Terraform/OpenTofu declarative code
| Standard ZFS
|-
| <code>/opt/terraform.enc</code>
| ZFS Dataset
| Underlying encrypted block storage for PEFS
| <code>compression=zstd</code>
|-
| <code>/opt/terraform/encrypted</code>
| PEFS Mount
| '''Encrypted state files.''' Mounted only during TF operations.
| AES-256-XTS
|-
| <code>/opt/terraform/tf-data</code>
| ZFS Dataset
| '''Provider cache and modules files.''' <code>TF_DATA_DIR</code> target.
| <code>compression=lz4</code>, <code>recordsize=128K</code> (optimized for Go binaries)
|}

=== Access control ===

* PEFS operations (mounting, adding keys) are executed as the <code>deploy</code> user.
* The wrapper verifies that the invoking user belongs to the <code>ops</code> or <code>deploy</code> group before proceeding.
* The PEFS passphrase is stored in HashiCorp Vault at <code>ops/infra/complector/terraform/pefs</code>.

== Standard operations ==

The <code>tf</code> wrapper automatically mounts PEFS, fetches the decryption key from Vault, executes the command, and unmounts PEFS upon exit, even on failure or <code>Ctrl+C</code>.

You can use it exactly like you would use terraform or tofu commands:

<syntaxhighlight lang="bash">
$ cd /opt/salt/nasqueron-operations/terraform/ovh-ops-backups
$ tf init
$ tf plan
$ tf apply
</syntaxhighlight>

{{Collapse card
|title=Terraform and OpenTofu tf wrapper :: how it works?
|content=
<pre>
┌─────────────────────────────────────────────────────────────────────────────┐
│ DEVELOPER TERMINAL ON COMPLECTOR │
│ │
│ $ cd /opt/salt/nasqueron-operations/terraform/<project> │
│ $ tf plan │
│ $ tf apply │
└──────────────────────────────────┬──────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ WRAPPER /usr/local/bin/tf │
│ │
│ 1. Validate current directory is a top-level project under │
│ /opt/salt/nasqueron-operations/terraform/ │
│ │
│ 2. Determine runtime: │
│ • openbao, ovh-ops-backups → terraform │
│ • everything else → tofu │
│ │
│ 3. Mount PEFS if not already mounted: │
│ pefs mount /opt/terraform.enc /opt/terraform/encrypted │
│ │
│ 4. Load encryption key if not already in kernel: │
│ vault kv get -field=password ops/infra/complector/terraform/pefs │
│ | │
│ └──► pefs addkey -c /opt/terraform -j - │
│ │
│ 5. Prepare directories and environment: │
│ mkdir -p /opt/terraform/encrypted/tf-state/<project> │
│ export TF_DATA_DIR=/opt/terraform/tf-data/<project> │
│ │
│ 6. Execute Terraform/OpenTofu: │
│ terraform <args> -or- tofu <args> │
│ │
│ 7. On exit (trap EXIT): │
│ pefs umount /opt/terraform │
└──────────────────────────────────┬──────────────────────────────────────────┘
│
┌──────────────┴──────────────────┐
│ │
▼ ▼
┌───────────────────────────────────────┐ ┌─────────────────────────────────┐
│ ENCRYPTED VOLUME (PEFS) │ │ PUBLIC REPOSITORY │
│ /opt/terraform.enc/ │ │ /opt/salt/nasqueron-operations/ │
│ │ │ │
│ Mounted at /opt/terraform/encrypted │ │ terraform/ │
│ while tf is running. Sensitive. │ │ ├── ovh-ops-backups/ │
│ │ │ │ ├── main.tf │
│ /o/t/encrypted/tf-state/<project>/ │ │ │ ├── backend.tf │
│ └── terraform.tfstate │ │ │ └── modules/ │
│ └── terraform.tfstate.bak │ │ │ │
│───────────────────────────────────────│ │ ├── openbao/ │
│ WORKING DIRECTORY │ │ │ ├── main.tf │
│ /opt/terraform/ │ │ │ └── ... │
│ │ │ │ │
│ /o/t/tf-data/<project>/ unencrypted │ │ └── <other-projects>/ │
│ └── .teraform/ │ │ │
│ └── providers/ │ │ Contains only public code. │
│ └── modules/ │ │ │
│ │ │ │
└───────────────────────────────────────┘ └─────────────────────────────────┘
│
│ (encrypted at rest by PEFS AES-256-XTS)
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ BACKUP PIPELINE (Restic) │
│ │
│ Restic /opt/terraform.enc │
│ │ │
│ ▼ │
│ OVH Object Storage (S3-compatible) │
│ • Bucket: nasqueron-backups-amaris │
│ • Region: EU-WEST-PAR │
│ • Versioning: enabled │
│ • Object Lock: governance mode, 90-day retention │
│ • Per-client prefix isolation via IAM policies │
└─────────────────────────────────────────────────────────────────────────────┘
</pre>
}}

== Specific deployment notes ==
=== Maintenance of .tfstate files ===
For manual state surgery or moving files, use the explicit mount commands. These bypass the automatic unmount.

<syntaxhighlight lang="bash">
# Mount PEFS and load keys for manual maintenance
tf mount

# Perform manual operations (e.g., moving state files)
cd /opt/terraform/encrypted/tf-states
# ...

# Unmount when finished
tf unmount
</syntaxhighlight>

=== Choose between opentofu or terraform ===
By default, tofu is used.

The wrapper maintains an allowlist of projects that still require HashiCorp Terraform.

The main blocker is <code>hashicorp/vault</code>, not compiled for FreeBSD on OpenTofu registry.

To add or remove a project from this list, edit the <code>STILL_REQUIRE_TERRAFORM</code> variable in {{Ops file|roles/salt-primary/opentofu/files/tf.sh}}.

=== New project configuration ===

Every Terraform project must explicitly configure its local backend to write state into the PEFS-encrypted mount.

Add this to your project's <code>backend.tf</code> or <code>providers.tf</code>:

<syntaxhighlight lang="hcl">
terraform {
backend "local" {
path = "/opt/terraform/encrypted/tf-states/<project-name>/terraform.tfstate"
}
}
</syntaxhighlight>

''Note: The provider cache path does not need to be configured in HCL. The wrapper automatically exports <code>TF_DATA_DIR=/opt/terraform/tf-data/<project-name></code>.''

=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-09-06, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ tf init # install any newly required providers and modules
$ tf plan
$ tf apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note that the benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole has been created in Vault, its credentials need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ tf init # if you've a new entry requiring a module, it needs to be installed
$ tf plan
$ tf apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important: Each time you reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

==== CARP OVH secrets usage ====

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

=== ovh-ops-backups ===
This configuration is handled by Terraform.

It requires full access to the public cloud project for backups, as the project is fully configured by these Terraform files.

You'll need to get the application key, application secret, and consumer key and write them in your $HOME/.ovh.conf on Complector.
You can also generate the file with <code>ovhcloud login</code>.

== First Terraform configuration (DRP) ==
=== Initialize Terraform working directories ===
Terraform and OpenTofu projects are currently deployed from Complector.
The states are encrypted, and a wrapper decrypts them for each operation.

You need to restore the contents of /opt/terraform.enc from a backup, or if it is not available, initialize a new encrypted directory.
Currently, the procedure is specific to FreeBSD, as it requires PEFS to encrypt directories.

# On the salt primary server, deploy the full roles/salt-primary, or at least the roles/salt-primary/opentofu unit
# Ensure pefs is active with <code>kldstat | grep pefs</code>
# Ensure Vault is up, then <code>vault kv put ops/infra/complector/terraform/pefs password=$(openssl rand -hex 48)</code>
# Run <code>initialize-pefs ops/infra/complector/terraform/pefs /opt/terraform.enc /opt/terraform/encrypted</code>

The previous version of the Vault secret, if still available, belongs to the previous directory; keep it if you need to restore that directory. However, you need a new password when creating a fresh encrypted directory.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tf init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tf plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tf init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some providers are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

To allow the wrapper to run <code>terraform</code> commands, add your project directory to the <code>STILL_REQUIRE_TERRAFORM</code> variable in {{Ops file|roles/salt-primary/opentofu/files/tf.sh}}.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tf state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

User:Dereckson/Sandbox

2026-09-20T20:38:52Z

Dereckson:

= Terraform Secure State Workflow =

{{Infobox software
| name = tf-ops / tf wrapper
| project = Nasqueron Operations
| license = BSD-2-Clause
| platform = FreeBSD
| depends_on = PEFS, HashiCorp Vault, Terraform, OpenTofu, Restic, OVH Object Storage
}}

== Overview ==

This workflow provides a secure, auditable method for managing Terraform and OpenTofu state on FreeBSD using local encryption. All sensitive infrastructure state is encrypted at rest using [[PEFS]], secrets are injected from [[Vault]] at runtime, and backups are stored in OVH Object Storage with Object Lock for immutability.

The core principle is: '''no plaintext state or secrets ever exist outside the PEFS encrypted volume''', and the volume is mounted only for the duration of a single Terraform operation.

== Architecture ==

=== Schema ===

<pre>
┌─────────────────────────────────────────────────────────────────────────────┐
│ DEVELOPER TERMINAL ON COMPLECTOR │
│ │
│ $ cd /opt/salt/nasqueron-operations/terraform/<project> │
│ $ tf plan │
│ $ tf apply │
└──────────────────────────────────┬──────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ WRAPPER /usr/local/bin/tf │
│ │
│ 1. Validate current directory is a top-level project under │
│ /opt/salt/nasqueron-operations/terraform/ │
│ │
│ 2. Determine runtime: │
│ • openbao, ovh-ops-backups → terraform │
│ • everything else → tofu │
│ │
│ 3. Mount PEFS if not already mounted: │
│ pefs mount /opt/terraform.enc /opt/terraform/encrypted │
│ │
│ 4. Load encryption key if not already in kernel: │
│ vault kv get -field=password ops/infra/complector/terraform/pefs │
│ | │
│ └──► pefs addkey -c /opt/terraform -j - │
│ │
│ 5. Prepare directories and environment: │
│ mkdir -p /opt/terraform/encrypted/tf-state/<project> │
│ export TF_DATA_DIR=/opt/terraform/tf-data/<project> │
│ │
│ 6. Execute Terraform/OpenTofu: │
│ terraform <args> -or- tofu <args> │
│ │
│ 7. On exit (trap EXIT): │
│ pefs umount /opt/terraform │
└──────────────────────────────────┬──────────────────────────────────────────┘
│
┌──────────────┴──────────────────┐
│ │
▼ ▼
┌───────────────────────────────────────┐ ┌─────────────────────────────────┐
│ ENCRYPTED VOLUME (PEFS) │ │ PUBLIC REPOSITORY │
│ /opt/terraform.enc/ │ │ /opt/salt/nasqueron-operations/ │
│ │ │ │
│ Mounted at /opt/terraform/encrypted │ │ terraform/ │
│ while tf is running. Sensitive. │ │ ├── ovh-ops-backups/ │
│ │ │ │ ├── main.tf │
│ /o/t/encrypted/tf-state/<project>/ │ │ │ ├── backend.tf │
│ └── terraform.tfstate │ │ │ └── modules/ │
│ └── terraform.tfstate.bak │ │ │ │
│───────────────────────────────────────│ │ ├── openbao/ │
│ WORKING DIRECTORY │ │ │ ├── main.tf │
│ /opt/terraform/ │ │ │ └── ... │
│ │ │ │ │
│ /o/t/tf-data/<project>/ unencrypted │ │ └── <other-projects>/ │
│ └── .teraform/ │ │ │
│ └── providers/ │ │ Contains only public code. │
│ └── modules/ │ │ │
│ │ │ │
└───────────────────────────────────────┘ └─────────────────────────────────┘
│
│ (encrypted at rest by PEFS AES-256-XTS)
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ BACKUP PIPELINE (Restic) │
│ │
│ Restic /opt/terraform.enc │
│ │ │
│ ▼ │
│ OVH Object Storage (S3-compatible) │
│ • Bucket: nasqueron-backups-amaris │
│ • Region: EU-WEST-PAR │
│ • Versioning: enabled │
│ • Object Lock: governance mode, 90-day retention │
│ • Per-client prefix isolation via IAM policies │
└─────────────────────────────────────────────────────────────────────────────┘
</pre>

</pre>

=== Components ===

{| class="wikitable sortable"
! Component
! Role
! Location
|-
| <code>/usr/local/bin/tf-ops</code>
| Wrapper script that orchestrates the secure workflow
| <code>/usr/local/bin/tf</code> (symlink or alias)
|-
| [[PEFS]]
| AES-256-XTS stacked filesystem for encrypting state at rest
| <code>/opt/terraform.enc</code> → mounted at <code>/opt/terraform</code>
|-
| [[Vault]]
| Stores the PEFS passphrase and all infrastructure secrets
| Path: <code>ops/infra/complector/terraform/pefs</code>
|-
| Terraform / OpenTofu
| Infrastructure-as-code engine
| Selected per-project by the wrapper
|-
| Restic
| Incremental, deduplicating backup client
| Backs up the raw <code>/opt/terraform.enc</code> directory
|-
| OVH Object Storage
| S3-compatible remote storage with Object Lock
| Buckets: <code>nasqueron-backups-{amaris,darak,vakor}</code>
|}

== Security Model ==

=== Encryption Layers ===

The workflow applies defense in depth across three layers:

{| class="wikitable"
! Layer
! Technology
! Protects Against
|-
| At-rest encryption
| PEFS (AES-256-XTS)
| Disk theft, unauthorized filesystem access, unencrypted backups
|-
| Secret injection
| HashiCorp Vault (KV v2)
| Plaintext passwords in scripts, config files, or shell history
|-
| Remote backup immutability
| OVH Object Lock (Governance)
| Ransomware deletion of backups, accidental pruning
|}

=== Secret Flow ===

<pre>
Vault KV v2 PEFS Kernel Terraform
(ops/infra/complector/ ──► (decrypts /opt/terraform.enc ──► reads/writes
terraform/pefs) in-memory, never touches encrypted state
disk in plaintext) inside PEFS mount
</pre>

The PEFS passphrase is never written to disk. It flows directly from the Vault API into <code>pefs addkey</code> via a Unix pipe (<code>-j -</code> reads from stdin). The plaintext passphrase exists only in process memory for the duration of the <code>addkey</code> system call.

=== Trust Boundaries ===

* The '''public repository''' contains only declarative infrastructure code. It is safe for Salt to read, for CI to lint, and for developers to clone.
* The '''PEFS volume''' contains all sensitive runtime artifacts (state files, provider caches, module downloads). It is encrypted and unmounted by default.
* The '''Vault server''' is the single source of truth for the PEFS passphrase. Access is governed by Vault ACL policies.
* The '''OVH backup''' stores only the encrypted PEFS volume. The backup provider never sees plaintext state or secrets.

== The <code>tf</code> Wrapper Script ==

=== Usage ===

<pre>
# From any top-level Terraform project directory:
$ cd /opt/salt/nasqueron-operations/terraform/ovh-ops-backups
$ tf init
$ tf plan
$ tf apply -auto-approve
$ tf state list
$ tf output -json
</pre>

The script must be executed from within a '''top-level''' subdirectory of <code>/opt/salt/nasqueron-operations/terraform/</code>. Running it from a nested module directory will result in an error.

=== Behavior ===

{| class="wikitable"
! Step
! Action
! Failure Handling
|-
| 1
| Validate working directory
| Exits with error code 1 if not in a valid project directory
|-
| 2
| Select Terraform or OpenTofu binary
| Falls back to <code>tofu</code> unless the project is in the whitelist
|-
| 3
| Mount PEFS if unmounted
| Exits with error code 2 if <code>pefs mount</code> fails
|-
| 4
| Load key from Vault if not in kernel
| Exits with error code 1 if Vault or <code>pefs addkey</code> fails
|-
| 5
| Create state and cache directories
| Uses <code>mkdir -p</code>; idempotent
|-
| 6
| Execute Terraform/OpenTofu
| Inherits the child process exit code
|-
| 7
| Unmount PEFS via <code>trap EXIT</code>
| Always runs, even on Ctrl+C or script failure
|}

=== Runtime Selection ===

The wrapper maintains a whitelist of projects that still require the HashiCorp <code>terraform</code> binary. All other projects default to <code>tofu</code> (OpenTofu).

<pre>
STILL_REQUIRE_TERRAFORM="openbao ovh-ops-backups"
</pre>

This allows a gradual migration from Terraform to OpenTofu without changing the developer workflow.

== Configuration Reference ==

=== Repository Structure ===

<pre>
/opt/salt/nasqueron-operations/
└── terraform/
├── ovh-ops-backups/ # Uses terraform (whitelisted)
│ ├── main.tf
│ ├── backend.tf # Must point to PEFS state path
│ └── modules/
├── openbao/ # Uses terraform (whitelisted)
│ └── ...
├── some-other-project/ # Uses tofu (default)
│ └── ...
└── ...
</pre>

=== PEFS Layout ===

When mounted, the PEFS volume exposes the following structure:

<pre>
/opt/terraform/
├── tf-state/
│ ├── ovh-ops-backups/
│ │ ├── terraform.tfstate
│ │ └── terraform.tfstate.backup
│ ├── openbao/
│ │ └── terraform.tfstate
│ └── ...
└── tf-data/
├── ovh-ops-backups/
│ └── .terraform/
│ ├── providers/
│ └── modules/
├── openbao/
│ └── .terraform/
└── ...
</pre>

=== Vault Paths ===

{| class="wikitable"
! Path
! Field
! Purpose
|-
| <code>ops/infra/complector/terraform/pefs</code>
| <code>password</code>
| PEFS passphrase used to decrypt <code>/opt/terraform.enc</code>
|-
| <code>ops/secrets/backups/ovh/s3/<account></code>
| <code>access_key</code>, <code>secret_key</code>
| Per-client S3 credentials for Restic backups
|}

=== Terraform Backend Configuration ===

Each project must configure its local backend to write state into the PEFS-mounted directory. Example <code>backend.tf</code>:

<syntaxhighlight lang="hcl">
terraform {
backend "local" {
path = "/opt/terraform/tf-state/ovh-ops-backups/terraform.tfstate"
}
}
</syntaxhighlight>

{{Warning|If this path is not configured, Terraform will write <code>terraform.tfstate</code> in plaintext to the current working directory, defeating the entire security model.}}

== Operations ==

=== Initial Setup ===

# Create the PEFS encrypted volume:
<pre>
mkdir -p /opt/terraform.enc
pefs mount /opt/terraform.enc /opt/terraform
pefs addkey -c /opt/terraform
# Store the passphrase in Vault:
vault kv put ops/infra/complector/terraform/pefs password="<your-passphrase>"
pefs umount /opt/terraform
</pre>

# Install the wrapper script to <code>/usr/local/bin/tf-ops</code> and create a symlink:
<pre>
chmod +x /usr/local/bin/tf-ops
ln -s /usr/local/bin/tf-ops /usr/local/bin/tf
</pre>

# Ensure Vault CLI is authenticated:
<pre>
vault login
</pre>

=== Daily Usage ===

<pre>
$ pm go terraform-ovh-ops-backups # or: cd /opt/.../terraform/ovh-ops-backups
$ tf init
$ tf plan
$ tf apply
</pre>

The wrapper handles mounting, key loading, and unmounting transparently. No manual PEFS commands are required.

=== Backup and Restore ===

Backups are performed by Restic against the raw encrypted volume:

<pre>
restic -r s3:https://s3.eu-west-par.io.cloud.ovh.net/nasqueron-backups-amaris \
backup /opt/terraform.enc
</pre>

To restore on a new machine:

<pre>
restic -r s3:https://s3.eu-west-par.io.cloud.ovh.net/nasqueron-backups-amaris \
restore latest --target /opt/terraform.enc

pefs mount /opt/terraform.enc /opt/terraform
vault kv get -field=password ops/infra/complector/terraform/pefs | \
pefs addkey -c /opt/terraform -j -
</pre>

=== Disaster Recovery ===

If the Vault server is unavailable, the PEFS volume cannot be unlocked. Ensure Vault itself is backed up and highly available. The PEFS passphrase should also be stored in a secure offline location (e.g., a hardware security module, a sealed envelope in a safe, or an encrypted password manager) as an emergency recovery path.

== References ==

* [[PEFS]] — Private Encrypted File System for FreeBSD
* [https://pefs.io/ PEFS official documentation]
* [https://pefs.io/static/pefs-devsummit-2011-oct.pdf PEFS Developer Summit 2011 presentation]
* [[Vault]] — HashiCorp Vault secrets management
* [https://opentofu.org/ OpenTofu]
* [https://restic.net/ Restic backup tool]
* [https://www.ovhcloud.com/en-ie/object-storage/ OVH Object Storage]

[[Category:Infrastructure]]
[[Category:Security]]
[[Category:FreeBSD]]
[[Category:Terraform]]

MediaWiki:Common.css

2026-09-20T20:38:09Z

Dereckson: Code in JetBrains Mono

/* Source code */

@font-face {
font-family: "JetBrains Mono";
font-style: normal;
font-weight: 400;
font-display: swap;
src: url("https://assets.nasqueron.org/webfonts/JetBrainsMono/JetBrainsMono-Regular.woff2") format("woff2");
}

@font-face {
font-family: "JetBrains Mono";
font-style: normal;
font-weight: 700;
font-display: swap;
src: url("https://assets.nasqueron.org/webfonts/JetBrainsMono/JetBrainsMono-Bold.woff2") format("woff2");
}

code, tt, kbd, pre, samp {
font-family: "JetBrains Mono", ui-monospace, monospace;
font-size: 0.9em !important;
}

/* Call for actions button */

.btn {
-webkit-border-radius: 6;
-moz-border-radius: 6;
border-radius: 6px;
color: #ffffff;
font-size: 1.4em;
background: #4d7b94;
padding: 10px 20px 10px 20px;
text-decoration: none;
}

.btn a, .btn a:hover, .btn a:visited {
color: white !important;
}

.btn:hover {
background: #6caacc;
text-decoration: none;
}

/* Inline code */

.inline-code, .inline-code div, .inline-code pre {
display: inline-table;
}

/* ============================================================
Technical Wiki Alert
Aesthetic: industrial / editorial
Typography: IBM Plex Sans + IBM Plex Mono
============================================================ */

:root {
/* Light mode */
--alert-danger: #b42318;
--alert-danger-dark: #7a1710;
--alert-danger-bg: #fff4f1;
--alert-danger-ink: #32110d;
--alert-danger-line: #d8aaa3;
--alert-accent: #f04438;
}

/* ============================================================
Base component
============================================================ */

.alert {
--alert-border: var(--alert-danger);
--alert-bg: var(--alert-danger-bg);
--alert-ink: var(--alert-danger-ink);

position: relative;
box-sizing: border-box;

margin: 1.5rem 0;
padding: 1rem 1.25rem 1rem 1.5rem;

background:
linear-gradient(
90deg,
color-mix(in srgb, var(--alert-border) 8%, transparent) 0,
color-mix(in srgb, var(--alert-border) 8%, transparent) 4px,
transparent 4px
),
var(--alert-bg);

color: var(--alert-ink);

border: 1px solid var(--alert-danger-line);
border-left: 5px solid var(--alert-border);

border-radius: 0;

font-family: "IBM Plex Sans", sans-serif;
font-size: 0.95rem;
font-weight: 400;
line-height: 1.6;

box-shadow:
4px 4px 0 rgba(50, 17, 13, 0.08);
}

/* Classification label */

.alert::before {
content: "ALERT";

display: block;
margin-bottom: 0.35rem;

color: var(--alert-danger);

font-family: "IBM Plex Mono", monospace;
font-size: 0.68rem;
font-weight: 700;
letter-spacing: 0.14em;
line-height: 1;

text-transform: uppercase;
}

/* Content */

.alert strong:first-child {
font-weight: 700;
}

/* Links */

.alert a {
color: var(--alert-danger-dark);
font-weight: 700;
text-decoration-thickness: 2px;
text-underline-offset: 3px;
}

.alert a:hover {
color: var(--alert-danger);
}

.alert a:focus-visible {
outline: 2px solid var(--alert-accent);
outline-offset: 3px;
}

/* ============================================================
Dark mode — explicitly configured
============================================================ */

html.skin-theme-clientpref-night {
--alert-danger: #e5483e;
--alert-danger-dark: #ff6b61;
--alert-danger-bg: #211513;
--alert-danger-ink: #f6e7e4;
--alert-danger-line: #5c2b27;
--alert-accent: #ff5a52;
}

html.skin-theme-clientpref-night .alert {
box-shadow:
4px 4px 0 rgba(0, 0, 0, 0.25);
}

/* ============================================================
Dark mode — follows system preference
============================================================ */

@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os {
--alert-danger: #e5483e;
--alert-danger-dark: #ff6b61;
--alert-danger-bg: #211513;
--alert-danger-ink: #f6e7e4;
--alert-danger-line: #5c2b27;
--alert-accent: #ff5a52;
}

html.skin-theme-clientpref-os .alert {
box-shadow:
4px 4px 0 rgba(0, 0, 0, 0.25);
}
}

/* ============================================================
Reduced motion
============================================================ */

@media (prefers-reduced-motion: no-preference) {
.alert {
animation: alert-in 220ms ease-out both;
}
}

@keyframes alert-in {
from {
opacity: 0;
transform: translateX(-8px);
}

to {
opacity: 1;
transform: translateX(0);
}
}

/* ============================================================
Alert variants
============================================================ */

.alert--warning {
--alert-danger: #9a6700;
--alert-danger-dark: #704800;
--alert-bg: #fff9eb;
--alert-ink: #3d2a0a;
--alert-danger-line: #dec58e;
--alert-accent: #d69e2e;
}

.alert--info {
--alert-danger: #1769aa;
--alert-danger-dark: #0f4f82;
--alert-bg: #eef7ff;
--alert-ink: #102a43;
--alert-danger-line: #a9cce8;
--alert-accent: #2b8ed6;
}

.alert--success {
--alert-danger: #287a4b;
--alert-danger-dark: #1b6038;
--alert-bg: #eefbf3;
--alert-ink: #102a1b;
--alert-danger-line: #a8d4b8;
--alert-accent: #38a169;
}

/* Dark variants */

html.skin-theme-clientpref-night .alert--warning,
html.skin-theme-clientpref-os .alert--warning {
--alert-danger: #d9a441;
--alert-danger-dark: #f0c66b;
--alert-bg: #211c11;
--alert-ink: #f4ead5;
--alert-danger-line: #5b4928;
--alert-accent: #e5b14d;
}

html.skin-theme-clientpref-night .alert--info,
html.skin-theme-clientpref-os .alert--info {
--alert-danger: #4da3df;
--alert-danger-dark: #79c4f2;
--alert-bg: #111d27;
--alert-ink: #e1edf5;
--alert-danger-line: #294b61;
--alert-accent: #5db5ed;
}

html.skin-theme-clientpref-night .alert--success,
html.skin-theme-clientpref-os .alert--success {
--alert-danger: #55b87a;
--alert-danger-dark: #7bd39a;
--alert-bg: #112019;
--alert-ink: #e1f0e6;
--alert-danger-line: #28523a;
--alert-accent: #62c889;
}

/* ============================================================
Variant labels
============================================================ */

.alert--warning::before {
content: "WARNING";
}

.alert--info::before {
content: "INFO";
}

.alert--success::before {
content: "OK";
}

/*
Colors from 2017 palette

See https://devcentral.nasqueron.org/M11 or [[Design/2017 colors]]
*/

.color-magnetic-one {
/* Cyberspace gray */
color: #44484D;
}
.color-magnetic-two {
/* Anchors Aweigh blue */
color: #2B3441;
}
.color-magnetic-three {
/* Niagara blue — Pantone 17-4123 */
color: #5587A2;
}
.color-magnetic-four {
/* Primrose yellow — Pantone 13-0755 */
color: #F6D258;
}
.color-magnetic-five {
/* Green from http://www.elledecor.com/design-decorate/color/g3175/color-trends/ */
color: #67947D;
}

/*
Responsive blocks.
*/

.block {
margin: 0 0;
padding: 5vh 5vw;

border: #808080 solid 5px;
}

.block-col {
position: relative;
display:inline;
float: left;
margin-right: 1em;
padding: 1vw;
}

.block-col-quarter {
width: 20%;
}

.block-col-half {
width: 40%;
}

.user-block {
min-height: 50vh;
background-color: #44484D;
color: white;
}

.user-block dt {
color: #67947D;
font-family: 'Segoe UI', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Lato', 'Liberation Sans', 'Noto Sans', 'Helvetica Neue', 'Helvetica', sans-serif;
font-size: 1.375em;
margin-bottom: 1em;
}

.user-block a {
color: #F6D258 !important;
}

/*
Variable Grid System.
Learn more ~ http://www.spry-soft.com/grids/
Based on 960 Grid System - http://960.gs/

Licensed under GPL and MIT.
*/

/* Containers
----------------------------------------------------------------------------------------------------*/
.container_12 {
margin-left: auto;
margin-right: auto;
width: 960px;
}

/* Grid >> Global
----------------------------------------------------------------------------------------------------*/

.grid_1,
.grid_2,
.grid_3,
.grid_4,
.grid_5,
.grid_6,
.grid_7,
.grid_8,
.grid_9,
.grid_10,
.grid_11,
.grid_12 {
display:inline;
float: left;
position: relative;
margin-left: 10px;
margin-right: 10px;
}

/* Grid >> Children (Alpha ~ First, Omega ~ Last)
----------------------------------------------------------------------------------------------------*/

.alpha {
margin-left: 0;
}

.omega {
margin-right: 0;
}

/* Grid >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .grid_1 {
width:60px;
}

.container_12 .grid_2 {
width:140px;
}

.container_12 .grid_3 {
width:220px;
}

.container_12 .grid_4 {
width:300px;
}

.container_12 .grid_5 {
width:380px;
}

.container_12 .grid_6 {
width:460px;
}

.container_12 .grid_7 {
width:540px;
}

.container_12 .grid_8 {
width:620px;
}

.container_12 .grid_9 {
width:700px;
}

.container_12 .grid_10 {
width:780px;
}

.container_12 .grid_11 {
width:860px;
}

.container_12 .grid_12 {
width:940px;
}

/* Prefix Extra Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .prefix_1 {
padding-left:80px;
}

.container_12 .prefix_2 {
padding-left:160px;
}

.container_12 .prefix_3 {
padding-left:240px;
}

.container_12 .prefix_4 {
padding-left:320px;
}

.container_12 .prefix_5 {
padding-left:400px;
}

.container_12 .prefix_6 {
padding-left:480px;
}

.container_12 .prefix_7 {
padding-left:560px;
}

.container_12 .prefix_8 {
padding-left:640px;
}

.container_12 .prefix_9 {
padding-left:720px;
}

.container_12 .prefix_10 {
padding-left:800px;
}

.container_12 .prefix_11 {
padding-left:880px;
}

/* Suffix Extra Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .suffix_1 {
padding-right:80px;
}

.container_12 .suffix_2 {
padding-right:160px;
}

.container_12 .suffix_3 {
padding-right:240px;
}

.container_12 .suffix_4 {
padding-right:320px;
}

.container_12 .suffix_5 {
padding-right:400px;
}

.container_12 .suffix_6 {
padding-right:480px;
}

.container_12 .suffix_7 {
padding-right:560px;
}

.container_12 .suffix_8 {
padding-right:640px;
}

.container_12 .suffix_9 {
padding-right:720px;
}

.container_12 .suffix_10 {
padding-right:800px;
}

.container_12 .suffix_11 {
padding-right:880px;
}

/* Push Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .push_1 {
left:80px;
}

.container_12 .push_2 {
left:160px;
}

.container_12 .push_3 {
left:240px;
}

.container_12 .push_4 {
left:320px;
}

.container_12 .push_5 {
left:400px;
}

.container_12 .push_6 {
left:480px;
}

.container_12 .push_7 {
left:560px;
}

.container_12 .push_8 {
left:640px;
}

.container_12 .push_9 {
left:720px;
}

.container_12 .push_10 {
left:800px;
}

.container_12 .push_11 {
left:880px;
}

/* Pull Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .pull_1 {
left:-80px;
}

.container_12 .pull_2 {
left:-160px;
}

.container_12 .pull_3 {
left:-240px;
}

.container_12 .pull_4 {
left:-320px;
}

.container_12 .pull_5 {
left:-400px;
}

.container_12 .pull_6 {
left:-480px;
}

.container_12 .pull_7 {
left:-560px;
}

.container_12 .pull_8 {
left:-640px;
}

.container_12 .pull_9 {
left:-720px;
}

.container_12 .pull_10 {
left:-800px;
}

.container_12 .pull_11 {
left:-880px;
}

/* Clear Floated Elements
----------------------------------------------------------------------------------------------------*/

/* http://sonspring.com/journal/clearing-floats */

.clear {
clear: both;
display: block;
overflow: hidden;
visibility: hidden;
width: 0;
height: 0;
}

/* http://perishablepress.com/press/2008/02/05/lessons-learned-concerning-the-clearfix-css-hack */

.clearfix:after {
clear: both;
content: ' ';
display: block;
font-size: 0;
line-height: 0;
visibility: hidden;
width: 0;
height: 0;
}

.clearfix {
display: inline-block;
}

* html .clearfix {
height: 1%;
}

.clearfix {
display: block;
}

Devserver reference

2026-09-13T11:40:04Z

Dereckson: /* Modern Neovim support */ Comment in T295 quotes basic settings

Nasqueron Operations SIG maintains '''devservers'''. They offer a remote development environment for Nasqueron and open source projects.

== General information ==
=== What server to use? ===

* WindRiver, for any general-purpose task
* Ysul, for webserver-legacy sites
* Dwellers, for Docker development
* Eglide, if you need an IRC session

=== How to get access? ===

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/3/
| text = Request account
}}

You can ask it on DevCentral.

==== Do it yourself ====

You're encouraged to submit a change with the configuration for your own access. That helps to speed up the process and ensure the right information is there:

* Familiar with Git and our contributions workflow? follow NOG instructions at [[Operations grimoire/Create and revoke user accounts on Salt servers]] and send a commit to DevCentral against our operations repository.
* Newcomer ? We also have a full guide in French explaining step by step how to create that change on a Windows system and send it to review: [[Dev zone/Create devserver access/fr]]

{| class="wikitable"
|+ Groups to use
|-
! Server !! Group name !! Description
|-
| Ysul / WindRiver || nasquenautes || for general purpose development
|-
| Dwellers || nasqueron-dev-docker || for Docker development
|-
| Eglide || shell || for IRC purpose
|}

== Userland ==
=== FreeBSD ===
Normally, devservers run under FreeBSD. That means your userland is a BSD one, and some commands arguments can be different if you're used to Linux. GNU coretools utilities are installed and prefixed by the letter g, e.g. gmake or gsed.

The most useful GNU commands are:
* gmake when the Makefile has been written for GNU make
* gsed -i to perform inline replacements
* gwatch (/usr/sbin/watch allows the user to examine all data coming through a specified tty, that's quite different)

Note grep is the BSD one, but documented to be GNU compatible.

=== Directories ===
* Use your /home/luser directory for anything personal
* Use /srv or /var when you need to share something, that generally requires a Salt config to give shared rights to that directory
* /var/51-wwwroot on Ysul is to use instead of your home folder for staging area of web applications you want to serve
* /datacube contains separate ZFS filesystems for a chunk of data, for example a backup, a collection of Git repositories, they can be declared in {{Ops file|pillar/devserver/datacubes.sls}}

=== tmux ===
* You can use <code>reptyr <pid></code> to attach a process spawned outside a tmux session in one
* [https://gist.github.com/MohamedAlaa/2961058 tmux cheat sheet]

=== Mouse support ===
* nano allows to enable mouse mode with meta+m (ESC, m or alt + m)
** you can click on any character you want to navigate to
** if you initiate a selection with shift + up/down, you can extend it with the mouse
* in tmux, mouse mode (to configure, for example ctrl + b, m) allows you to resize panes
* mouse scroll (mouse wheel or swipe right of your touchpad) generally works like page up / page down to scroll in a buffer

=== Modern Neovim support ===

The devservers provide a fully provisioned environment for modern Neovim development, in addition to the previous generations vi editors.

You can run <code>vi</code> (very old nvi, shipped with FreeBSD OS), <code>vim</code> for traditional Vim or <code>nvim</code> for modern Neovim environment.

We recommend to use <code>nvim</code> and support the [https://www.astronvim.com/ AstroNvim] distribution. All system dependencies are already installed and managed via Salt.

==== AstroNvim ====

To start with AstroNvim:

<syntaxhighlight lang="shell">
mkdir -p ~/.config
git clone https://github.com/AstroNvim/template ~/.config/nvim
nvim
</syntaxhighlight>

On the first launch, Neovim will automatically download all required plugins and compile Treesitter parsers. This may take a minute. Once finished, you can type <code>:qa</code> to exit and relaunch.

It's now ready to use. To add support for a specific language, type <code>:Mason</code> and search for the language server relevant to your development.

Don't forget to install a [https://www.nerdfonts.com/ Nerd Font] in your own OS to see the symbols, as a lot of modern Neovim plugins rely on them.

==== Other frameworks ====

LazyNvim and other configuration frameworks built upon lazy.nvim should work too.

==== Basic vim confguration ====

If you don't want an IDE vibe but a lightweight editor, you can also benefit from Amir Salihefendic settings.

Use https://github.com/amix/vimrc/blob/master/vimrcs/basic.vim as your <code>$HOME/.vimrc</code> file, then run <code>vim</code>.

=== Customize themes ===
==== Save configuration files ====

You can commit directly in the Operations repository your own dotfiles to configure your applications themes, or any other settings.

Create a directory with your username at the following location:
* for every server: {{Ops file|roles/core/userland-home/files}}
* for devserver only: {{Ops file|roles/devserver/userland-home/files}}

Content from those directories will be directly deployed in your home directory.

==== Nerd Font and Powerline ====

SSH server accepts the POWERLINE_SUPPORTED environment variable, so you can add in your own client shell configuration:

<syntaxhighlight lang="shell">
export POWERLINE_SUPPORTED=1
</syntaxhighlight>

Then on the server, you can read it to apply a different theme for your prompt, tmux, etc. when you've this variable:

<syntaxhighlight lang="shell">
if [[ -n "$POWERLINE_SUPPORTED" ]]; then
source ~/.config/zsh/powerline-prompt.zsh
else
source ~/.config/zsh/fallback-prompt.zsh
fi
</syntaxhighlight>

We're open to other ideas to improve better integration with client themes.
If you save any setting in Operations repository, you can attach {{T|2361}} as a reference.

== FreeBSD development ==

For FreeBSD development tasks, WindRiver could be suitable if you need a amd64 arch.
It's certainly suitable for ports development, as Poudriere is installed there.

=== Ports ===
==== Poudriere ====
The [https://docs.freebsd.org/en/books/porters-handbook/testing/#testing-poudriere FreeBSD porter handbook suggests Poudriere] as a convenient way to test ports in a clean environment.

One of the big interest of this method is to start from scratch, allowing to detect hidden dependencies, like <code>pkg-config</code> silently invoked by autotools.

'''Once time setup.''' Poudriere is installed in devserver role. To use it you need:
- a FreeBSD ports tree, let's say you clone it to /home/luser/dev/freebsd/ports
- to declare `luser-dev: /home/luser/dev/freebsd/ports` to {{Ops file|pillar/devserver/ports.sls}} under poudriere.ports

'''Build a port.''' Then you can work in /home/luser/dev/freebsd/ports and build through:

sudo poudriere testport -j base14 -p luser_dev -o somecategory/someport

'''Logs.''' You can browse logs on the web, as https://windriver.nasqueron.org/poudriere serves <code>/usr/local/poudriere/data/logs</code>.

'''Cache.''' To speed up recompilation, [https://ccache.dev/ ccache] is used as disk cache. Metrics for the cache are available for WindRiver at http://172.27.27.35:2337/metrics/ccache (curl it from the server).

== Databases ==

=== MariaDB ===

Works on server with the ''devserver-mysql'' role.

You've access to test_% databases, so you can without any specific configuration use that for unit tests. It's even OK to connect without login or password for the test_% namespace.

If you need any other database and app config, you can request it on DevCentral.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20MariaDB%20database%20on%20devserver
| text = Request database creation
}}

For long term projects, you can also specify where you want the credentials to be be provisioned,
or request a Vault AppRole for your application to fetch them securely.

=== PostgreSQL ===

Works on server with the ''devserver-pgsql'' role.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20PostgreSQL%20database%20on%20devserver
| text = Request database creation
}}

=== Redis ===

''For licensing purpose, should be replaced by Valkey or upgraded to a recent version under AGPLv3. See [https://devcentral.nasqueron.org/T1938 this discussion on DevCentral] for more context.''

Redis is available on WindRiver, with database 0 used by NetBox.

== General build information ==
=== Number of CPUS ===
On FreeBSD, the number of CPU core can be given by <code>sysctl hw.ncpu</code> while the full XML description is available at <code>sysctl kern.sched.topology_spec</code>.

Modern CPU allow for parallel compile tasks, use that.

For example, as of October 2024, you can use 12 core to build on WindRiver.

=== ccache ===
A compiler cache is installed with ccache.

The /etc/make.conf configuration file defines /var/cache/ccache directory to be used for ports build.
That directory can't only be written as root.

You can create your own configuration in <code>$HOME/.ccache/ccache.conf</code>.
The exact path and configuration values can be get by <code>ccache -s</code>.

== Rust ==
=== Rustup ===
If you wish to have control of what stable and nightly Rust versions to use, you can use Rustup.

To use it, the command <code>rustup-init</code> is available as an alternative to the curl magic documented on the Rustup web site (actually it's a fairly recent version of that script saved locally).

=== cargo, rustc ===
If you're OK with the Rust version installed by OS packages, feel free to call directly cargo or rustc.

=== Documentation ===
You can generate project documentation with the `cargo doc` command.

== PHP ==
=== Tools provided ===
The following software are maintained as phar or repository clones in /opt:
* psysh, REPL shell to test PHP code (with PHP documentation available at /usr/local/share/psysh/php_manual.sqlite)
* psalm, for static analysis
* doctum and phpdoc (phpDocumentor) to generate documentation
* phpunit
* phpcs

Most of those tools have wrappers in /usr/local/bin trying to detect if a version is installed locally for the PHP project through Composer and switching to that version if available.

So by running "phpunit", you'll run your Composer version and the system version when missing.

=== Documentation ===

To generate documentation for your code, <code>phpdoc</code> and <code>doctum</code> commands are available, including GraphViz and PlantUML for phpDocumentor classes graphes.

== Network use ==
=== Port to use to spawn a server ===
To spawn a temporary web server, you can use ports 1080, 8000 or 8080 for a recommended 30 minutes maximum duration.

For longer temporary need, the ports 3000, 3100, 3300, 3400, 3500, 3600, 3700, 3800 and 3900 are recommended.

Other applications server can use any free port. Any long-term server should add an entry into {{Ops file|PORTS}}.

== SSH tunnels ==
You can connect to the devserver and create one or more tunnels where you need:
* directly on the devserver: <code>ssh -L 3306:localhost:3306 windriver.nasqueron.org</code>
* to another server: <code>ssh -L 3307:db-B-001:3306 windriver.nasqueron.org</code>

Format is always -L <port on your computer>:<server ip or hostname>:<port on the server>

Resources are reachable on your computer going to localhost and the port you specified locally (e.g. localhost:3307 for db-B-001 MariaDB).

=== Certificates for private network resources ===
Resources using TLS connections on the private network use certificates managed by the CA we've set up with Vault.

To do so, you need to install on your computer the root certificate: {{Ops file|roles/core/certificates/files/nasqueron-vault-ca.crt}}

{| class="wikitable"
|+ Certificates installation procedure - Linux and UNIX
|-
! OS/distro || Step 1. Install package !! Step 2. Drop .crt in directory !! Step 3. Run update command
|-
| Arch Linux || ca-certificates-utils || /etc/ca-certificates/trust-source/anchors || update-ca-trust
|-
| Debian/Ubuntu|| ca-certificates || /usr/local/share/ca-certificates || update-ca-certificates
|-
| Fedora/RHEL || ca-certificates || /etc/pki/ca-trust/source/anchors || update-ca-trust
|-
| FreeBSD || ca_root_nss || /usr/local/share/certs || ''You're done, nothing to run :)''
|-
| openSUSE || ca-certificates-mozilla || /etc/pki/trust/anchors || update-ca-certificates
|}

{| class="wikitable"
|+ Certificates installation procedure - OS using GUI
|-
! OS/distro || Procedure
|-
| ChromeOS || Chrome browser → Settings → Privacy and security → Security → Manage certificates → Authorities → Import
|-
| macOS || Keychain Access → System keychain → File > Import Items…
|-
| Windows || Import into “Trusted Root Certification Authorities” (mmc → Certificates snap-in)
|}

== Acceptable use policy ==
<poem>
''The devserver is a shared space built on trust.''
''It exists to enable creativity, learning, and collaboration, not to enforce restrictive usage rules.''
</poem>

The devserver is primarily intended to:

* support any activity related to Nasqueron;
* support contributions to open source software and free culture in general;
* support participation in technical workshops organized with Nasqueron.

Any activity falling within these purposes is encouraged.

The devserver may also be used to:

* host personal content, provided resource usage remains reasonable (disk space, CPU, RAM, bandwidth);
* support activities aimed at learning, experimentation, and knowledge sharing.

There is no requirement for all hosted content to be open source. Closed-source software, personal documents, or non-public projects are acceptable as long as they do not interfere with the normal operation of the service or other users.

IRC usage should normally take place on Eglide.
However, hosting a lightweight IRC client (such as irssi or weechat) on another devserver, for example to avoid managing multiple SSH or tmux sessions, is acceptable.

== Personal notes ==

You can add in this section links to your own personal notes to use the devserver for your activities, including ideally a disaster recovery plan (how do you reinstall the code your work with?)

* [[User:Dereckson/Devserver]]

== Troubleshoot ==
=== You've lost a file ===

Your home directory has snapshots every 5 minutes, you can get back your recently lost file from a read-only snapshot:

cd ~/.zfs/snapshot
ls

Those are folders with your home directory content as it was at the snapshot time, you can even diff files to spot differences:

cd zfs-auto-snap_hourly-2023-06-05-20h00
diff -u dev/nasqueron/operations/alkane/Jenkinsfile ~/dev/nasqueron/operations/alkane/Jenkinsfile

You've 12 months to act if your file is already in a monthly snapshot, but only 2 hours if it's in the last frequent snapshot and you keep modifying files, so act as quick as possible, ie right now. If you can't act right now, at least save the snapshot having the file (check that to avoid to save the wrong one) you want to recover with <code>zfs hold</code>:

zfs hold keep arcology/usr/home/dereckson@zfs-auto-snap_hourly-2023-06-05-22h00

=== SSH issues ===

If you've a message like <code>username@windriver.nasqueron.org: Permission denied (publickey).</code>, it can means:

* No SSH key has been offered
* SSH keys have been offered, but not recognized by the server
** Check {{Ops file|pillar/core/users.sls}} - do you have your public key on it?
** If not, and you have a new key, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add your new SSH key]
* SSH key is in a non-standard path - launch a SSH agent if needed (you've already one with your desktop engine), then ssh-add <path to key>
* SSH key is protected by a passphrase and you don't remember the password
** Solution 1. Try to remember the password, with an agent and ssh-add, it will be less confusing as you'll work locally
** Solution 2. Destroy the SSH key, create a new one, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add that new key], login or ssh-add each day for one week to remember it

[[Category:FreeBSD]]
[[Category:PHP]]
[[Category:ZFS]]
[[Category:Contributor guide]]
[[Category:Reference]]

Devserver reference

2026-09-13T11:24:40Z

Dereckson: /* Modern Neovim support */

Nasqueron Operations SIG maintains '''devservers'''. They offer a remote development environment for Nasqueron and open source projects.

== General information ==
=== What server to use? ===

* WindRiver, for any general-purpose task
* Ysul, for webserver-legacy sites
* Dwellers, for Docker development
* Eglide, if you need an IRC session

=== How to get access? ===

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/3/
| text = Request account
}}

You can ask it on DevCentral.

==== Do it yourself ====

You're encouraged to submit a change with the configuration for your own access. That helps to speed up the process and ensure the right information is there:

* Familiar with Git and our contributions workflow? follow NOG instructions at [[Operations grimoire/Create and revoke user accounts on Salt servers]] and send a commit to DevCentral against our operations repository.
* Newcomer ? We also have a full guide in French explaining step by step how to create that change on a Windows system and send it to review: [[Dev zone/Create devserver access/fr]]

{| class="wikitable"
|+ Groups to use
|-
! Server !! Group name !! Description
|-
| Ysul / WindRiver || nasquenautes || for general purpose development
|-
| Dwellers || nasqueron-dev-docker || for Docker development
|-
| Eglide || shell || for IRC purpose
|}

== Userland ==
=== FreeBSD ===
Normally, devservers run under FreeBSD. That means your userland is a BSD one, and some commands arguments can be different if you're used to Linux. GNU coretools utilities are installed and prefixed by the letter g, e.g. gmake or gsed.

The most useful GNU commands are:
* gmake when the Makefile has been written for GNU make
* gsed -i to perform inline replacements
* gwatch (/usr/sbin/watch allows the user to examine all data coming through a specified tty, that's quite different)

Note grep is the BSD one, but documented to be GNU compatible.

=== Directories ===
* Use your /home/luser directory for anything personal
* Use /srv or /var when you need to share something, that generally requires a Salt config to give shared rights to that directory
* /var/51-wwwroot on Ysul is to use instead of your home folder for staging area of web applications you want to serve
* /datacube contains separate ZFS filesystems for a chunk of data, for example a backup, a collection of Git repositories, they can be declared in {{Ops file|pillar/devserver/datacubes.sls}}

=== tmux ===
* You can use <code>reptyr <pid></code> to attach a process spawned outside a tmux session in one
* [https://gist.github.com/MohamedAlaa/2961058 tmux cheat sheet]

=== Mouse support ===
* nano allows to enable mouse mode with meta+m (ESC, m or alt + m)
** you can click on any character you want to navigate to
** if you initiate a selection with shift + up/down, you can extend it with the mouse
* in tmux, mouse mode (to configure, for example ctrl + b, m) allows you to resize panes
* mouse scroll (mouse wheel or swipe right of your touchpad) generally works like page up / page down to scroll in a buffer

=== Modern Neovim support ===

The devservers provide a fully provisioned environment for modern Neovim development, in addition to the previous generations vi editors.

You can run <code>vi</code> (very old nvi, shipped with FreeBSD OS), <code>vim</code> for traditional Vim or <code>nvim</code> for modern Neovim environment.

We recommend to use <code>nvim</code> and support the [https://www.astronvim.com/ AstroNvim] distribution. All system dependencies are already installed and managed via Salt.

==== AstroNvim ====

To start with AstroNvim:

<syntaxhighlight lang="shell">
mkdir -p ~/.config
git clone https://github.com/AstroNvim/template ~/.config/nvim
nvim
</syntaxhighlight>

On the first launch, Neovim will automatically download all required plugins and compile Treesitter parsers. This may take a minute. Once finished, you can type <code>:qa</code> to exit and relaunch.

It's now ready to use. To add support for a specific language, type <code>:Mason</code> and search for the language server relevant to your development.

Don't forget to install a [https://www.nerdfonts.com/ Nerd Font] in your own OS to see the symbols, as a lot of modern Neovim plugins rely on them.

==== Other frameworks ====

LazyNvim and other configuration frameworks built upon lazy.nvim should work too.

=== Customize themes ===
==== Save configuration files ====

You can commit directly in the Operations repository your own dotfiles to configure your applications themes, or any other settings.

Create a directory with your username at the following location:
* for every server: {{Ops file|roles/core/userland-home/files}}
* for devserver only: {{Ops file|roles/devserver/userland-home/files}}

Content from those directories will be directly deployed in your home directory.

==== Nerd Font and Powerline ====

SSH server accepts the POWERLINE_SUPPORTED environment variable, so you can add in your own client shell configuration:

<syntaxhighlight lang="shell">
export POWERLINE_SUPPORTED=1
</syntaxhighlight>

Then on the server, you can read it to apply a different theme for your prompt, tmux, etc. when you've this variable:

<syntaxhighlight lang="shell">
if [[ -n "$POWERLINE_SUPPORTED" ]]; then
source ~/.config/zsh/powerline-prompt.zsh
else
source ~/.config/zsh/fallback-prompt.zsh
fi
</syntaxhighlight>

We're open to other ideas to improve better integration with client themes.
If you save any setting in Operations repository, you can attach {{T|2361}} as a reference.

== FreeBSD development ==

For FreeBSD development tasks, WindRiver could be suitable if you need a amd64 arch.
It's certainly suitable for ports development, as Poudriere is installed there.

=== Ports ===
==== Poudriere ====
The [https://docs.freebsd.org/en/books/porters-handbook/testing/#testing-poudriere FreeBSD porter handbook suggests Poudriere] as a convenient way to test ports in a clean environment.

One of the big interest of this method is to start from scratch, allowing to detect hidden dependencies, like <code>pkg-config</code> silently invoked by autotools.

'''Once time setup.''' Poudriere is installed in devserver role. To use it you need:
- a FreeBSD ports tree, let's say you clone it to /home/luser/dev/freebsd/ports
- to declare `luser-dev: /home/luser/dev/freebsd/ports` to {{Ops file|pillar/devserver/ports.sls}} under poudriere.ports

'''Build a port.''' Then you can work in /home/luser/dev/freebsd/ports and build through:

sudo poudriere testport -j base14 -p luser_dev -o somecategory/someport

'''Logs.''' You can browse logs on the web, as https://windriver.nasqueron.org/poudriere serves <code>/usr/local/poudriere/data/logs</code>.

'''Cache.''' To speed up recompilation, [https://ccache.dev/ ccache] is used as disk cache. Metrics for the cache are available for WindRiver at http://172.27.27.35:2337/metrics/ccache (curl it from the server).

== Databases ==

=== MariaDB ===

Works on server with the ''devserver-mysql'' role.

You've access to test_% databases, so you can without any specific configuration use that for unit tests. It's even OK to connect without login or password for the test_% namespace.

If you need any other database and app config, you can request it on DevCentral.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20MariaDB%20database%20on%20devserver
| text = Request database creation
}}

For long term projects, you can also specify where you want the credentials to be be provisioned,
or request a Vault AppRole for your application to fetch them securely.

=== PostgreSQL ===

Works on server with the ''devserver-pgsql'' role.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20PostgreSQL%20database%20on%20devserver
| text = Request database creation
}}

=== Redis ===

''For licensing purpose, should be replaced by Valkey or upgraded to a recent version under AGPLv3. See [https://devcentral.nasqueron.org/T1938 this discussion on DevCentral] for more context.''

Redis is available on WindRiver, with database 0 used by NetBox.

== General build information ==
=== Number of CPUS ===
On FreeBSD, the number of CPU core can be given by <code>sysctl hw.ncpu</code> while the full XML description is available at <code>sysctl kern.sched.topology_spec</code>.

Modern CPU allow for parallel compile tasks, use that.

For example, as of October 2024, you can use 12 core to build on WindRiver.

=== ccache ===
A compiler cache is installed with ccache.

The /etc/make.conf configuration file defines /var/cache/ccache directory to be used for ports build.
That directory can't only be written as root.

You can create your own configuration in <code>$HOME/.ccache/ccache.conf</code>.
The exact path and configuration values can be get by <code>ccache -s</code>.

== Rust ==
=== Rustup ===
If you wish to have control of what stable and nightly Rust versions to use, you can use Rustup.

To use it, the command <code>rustup-init</code> is available as an alternative to the curl magic documented on the Rustup web site (actually it's a fairly recent version of that script saved locally).

=== cargo, rustc ===
If you're OK with the Rust version installed by OS packages, feel free to call directly cargo or rustc.

=== Documentation ===
You can generate project documentation with the `cargo doc` command.

== PHP ==
=== Tools provided ===
The following software are maintained as phar or repository clones in /opt:
* psysh, REPL shell to test PHP code (with PHP documentation available at /usr/local/share/psysh/php_manual.sqlite)
* psalm, for static analysis
* doctum and phpdoc (phpDocumentor) to generate documentation
* phpunit
* phpcs

Most of those tools have wrappers in /usr/local/bin trying to detect if a version is installed locally for the PHP project through Composer and switching to that version if available.

So by running "phpunit", you'll run your Composer version and the system version when missing.

=== Documentation ===

To generate documentation for your code, <code>phpdoc</code> and <code>doctum</code> commands are available, including GraphViz and PlantUML for phpDocumentor classes graphes.

== Network use ==
=== Port to use to spawn a server ===
To spawn a temporary web server, you can use ports 1080, 8000 or 8080 for a recommended 30 minutes maximum duration.

For longer temporary need, the ports 3000, 3100, 3300, 3400, 3500, 3600, 3700, 3800 and 3900 are recommended.

Other applications server can use any free port. Any long-term server should add an entry into {{Ops file|PORTS}}.

== SSH tunnels ==
You can connect to the devserver and create one or more tunnels where you need:
* directly on the devserver: <code>ssh -L 3306:localhost:3306 windriver.nasqueron.org</code>
* to another server: <code>ssh -L 3307:db-B-001:3306 windriver.nasqueron.org</code>

Format is always -L <port on your computer>:<server ip or hostname>:<port on the server>

Resources are reachable on your computer going to localhost and the port you specified locally (e.g. localhost:3307 for db-B-001 MariaDB).

=== Certificates for private network resources ===
Resources using TLS connections on the private network use certificates managed by the CA we've set up with Vault.

To do so, you need to install on your computer the root certificate: {{Ops file|roles/core/certificates/files/nasqueron-vault-ca.crt}}

{| class="wikitable"
|+ Certificates installation procedure - Linux and UNIX
|-
! OS/distro || Step 1. Install package !! Step 2. Drop .crt in directory !! Step 3. Run update command
|-
| Arch Linux || ca-certificates-utils || /etc/ca-certificates/trust-source/anchors || update-ca-trust
|-
| Debian/Ubuntu|| ca-certificates || /usr/local/share/ca-certificates || update-ca-certificates
|-
| Fedora/RHEL || ca-certificates || /etc/pki/ca-trust/source/anchors || update-ca-trust
|-
| FreeBSD || ca_root_nss || /usr/local/share/certs || ''You're done, nothing to run :)''
|-
| openSUSE || ca-certificates-mozilla || /etc/pki/trust/anchors || update-ca-certificates
|}

{| class="wikitable"
|+ Certificates installation procedure - OS using GUI
|-
! OS/distro || Procedure
|-
| ChromeOS || Chrome browser → Settings → Privacy and security → Security → Manage certificates → Authorities → Import
|-
| macOS || Keychain Access → System keychain → File > Import Items…
|-
| Windows || Import into “Trusted Root Certification Authorities” (mmc → Certificates snap-in)
|}

== Acceptable use policy ==
<poem>
''The devserver is a shared space built on trust.''
''It exists to enable creativity, learning, and collaboration, not to enforce restrictive usage rules.''
</poem>

The devserver is primarily intended to:

* support any activity related to Nasqueron;
* support contributions to open source software and free culture in general;
* support participation in technical workshops organized with Nasqueron.

Any activity falling within these purposes is encouraged.

The devserver may also be used to:

* host personal content, provided resource usage remains reasonable (disk space, CPU, RAM, bandwidth);
* support activities aimed at learning, experimentation, and knowledge sharing.

There is no requirement for all hosted content to be open source. Closed-source software, personal documents, or non-public projects are acceptable as long as they do not interfere with the normal operation of the service or other users.

IRC usage should normally take place on Eglide.
However, hosting a lightweight IRC client (such as irssi or weechat) on another devserver, for example to avoid managing multiple SSH or tmux sessions, is acceptable.

== Personal notes ==

You can add in this section links to your own personal notes to use the devserver for your activities, including ideally a disaster recovery plan (how do you reinstall the code your work with?)

* [[User:Dereckson/Devserver]]

== Troubleshoot ==
=== You've lost a file ===

Your home directory has snapshots every 5 minutes, you can get back your recently lost file from a read-only snapshot:

cd ~/.zfs/snapshot
ls

Those are folders with your home directory content as it was at the snapshot time, you can even diff files to spot differences:

cd zfs-auto-snap_hourly-2023-06-05-20h00
diff -u dev/nasqueron/operations/alkane/Jenkinsfile ~/dev/nasqueron/operations/alkane/Jenkinsfile

You've 12 months to act if your file is already in a monthly snapshot, but only 2 hours if it's in the last frequent snapshot and you keep modifying files, so act as quick as possible, ie right now. If you can't act right now, at least save the snapshot having the file (check that to avoid to save the wrong one) you want to recover with <code>zfs hold</code>:

zfs hold keep arcology/usr/home/dereckson@zfs-auto-snap_hourly-2023-06-05-22h00

=== SSH issues ===

If you've a message like <code>username@windriver.nasqueron.org: Permission denied (publickey).</code>, it can means:

* No SSH key has been offered
* SSH keys have been offered, but not recognized by the server
** Check {{Ops file|pillar/core/users.sls}} - do you have your public key on it?
** If not, and you have a new key, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add your new SSH key]
* SSH key is in a non-standard path - launch a SSH agent if needed (you've already one with your desktop engine), then ssh-add <path to key>
* SSH key is protected by a passphrase and you don't remember the password
** Solution 1. Try to remember the password, with an agent and ssh-add, it will be less confusing as you'll work locally
** Solution 2. Destroy the SSH key, create a new one, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add that new key], login or ssh-add each day for one week to remember it

[[Category:FreeBSD]]
[[Category:PHP]]
[[Category:ZFS]]
[[Category:Contributor guide]]
[[Category:Reference]]

Devserver reference

2026-09-13T11:20:26Z

Dereckson: /* Modern Neovim support */

Nasqueron Operations SIG maintains '''devservers'''. They offer a remote development environment for Nasqueron and open source projects.

== General information ==
=== What server to use? ===

* WindRiver, for any general-purpose task
* Ysul, for webserver-legacy sites
* Dwellers, for Docker development
* Eglide, if you need an IRC session

=== How to get access? ===

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/3/
| text = Request account
}}

You can ask it on DevCentral.

==== Do it yourself ====

You're encouraged to submit a change with the configuration for your own access. That helps to speed up the process and ensure the right information is there:

* Familiar with Git and our contributions workflow? follow NOG instructions at [[Operations grimoire/Create and revoke user accounts on Salt servers]] and send a commit to DevCentral against our operations repository.
* Newcomer ? We also have a full guide in French explaining step by step how to create that change on a Windows system and send it to review: [[Dev zone/Create devserver access/fr]]

{| class="wikitable"
|+ Groups to use
|-
! Server !! Group name !! Description
|-
| Ysul / WindRiver || nasquenautes || for general purpose development
|-
| Dwellers || nasqueron-dev-docker || for Docker development
|-
| Eglide || shell || for IRC purpose
|}

== Userland ==
=== FreeBSD ===
Normally, devservers run under FreeBSD. That means your userland is a BSD one, and some commands arguments can be different if you're used to Linux. GNU coretools utilities are installed and prefixed by the letter g, e.g. gmake or gsed.

The most useful GNU commands are:
* gmake when the Makefile has been written for GNU make
* gsed -i to perform inline replacements
* gwatch (/usr/sbin/watch allows the user to examine all data coming through a specified tty, that's quite different)

Note grep is the BSD one, but documented to be GNU compatible.

=== Directories ===
* Use your /home/luser directory for anything personal
* Use /srv or /var when you need to share something, that generally requires a Salt config to give shared rights to that directory
* /var/51-wwwroot on Ysul is to use instead of your home folder for staging area of web applications you want to serve
* /datacube contains separate ZFS filesystems for a chunk of data, for example a backup, a collection of Git repositories, they can be declared in {{Ops file|pillar/devserver/datacubes.sls}}

=== tmux ===
* You can use <code>reptyr <pid></code> to attach a process spawned outside a tmux session in one
* [https://gist.github.com/MohamedAlaa/2961058 tmux cheat sheet]

=== Mouse support ===
* nano allows to enable mouse mode with meta+m (ESC, m or alt + m)
** you can click on any character you want to navigate to
** if you initiate a selection with shift + up/down, you can extend it with the mouse
* in tmux, mouse mode (to configure, for example ctrl + b, m) allows you to resize panes
* mouse scroll (mouse wheel or swipe right of your touchpad) generally works like page up / page down to scroll in a buffer

=== Modern Neovim support ===

You can run <code>vi</code> (very old nvi, shipped with FreeBSD OS), <code>vim</code> for traditional Vim or <code>nvim</code> for modern Neovim environment.

The devservers provide a fully provisioned environment for modern Neovim development. All system dependencies required by (including <code>neovim</code>, <code>ripgrep</code>, <code>fd</code>, <code>node</code>, <code>npm</code>, <code>tree-sitter-cli</code>, and <code>gmake</code> for FreeBSD)

We recommend to use <code>nvim</code> and support the [https://www.astronvim.com/ AstroNvim] distribution. All system dependencies are already installed and managed via Salt.

==== AstroNvim ====

To start with AstroNvim:

<syntaxhighlight lang="shell">
mkdir -p ~/.config
git clone https://github.com/AstroNvim/template ~/.config/nvim
nvim
</syntaxhighlight>

On the first launch, Neovim will automatically download all required plugins and compile Treesitter parsers. This may take a minute. Once finished, you can type <code>:qa</code> to exit and relaunch.

It's now ready to use. To add support for a specific language, type <code>:Mason</code> and search for the language server relevant to your development.

==== Other frameworks ====

LazyNvim and other configuration frameworks built upon lazy.nvim should work too.

=== Customize themes ===
==== Save configuration files ====

You can commit directly in the Operations repository your own dotfiles to configure your applications themes, or any other settings.

Create a directory with your username at the following location:
* for every server: {{Ops file|roles/core/userland-home/files}}
* for devserver only: {{Ops file|roles/devserver/userland-home/files}}

Content from those directories will be directly deployed in your home directory.

==== Nerd Font and Powerline ====

SSH server accepts the POWERLINE_SUPPORTED environment variable, so you can add in your own client shell configuration:

<syntaxhighlight lang="shell">
export POWERLINE_SUPPORTED=1
</syntaxhighlight>

Then on the server, you can read it to apply a different theme for your prompt, tmux, etc. when you've this variable:

<syntaxhighlight lang="shell">
if [[ -n "$POWERLINE_SUPPORTED" ]]; then
source ~/.config/zsh/powerline-prompt.zsh
else
source ~/.config/zsh/fallback-prompt.zsh
fi
</syntaxhighlight>

We're open to other ideas to improve better integration with client themes.
If you save any setting in Operations repository, you can attach {{T|2361}} as a reference.

== FreeBSD development ==

For FreeBSD development tasks, WindRiver could be suitable if you need a amd64 arch.
It's certainly suitable for ports development, as Poudriere is installed there.

=== Ports ===
==== Poudriere ====
The [https://docs.freebsd.org/en/books/porters-handbook/testing/#testing-poudriere FreeBSD porter handbook suggests Poudriere] as a convenient way to test ports in a clean environment.

One of the big interest of this method is to start from scratch, allowing to detect hidden dependencies, like <code>pkg-config</code> silently invoked by autotools.

'''Once time setup.''' Poudriere is installed in devserver role. To use it you need:
- a FreeBSD ports tree, let's say you clone it to /home/luser/dev/freebsd/ports
- to declare `luser-dev: /home/luser/dev/freebsd/ports` to {{Ops file|pillar/devserver/ports.sls}} under poudriere.ports

'''Build a port.''' Then you can work in /home/luser/dev/freebsd/ports and build through:

sudo poudriere testport -j base14 -p luser_dev -o somecategory/someport

'''Logs.''' You can browse logs on the web, as https://windriver.nasqueron.org/poudriere serves <code>/usr/local/poudriere/data/logs</code>.

'''Cache.''' To speed up recompilation, [https://ccache.dev/ ccache] is used as disk cache. Metrics for the cache are available for WindRiver at http://172.27.27.35:2337/metrics/ccache (curl it from the server).

== Databases ==

=== MariaDB ===

Works on server with the ''devserver-mysql'' role.

You've access to test_% databases, so you can without any specific configuration use that for unit tests. It's even OK to connect without login or password for the test_% namespace.

If you need any other database and app config, you can request it on DevCentral.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20MariaDB%20database%20on%20devserver
| text = Request database creation
}}

For long term projects, you can also specify where you want the credentials to be be provisioned,
or request a Vault AppRole for your application to fetch them securely.

=== PostgreSQL ===

Works on server with the ''devserver-pgsql'' role.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20PostgreSQL%20database%20on%20devserver
| text = Request database creation
}}

=== Redis ===

''For licensing purpose, should be replaced by Valkey or upgraded to a recent version under AGPLv3. See [https://devcentral.nasqueron.org/T1938 this discussion on DevCentral] for more context.''

Redis is available on WindRiver, with database 0 used by NetBox.

== General build information ==
=== Number of CPUS ===
On FreeBSD, the number of CPU core can be given by <code>sysctl hw.ncpu</code> while the full XML description is available at <code>sysctl kern.sched.topology_spec</code>.

Modern CPU allow for parallel compile tasks, use that.

For example, as of October 2024, you can use 12 core to build on WindRiver.

=== ccache ===
A compiler cache is installed with ccache.

The /etc/make.conf configuration file defines /var/cache/ccache directory to be used for ports build.
That directory can't only be written as root.

You can create your own configuration in <code>$HOME/.ccache/ccache.conf</code>.
The exact path and configuration values can be get by <code>ccache -s</code>.

== Rust ==
=== Rustup ===
If you wish to have control of what stable and nightly Rust versions to use, you can use Rustup.

To use it, the command <code>rustup-init</code> is available as an alternative to the curl magic documented on the Rustup web site (actually it's a fairly recent version of that script saved locally).

=== cargo, rustc ===
If you're OK with the Rust version installed by OS packages, feel free to call directly cargo or rustc.

=== Documentation ===
You can generate project documentation with the `cargo doc` command.

== PHP ==
=== Tools provided ===
The following software are maintained as phar or repository clones in /opt:
* psysh, REPL shell to test PHP code (with PHP documentation available at /usr/local/share/psysh/php_manual.sqlite)
* psalm, for static analysis
* doctum and phpdoc (phpDocumentor) to generate documentation
* phpunit
* phpcs

Most of those tools have wrappers in /usr/local/bin trying to detect if a version is installed locally for the PHP project through Composer and switching to that version if available.

So by running "phpunit", you'll run your Composer version and the system version when missing.

=== Documentation ===

To generate documentation for your code, <code>phpdoc</code> and <code>doctum</code> commands are available, including GraphViz and PlantUML for phpDocumentor classes graphes.

== Network use ==
=== Port to use to spawn a server ===
To spawn a temporary web server, you can use ports 1080, 8000 or 8080 for a recommended 30 minutes maximum duration.

For longer temporary need, the ports 3000, 3100, 3300, 3400, 3500, 3600, 3700, 3800 and 3900 are recommended.

Other applications server can use any free port. Any long-term server should add an entry into {{Ops file|PORTS}}.

== SSH tunnels ==
You can connect to the devserver and create one or more tunnels where you need:
* directly on the devserver: <code>ssh -L 3306:localhost:3306 windriver.nasqueron.org</code>
* to another server: <code>ssh -L 3307:db-B-001:3306 windriver.nasqueron.org</code>

Format is always -L <port on your computer>:<server ip or hostname>:<port on the server>

Resources are reachable on your computer going to localhost and the port you specified locally (e.g. localhost:3307 for db-B-001 MariaDB).

=== Certificates for private network resources ===
Resources using TLS connections on the private network use certificates managed by the CA we've set up with Vault.

To do so, you need to install on your computer the root certificate: {{Ops file|roles/core/certificates/files/nasqueron-vault-ca.crt}}

{| class="wikitable"
|+ Certificates installation procedure - Linux and UNIX
|-
! OS/distro || Step 1. Install package !! Step 2. Drop .crt in directory !! Step 3. Run update command
|-
| Arch Linux || ca-certificates-utils || /etc/ca-certificates/trust-source/anchors || update-ca-trust
|-
| Debian/Ubuntu|| ca-certificates || /usr/local/share/ca-certificates || update-ca-certificates
|-
| Fedora/RHEL || ca-certificates || /etc/pki/ca-trust/source/anchors || update-ca-trust
|-
| FreeBSD || ca_root_nss || /usr/local/share/certs || ''You're done, nothing to run :)''
|-
| openSUSE || ca-certificates-mozilla || /etc/pki/trust/anchors || update-ca-certificates
|}

{| class="wikitable"
|+ Certificates installation procedure - OS using GUI
|-
! OS/distro || Procedure
|-
| ChromeOS || Chrome browser → Settings → Privacy and security → Security → Manage certificates → Authorities → Import
|-
| macOS || Keychain Access → System keychain → File > Import Items…
|-
| Windows || Import into “Trusted Root Certification Authorities” (mmc → Certificates snap-in)
|}

== Acceptable use policy ==
<poem>
''The devserver is a shared space built on trust.''
''It exists to enable creativity, learning, and collaboration, not to enforce restrictive usage rules.''
</poem>

The devserver is primarily intended to:

* support any activity related to Nasqueron;
* support contributions to open source software and free culture in general;
* support participation in technical workshops organized with Nasqueron.

Any activity falling within these purposes is encouraged.

The devserver may also be used to:

* host personal content, provided resource usage remains reasonable (disk space, CPU, RAM, bandwidth);
* support activities aimed at learning, experimentation, and knowledge sharing.

There is no requirement for all hosted content to be open source. Closed-source software, personal documents, or non-public projects are acceptable as long as they do not interfere with the normal operation of the service or other users.

IRC usage should normally take place on Eglide.
However, hosting a lightweight IRC client (such as irssi or weechat) on another devserver, for example to avoid managing multiple SSH or tmux sessions, is acceptable.

== Personal notes ==

You can add in this section links to your own personal notes to use the devserver for your activities, including ideally a disaster recovery plan (how do you reinstall the code your work with?)

* [[User:Dereckson/Devserver]]

== Troubleshoot ==
=== You've lost a file ===

Your home directory has snapshots every 5 minutes, you can get back your recently lost file from a read-only snapshot:

cd ~/.zfs/snapshot
ls

Those are folders with your home directory content as it was at the snapshot time, you can even diff files to spot differences:

cd zfs-auto-snap_hourly-2023-06-05-20h00
diff -u dev/nasqueron/operations/alkane/Jenkinsfile ~/dev/nasqueron/operations/alkane/Jenkinsfile

You've 12 months to act if your file is already in a monthly snapshot, but only 2 hours if it's in the last frequent snapshot and you keep modifying files, so act as quick as possible, ie right now. If you can't act right now, at least save the snapshot having the file (check that to avoid to save the wrong one) you want to recover with <code>zfs hold</code>:

zfs hold keep arcology/usr/home/dereckson@zfs-auto-snap_hourly-2023-06-05-22h00

=== SSH issues ===

If you've a message like <code>username@windriver.nasqueron.org: Permission denied (publickey).</code>, it can means:

* No SSH key has been offered
* SSH keys have been offered, but not recognized by the server
** Check {{Ops file|pillar/core/users.sls}} - do you have your public key on it?
** If not, and you have a new key, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add your new SSH key]
* SSH key is in a non-standard path - launch a SSH agent if needed (you've already one with your desktop engine), then ssh-add <path to key>
* SSH key is protected by a passphrase and you don't remember the password
** Solution 1. Try to remember the password, with an agent and ssh-add, it will be less confusing as you'll work locally
** Solution 2. Destroy the SSH key, create a new one, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add that new key], login or ssh-add each day for one week to remember it

[[Category:FreeBSD]]
[[Category:PHP]]
[[Category:ZFS]]
[[Category:Contributor guide]]
[[Category:Reference]]

Devserver reference

2026-09-13T11:19:35Z

Dereckson: /* Userland */

Nasqueron Operations SIG maintains '''devservers'''. They offer a remote development environment for Nasqueron and open source projects.

== General information ==
=== What server to use? ===

* WindRiver, for any general-purpose task
* Ysul, for webserver-legacy sites
* Dwellers, for Docker development
* Eglide, if you need an IRC session

=== How to get access? ===

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/3/
| text = Request account
}}

You can ask it on DevCentral.

==== Do it yourself ====

You're encouraged to submit a change with the configuration for your own access. That helps to speed up the process and ensure the right information is there:

* Familiar with Git and our contributions workflow? follow NOG instructions at [[Operations grimoire/Create and revoke user accounts on Salt servers]] and send a commit to DevCentral against our operations repository.
* Newcomer ? We also have a full guide in French explaining step by step how to create that change on a Windows system and send it to review: [[Dev zone/Create devserver access/fr]]

{| class="wikitable"
|+ Groups to use
|-
! Server !! Group name !! Description
|-
| Ysul / WindRiver || nasquenautes || for general purpose development
|-
| Dwellers || nasqueron-dev-docker || for Docker development
|-
| Eglide || shell || for IRC purpose
|}

== Userland ==
=== FreeBSD ===
Normally, devservers run under FreeBSD. That means your userland is a BSD one, and some commands arguments can be different if you're used to Linux. GNU coretools utilities are installed and prefixed by the letter g, e.g. gmake or gsed.

The most useful GNU commands are:
* gmake when the Makefile has been written for GNU make
* gsed -i to perform inline replacements
* gwatch (/usr/sbin/watch allows the user to examine all data coming through a specified tty, that's quite different)

Note grep is the BSD one, but documented to be GNU compatible.

=== Directories ===
* Use your /home/luser directory for anything personal
* Use /srv or /var when you need to share something, that generally requires a Salt config to give shared rights to that directory
* /var/51-wwwroot on Ysul is to use instead of your home folder for staging area of web applications you want to serve
* /datacube contains separate ZFS filesystems for a chunk of data, for example a backup, a collection of Git repositories, they can be declared in {{Ops file|pillar/devserver/datacubes.sls}}

=== tmux ===
* You can use <code>reptyr <pid></code> to attach a process spawned outside a tmux session in one
* [https://gist.github.com/MohamedAlaa/2961058 tmux cheat sheet]

=== Mouse support ===
* nano allows to enable mouse mode with meta+m (ESC, m or alt + m)
** you can click on any character you want to navigate to
** if you initiate a selection with shift + up/down, you can extend it with the mouse
* in tmux, mouse mode (to configure, for example ctrl + b, m) allows you to resize panes
* mouse scroll (mouse wheel or swipe right of your touchpad) generally works like page up / page down to scroll in a buffer

=== Modern Neovim support ===

You can run <code>vi</code> (very old nvi, shipped with FreeBSD OS), <code>vim</code> for traditional Vim or <code>nvim</code> for modern Neovim environment.

We recommend to use <code>nvim</code> and support the [https://www.astronvim.com/ AstroNvim] distribution. All system dependencies are already installed and managed via Salt.

To start with AstroNvim:

<syntaxhighlight lang="shell">
mkdir -p ~/.config
git clone https://github.com/AstroNvim/template ~/.config/nvim
nvim
</syntaxhighlight>

On the first launch, Neovim will automatically download all required plugins and compile Treesitter parsers. This may take a minute. Once finished, you can type <code>:qa</code> to exit and relaunch.

It's now ready to use. To add support for a specific language, type <code>:Mason</code> and search for the language server relevant to your development.

LazyNvim and other configuration frameworks built upon lazy.nvim should work too.

The devservers provide a fully provisioned environment for modern Neovim development. All system dependencies required by (including <code>neovim</code>, <code>ripgrep</code>, <code>fd</code>, <code>node</code>, <code>npm</code>, <code>tree-sitter-cli</code>, and <code>gmake</code> for FreeBSD)

=== Customize themes ===
==== Save configuration files ====

You can commit directly in the Operations repository your own dotfiles to configure your applications themes, or any other settings.

Create a directory with your username at the following location:
* for every server: {{Ops file|roles/core/userland-home/files}}
* for devserver only: {{Ops file|roles/devserver/userland-home/files}}

Content from those directories will be directly deployed in your home directory.

==== Nerd Font and Powerline ====

SSH server accepts the POWERLINE_SUPPORTED environment variable, so you can add in your own client shell configuration:

<syntaxhighlight lang="shell">
export POWERLINE_SUPPORTED=1
</syntaxhighlight>

Then on the server, you can read it to apply a different theme for your prompt, tmux, etc. when you've this variable:

<syntaxhighlight lang="shell">
if [[ -n "$POWERLINE_SUPPORTED" ]]; then
source ~/.config/zsh/powerline-prompt.zsh
else
source ~/.config/zsh/fallback-prompt.zsh
fi
</syntaxhighlight>

We're open to other ideas to improve better integration with client themes.
If you save any setting in Operations repository, you can attach {{T|2361}} as a reference.

== FreeBSD development ==

For FreeBSD development tasks, WindRiver could be suitable if you need a amd64 arch.
It's certainly suitable for ports development, as Poudriere is installed there.

=== Ports ===
==== Poudriere ====
The [https://docs.freebsd.org/en/books/porters-handbook/testing/#testing-poudriere FreeBSD porter handbook suggests Poudriere] as a convenient way to test ports in a clean environment.

One of the big interest of this method is to start from scratch, allowing to detect hidden dependencies, like <code>pkg-config</code> silently invoked by autotools.

'''Once time setup.''' Poudriere is installed in devserver role. To use it you need:
- a FreeBSD ports tree, let's say you clone it to /home/luser/dev/freebsd/ports
- to declare `luser-dev: /home/luser/dev/freebsd/ports` to {{Ops file|pillar/devserver/ports.sls}} under poudriere.ports

'''Build a port.''' Then you can work in /home/luser/dev/freebsd/ports and build through:

sudo poudriere testport -j base14 -p luser_dev -o somecategory/someport

'''Logs.''' You can browse logs on the web, as https://windriver.nasqueron.org/poudriere serves <code>/usr/local/poudriere/data/logs</code>.

'''Cache.''' To speed up recompilation, [https://ccache.dev/ ccache] is used as disk cache. Metrics for the cache are available for WindRiver at http://172.27.27.35:2337/metrics/ccache (curl it from the server).

== Databases ==

=== MariaDB ===

Works on server with the ''devserver-mysql'' role.

You've access to test_% databases, so you can without any specific configuration use that for unit tests. It's even OK to connect without login or password for the test_% namespace.

If you need any other database and app config, you can request it on DevCentral.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20MariaDB%20database%20on%20devserver
| text = Request database creation
}}

For long term projects, you can also specify where you want the credentials to be be provisioned,
or request a Vault AppRole for your application to fetch them securely.

=== PostgreSQL ===

Works on server with the ''devserver-pgsql'' role.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20PostgreSQL%20database%20on%20devserver
| text = Request database creation
}}

=== Redis ===

''For licensing purpose, should be replaced by Valkey or upgraded to a recent version under AGPLv3. See [https://devcentral.nasqueron.org/T1938 this discussion on DevCentral] for more context.''

Redis is available on WindRiver, with database 0 used by NetBox.

== General build information ==
=== Number of CPUS ===
On FreeBSD, the number of CPU core can be given by <code>sysctl hw.ncpu</code> while the full XML description is available at <code>sysctl kern.sched.topology_spec</code>.

Modern CPU allow for parallel compile tasks, use that.

For example, as of October 2024, you can use 12 core to build on WindRiver.

=== ccache ===
A compiler cache is installed with ccache.

The /etc/make.conf configuration file defines /var/cache/ccache directory to be used for ports build.
That directory can't only be written as root.

You can create your own configuration in <code>$HOME/.ccache/ccache.conf</code>.
The exact path and configuration values can be get by <code>ccache -s</code>.

== Rust ==
=== Rustup ===
If you wish to have control of what stable and nightly Rust versions to use, you can use Rustup.

To use it, the command <code>rustup-init</code> is available as an alternative to the curl magic documented on the Rustup web site (actually it's a fairly recent version of that script saved locally).

=== cargo, rustc ===
If you're OK with the Rust version installed by OS packages, feel free to call directly cargo or rustc.

=== Documentation ===
You can generate project documentation with the `cargo doc` command.

== PHP ==
=== Tools provided ===
The following software are maintained as phar or repository clones in /opt:
* psysh, REPL shell to test PHP code (with PHP documentation available at /usr/local/share/psysh/php_manual.sqlite)
* psalm, for static analysis
* doctum and phpdoc (phpDocumentor) to generate documentation
* phpunit
* phpcs

Most of those tools have wrappers in /usr/local/bin trying to detect if a version is installed locally for the PHP project through Composer and switching to that version if available.

So by running "phpunit", you'll run your Composer version and the system version when missing.

=== Documentation ===

To generate documentation for your code, <code>phpdoc</code> and <code>doctum</code> commands are available, including GraphViz and PlantUML for phpDocumentor classes graphes.

== Network use ==
=== Port to use to spawn a server ===
To spawn a temporary web server, you can use ports 1080, 8000 or 8080 for a recommended 30 minutes maximum duration.

For longer temporary need, the ports 3000, 3100, 3300, 3400, 3500, 3600, 3700, 3800 and 3900 are recommended.

Other applications server can use any free port. Any long-term server should add an entry into {{Ops file|PORTS}}.

== SSH tunnels ==
You can connect to the devserver and create one or more tunnels where you need:
* directly on the devserver: <code>ssh -L 3306:localhost:3306 windriver.nasqueron.org</code>
* to another server: <code>ssh -L 3307:db-B-001:3306 windriver.nasqueron.org</code>

Format is always -L <port on your computer>:<server ip or hostname>:<port on the server>

Resources are reachable on your computer going to localhost and the port you specified locally (e.g. localhost:3307 for db-B-001 MariaDB).

=== Certificates for private network resources ===
Resources using TLS connections on the private network use certificates managed by the CA we've set up with Vault.

To do so, you need to install on your computer the root certificate: {{Ops file|roles/core/certificates/files/nasqueron-vault-ca.crt}}

{| class="wikitable"
|+ Certificates installation procedure - Linux and UNIX
|-
! OS/distro || Step 1. Install package !! Step 2. Drop .crt in directory !! Step 3. Run update command
|-
| Arch Linux || ca-certificates-utils || /etc/ca-certificates/trust-source/anchors || update-ca-trust
|-
| Debian/Ubuntu|| ca-certificates || /usr/local/share/ca-certificates || update-ca-certificates
|-
| Fedora/RHEL || ca-certificates || /etc/pki/ca-trust/source/anchors || update-ca-trust
|-
| FreeBSD || ca_root_nss || /usr/local/share/certs || ''You're done, nothing to run :)''
|-
| openSUSE || ca-certificates-mozilla || /etc/pki/trust/anchors || update-ca-certificates
|}

{| class="wikitable"
|+ Certificates installation procedure - OS using GUI
|-
! OS/distro || Procedure
|-
| ChromeOS || Chrome browser → Settings → Privacy and security → Security → Manage certificates → Authorities → Import
|-
| macOS || Keychain Access → System keychain → File > Import Items…
|-
| Windows || Import into “Trusted Root Certification Authorities” (mmc → Certificates snap-in)
|}

== Acceptable use policy ==
<poem>
''The devserver is a shared space built on trust.''
''It exists to enable creativity, learning, and collaboration, not to enforce restrictive usage rules.''
</poem>

The devserver is primarily intended to:

* support any activity related to Nasqueron;
* support contributions to open source software and free culture in general;
* support participation in technical workshops organized with Nasqueron.

Any activity falling within these purposes is encouraged.

The devserver may also be used to:

* host personal content, provided resource usage remains reasonable (disk space, CPU, RAM, bandwidth);
* support activities aimed at learning, experimentation, and knowledge sharing.

There is no requirement for all hosted content to be open source. Closed-source software, personal documents, or non-public projects are acceptable as long as they do not interfere with the normal operation of the service or other users.

IRC usage should normally take place on Eglide.
However, hosting a lightweight IRC client (such as irssi or weechat) on another devserver, for example to avoid managing multiple SSH or tmux sessions, is acceptable.

== Personal notes ==

You can add in this section links to your own personal notes to use the devserver for your activities, including ideally a disaster recovery plan (how do you reinstall the code your work with?)

* [[User:Dereckson/Devserver]]

== Troubleshoot ==
=== You've lost a file ===

Your home directory has snapshots every 5 minutes, you can get back your recently lost file from a read-only snapshot:

cd ~/.zfs/snapshot
ls

Those are folders with your home directory content as it was at the snapshot time, you can even diff files to spot differences:

cd zfs-auto-snap_hourly-2023-06-05-20h00
diff -u dev/nasqueron/operations/alkane/Jenkinsfile ~/dev/nasqueron/operations/alkane/Jenkinsfile

You've 12 months to act if your file is already in a monthly snapshot, but only 2 hours if it's in the last frequent snapshot and you keep modifying files, so act as quick as possible, ie right now. If you can't act right now, at least save the snapshot having the file (check that to avoid to save the wrong one) you want to recover with <code>zfs hold</code>:

zfs hold keep arcology/usr/home/dereckson@zfs-auto-snap_hourly-2023-06-05-22h00

=== SSH issues ===

If you've a message like <code>username@windriver.nasqueron.org: Permission denied (publickey).</code>, it can means:

* No SSH key has been offered
* SSH keys have been offered, but not recognized by the server
** Check {{Ops file|pillar/core/users.sls}} - do you have your public key on it?
** If not, and you have a new key, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add your new SSH key]
* SSH key is in a non-standard path - launch a SSH agent if needed (you've already one with your desktop engine), then ssh-add <path to key>
* SSH key is protected by a passphrase and you don't remember the password
** Solution 1. Try to remember the password, with an agent and ssh-add, it will be less confusing as you'll work locally
** Solution 2. Destroy the SSH key, create a new one, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add that new key], login or ssh-add each day for one week to remember it

[[Category:FreeBSD]]
[[Category:PHP]]
[[Category:ZFS]]
[[Category:Contributor guide]]
[[Category:Reference]]

WindRiver

2026-09-12T18:41:30Z

Dereckson: /* Troubleshoot */

WindRiver is an FreeBSD 15 bare metal server for Nasqueron general-purpose development.

It supersedes [[Ysul]].

Upgrade is planned in September 2027, per [[Operations grimoire/Servers lifecycle]].

Documentation: [[Devserver reference]]

== Basic information ==
* '''IP:'''
** 195.154.30.15 <strike>51.159.17.168 since 2023-06-14. Previously 51.159.18.59.</strike>
** 2a02:578:4f0d:0:30d0:7b22:6cde:a52e (native, still to migrate)
** 2001:bc8:6005:5:aa1e:84ff:fef3:5d9c (future through HE)
* '''Hostname:''' windriver.nasqueron.org
* '''Homepage:''' https://windriver.nasqueron.org/
* '''Configuration:''' <strike>64 Gb RAM, Xeon E3 1240 V6, 2x 500 GB SSD ("Pro-6-S")</strike> 96 Gb. RAM, Xeon E5-1650 v3, 3x 500 GB SSD ("Pro-4-L")
* '''ISP:''' [http://www.online.net Online] (FR)
* '''Network:''' Illiad (FR)
* '''Policy:''' Access for any Nasqueron project and for infrastructure operations task.
* '''Started:''' 2019-11-21

== Ports ==

Ports for services managed automatically through Salt are available on {{Ops file|PORTS}}

{| class="wikitable"
|+ Reserved ports - IRC server range
|-
! Port !! User account !! Description
|-
| 6901 || dereckson || irssi proxy
|-
| 6902 || dereckson || irssi proxy
|}

== Troubleshoot ==

=== Restore private network ===

We made an error in 2026. We let students directly configure the current infrastructure instead of a sandbox environment to install a new router. At the end of their internship, they didn't merge their patches.

As such, tunnels configured on WindRiver don't match the reality.

As of 2026-09-12, to restore network:

<syntaxhighlight lang="shell">
ifconfig gre1 destroy
ifconfig gre0 destroy
ifconfig gre0 tunnel 195.154.30.15 178.32.70.110
ifconfig gre0 inet 172.27.27.35 172.27.27.243
route add 172.27.27.0/24 172.27.27.243
ifconfig igb0 inet6 2001:bc8:2e84:700:0:dead:c0de:b07 prefixlen 56 alias
</syntaxhighlight>

=== To check after reboot ===

* Network
** IPv4 - ICANN
** IPv6 - main + viperserv alias
** IPv6 - can we reach something with IPv6
** IPv4 - Drake: tunnel + route + ping any server
* Services
** Alkane HTTP server
** API exec HTTP server
** Bitlbee
** Eggdrops: Dæghrefn + Wearg
** Grafana
** MariaDB
** NetBox
** nginx
** Node exporter for Prometheus
** oidentd
** php-fpm
** PostgreSQL
** Prometheus
** Redis
** Salt minion
** SSH server
* Vault connectivity

Devserver reference

2026-09-12T18:20:47Z

Dereckson: /* Customize themes */

Nasqueron Operations SIG maintains '''devservers'''. They offer a remote development environment for Nasqueron and open source projects.

== General information ==
=== What server to use? ===

* WindRiver, for any general-purpose task
* Ysul, for webserver-legacy sites
* Dwellers, for Docker development
* Eglide, if you need an IRC session

=== How to get access? ===

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/3/
| text = Request account
}}

You can ask it on DevCentral.

==== Do it yourself ====

You're encouraged to submit a change with the configuration for your own access. That helps to speed up the process and ensure the right information is there:

* Familiar with Git and our contributions workflow? follow NOG instructions at [[Operations grimoire/Create and revoke user accounts on Salt servers]] and send a commit to DevCentral against our operations repository.
* Newcomer ? We also have a full guide in French explaining step by step how to create that change on a Windows system and send it to review: [[Dev zone/Create devserver access/fr]]

{| class="wikitable"
|+ Groups to use
|-
! Server !! Group name !! Description
|-
| Ysul / WindRiver || nasquenautes || for general purpose development
|-
| Dwellers || nasqueron-dev-docker || for Docker development
|-
| Eglide || shell || for IRC purpose
|}

== Userland ==
=== FreeBSD ===
Normally, devservers run under FreeBSD. That means your userland is a BSD one, and some commands arguments can be different if you're used to Linux. GNU coretools utilities are installed and prefixed by the letter g, e.g. gmake or gsed.

The most useful GNU commands are:
* gmake when the Makefile has been written for GNU make
* gsed -i to perform inline replacements
* gwatch (/usr/sbin/watch allows the user to examine all data coming through a specified tty, that's quite different)

Note grep is the BSD one, but documented to be GNU compatible.

=== Directories ===
* Use your /home/luser directory for anything personal
* Use /srv or /var when you need to share something, that generally requires a Salt config to give shared rights to that directory
* /var/51-wwwroot on Ysul is to use instead of your home folder for staging area of web applications you want to serve
* /datacube contains separate ZFS filesystems for a chunk of data, for example a backup, a collection of Git repositories, they can be declared in {{Ops file|pillar/devserver/datacubes.sls}}

=== tmux ===
* You can use <code>reptyr <pid></code> to attach a process spawned outside a tmux session in one
* [https://gist.github.com/MohamedAlaa/2961058 tmux cheat sheet]

=== Mouse support ===
* nano allows to enable mouse mode with meta+m (ESC, m or alt + m)
** you can click on any character you want to navigate to
** if you initiate a selection with shift + up/down, you can extend it with the mouse
* in tmux, mouse mode (to configure, for example ctrl + b, m) allows you to resize panes
* mouse scroll (mouse wheel or swipe right of your touchpad) generally works like page up / page down to scroll in a buffer

=== Customize themes ===
==== Save configuration files ====

You can commit directly in the Operations repository your own dotfiles to configure your applications themes, or any other settings.

Create a directory with your username at the following location:
* for every server: {{Ops file|roles/core/userland-home/files}}
* for devserver only: {{Ops file|roles/devserver/userland-home/files}}

Content from those directories will be directly deployed in your home directory.

==== Nerd Font and Powerline ====

SSH server accepts the POWERLINE_SUPPORTED environment variable, so you can add in your own client shell configuration:

<syntaxhighlight lang="shell">
export POWERLINE_SUPPORTED=1
</syntaxhighlight>

Then on the server, you can read it to apply a different theme for your prompt, tmux, etc. when you've this variable:

<syntaxhighlight lang="shell">
if [[ -n "$POWERLINE_SUPPORTED" ]]; then
source ~/.config/zsh/powerline-prompt.zsh
else
source ~/.config/zsh/fallback-prompt.zsh
fi
</syntaxhighlight>

We're open to other ideas to improve better integration with client themes.
If you save any setting in Operations repository, you can attach {{T|2361}} as a reference.

== FreeBSD development ==

For FreeBSD development tasks, WindRiver could be suitable if you need a amd64 arch.
It's certainly suitable for ports development, as Poudriere is installed there.

=== Ports ===
==== Poudriere ====
The [https://docs.freebsd.org/en/books/porters-handbook/testing/#testing-poudriere FreeBSD porter handbook suggests Poudriere] as a convenient way to test ports in a clean environment.

One of the big interest of this method is to start from scratch, allowing to detect hidden dependencies, like <code>pkg-config</code> silently invoked by autotools.

'''Once time setup.''' Poudriere is installed in devserver role. To use it you need:
- a FreeBSD ports tree, let's say you clone it to /home/luser/dev/freebsd/ports
- to declare `luser-dev: /home/luser/dev/freebsd/ports` to {{Ops file|pillar/devserver/ports.sls}} under poudriere.ports

'''Build a port.''' Then you can work in /home/luser/dev/freebsd/ports and build through:

sudo poudriere testport -j base14 -p luser_dev -o somecategory/someport

'''Logs.''' You can browse logs on the web, as https://windriver.nasqueron.org/poudriere serves <code>/usr/local/poudriere/data/logs</code>.

'''Cache.''' To speed up recompilation, [https://ccache.dev/ ccache] is used as disk cache. Metrics for the cache are available for WindRiver at http://172.27.27.35:2337/metrics/ccache (curl it from the server).

== Databases ==

=== MariaDB ===

Works on server with the ''devserver-mysql'' role.

You've access to test_% databases, so you can without any specific configuration use that for unit tests. It's even OK to connect without login or password for the test_% namespace.

If you need any other database and app config, you can request it on DevCentral.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20MariaDB%20database%20on%20devserver
| text = Request database creation
}}

For long term projects, you can also specify where you want the credentials to be be provisioned,
or request a Vault AppRole for your application to fetch them securely.

=== PostgreSQL ===

Works on server with the ''devserver-pgsql'' role.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20PostgreSQL%20database%20on%20devserver
| text = Request database creation
}}

=== Redis ===

''For licensing purpose, should be replaced by Valkey or upgraded to a recent version under AGPLv3. See [https://devcentral.nasqueron.org/T1938 this discussion on DevCentral] for more context.''

Redis is available on WindRiver, with database 0 used by NetBox.

== General build information ==
=== Number of CPUS ===
On FreeBSD, the number of CPU core can be given by <code>sysctl hw.ncpu</code> while the full XML description is available at <code>sysctl kern.sched.topology_spec</code>.

Modern CPU allow for parallel compile tasks, use that.

For example, as of October 2024, you can use 12 core to build on WindRiver.

=== ccache ===
A compiler cache is installed with ccache.

The /etc/make.conf configuration file defines /var/cache/ccache directory to be used for ports build.
That directory can't only be written as root.

You can create your own configuration in <code>$HOME/.ccache/ccache.conf</code>.
The exact path and configuration values can be get by <code>ccache -s</code>.

== Rust ==
=== Rustup ===
If you wish to have control of what stable and nightly Rust versions to use, you can use Rustup.

To use it, the command <code>rustup-init</code> is available as an alternative to the curl magic documented on the Rustup web site (actually it's a fairly recent version of that script saved locally).

=== cargo, rustc ===
If you're OK with the Rust version installed by OS packages, feel free to call directly cargo or rustc.

=== Documentation ===
You can generate project documentation with the `cargo doc` command.

== PHP ==
=== Tools provided ===
The following software are maintained as phar or repository clones in /opt:
* psysh, REPL shell to test PHP code (with PHP documentation available at /usr/local/share/psysh/php_manual.sqlite)
* psalm, for static analysis
* doctum and phpdoc (phpDocumentor) to generate documentation
* phpunit
* phpcs

Most of those tools have wrappers in /usr/local/bin trying to detect if a version is installed locally for the PHP project through Composer and switching to that version if available.

So by running "phpunit", you'll run your Composer version and the system version when missing.

=== Documentation ===

To generate documentation for your code, <code>phpdoc</code> and <code>doctum</code> commands are available, including GraphViz and PlantUML for phpDocumentor classes graphes.

== Network use ==
=== Port to use to spawn a server ===
To spawn a temporary web server, you can use ports 1080, 8000 or 8080 for a recommended 30 minutes maximum duration.

For longer temporary need, the ports 3000, 3100, 3300, 3400, 3500, 3600, 3700, 3800 and 3900 are recommended.

Other applications server can use any free port. Any long-term server should add an entry into {{Ops file|PORTS}}.

== SSH tunnels ==
You can connect to the devserver and create one or more tunnels where you need:
* directly on the devserver: <code>ssh -L 3306:localhost:3306 windriver.nasqueron.org</code>
* to another server: <code>ssh -L 3307:db-B-001:3306 windriver.nasqueron.org</code>

Format is always -L <port on your computer>:<server ip or hostname>:<port on the server>

Resources are reachable on your computer going to localhost and the port you specified locally (e.g. localhost:3307 for db-B-001 MariaDB).

=== Certificates for private network resources ===
Resources using TLS connections on the private network use certificates managed by the CA we've set up with Vault.

To do so, you need to install on your computer the root certificate: {{Ops file|roles/core/certificates/files/nasqueron-vault-ca.crt}}

{| class="wikitable"
|+ Certificates installation procedure - Linux and UNIX
|-
! OS/distro || Step 1. Install package !! Step 2. Drop .crt in directory !! Step 3. Run update command
|-
| Arch Linux || ca-certificates-utils || /etc/ca-certificates/trust-source/anchors || update-ca-trust
|-
| Debian/Ubuntu|| ca-certificates || /usr/local/share/ca-certificates || update-ca-certificates
|-
| Fedora/RHEL || ca-certificates || /etc/pki/ca-trust/source/anchors || update-ca-trust
|-
| FreeBSD || ca_root_nss || /usr/local/share/certs || ''You're done, nothing to run :)''
|-
| openSUSE || ca-certificates-mozilla || /etc/pki/trust/anchors || update-ca-certificates
|}

{| class="wikitable"
|+ Certificates installation procedure - OS using GUI
|-
! OS/distro || Procedure
|-
| ChromeOS || Chrome browser → Settings → Privacy and security → Security → Manage certificates → Authorities → Import
|-
| macOS || Keychain Access → System keychain → File > Import Items…
|-
| Windows || Import into “Trusted Root Certification Authorities” (mmc → Certificates snap-in)
|}

== Acceptable use policy ==
<poem>
''The devserver is a shared space built on trust.''
''It exists to enable creativity, learning, and collaboration, not to enforce restrictive usage rules.''
</poem>

The devserver is primarily intended to:

* support any activity related to Nasqueron;
* support contributions to open source software and free culture in general;
* support participation in technical workshops organized with Nasqueron.

Any activity falling within these purposes is encouraged.

The devserver may also be used to:

* host personal content, provided resource usage remains reasonable (disk space, CPU, RAM, bandwidth);
* support activities aimed at learning, experimentation, and knowledge sharing.

There is no requirement for all hosted content to be open source. Closed-source software, personal documents, or non-public projects are acceptable as long as they do not interfere with the normal operation of the service or other users.

IRC usage should normally take place on Eglide.
However, hosting a lightweight IRC client (such as irssi or weechat) on another devserver, for example to avoid managing multiple SSH or tmux sessions, is acceptable.

== Personal notes ==

You can add in this section links to your own personal notes to use the devserver for your activities, including ideally a disaster recovery plan (how do you reinstall the code your work with?)

* [[User:Dereckson/Devserver]]

== Troubleshoot ==
=== You've lost a file ===

Your home directory has snapshots every 5 minutes, you can get back your recently lost file from a read-only snapshot:

cd ~/.zfs/snapshot
ls

Those are folders with your home directory content as it was at the snapshot time, you can even diff files to spot differences:

cd zfs-auto-snap_hourly-2023-06-05-20h00
diff -u dev/nasqueron/operations/alkane/Jenkinsfile ~/dev/nasqueron/operations/alkane/Jenkinsfile

You've 12 months to act if your file is already in a monthly snapshot, but only 2 hours if it's in the last frequent snapshot and you keep modifying files, so act as quick as possible, ie right now. If you can't act right now, at least save the snapshot having the file (check that to avoid to save the wrong one) you want to recover with <code>zfs hold</code>:

zfs hold keep arcology/usr/home/dereckson@zfs-auto-snap_hourly-2023-06-05-22h00

=== SSH issues ===

If you've a message like <code>username@windriver.nasqueron.org: Permission denied (publickey).</code>, it can means:

* No SSH key has been offered
* SSH keys have been offered, but not recognized by the server
** Check {{Ops file|pillar/core/users.sls}} - do you have your public key on it?
** If not, and you have a new key, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add your new SSH key]
* SSH key is in a non-standard path - launch a SSH agent if needed (you've already one with your desktop engine), then ssh-add <path to key>
* SSH key is protected by a passphrase and you don't remember the password
** Solution 1. Try to remember the password, with an agent and ssh-add, it will be less confusing as you'll work locally
** Solution 2. Destroy the SSH key, create a new one, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add that new key], login or ssh-add each day for one week to remember it

[[Category:FreeBSD]]
[[Category:PHP]]
[[Category:ZFS]]
[[Category:Contributor guide]]
[[Category:Reference]]

Devserver reference

2026-09-12T18:16:33Z

Dereckson: /* Userland */

Nasqueron Operations SIG maintains '''devservers'''. They offer a remote development environment for Nasqueron and open source projects.

== General information ==
=== What server to use? ===

* WindRiver, for any general-purpose task
* Ysul, for webserver-legacy sites
* Dwellers, for Docker development
* Eglide, if you need an IRC session

=== How to get access? ===

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/3/
| text = Request account
}}

You can ask it on DevCentral.

==== Do it yourself ====

You're encouraged to submit a change with the configuration for your own access. That helps to speed up the process and ensure the right information is there:

* Familiar with Git and our contributions workflow? follow NOG instructions at [[Operations grimoire/Create and revoke user accounts on Salt servers]] and send a commit to DevCentral against our operations repository.
* Newcomer ? We also have a full guide in French explaining step by step how to create that change on a Windows system and send it to review: [[Dev zone/Create devserver access/fr]]

{| class="wikitable"
|+ Groups to use
|-
! Server !! Group name !! Description
|-
| Ysul / WindRiver || nasquenautes || for general purpose development
|-
| Dwellers || nasqueron-dev-docker || for Docker development
|-
| Eglide || shell || for IRC purpose
|}

== Userland ==
=== FreeBSD ===
Normally, devservers run under FreeBSD. That means your userland is a BSD one, and some commands arguments can be different if you're used to Linux. GNU coretools utilities are installed and prefixed by the letter g, e.g. gmake or gsed.

The most useful GNU commands are:
* gmake when the Makefile has been written for GNU make
* gsed -i to perform inline replacements
* gwatch (/usr/sbin/watch allows the user to examine all data coming through a specified tty, that's quite different)

Note grep is the BSD one, but documented to be GNU compatible.

=== Directories ===
* Use your /home/luser directory for anything personal
* Use /srv or /var when you need to share something, that generally requires a Salt config to give shared rights to that directory
* /var/51-wwwroot on Ysul is to use instead of your home folder for staging area of web applications you want to serve
* /datacube contains separate ZFS filesystems for a chunk of data, for example a backup, a collection of Git repositories, they can be declared in {{Ops file|pillar/devserver/datacubes.sls}}

=== tmux ===
* You can use <code>reptyr <pid></code> to attach a process spawned outside a tmux session in one
* [https://gist.github.com/MohamedAlaa/2961058 tmux cheat sheet]

=== Mouse support ===
* nano allows to enable mouse mode with meta+m (ESC, m or alt + m)
** you can click on any character you want to navigate to
** if you initiate a selection with shift + up/down, you can extend it with the mouse
* in tmux, mouse mode (to configure, for example ctrl + b, m) allows you to resize panes
* mouse scroll (mouse wheel or swipe right of your touchpad) generally works like page up / page down to scroll in a buffer

=== Customize themes ===

==== Nerd Font and Powerline ====

SSH server accepts the POWERLINE_SUPPORTED environment variable, so you can add in your own client shell configuration:

<syntaxhighlight lang="shell">
export POWERLINE_SUPPORTED=1
</syntaxhighlight>

Then on the server, you can read it to apply a different theme for your prompt, tmux, etc. when you've this variable:

<syntaxhighlight lang="shell">
if [[ -n "$POWERLINE_SUPPORTED" ]]; then
source ~/.config/zsh/powerline-prompt.zsh
else
source ~/.config/zsh/fallback-prompt.zsh
fi
</syntaxhighlight>

We're open to other ideas to improve better integration with client themes.
If you save any setting in Operations repository, you can attach {{T|2361}} as a reference.

== FreeBSD development ==

For FreeBSD development tasks, WindRiver could be suitable if you need a amd64 arch.
It's certainly suitable for ports development, as Poudriere is installed there.

=== Ports ===
==== Poudriere ====
The [https://docs.freebsd.org/en/books/porters-handbook/testing/#testing-poudriere FreeBSD porter handbook suggests Poudriere] as a convenient way to test ports in a clean environment.

One of the big interest of this method is to start from scratch, allowing to detect hidden dependencies, like <code>pkg-config</code> silently invoked by autotools.

'''Once time setup.''' Poudriere is installed in devserver role. To use it you need:
- a FreeBSD ports tree, let's say you clone it to /home/luser/dev/freebsd/ports
- to declare `luser-dev: /home/luser/dev/freebsd/ports` to {{Ops file|pillar/devserver/ports.sls}} under poudriere.ports

'''Build a port.''' Then you can work in /home/luser/dev/freebsd/ports and build through:

sudo poudriere testport -j base14 -p luser_dev -o somecategory/someport

'''Logs.''' You can browse logs on the web, as https://windriver.nasqueron.org/poudriere serves <code>/usr/local/poudriere/data/logs</code>.

'''Cache.''' To speed up recompilation, [https://ccache.dev/ ccache] is used as disk cache. Metrics for the cache are available for WindRiver at http://172.27.27.35:2337/metrics/ccache (curl it from the server).

== Databases ==

=== MariaDB ===

Works on server with the ''devserver-mysql'' role.

You've access to test_% databases, so you can without any specific configuration use that for unit tests. It's even OK to connect without login or password for the test_% namespace.

If you need any other database and app config, you can request it on DevCentral.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20MariaDB%20database%20on%20devserver
| text = Request database creation
}}

For long term projects, you can also specify where you want the credentials to be be provisioned,
or request a Vault AppRole for your application to fetch them securely.

=== PostgreSQL ===

Works on server with the ''devserver-pgsql'' role.

{{Call for action
| link = https://devcentral.nasqueron.org/maniphest/task/edit/form/1/?tags=servers,Nasqueron_Operations_Squad&title=Create%20PostgreSQL%20database%20on%20devserver
| text = Request database creation
}}

=== Redis ===

''For licensing purpose, should be replaced by Valkey or upgraded to a recent version under AGPLv3. See [https://devcentral.nasqueron.org/T1938 this discussion on DevCentral] for more context.''

Redis is available on WindRiver, with database 0 used by NetBox.

== General build information ==
=== Number of CPUS ===
On FreeBSD, the number of CPU core can be given by <code>sysctl hw.ncpu</code> while the full XML description is available at <code>sysctl kern.sched.topology_spec</code>.

Modern CPU allow for parallel compile tasks, use that.

For example, as of October 2024, you can use 12 core to build on WindRiver.

=== ccache ===
A compiler cache is installed with ccache.

The /etc/make.conf configuration file defines /var/cache/ccache directory to be used for ports build.
That directory can't only be written as root.

You can create your own configuration in <code>$HOME/.ccache/ccache.conf</code>.
The exact path and configuration values can be get by <code>ccache -s</code>.

== Rust ==
=== Rustup ===
If you wish to have control of what stable and nightly Rust versions to use, you can use Rustup.

To use it, the command <code>rustup-init</code> is available as an alternative to the curl magic documented on the Rustup web site (actually it's a fairly recent version of that script saved locally).

=== cargo, rustc ===
If you're OK with the Rust version installed by OS packages, feel free to call directly cargo or rustc.

=== Documentation ===
You can generate project documentation with the `cargo doc` command.

== PHP ==
=== Tools provided ===
The following software are maintained as phar or repository clones in /opt:
* psysh, REPL shell to test PHP code (with PHP documentation available at /usr/local/share/psysh/php_manual.sqlite)
* psalm, for static analysis
* doctum and phpdoc (phpDocumentor) to generate documentation
* phpunit
* phpcs

Most of those tools have wrappers in /usr/local/bin trying to detect if a version is installed locally for the PHP project through Composer and switching to that version if available.

So by running "phpunit", you'll run your Composer version and the system version when missing.

=== Documentation ===

To generate documentation for your code, <code>phpdoc</code> and <code>doctum</code> commands are available, including GraphViz and PlantUML for phpDocumentor classes graphes.

== Network use ==
=== Port to use to spawn a server ===
To spawn a temporary web server, you can use ports 1080, 8000 or 8080 for a recommended 30 minutes maximum duration.

For longer temporary need, the ports 3000, 3100, 3300, 3400, 3500, 3600, 3700, 3800 and 3900 are recommended.

Other applications server can use any free port. Any long-term server should add an entry into {{Ops file|PORTS}}.

== SSH tunnels ==
You can connect to the devserver and create one or more tunnels where you need:
* directly on the devserver: <code>ssh -L 3306:localhost:3306 windriver.nasqueron.org</code>
* to another server: <code>ssh -L 3307:db-B-001:3306 windriver.nasqueron.org</code>

Format is always -L <port on your computer>:<server ip or hostname>:<port on the server>

Resources are reachable on your computer going to localhost and the port you specified locally (e.g. localhost:3307 for db-B-001 MariaDB).

=== Certificates for private network resources ===
Resources using TLS connections on the private network use certificates managed by the CA we've set up with Vault.

To do so, you need to install on your computer the root certificate: {{Ops file|roles/core/certificates/files/nasqueron-vault-ca.crt}}

{| class="wikitable"
|+ Certificates installation procedure - Linux and UNIX
|-
! OS/distro || Step 1. Install package !! Step 2. Drop .crt in directory !! Step 3. Run update command
|-
| Arch Linux || ca-certificates-utils || /etc/ca-certificates/trust-source/anchors || update-ca-trust
|-
| Debian/Ubuntu|| ca-certificates || /usr/local/share/ca-certificates || update-ca-certificates
|-
| Fedora/RHEL || ca-certificates || /etc/pki/ca-trust/source/anchors || update-ca-trust
|-
| FreeBSD || ca_root_nss || /usr/local/share/certs || ''You're done, nothing to run :)''
|-
| openSUSE || ca-certificates-mozilla || /etc/pki/trust/anchors || update-ca-certificates
|}

{| class="wikitable"
|+ Certificates installation procedure - OS using GUI
|-
! OS/distro || Procedure
|-
| ChromeOS || Chrome browser → Settings → Privacy and security → Security → Manage certificates → Authorities → Import
|-
| macOS || Keychain Access → System keychain → File > Import Items…
|-
| Windows || Import into “Trusted Root Certification Authorities” (mmc → Certificates snap-in)
|}

== Acceptable use policy ==
<poem>
''The devserver is a shared space built on trust.''
''It exists to enable creativity, learning, and collaboration, not to enforce restrictive usage rules.''
</poem>

The devserver is primarily intended to:

* support any activity related to Nasqueron;
* support contributions to open source software and free culture in general;
* support participation in technical workshops organized with Nasqueron.

Any activity falling within these purposes is encouraged.

The devserver may also be used to:

* host personal content, provided resource usage remains reasonable (disk space, CPU, RAM, bandwidth);
* support activities aimed at learning, experimentation, and knowledge sharing.

There is no requirement for all hosted content to be open source. Closed-source software, personal documents, or non-public projects are acceptable as long as they do not interfere with the normal operation of the service or other users.

IRC usage should normally take place on Eglide.
However, hosting a lightweight IRC client (such as irssi or weechat) on another devserver, for example to avoid managing multiple SSH or tmux sessions, is acceptable.

== Personal notes ==

You can add in this section links to your own personal notes to use the devserver for your activities, including ideally a disaster recovery plan (how do you reinstall the code your work with?)

* [[User:Dereckson/Devserver]]

== Troubleshoot ==
=== You've lost a file ===

Your home directory has snapshots every 5 minutes, you can get back your recently lost file from a read-only snapshot:

cd ~/.zfs/snapshot
ls

Those are folders with your home directory content as it was at the snapshot time, you can even diff files to spot differences:

cd zfs-auto-snap_hourly-2023-06-05-20h00
diff -u dev/nasqueron/operations/alkane/Jenkinsfile ~/dev/nasqueron/operations/alkane/Jenkinsfile

You've 12 months to act if your file is already in a monthly snapshot, but only 2 hours if it's in the last frequent snapshot and you keep modifying files, so act as quick as possible, ie right now. If you can't act right now, at least save the snapshot having the file (check that to avoid to save the wrong one) you want to recover with <code>zfs hold</code>:

zfs hold keep arcology/usr/home/dereckson@zfs-auto-snap_hourly-2023-06-05-22h00

=== SSH issues ===

If you've a message like <code>username@windriver.nasqueron.org: Permission denied (publickey).</code>, it can means:

* No SSH key has been offered
* SSH keys have been offered, but not recognized by the server
** Check {{Ops file|pillar/core/users.sls}} - do you have your public key on it?
** If not, and you have a new key, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add your new SSH key]
* SSH key is in a non-standard path - launch a SSH agent if needed (you've already one with your desktop engine), then ssh-add <path to key>
* SSH key is protected by a passphrase and you don't remember the password
** Solution 1. Try to remember the password, with an agent and ssh-add, it will be less confusing as you'll work locally
** Solution 2. Destroy the SSH key, create a new one, [https://devcentral.nasqueron.org/maniphest/task/edit/form/3/ request to add that new key], login or ssh-add each day for one week to remember it

[[Category:FreeBSD]]
[[Category:PHP]]
[[Category:ZFS]]
[[Category:Contributor guide]]
[[Category:Reference]]

Operations grimoire/Deploy with Terraform

2026-09-06T21:08:51Z

Dereckson: Proofread

Operations grimoire/Deploy with Terraform

2026-09-06T18:54:32Z

Dereckson: Per T2359. Explain the tf wrapper, and the directories where are stored the states/providers. Switch from tofu/terraform to tf command.

Operations grimoire/Deploy with Terraform

2026-09-06T13:50:17Z

Dereckson:

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

==== CARP OVH secrets usage ====

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

=== ovh-ops-backups ===
This configuration is handled by Terraform.

It requires a full access to public cloud project for backups, as the project is fully configured by those Terraform files.

You'll need to get application key, application secret and consumer_key in your $HOME/.ovh.conf on Complector.
You can also generate such files with <code>ovhcloud login</code>.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenTofu states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
|-
| ovh-ops-backups || On disk || /opt/salt/nasqueron-operations/terraform/ovh-ops-backups/terraform.tfstate || Terraform
|}

On disk paths are stored in Complector.

== First Terraform configuration (DRP) ==
=== Initialize Terraform working directories ===
Terraform and OpenTofu are currently deployed from Complector.
The working directories are encrypted, a wrapper decrypt them for each operation.

You need to restore from a backup the content of /opt/terraform.enc or if not available reinitialize a new encrypted directory.
Currently, the procedure is valid for FreeBSD, as it requires PEFS to encrypt working director.

# On the salt primary server, deploy the full roles/salt-primary, or at least the roles/salt-primary/opentofu unit
# Ensure pefs is active with <code>kldstat | grep pefs</code>
# Ensure Vault is up, then <code>vault kv put ops/infra/complector/terraform/pefs password=$(openssl rand -hex 48)</code>
# Run <code>initialize-pefs ops/infra/complector/terraform/pefs /opt/terraform.enc /opt/terraform</code>

The vault previous version of the secret, if still available, is for the previous directory, keep it if we restore afterhand.
But you need a new password for your new fresh encrypted directory.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

Operations grimoire/Deploy with Terraform

2026-09-05T19:43:53Z

Dereckson: /* ovh-ops-backups */ Terraform, not OpenTofu

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

==== CARP OVH secrets usage ====

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

=== ovh-ops-backups ===
This configuration is handled by Terraform.

It requires a full access to public cloud project for backups, as the project is fully configured by those Terraform files.

You'll need to get application key, application secret and consumer_key in your $HOME/.ovh.conf on Complector.
You can also generate such files with <code>ovhcloud login</code>.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenTofu states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
|-
| ovh-ops-backups || On disk || /opt/salt/nasqueron-operations/terraform/ovh-ops-backups/terraform.tfstate || Terraform
|}

On disk paths are stored in Complector.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

Operations grimoire/Deploy with Terraform

2026-09-05T19:43:23Z

Dereckson: /* Table of Terraform states */ Terraform too for ovh-ops-backups as we need to store credentials to Vault

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

==== CARP OVH secrets usage ====

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

=== ovh-ops-backups ===
This Terraform configuration is handled by OpenTofu.

It requires a full access to public cloud project for backups, as the project is fully configured by those Terraform files.

You'll need to get application key, application secret and consumer_key in your $HOME/.ovh.conf on Complector.
You can also generate such files with <code>ovhcloud login</code>.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenTofu states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
|-
| ovh-ops-backups || On disk || /opt/salt/nasqueron-operations/terraform/ovh-ops-backups/terraform.tfstate || Terraform
|}

On disk paths are stored in Complector.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

User:Dereckson/timeless.css

2026-09-05T18:42:44Z

Dereckson: Table headers rows

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);

--nq-soft-sage: #eef1ea;
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: var(--nq-soft-sage);
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

/*
* The side rails contain navigation and contextual tools rather than reading
* content. Deep Sea Dive gives those blocks one stable role in both modes.
*/
.skin-timeless #mw-site-navigation .sidebar-chunk,
.skin-timeless #mw-related-navigation .sidebar-chunk {
border-color: rgba(138, 197, 186, 0.38);
background: var(--nq-dive);
color: var(--nq-paper);
box-shadow: 0 12px 28px rgba(32, 36, 45, 0.16);
}

.skin-timeless #mw-site-navigation #site-tools,
.skin-timeless #mw-related-navigation #catlinks-sidebar {
background: #2f5459;
}

.skin-timeless #mw-site-navigation .sidebar-chunk h2,
.skin-timeless #mw-site-navigation .sidebar-chunk h3,
.skin-timeless #mw-related-navigation .sidebar-chunk h2,
.skin-timeless #mw-related-navigation .sidebar-chunk h3 {
border-bottom-color: rgba(138, 197, 186, 0.58);
color: var(--nq-paper);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a,
.skin-timeless #mw-site-navigation .sidebar-chunk a:visited,
.skin-timeless #mw-related-navigation .sidebar-chunk a,
.skin-timeless #mw-related-navigation .sidebar-chunk a:visited {
color: var(--nq-mist);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-site-navigation .sidebar-chunk a:focus-visible,
.skin-timeless #mw-related-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-related-navigation .sidebar-chunk a:focus-visible {
color: var(--nq-paper);
text-decoration-color: var(--nq-blue-box);
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-night.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless .wikitable th,
html.skin-theme-clientpref-night .skin-timeless .mw_metadata th {
background: var(--nq-dive)
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-os.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless .wikitable th,
html.skin-theme-clientpref-os .skin-timeless .mw_metadata th {
background: var(--nq-dive)
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

MediaWiki:Common.css

2026-09-05T18:31:07Z

Dereckson: More complex alert solution

/* Source code */

code, tt, kbd, pre, samp {
font-size: 0.9em !important;
}

/* Call for actions button */

.btn {
-webkit-border-radius: 6;
-moz-border-radius: 6;
border-radius: 6px;
color: #ffffff;
font-size: 1.4em;
background: #4d7b94;
padding: 10px 20px 10px 20px;
text-decoration: none;
}

.btn a, .btn a:hover, .btn a:visited {
color: white !important;
}

.btn:hover {
background: #6caacc;
text-decoration: none;
}

/* Inline code */

.inline-code, .inline-code div, .inline-code pre {
display: inline-table;
}

/* ============================================================
Technical Wiki Alert
Aesthetic: industrial / editorial
Typography: IBM Plex Sans + IBM Plex Mono
============================================================ */

:root {
/* Light mode */
--alert-danger: #b42318;
--alert-danger-dark: #7a1710;
--alert-danger-bg: #fff4f1;
--alert-danger-ink: #32110d;
--alert-danger-line: #d8aaa3;
--alert-accent: #f04438;
}

/* ============================================================
Base component
============================================================ */

.alert {
--alert-border: var(--alert-danger);
--alert-bg: var(--alert-danger-bg);
--alert-ink: var(--alert-danger-ink);

position: relative;
box-sizing: border-box;

margin: 1.5rem 0;
padding: 1rem 1.25rem 1rem 1.5rem;

background:
linear-gradient(
90deg,
color-mix(in srgb, var(--alert-border) 8%, transparent) 0,
color-mix(in srgb, var(--alert-border) 8%, transparent) 4px,
transparent 4px
),
var(--alert-bg);

color: var(--alert-ink);

border: 1px solid var(--alert-danger-line);
border-left: 5px solid var(--alert-border);

border-radius: 0;

font-family: "IBM Plex Sans", sans-serif;
font-size: 0.95rem;
font-weight: 400;
line-height: 1.6;

box-shadow:
4px 4px 0 rgba(50, 17, 13, 0.08);
}

/* Classification label */

.alert::before {
content: "ALERT";

display: block;
margin-bottom: 0.35rem;

color: var(--alert-danger);

font-family: "IBM Plex Mono", monospace;
font-size: 0.68rem;
font-weight: 700;
letter-spacing: 0.14em;
line-height: 1;

text-transform: uppercase;
}

/* Content */

.alert strong:first-child {
font-weight: 700;
}

/* Links */

.alert a {
color: var(--alert-danger-dark);
font-weight: 700;
text-decoration-thickness: 2px;
text-underline-offset: 3px;
}

.alert a:hover {
color: var(--alert-danger);
}

.alert a:focus-visible {
outline: 2px solid var(--alert-accent);
outline-offset: 3px;
}

/* ============================================================
Dark mode — explicitly configured
============================================================ */

html.skin-theme-clientpref-night {
--alert-danger: #e5483e;
--alert-danger-dark: #ff6b61;
--alert-danger-bg: #211513;
--alert-danger-ink: #f6e7e4;
--alert-danger-line: #5c2b27;
--alert-accent: #ff5a52;
}

html.skin-theme-clientpref-night .alert {
box-shadow:
4px 4px 0 rgba(0, 0, 0, 0.25);
}

/* ============================================================
Dark mode — follows system preference
============================================================ */

@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os {
--alert-danger: #e5483e;
--alert-danger-dark: #ff6b61;
--alert-danger-bg: #211513;
--alert-danger-ink: #f6e7e4;
--alert-danger-line: #5c2b27;
--alert-accent: #ff5a52;
}

html.skin-theme-clientpref-os .alert {
box-shadow:
4px 4px 0 rgba(0, 0, 0, 0.25);
}
}

/* ============================================================
Reduced motion
============================================================ */

@media (prefers-reduced-motion: no-preference) {
.alert {
animation: alert-in 220ms ease-out both;
}
}

@keyframes alert-in {
from {
opacity: 0;
transform: translateX(-8px);
}

to {
opacity: 1;
transform: translateX(0);
}
}

/* ============================================================
Alert variants
============================================================ */

.alert--warning {
--alert-danger: #9a6700;
--alert-danger-dark: #704800;
--alert-bg: #fff9eb;
--alert-ink: #3d2a0a;
--alert-danger-line: #dec58e;
--alert-accent: #d69e2e;
}

.alert--info {
--alert-danger: #1769aa;
--alert-danger-dark: #0f4f82;
--alert-bg: #eef7ff;
--alert-ink: #102a43;
--alert-danger-line: #a9cce8;
--alert-accent: #2b8ed6;
}

.alert--success {
--alert-danger: #287a4b;
--alert-danger-dark: #1b6038;
--alert-bg: #eefbf3;
--alert-ink: #102a1b;
--alert-danger-line: #a8d4b8;
--alert-accent: #38a169;
}

/* Dark variants */

html.skin-theme-clientpref-night .alert--warning,
html.skin-theme-clientpref-os .alert--warning {
--alert-danger: #d9a441;
--alert-danger-dark: #f0c66b;
--alert-bg: #211c11;
--alert-ink: #f4ead5;
--alert-danger-line: #5b4928;
--alert-accent: #e5b14d;
}

html.skin-theme-clientpref-night .alert--info,
html.skin-theme-clientpref-os .alert--info {
--alert-danger: #4da3df;
--alert-danger-dark: #79c4f2;
--alert-bg: #111d27;
--alert-ink: #e1edf5;
--alert-danger-line: #294b61;
--alert-accent: #5db5ed;
}

html.skin-theme-clientpref-night .alert--success,
html.skin-theme-clientpref-os .alert--success {
--alert-danger: #55b87a;
--alert-danger-dark: #7bd39a;
--alert-bg: #112019;
--alert-ink: #e1f0e6;
--alert-danger-line: #28523a;
--alert-accent: #62c889;
}

/* ============================================================
Variant labels
============================================================ */

.alert--warning::before {
content: "WARNING";
}

.alert--info::before {
content: "INFO";
}

.alert--success::before {
content: "OK";
}

/*
Colors from 2017 palette

See https://devcentral.nasqueron.org/M11 or [[Design/2017 colors]]
*/

.color-magnetic-one {
/* Cyberspace gray */
color: #44484D;
}
.color-magnetic-two {
/* Anchors Aweigh blue */
color: #2B3441;
}
.color-magnetic-three {
/* Niagara blue — Pantone 17-4123 */
color: #5587A2;
}
.color-magnetic-four {
/* Primrose yellow — Pantone 13-0755 */
color: #F6D258;
}
.color-magnetic-five {
/* Green from http://www.elledecor.com/design-decorate/color/g3175/color-trends/ */
color: #67947D;
}

/*
Responsive blocks.
*/

.block {
margin: 0 0;
padding: 5vh 5vw;

border: #808080 solid 5px;
}

.block-col {
position: relative;
display:inline;
float: left;
margin-right: 1em;
padding: 1vw;
}

.block-col-quarter {
width: 20%;
}

.block-col-half {
width: 40%;
}

.user-block {
min-height: 50vh;
background-color: #44484D;
color: white;
}

.user-block dt {
color: #67947D;
font-family: 'Segoe UI', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Lato', 'Liberation Sans', 'Noto Sans', 'Helvetica Neue', 'Helvetica', sans-serif;
font-size: 1.375em;
margin-bottom: 1em;
}

.user-block a {
color: #F6D258 !important;
}

/*
Variable Grid System.
Learn more ~ http://www.spry-soft.com/grids/
Based on 960 Grid System - http://960.gs/

Licensed under GPL and MIT.
*/

/* Containers
----------------------------------------------------------------------------------------------------*/
.container_12 {
margin-left: auto;
margin-right: auto;
width: 960px;
}

/* Grid >> Global
----------------------------------------------------------------------------------------------------*/

.grid_1,
.grid_2,
.grid_3,
.grid_4,
.grid_5,
.grid_6,
.grid_7,
.grid_8,
.grid_9,
.grid_10,
.grid_11,
.grid_12 {
display:inline;
float: left;
position: relative;
margin-left: 10px;
margin-right: 10px;
}

/* Grid >> Children (Alpha ~ First, Omega ~ Last)
----------------------------------------------------------------------------------------------------*/

.alpha {
margin-left: 0;
}

.omega {
margin-right: 0;
}

/* Grid >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .grid_1 {
width:60px;
}

.container_12 .grid_2 {
width:140px;
}

.container_12 .grid_3 {
width:220px;
}

.container_12 .grid_4 {
width:300px;
}

.container_12 .grid_5 {
width:380px;
}

.container_12 .grid_6 {
width:460px;
}

.container_12 .grid_7 {
width:540px;
}

.container_12 .grid_8 {
width:620px;
}

.container_12 .grid_9 {
width:700px;
}

.container_12 .grid_10 {
width:780px;
}

.container_12 .grid_11 {
width:860px;
}

.container_12 .grid_12 {
width:940px;
}

/* Prefix Extra Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .prefix_1 {
padding-left:80px;
}

.container_12 .prefix_2 {
padding-left:160px;
}

.container_12 .prefix_3 {
padding-left:240px;
}

.container_12 .prefix_4 {
padding-left:320px;
}

.container_12 .prefix_5 {
padding-left:400px;
}

.container_12 .prefix_6 {
padding-left:480px;
}

.container_12 .prefix_7 {
padding-left:560px;
}

.container_12 .prefix_8 {
padding-left:640px;
}

.container_12 .prefix_9 {
padding-left:720px;
}

.container_12 .prefix_10 {
padding-left:800px;
}

.container_12 .prefix_11 {
padding-left:880px;
}

/* Suffix Extra Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .suffix_1 {
padding-right:80px;
}

.container_12 .suffix_2 {
padding-right:160px;
}

.container_12 .suffix_3 {
padding-right:240px;
}

.container_12 .suffix_4 {
padding-right:320px;
}

.container_12 .suffix_5 {
padding-right:400px;
}

.container_12 .suffix_6 {
padding-right:480px;
}

.container_12 .suffix_7 {
padding-right:560px;
}

.container_12 .suffix_8 {
padding-right:640px;
}

.container_12 .suffix_9 {
padding-right:720px;
}

.container_12 .suffix_10 {
padding-right:800px;
}

.container_12 .suffix_11 {
padding-right:880px;
}

/* Push Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .push_1 {
left:80px;
}

.container_12 .push_2 {
left:160px;
}

.container_12 .push_3 {
left:240px;
}

.container_12 .push_4 {
left:320px;
}

.container_12 .push_5 {
left:400px;
}

.container_12 .push_6 {
left:480px;
}

.container_12 .push_7 {
left:560px;
}

.container_12 .push_8 {
left:640px;
}

.container_12 .push_9 {
left:720px;
}

.container_12 .push_10 {
left:800px;
}

.container_12 .push_11 {
left:880px;
}

/* Pull Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .pull_1 {
left:-80px;
}

.container_12 .pull_2 {
left:-160px;
}

.container_12 .pull_3 {
left:-240px;
}

.container_12 .pull_4 {
left:-320px;
}

.container_12 .pull_5 {
left:-400px;
}

.container_12 .pull_6 {
left:-480px;
}

.container_12 .pull_7 {
left:-560px;
}

.container_12 .pull_8 {
left:-640px;
}

.container_12 .pull_9 {
left:-720px;
}

.container_12 .pull_10 {
left:-800px;
}

.container_12 .pull_11 {
left:-880px;
}

/* Clear Floated Elements
----------------------------------------------------------------------------------------------------*/

/* http://sonspring.com/journal/clearing-floats */

.clear {
clear: both;
display: block;
overflow: hidden;
visibility: hidden;
width: 0;
height: 0;
}

/* http://perishablepress.com/press/2008/02/05/lessons-learned-concerning-the-clearfix-css-hack */

.clearfix:after {
clear: both;
content: ' ';
display: block;
font-size: 0;
line-height: 0;
visibility: hidden;
width: 0;
height: 0;
}

.clearfix {
display: inline-block;
}

* html .clearfix {
height: 1%;
}

.clearfix {
display: block;
}

Operations grimoire/Deploy with Terraform

2026-09-05T18:24:14Z

Dereckson: /* Table of Terraform states */ row break

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

==== CARP OVH secrets usage ====

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

=== ovh-ops-backups ===
This Terraform configuration is handled by OpenTofu.

It requires a full access to public cloud project for backups, as the project is fully configured by those Terraform files.

You'll need to get application key, application secret and consumer_key in your $HOME/.ovh.conf on Complector.
You can also generate such files with <code>ovhcloud login</code>.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenTofu states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
|-
| ovh-ops-backups || On disk || /opt/salt/nasqueron-operations/terraform/ovh-ops-backups/terraform.tfstate || OpenTofu
|}

On disk paths are stored in Complector.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

Operations grimoire/Deploy with Terraform

2026-09-05T18:19:55Z

Dereckson: /* Specific deployment notes */

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

==== CARP OVH secrets usage ====

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

=== ovh-ops-backups ===
This Terraform configuration is handled by OpenTofu.

It requires a full access to public cloud project for backups, as the project is fully configured by those Terraform files.

You'll need to get application key, application secret and consumer_key in your $HOME/.ovh.conf on Complector.
You can also generate such files with <code>ovhcloud login</code>.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenTofu states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
| ovh-ops-backups || On disk || /opt/salt/nasqueron-operations/terraform/ovh-ops-backups/terraform.tfstate || OpenTofu
|}

On disk paths are stored in Complector.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

MediaWiki:Common.css

2026-09-05T18:15:08Z

Dereckson: Improve alert CSS code

/* Source code */

code, tt, kbd, pre, samp {
font-size: 0.9em !important;
}

/* Call for actions button */

.btn {
-webkit-border-radius: 6;
-moz-border-radius: 6;
border-radius: 6px;
color: #ffffff;
font-size: 1.4em;
background: #4d7b94;
padding: 10px 20px 10px 20px;
text-decoration: none;
}

.btn a, .btn a:hover, .btn a:visited {
color: white !important;
}

.btn:hover {
background: #6caacc;
text-decoration: none;
}

/* Inline code */

.inline-code, .inline-code div, .inline-code pre {
display: inline-table;
}

/*
Banners
*/

:root {
--alert-danger: #b42318;
--alert-danger-dark: #7a1710;
--alert-danger-bg: #fff4f1;
--alert-danger-ink: #32110d;
--alert-danger-line: #d8aaa3;
--alert-accent: #f04438;
}

/*
* Technical wiki alert
* Direction: industrial / editorial
*/
.alert {
--alert-border: var(--alert-danger);
--alert-bg: var(--alert-danger-bg);
--alert-ink: var(--alert-danger-ink);

position: relative;
box-sizing: border-box;

margin: 1.5rem 0;
padding: 1rem 1.25rem 1rem 1.5rem;

background:
linear-gradient(
90deg,
rgba(180, 35, 24, 0.055) 0,
rgba(180, 35, 24, 0.055) 4px,
transparent 4px
),
var(--alert-bg);

color: var(--alert-ink);
border: 1px solid var(--alert-danger-line);
border-left: 5px solid var(--alert-border);

border-radius: 0;

font-family: "IBM Plex Sans", sans-serif;
font-size: 0.95rem;
line-height: 1.6;

box-shadow:
4px 4px 0 rgba(50, 17, 13, 0.08);
}

/* Classification stamp */
.alert::before {
content: "ALERT";
display: block;

margin-bottom: 0.35rem;

color: var(--alert-danger);
font-family: "IBM Plex Mono", monospace;
font-size: 0.68rem;
font-weight: 700;
letter-spacing: 0.14em;
line-height: 1;

text-transform: uppercase;
}

/* Optional heading */
.alert strong:first-child {
font-family: "IBM Plex Sans", sans-serif;
font-weight: 700;
}

/* Links should look intentional, not like default wiki links */
.alert a {
color: var(--alert-danger-dark);
font-weight: 700;
text-decoration-thickness: 2px;
text-underline-offset: 3px;
}

.alert a:hover {
color: #4f0d08;
}

/* Keyboard accessibility */
.alert a:focus-visible {
outline: 2px solid var(--alert-accent);
outline-offset: 3px;
}

/* Respect reduced-motion preferences if you add the reveal below */
@media (prefers-reduced-motion: no-preference) {
.alert {
animation: alert-in 220ms ease-out both;
}
}

@keyframes alert-in {
from {
opacity: 0;
transform: translateX(-8px);
}

to {
opacity: 1;
transform: translateX(0);
}
}

/*
Colors from 2017 palette

See https://devcentral.nasqueron.org/M11 or [[Design/2017 colors]]
*/

.color-magnetic-one {
/* Cyberspace gray */
color: #44484D;
}
.color-magnetic-two {
/* Anchors Aweigh blue */
color: #2B3441;
}
.color-magnetic-three {
/* Niagara blue — Pantone 17-4123 */
color: #5587A2;
}
.color-magnetic-four {
/* Primrose yellow — Pantone 13-0755 */
color: #F6D258;
}
.color-magnetic-five {
/* Green from http://www.elledecor.com/design-decorate/color/g3175/color-trends/ */
color: #67947D;
}

/*
Responsive blocks.
*/

.block {
margin: 0 0;
padding: 5vh 5vw;

border: #808080 solid 5px;
}

.block-col {
position: relative;
display:inline;
float: left;
margin-right: 1em;
padding: 1vw;
}

.block-col-quarter {
width: 20%;
}

.block-col-half {
width: 40%;
}

.user-block {
min-height: 50vh;
background-color: #44484D;
color: white;
}

.user-block dt {
color: #67947D;
font-family: 'Segoe UI', 'Segoe UI Emoji', 'Segoe UI Symbol', 'Lato', 'Liberation Sans', 'Noto Sans', 'Helvetica Neue', 'Helvetica', sans-serif;
font-size: 1.375em;
margin-bottom: 1em;
}

.user-block a {
color: #F6D258 !important;
}

/*
Variable Grid System.
Learn more ~ http://www.spry-soft.com/grids/
Based on 960 Grid System - http://960.gs/

Licensed under GPL and MIT.
*/

/* Containers
----------------------------------------------------------------------------------------------------*/
.container_12 {
margin-left: auto;
margin-right: auto;
width: 960px;
}

/* Grid >> Global
----------------------------------------------------------------------------------------------------*/

.grid_1,
.grid_2,
.grid_3,
.grid_4,
.grid_5,
.grid_6,
.grid_7,
.grid_8,
.grid_9,
.grid_10,
.grid_11,
.grid_12 {
display:inline;
float: left;
position: relative;
margin-left: 10px;
margin-right: 10px;
}

/* Grid >> Children (Alpha ~ First, Omega ~ Last)
----------------------------------------------------------------------------------------------------*/

.alpha {
margin-left: 0;
}

.omega {
margin-right: 0;
}

/* Grid >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .grid_1 {
width:60px;
}

.container_12 .grid_2 {
width:140px;
}

.container_12 .grid_3 {
width:220px;
}

.container_12 .grid_4 {
width:300px;
}

.container_12 .grid_5 {
width:380px;
}

.container_12 .grid_6 {
width:460px;
}

.container_12 .grid_7 {
width:540px;
}

.container_12 .grid_8 {
width:620px;
}

.container_12 .grid_9 {
width:700px;
}

.container_12 .grid_10 {
width:780px;
}

.container_12 .grid_11 {
width:860px;
}

.container_12 .grid_12 {
width:940px;
}

/* Prefix Extra Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .prefix_1 {
padding-left:80px;
}

.container_12 .prefix_2 {
padding-left:160px;
}

.container_12 .prefix_3 {
padding-left:240px;
}

.container_12 .prefix_4 {
padding-left:320px;
}

.container_12 .prefix_5 {
padding-left:400px;
}

.container_12 .prefix_6 {
padding-left:480px;
}

.container_12 .prefix_7 {
padding-left:560px;
}

.container_12 .prefix_8 {
padding-left:640px;
}

.container_12 .prefix_9 {
padding-left:720px;
}

.container_12 .prefix_10 {
padding-left:800px;
}

.container_12 .prefix_11 {
padding-left:880px;
}

/* Suffix Extra Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .suffix_1 {
padding-right:80px;
}

.container_12 .suffix_2 {
padding-right:160px;
}

.container_12 .suffix_3 {
padding-right:240px;
}

.container_12 .suffix_4 {
padding-right:320px;
}

.container_12 .suffix_5 {
padding-right:400px;
}

.container_12 .suffix_6 {
padding-right:480px;
}

.container_12 .suffix_7 {
padding-right:560px;
}

.container_12 .suffix_8 {
padding-right:640px;
}

.container_12 .suffix_9 {
padding-right:720px;
}

.container_12 .suffix_10 {
padding-right:800px;
}

.container_12 .suffix_11 {
padding-right:880px;
}

/* Push Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .push_1 {
left:80px;
}

.container_12 .push_2 {
left:160px;
}

.container_12 .push_3 {
left:240px;
}

.container_12 .push_4 {
left:320px;
}

.container_12 .push_5 {
left:400px;
}

.container_12 .push_6 {
left:480px;
}

.container_12 .push_7 {
left:560px;
}

.container_12 .push_8 {
left:640px;
}

.container_12 .push_9 {
left:720px;
}

.container_12 .push_10 {
left:800px;
}

.container_12 .push_11 {
left:880px;
}

/* Pull Space >> 12 Columns
----------------------------------------------------------------------------------------------------*/

.container_12 .pull_1 {
left:-80px;
}

.container_12 .pull_2 {
left:-160px;
}

.container_12 .pull_3 {
left:-240px;
}

.container_12 .pull_4 {
left:-320px;
}

.container_12 .pull_5 {
left:-400px;
}

.container_12 .pull_6 {
left:-480px;
}

.container_12 .pull_7 {
left:-560px;
}

.container_12 .pull_8 {
left:-640px;
}

.container_12 .pull_9 {
left:-720px;
}

.container_12 .pull_10 {
left:-800px;
}

.container_12 .pull_11 {
left:-880px;
}

/* Clear Floated Elements
----------------------------------------------------------------------------------------------------*/

/* http://sonspring.com/journal/clearing-floats */

.clear {
clear: both;
display: block;
overflow: hidden;
visibility: hidden;
width: 0;
height: 0;
}

/* http://perishablepress.com/press/2008/02/05/lessons-learned-concerning-the-clearfix-css-hack */

.clearfix:after {
clear: both;
content: ' ';
display: block;
font-size: 0;
line-height: 0;
visibility: hidden;
width: 0;
height: 0;
}

.clearfix {
display: inline-block;
}

* html .clearfix {
height: 1%;
}

.clearfix {
display: block;
}

Operations grimoire/Deploy with Terraform

2026-09-05T18:04:37Z

Dereckson: /* Table of Terraform states */

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

=== CARP OVH secrets usage ===

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenTofu states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
| ovh-ops-backups || On disk || /opt/salt/nasqueron-operations/terraform/ovh-ops-backups/terraform.tfstate || OpenTofu
|}

On disk paths are stored in Complector.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

User:Dereckson/timeless.css

2026-08-29T16:08:12Z

Dereckson: Introducing soft sage color #eef1ea for out-of-page content (e.g. left / right menu)

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);

--nq-soft-sage: #eef1ea;
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: var(--nq-soft-sage);
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

/*
* The side rails contain navigation and contextual tools rather than reading
* content. Deep Sea Dive gives those blocks one stable role in both modes.
*/
.skin-timeless #mw-site-navigation .sidebar-chunk,
.skin-timeless #mw-related-navigation .sidebar-chunk {
border-color: rgba(138, 197, 186, 0.38);
background: var(--nq-dive);
color: var(--nq-paper);
box-shadow: 0 12px 28px rgba(32, 36, 45, 0.16);
}

.skin-timeless #mw-site-navigation #site-tools,
.skin-timeless #mw-related-navigation #catlinks-sidebar {
background: #2f5459;
}

.skin-timeless #mw-site-navigation .sidebar-chunk h2,
.skin-timeless #mw-site-navigation .sidebar-chunk h3,
.skin-timeless #mw-related-navigation .sidebar-chunk h2,
.skin-timeless #mw-related-navigation .sidebar-chunk h3 {
border-bottom-color: rgba(138, 197, 186, 0.58);
color: var(--nq-paper);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a,
.skin-timeless #mw-site-navigation .sidebar-chunk a:visited,
.skin-timeless #mw-related-navigation .sidebar-chunk a,
.skin-timeless #mw-related-navigation .sidebar-chunk a:visited {
color: var(--nq-mist);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-site-navigation .sidebar-chunk a:focus-visible,
.skin-timeless #mw-related-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-related-navigation .sidebar-chunk a:focus-visible {
color: var(--nq-paper);
text-decoration-color: var(--nq-blue-box);
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-night.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-os.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

User:Dereckson/timeless.css

2026-08-29T15:36:11Z

Dereckson: Undid revision 2588 by Dereckson (talk)

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: #ebe6da;
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

/*
* The side rails contain navigation and contextual tools rather than reading
* content. Deep Sea Dive gives those blocks one stable role in both modes.
*/
.skin-timeless #mw-site-navigation .sidebar-chunk,
.skin-timeless #mw-related-navigation .sidebar-chunk {
border-color: rgba(138, 197, 186, 0.38);
background: var(--nq-dive);
color: var(--nq-paper);
box-shadow: 0 12px 28px rgba(32, 36, 45, 0.16);
}

.skin-timeless #mw-site-navigation #site-tools,
.skin-timeless #mw-related-navigation #catlinks-sidebar {
background: #2f5459;
}

.skin-timeless #mw-site-navigation .sidebar-chunk h2,
.skin-timeless #mw-site-navigation .sidebar-chunk h3,
.skin-timeless #mw-related-navigation .sidebar-chunk h2,
.skin-timeless #mw-related-navigation .sidebar-chunk h3 {
border-bottom-color: rgba(138, 197, 186, 0.58);
color: var(--nq-paper);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a,
.skin-timeless #mw-site-navigation .sidebar-chunk a:visited,
.skin-timeless #mw-related-navigation .sidebar-chunk a,
.skin-timeless #mw-related-navigation .sidebar-chunk a:visited {
color: var(--nq-mist);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-site-navigation .sidebar-chunk a:focus-visible,
.skin-timeless #mw-related-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-related-navigation .sidebar-chunk a:focus-visible {
color: var(--nq-paper);
text-decoration-color: var(--nq-blue-box);
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-night.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-os.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

User:Dereckson/timeless.css

2026-08-29T15:35:06Z

Dereckson: Qwen older experiment

User:Dereckson/timeless.css

2026-08-29T15:08:13Z

Dereckson: Invert logo color with filter

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: #ebe6da;
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

/*
* The side rails contain navigation and contextual tools rather than reading
* content. Deep Sea Dive gives those blocks one stable role in both modes.
*/
.skin-timeless #mw-site-navigation .sidebar-chunk,
.skin-timeless #mw-related-navigation .sidebar-chunk {
border-color: rgba(138, 197, 186, 0.38);
background: var(--nq-dive);
color: var(--nq-paper);
box-shadow: 0 12px 28px rgba(32, 36, 45, 0.16);
}

.skin-timeless #mw-site-navigation #site-tools,
.skin-timeless #mw-related-navigation #catlinks-sidebar {
background: #2f5459;
}

.skin-timeless #mw-site-navigation .sidebar-chunk h2,
.skin-timeless #mw-site-navigation .sidebar-chunk h3,
.skin-timeless #mw-related-navigation .sidebar-chunk h2,
.skin-timeless #mw-related-navigation .sidebar-chunk h3 {
border-bottom-color: rgba(138, 197, 186, 0.58);
color: var(--nq-paper);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a,
.skin-timeless #mw-site-navigation .sidebar-chunk a:visited,
.skin-timeless #mw-related-navigation .sidebar-chunk a,
.skin-timeless #mw-related-navigation .sidebar-chunk a:visited {
color: var(--nq-mist);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-site-navigation .sidebar-chunk a:focus-visible,
.skin-timeless #mw-related-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-related-navigation .sidebar-chunk a:focus-visible {
color: var(--nq-paper);
text-decoration-color: var(--nq-blue-box);
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-night.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless .mw-wiki-logo img,
html.skin-theme-clientpref-os.skin-timeless .mw-wiki-logo img {
filter: invert(1);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

User:Dereckson/timeless.css

2026-08-29T10:44:20Z

Dereckson: Left bar too

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: #ebe6da;
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

/*
* The side rails contain navigation and contextual tools rather than reading
* content. Deep Sea Dive gives those blocks one stable role in both modes.
*/
.skin-timeless #mw-site-navigation .sidebar-chunk,
.skin-timeless #mw-related-navigation .sidebar-chunk {
border-color: rgba(138, 197, 186, 0.38);
background: var(--nq-dive);
color: var(--nq-paper);
box-shadow: 0 12px 28px rgba(32, 36, 45, 0.16);
}

.skin-timeless #mw-site-navigation #site-tools,
.skin-timeless #mw-related-navigation #catlinks-sidebar {
background: #2f5459;
}

.skin-timeless #mw-site-navigation .sidebar-chunk h2,
.skin-timeless #mw-site-navigation .sidebar-chunk h3,
.skin-timeless #mw-related-navigation .sidebar-chunk h2,
.skin-timeless #mw-related-navigation .sidebar-chunk h3 {
border-bottom-color: rgba(138, 197, 186, 0.58);
color: var(--nq-paper);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a,
.skin-timeless #mw-site-navigation .sidebar-chunk a:visited,
.skin-timeless #mw-related-navigation .sidebar-chunk a,
.skin-timeless #mw-related-navigation .sidebar-chunk a:visited {
color: var(--nq-mist);
}

.skin-timeless #mw-site-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-site-navigation .sidebar-chunk a:focus-visible,
.skin-timeless #mw-related-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-related-navigation .sidebar-chunk a:focus-visible {
color: var(--nq-paper);
text-decoration-color: var(--nq-blue-box);
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

User:Dereckson/timeless.css

2026-08-29T10:36:43Z

Dereckson: Right tools blocks

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: #ebe6da;
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

/*
* The right rail contains contextual tools rather than reading content. A
* Deep Sea Dive surface gives those blocks a distinct, stable role in both
* light and dark modes without changing the quieter left navigation.
*/
.skin-timeless #mw-related-navigation .sidebar-chunk {
border-color: rgba(138, 197, 186, 0.38);
background: var(--nq-dive);
color: var(--nq-paper);
box-shadow: 0 12px 28px rgba(32, 36, 45, 0.16);
}

.skin-timeless #mw-related-navigation #catlinks-sidebar {
background: #2f5459;
}

.skin-timeless #mw-related-navigation .sidebar-chunk h2,
.skin-timeless #mw-related-navigation .sidebar-chunk h3 {
border-bottom-color: rgba(138, 197, 186, 0.58);
color: var(--nq-paper);
}

.skin-timeless #mw-related-navigation .sidebar-chunk a,
.skin-timeless #mw-related-navigation .sidebar-chunk a:visited {
color: var(--nq-mist);
}

.skin-timeless #mw-related-navigation .sidebar-chunk a:hover,
.skin-timeless #mw-related-navigation .sidebar-chunk a:focus-visible {
color: var(--nq-paper);
text-decoration-color: var(--nq-blue-box);
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

User:Dereckson/timeless.css

2026-08-29T10:25:14Z

Dereckson: Update to support personal tools bar

/* -------------------------------------------------------------
T-rex and mountains are better than cats - content background
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

#mw-content-container {
background-image: url(https://windriver.nasqueron.org/~dereckson/gfx/svg/t-rex-complete.svg) !important;
background-position: 30em 10em !important;
background-repeat: no-repeat !important;
}

/* -------------------------------------------------------------
Tiles
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - */

.tiles {
grid-template-columns: 100px 50px 100px;
grid-template-rows: 80px auto 80px;
column-gap: 10px;
row-gap: 15px;
}

/**
* Nasqueron colour treatment for MediaWiki's Timeless skin.
*
* Installation: paste this file into MediaWiki:Timeless.css.
* Scope: presentation only; no Timeless templates or PHP are replaced.
* Palette study: 2026-08.
*/

:root {
--nq-fig: #383c49;
--nq-dive: #376167;
--nq-blue-box: #8ac5ba;
--nq-grenadine: #d66972;
--nq-kiss: #813235;
--nq-paper: #f7f4ec;
--nq-surface: #fffdf8;
--nq-mist: #dce9e5;
--nq-night: #20242d;
--nq-line: rgba(56, 60, 73, 0.16);
}

/* Light mode: calm paper, strong editorial contrast. */
.skin-timeless {
background: var(--nq-fig);
color: var(--nq-fig);
}

.skin-timeless #mw-header-container {
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: 0 8px 24px rgba(56, 60, 73, 0.16);
}

.skin-timeless #mw-header-container a,
.skin-timeless #mw-header-container #p-logo-text a {
color: var(--nq-paper);
}

/*
* Timeless renders the personal tools inside the header, but the dropdown is
* a light floating surface. Restate its colours here so the broad header link
* rule above does not produce paper-coloured text on a paper background.
*/
.skin-timeless #mw-header-container #personal-inner {
border: 1px solid var(--nq-line);
background: var(--nq-surface);
color: var(--nq-fig);
box-shadow: 0 14px 34px rgba(56, 60, 73, 0.18);
}

.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: var(--nq-line);
}

.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: var(--nq-surface);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: var(--nq-line);
color: rgba(56, 60, 73, 0.68);
}

.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-fig);
}

.skin-timeless #mw-header-container #personal-inner a,
.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-dive);
}

.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: var(--nq-mist);
color: var(--nq-fig);
text-decoration: none;
}

.skin-timeless #mw-header-container #personal-inner #pt-logout {
margin-top: 0.35em;
padding-top: 0.35em;
border-top: 1px solid var(--nq-line);
}

.skin-timeless #simpleSearch {
border-color: rgba(247, 244, 236, 0.24);
border-radius: 4px;
background: rgba(255, 255, 255, 0.09);
box-shadow: none;
}

.skin-timeless #searchInput {
color: var(--nq-paper);
}

.skin-timeless #searchInput::placeholder {
color: rgba(247, 244, 236, 0.62);
}

.skin-timeless #mw-content-container {
border-bottom-color: var(--nq-blue-box);
background-color: #ebe6da;
background-image: none;
}

.skin-timeless #mw-content {
border: 1px solid var(--nq-line);
border-radius: 5px;
background: var(--nq-surface);
box-shadow: 0 18px 48px rgba(56, 60, 73, 0.11);
}

.skin-timeless .sidebar-chunk {
border-color: var(--nq-line);
border-radius: 4px;
background: rgba(255, 253, 248, 0.72);
box-shadow: none;
}

.skin-timeless .sidebar-chunk h2,
.skin-timeless .sidebar-chunk h3 {
color: var(--nq-kiss);
letter-spacing: 0.08em;
}

.skin-timeless a,
.skin-timeless .mw-parser-output a.external,
.skin-timeless .mw-parser-output a.extiw {
color: var(--nq-dive);
text-decoration-thickness: 1px;
text-underline-offset: 0.16em;
}

.skin-timeless a:visited {
color: #5d5367;
}

.skin-timeless a.new,
.skin-timeless .new a {
color: var(--nq-kiss);
}

.skin-timeless .mw-body h1.firstHeading {
border-bottom-color: var(--nq-grenadine);
color: var(--nq-fig);
letter-spacing: -0.025em;
}

.skin-timeless .mw-body .mw-heading1,
.skin-timeless .mw-body h1,
.skin-timeless .mw-body .mw-heading2,
.skin-timeless .mw-body h2,
.skin-timeless .mw-body .toctitle {
border-bottom-color: var(--nq-mist);
}

.skin-timeless .toc,
.skin-timeless .toccolours,
.skin-timeless .thumbinner,
.skin-timeless .wikitable,
.skin-timeless code,
.skin-timeless pre,
.skin-timeless .mw-code {
border-color: rgba(55, 97, 103, 0.22);
background: #eff3ef;
}

.skin-timeless .wikitable th,
.skin-timeless .mw_metadata th {
background: var(--nq-mist);
}

.skin-timeless .tools-inline li.selected {
border-bottom-color: var(--nq-grenadine);
}

.skin-timeless .color-left { background: var(--nq-kiss); }
.skin-timeless .color-middle { background: var(--nq-dive); }
.skin-timeless .color-right { background: var(--nq-blue-box); }

.skin-timeless .mw-footer-container {
border-top-color: rgba(247, 244, 236, 0.16);
background: var(--nq-fig);
color: var(--nq-paper);
box-shadow: none;
}

.skin-timeless :is(a, button, input, select, textarea):focus-visible {
outline: 3px solid var(--nq-grenadine);
outline-offset: 3px;
}

/* Explicit MediaWiki night preference. */
html.skin-theme-clientpref-night .skin-timeless,
html.skin-theme-clientpref-night.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-content-container,
html.skin-theme-clientpref-night.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-night .skin-timeless #mw-content,
html.skin-theme-clientpref-night.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
box-shadow: 0 22px 55px rgba(0, 0, 0, 0.26);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-night.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-night .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-night.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless a,
html.skin-theme-clientpref-night.skin-timeless a {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-night .skin-timeless .mw-body h1.firstHeading,
html.skin-theme-clientpref-night.skin-timeless .mw-body h1.firstHeading {
color: var(--nq-paper);
}

html.skin-theme-clientpref-night .skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code),
html.skin-theme-clientpref-night.skin-timeless :is(.toc, .toccolours, .thumbinner, .wikitable, code, pre, .mw-code) {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
}

/* Follow the operating system only when MediaWiki's preference is "automatic". */
@media (prefers-color-scheme: dark) {
html.skin-theme-clientpref-os .skin-timeless,
html.skin-theme-clientpref-os.skin-timeless {
background: #171a20;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-content-container,
html.skin-theme-clientpref-os.skin-timeless #mw-content-container {
background-color: #171a20;
}

html.skin-theme-clientpref-os .skin-timeless #mw-content,
html.skin-theme-clientpref-os.skin-timeless #mw-content {
border-color: rgba(247, 244, 236, 0.11);
background: var(--nq-night);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner {
border-color: rgba(247, 244, 236, 0.13);
background: #292e38;
color: var(--nq-paper);
box-shadow: 0 16px 38px rgba(0, 0, 0, 0.34);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::before,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::before {
border-bottom-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner::after,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner::after {
border-bottom-color: #292e38;
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label {
border-bottom-color: rgba(247, 244, 236, 0.13);
color: rgba(247, 244, 236, 0.66);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #p-personal-label b,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #p-personal-label b {
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner a:visited,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner a:visited {
color: var(--nq-blue-box);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:hover,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner .mw-list-item a:focus-visible {
background: rgba(138, 197, 186, 0.14);
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless #mw-header-container #personal-inner #pt-logout,
html.skin-theme-clientpref-os.skin-timeless #mw-header-container #personal-inner #pt-logout {
border-top-color: rgba(247, 244, 236, 0.13);
}

html.skin-theme-clientpref-os .skin-timeless .sidebar-chunk,
html.skin-theme-clientpref-os.skin-timeless .sidebar-chunk {
border-color: rgba(247, 244, 236, 0.11);
background: #292e38;
color: var(--nq-paper);
}

html.skin-theme-clientpref-os .skin-timeless a,
html.skin-theme-clientpref-os.skin-timeless a {
color: var(--nq-blue-box);
}
}

@media (prefers-reduced-motion: reduce) {
.skin-timeless * {
scroll-behavior: auto !important;
transition-duration: 0.01ms !important;
}
}

MediaWiki SaaS

2026-08-29T07:47:04Z

Dereckson: Upgrade

We maintain an up-to-date MediaWiki installation to serve this wiki, and several others.

If you license your content under an open source license like CC-BY, you're welcome to request hosting.

== Hosted wikis ==

The following wikis are hosted on this service:

* https://agora.nasqueron.org/ — this wiki
* https://www.wolfplex.org/wiki/ — Wolfplex Hackerspace wiki

== Repositories ==

* [https://devcentral.nasqueron.org/source/saas-mediawiki saas-mediawiki]: MediaWiki SaaS entry point: contains the wiki configuration and the MediaWiki bootstrap logic
* [https://devcentral.nasqueron.org/source/saas-service saas-service]: base entry point for SaaS: serves /status requests and contains some base classes
* [https://devcentral.nasqueron.org/source/operations rOPS]: describes the saas-mediawiki role provisioning instructions

== How to add a wiki? ==

# DNS: <your domain> CNAME saas-mediawiki.nasqueron.org
# Send a change to the Operations repository
## nginx: add your server block to the webserver-legacy role, you need to use <code>include includes/mediawiki-root</code> to serve /Article pages, or <code>include includes/mediawiki-wiki</code> to serve /wiki/Article pages (useful if you've other services than a wiki on this domain)
## data directory: add your canonical host to the pillar/saas/mediawiki.sls file in the mediawiki_datastores section
# Deploy operations changes with Salt
## '''Nginx vhost.''' <code>salt-call --local state.sls roles/webserver-legacy/nginx</code> or sometimes saas-mediawiki/nginx instead
## '''Datastores.''' <code>salt-call --local state.sls roles/saas-mediawiki/data</code>
# Declare the dbname/host name pair for the new instance in the configuration
# Create a database
## In every case, <kbd>GRANT ALL PRIVILEGES on wikis.* TO 'mediawiki-saas'@'localhost';</kbd>
## If you migrate an existing wiki from its db: <kbd>mysql yourwiki < dump.sql</kbd> + <kbd>mw update yourwiki</kbd> works well
## If it's a fresh new wiki: <kbd>mw addWiki yourwiki</kbd> will create the database and populate the tables

To deploy changes with Salt

== How to deploy an extension or a skin? ==

* Ensure it's available on the service
** If it's hosted on gerrit.wikimedia.org, add it to pillar/saas/mediawiki.sls file in the rOPS repository
** If not, you need to provide custom logic at roles/saas-mediawiki/mediawiki
* Configure it
** Edit the saas-mediawiki config/Settings.php folder, saasUseExtensionFoo will load the Foo extension and saasUseSkinBar will load the bar skin.
** If you need more advanced logic, config/CommonsSettings.php contain a good example for Scribunto

== Where to configure settings? ==
=== MediaWiki wg variables ===
Most variables can directly be set in the saas-mediawiki repository under config/Settings.php.

For any special logic, like transform values or set a bunch of values at once, can be added to CommonSettings.php. Feel free to create a task on DevCentral if you need assistance to do so.

=== Interwiki ===
Interwiki configuration is peculiar, as it's a database.

To update the interwiki:
# Update the configuration under mediawiki_interwikis at {{Ops file|pillar/saas/mediawiki.sls}}
# Deploy with <code>salt web-001 state.apply roles/saas-mediawiki/mediawiki/interwiki</code>

== How to run a script against a wiki? ==

The <code>mw <script to run> <wiki name></code> command allow to run a maintenance script to a specific wiki.

For example <kbd>sudo -u mediawiki mw update agora</kbd> will run update.php for this wiki.

== How to lock a wiki in read-only mode? ==

Set saasReadOnly to Some("Your explanation message").

An example can be found at [https://devcentral.nasqueron.org/D3743 D3743].

If the lock is for a maintenance, commit it so we've a trace, then simply revert the change when the maintenance is done.

== Upgrade ==
=== SaaS entry point ===
Should be automated with Jenkins CD.

For now, as mediawiki user: <code>cd /srv/saas/mediawiki && git pull && composer update && restart-php-fpm</code>

=== MediaWiki ===

As mediawiki user, assuming a clean branch:

<syntaxhighlight language=bash>
cd /srv/mediawiki
git pull

for dir in extensions/*/; do (cd "$dir" && git pull); done
for dir in skins/*/; do (cd "$dir" && git pull); done

composer update

mw update agora
mw update wolfplex
mw update wikis
</syntaxhighlight>

=== Troubleshoot ===
==== Upgrade databases older than 1.39 ====

Support has been removed for older versions upgrades.

We need to create a temporary installation with that "installation relais" for a by-step update.

There is no automation for that currently.

Operations grimoire/Operations repository

2026-08-28T09:53:02Z

Dereckson: /* IDE configuration */ Only available in PyCharm Pro:

Our configuration as code is stores in the operations (rOPS) repository.

== Repository layout ==
{| class="wikitable sortable"
|+ Content of rOPS
|-
! Path !! Description
|-
| _modules || Custom execution modules
|-
| _states || Custom states modules
|-
| _tests || Unit tests for custom modules, scripts, tests for repo
|-
| hotfixes || Fixes you need to run to solve a problem on the servers
|-
| pillar || Configuration data structures to use in the states
|-
| roles || The states to deploy, divided in roles and then in units
|-
| utils || Helper scripts to maintain the repository
|-
| terraform || OpenTofu / Terraform infrastructure configuration
|-
| map.jinja || As we deploy on several OS and distros, mapping of packages names or directories
|-
| top.sls || topfile: what we deploy where?
|-
| PORTS || Documentation of the ports used in the configuration
|-
| UIDs || Documentation of the users used in the configuration
|-
| GIDs || Documentation of the groups used in the configuration
|}

== Contributions howto ==
=== Repository source ===
You'll find the Operations repository at https://devcentral.nasqueron.org/source/operations/

If DevCentral isn't available, a mirror of the repository can be found at https://github.com/nasqueron/operations.

=== Workflow of contributions ===
We follow the general workflow is described at [[How to contribute code]].

Before committing a change to the main branch, you can test a deployment on a server.
In that case, merge in main immediately after the deployment as the repository is the source of truth for the server state.

Log what you do on #nasqueron-ops, so it will be included at https://infra.nasqueron.org/servers-log/

=== Code conventions ===
''See also: [[Code conventions]].''

* Python code: run `black` before committing
* YAML: indent with two spaces, including list bullets

<syntaxhighlight lang="yaml">
id:
method:
- somekey: value
- otherkey: value
</syntaxhighlight>

== Environment setup ==

Use of WindRiver is recommended if you wish to get an environment already installed for your contributions.

=== Everywhere setup ===
This section cover topics needed both on our development servers or in your laptop.

==== Python dependencies ====

Create a virtual environment, then install dependencies from {{Ops file|requirements.txt}}:

mkdir -p $HOME/dev/python/ops
python3 -m venv $HOME/dev/python/ops
source $HOME/dev/python/ops/bin/activate
pip install -r requirements.txt

As of July 2026, it seems possible to also install Salt in the virtual environment and run tests:

pip install salt==3006.26
make test

(tested on WindRiver: with FreeBSD 15.1, Python 3.12.13, Salt 3006.26)
(tested on local workstation BlueDrake: with Fedora 42 Python 3.13.13, Salt 3006.26)

==== Datacube ====

If you're in the ops group, you'll need sometimes to deploy from branches. As our deployment server Complector doesn't have PHP installed (so no arc), you need to exchange branches through our datacube.

On WindRiver:

git remote add datacube /datacube/git/operations.git

Anywhere else:

git remote add datacube ssh://windriver.nasqueron.org/datacube/git/operations.git

If you aren't in the ops groups, and have access to our devserver, you'll still be able to clone or pull from that directory, but not to write there (ie push branches).

=== Local computer setup ===

This section cover topics NOT needed on our development servers.

==== macOS ====

To run tests properly, install first:

brew install bats
brew install python3.13

You can now setup the virtual environment per everywhere setup instructions.

Salt behaves correctly on macOS, so you can install it safely in the virtual environment:

pip install salt==3006.26

Check the version on WindRiver or Complector with <code>salt --versions</code>.

Finally, to run the tests, you need a recent version of make, but the BSD make currently shipped, as of Tahoe 26.5, isn't up-to-date:

brew install gmake
(cd _tests && gmake)

==== Arcanist ====

To use arc with the operations repository, our collection of patches is needed.

If arcanist isn't installed through Git repository, best is to do like on devserver role:

mkdir /opt/phabricator && cd /opt/phabricator
git clone https://github.com/nasqueron/arcanist.git
(cd arcanist && git checkout production)
ln -s /opt/phabricator/arcanist/bin/arc /usr/local/bin/
git clone https://devcentral.nasqueron.org/source/shellcheck-linter.git

If you've already cloned Arcanist repository, switch to our branch production:

git remote add nasqueron git@github.com:nasqueron/arcanist.git
git fetch --all
git checkout production

As of August 2024, there is no plan to make that repository available on DevCentral.

You'll also need shellcheck library-linter library, normally at the same level than your arcanist repository.

==== IDE configuration ====
[[File:PyCharm-TemplateLanguages.png|thumb|right|Screenshot of correctly configured template languages]]
The states .sls file are Jinja2 templates producing YAML files, or "jinja2+yaml". If this case can't be handled by your IDE, it works best to use YAML syntax highlighting.

If you use PyCharm Pro or IntelliJ IDEA Ultimate, you can configure this scheme:

* Allow YAML files to be Jinja2 templates
** Go to Settings > Languages & Frameworks > Template Languages
** Select Jinja2 as template language
** Add YAML in the list
* Open SLS as YAML

== Linting ==

=== pre-commit ===
You can use '''pre-commit''' you can install with <code>make</code> to get a hook running Python code to lint the repository before a commit.

Beware if you use <code>arc diff</code> without a commit first: your message will be lost if pre-commit raises an error, always use <code>git commit</code> first.

On FreeBSD, there is an issue to build with clang 16+ the ruamel yaml clib library. You can build the FreeBSD port devel/py-ruamel.yaml.clib and copy the .whl to a stable path, then install it in your virtual environment.

On WindRiver, the .whl is available in /opt/python/py311, so you can:

$ python3 -m venv /path/to/your/virtualenv
$ source /path/to/your/virtualenv/bin/activate
$ pip install /opt/python/py311/ruamel.yaml.clib-0.2.8-cp311-cp311-freebsd_14_0_release_p3_amd64.whl
$ pip install pre-commit
$ make
pre-commit install
pre-commit installed at .git/hooks/pre-commit
$ rehash
$ pre-commit

== Refactoring ==

=== Rename a lot of files ===

To move a directory and rename the ''Source file'' headers:

git mv roles/webserver-legacy/nginx/files roles/webserver-alkane/nginx/
cd roles/webserver-alkane/nginx/
find . -type f -name '*.conf' | xargs gsed -i s/webserver-legacy/webserver-alkane/g

== See also ==
* [[/FAQ]] - Frequently asked questions about the Operations repository
* [[How to contribute code]]
* [[Devserver reference]]

Template:User

2026-08-23T11:42:52Z

Dereckson: {{{DevCentral user board}}} is now optional

{{DISPLAYTITLE:<span style="color:white;width:0;font-size:0;">{{FULLPAGENAME}}</span>}}
<div class="block user-block">
<div style="font-size: 3.75em; margin-bottom: 0.5em;" class="color-magnetic-five">{{PAGENAME}}</div>
<div style="font-size: 3em; margin-bottom: 10vh;" class="color-magnetic-five">{{{Full name|}}}</div>
<div>
<div class="block-col block-col-half">
{{{Presentation}}}
</div>
<div class="block-col block-col-quarter">
;Projects
:{{{Projects}}}
</div>
<div class="block-col block-col-quarter">
;DevCentral
{{#if:{{{DevCentral user board|}}}|:▥ [https://devcentral.nasqueron.org/tag/{{{DevCentral user board}}} Personal user board]}}
:▤ [https://devcentral.nasqueron.org/p/{{{DevCentral user feed}}}/ View my feed]
;External sites
:⚓ [https://github.com/{{{GitHub}}} GitHub]
:⚓ {{{Personal site|}}}
</div>
<div style="clear: both;"></div>
</div>

User:Ptdradmin

2026-08-23T11:40:31Z

Dereckson: Fixing link

{{User
| Full name = Gui Martinien Doba
| Presentation =
;Contributions
* Nasqueron Operations SIG apprentice
* Currently working on Stud'In

;Field notes
* See [[/Notes]] (mostly in French)

| Projects = [[Operations grimoire|Ops]]
| DevCentral user feed = ptdradmin
| GitHub = ptdradmin
| Personal site = [https://www.stud-in.be/ stud-in.be]
}}

User:Ptdradmin

2026-08-23T11:40:17Z

Dereckson:

{{User
| Full name = Gui Martinien Doba
| Presentation =
;Contributions
* Nasqueron Operations SIG apprentice
* Currently working on Stud'In

;Field notes
* See [[/notes]] (mostly in French)

| Projects = [[Operations grimoire|Ops]]
| DevCentral user feed = ptdradmin
| GitHub = ptdradmin
| Personal site = [https://www.stud-in.be/ stud-in.be]
}}

User:Ptdradmin/Notes

2026-08-23T11:38:36Z

Dereckson: Created page with "== Field notes == {{Special:Prefixindex/User:Ptdradmin/Notes/|stripprefix=1}} ;See also * Dev zone/Create devserver access/fr Category:Notes"

== Field notes ==
{{Special:Prefixindex/User:Ptdradmin/Notes/|stripprefix=1}}

;See also
* [[Dev zone/Create devserver access/fr]]

[[Category:Notes]]

User:Ptdradmin/Notes/Anubis/fr

2026-08-23T11:31:49Z

Dereckson: Dereckson moved page Fr to User:Ptdradmin/Notes/Anubis/fr without leaving a redirect: Lost & found - Field notes on Anubis

= Documentation - Résolution d'erreur de build Anubis =

== Contexte ==
Installation et configuration d’'''Anubis Web AI Firewall''' sur un serveur '''Red Hat Enterprise Linux 10 (RHEL 10)'''.

* '''Serveur :''' dwellers.nasqueron.org
* '''Utilisateur :''' ptdradmin
* '''Répertoire d’installation :''' /opt/anubis

'''Versions des outils :'''
* Go : 1.25.3
* Node.js : 22.16.0
* npm : 10.9.2
* esbuild : 0.27.2

== Problème rencontré ==
=== Symptômes ===
# Échec de la génération de code (<code>go generate ./...</code>)
* Permissions refusées lors de la création de fichiers
* Messages : <code>permission denied</code>
* Erreur : <code>./build.sh: line 48: esbuild: command not found</code>

# Échec de la compilation (<code>go build</code>)
* Le binaire <code>/opt/anubis/var/anubis</code> n'a pas été créé
* Erreur : <code>pattern static/app.js: no matching files found</code>

# Échec du démarrage du service systemd
* Service anubis ne peut pas démarrer
* Erreur : <code>Unable to locate executable '/usr/bin/anubis': No such file or directory</code>

=== Erreurs détaillées ===
<syntaxhighlight lang="bash">
go generate ./...

stringer: writing output: open droneblresponse_string.go: permission denied
(✗) Error [ error=failed to generate code for "/opt/anubis/internal/honeypot/naive/page.templ":
failed to write target file "/opt/anubis/internal/honeypot/naive/page_templ.go":
open /opt/anubis/internal/honeypot/naive/page_templ.go: permission denied ]
mkdir: cannot create directory 'static/js': Permission denied
./build.sh: line 48: esbuild: command not found
lib/challenge/preact/preact.go:20: running "./build.sh": exit status 127
</syntaxhighlight>

<syntaxhighlight lang="bash">
go build -o var/anubis cmd/anubis/main.go

lib/challenge/preact/preact.go:23:12: pattern static/app.js: no matching files found
</syntaxhighlight>

<syntaxhighlight lang="bash">
sudo systemctl status anubis

× anubis.service - Anubis Web AI Firewall
Active: failed (Result: exit-code)
Process: 821872 ExecStart=/usr/bin/anubis (code=exited, status=203/EXEC)

anubis.service: Unable to locate executable '/usr/bin/anubis': No such file or directory
</syntaxhighlight>

== Analyse de la cause racine ==
=== Causes principales ===
* Conflit de permissions dû à l'utilisation de <code>sudo git clone</code>
* Outil ''esbuild'' manquant dans le PATH lors de l’exécution de <code>build.sh</code>

=== Conséquences en cascade ===
* Génération incomplète : fichiers de code généré non créés
* esbuild non trouvé : bundler JavaScript inaccessible
* Assets manquants : fichiers JS comme <code>static/app.js</code> non générés
* Compilation impossible
* Binaire absent : /usr/bin/anubis inexistant
* Service systemd en échec

== Solution ==
<folding summary="Cliquez pour dérouler les étapes complètes de résolution">
=== Étape 1 : Arrêter le service en échec ===
<syntaxhighlight lang="bash">
sudo systemctl stop anubis
</syntaxhighlight>

=== Étape 2 : Installer esbuild globalement ===
<syntaxhighlight lang="bash">
sudo npm install -g esbuild
which esbuild
esbuild --version
</syntaxhighlight>

=== Étape 3 : Corriger la propriété des fichiers ===
<syntaxhighlight lang="bash">
sudo chown -R ptdradmin:ptdradmin /opt/anubis
</syntaxhighlight>

=== Étape 4 : Nettoyer les artéfacts de build partiels ===
<syntaxhighlight lang="bash">
cd /opt/anubis
rm -rf bin var
</syntaxhighlight>

=== Étape 5 : Générer le code sans sudo ===
<syntaxhighlight lang="bash">
go generate ./...
</syntaxhighlight>

* La génération doit se terminer avec succès et produire les fichiers JS :
<syntaxhighlight lang="text">
(✓) Complete [ updates=0 duration=2.753344ms ]
(✓) Complete [ updates=0 duration=4.775691ms ]
app.js
static/app.js 20.3kb
⚡ Done in 12ms
(✓) Complete [ updates=0 duration=2.333324ms ]
(✓) Complete [ updates=0 duration=3.490825ms ]
(✓) Complete [ updates=0 duration=14.668559ms ]
</syntaxhighlight>

=== Étape 6 : Compiler le binaire ===
<syntaxhighlight lang="bash">
go build -o var/anubis cmd/anubis/main.go
</syntaxhighlight>

=== Étape 7 : Vérifier la création du binaire ===
<syntaxhighlight lang="bash">
ls -l var/anubis
</syntaxhighlight>
* Exemple attendu :
<syntaxhighlight lang="text">
-rwxr-xr-x. 1 ptdradmin ptdradmin 52659096 Dec 17 14:46 var/anubis
</syntaxhighlight>

=== Étape 8 : Copier le binaire vers /usr/bin ===
<syntaxhighlight lang="bash">
sudo cp var/anubis /usr/bin/anubis
sudo chmod 755 /usr/bin/anubis
</syntaxhighlight>

=== Étape 9 : Vérifier l'installation ===
<syntaxhighlight lang="bash">
/usr/bin/anubis --version
</syntaxhighlight>
* Exemple attendu : <code>Anubis devel</code>

=== Étape 10 : Démarrer le service ===
<syntaxhighlight lang="bash">
sudo systemctl start anubis
sudo systemctl status anubis
</syntaxhighlight>

* Statut attendu :
<syntaxhighlight lang="text">
● anubis.service - Anubis Web AI Firewall
Loaded: loaded (/etc/systemd/system/anubis.service; enabled; preset: disabled)
Active: active (running) since Wed 2025-12-17 14:46:41 UTC; 6s ago
Main PID: 823482 (anubis)
Tasks: 13 (limit: 203296)
Memory: 15.5M (peak: 18.7M)
</syntaxhighlight>

=== Étape 11 : Commandes complètes de séquence ===
<syntaxhighlight lang="bash">
# Arrêter le service
sudo systemctl stop anubis

# S'assurer que esbuild est installé
sudo npm install -g esbuild
which esbuild
esbuild --version

# Corriger la propriété
sudo chown -R ptdradmin:ptdradmin /opt/anubis

# Nettoyer et reconstruire
cd /opt/anubis
rm -rf bin var
go generate ./...
go build -o var/anubis cmd/anubis/main.go

# Vérifier et installer
ls -l var/anubis
sudo cp var/anubis /usr/bin/anubis
sudo chmod 755 /usr/bin/anubis

# Tester et démarrer
/usr/bin/anubis --version
sudo systemctl start anubis
sudo systemctl status anubis
</syntaxhighlight>
</folding>

== Bonnes pratiques ==
* Ne pas utiliser <code>sudo</code> pour <code>git clone</code>
* Installer tous les outils nécessaires globalement avant le build
* Séparer les opérations utilisateur et root (build vs installation)
* Vérifier les permissions avant de lancer le build
* Utiliser <code>make build</code> si disponible

== Structure de répertoires recommandée ==
<syntaxhighlight lang="text">
/opt/anubis/ # Code source (propriétaire: utilisateur)
├── cmd/
├── internal/
├── lib/
└── var/
└── anubis # Binaire compilé

/usr/bin/anubis # Installation système (root)
/etc/anubis/ # Configuration (root)
├── site.env
└── site.botPolicies.yaml
</syntaxhighlight>

== Vérifications post-installation ==
<syntaxhighlight lang="bash">
sudo systemctl status anubis
sudo journalctl -u anubis -n 50
sudo journalctl -u anubis -f
sudo ss -tulpn | grep anubis
sudo systemctl restart anubis
</syntaxhighlight>

== Résumé ==
* Problèmes : permissions incorrectes et esbuild manquant
* Solutions : installer esbuild globalement, corriger propriété des fichiers, reconstruire sans sudo
* Résultat final : le service Anubis fonctionne correctement et protège le site desk.nasqueron.org

User:Ptdradmin

2026-08-23T11:28:42Z

Dereckson: Created page with "{{User | Full name = Gui Martinien Doba | Presentation = * Nasqueron Operations SIG apprentice * Currently working on Stud'In | Projects = Ops | DevCentral user feed = ptdradmin | GitHub = ptdradmin | Personal site = [https://www.stud-in.be/ stud-in.be] }}"

{{User
| Full name = Gui Martinien Doba
| Presentation = * Nasqueron Operations SIG apprentice
* Currently working on Stud'In
| Projects = [[Operations grimoire|Ops]]
| DevCentral user feed = ptdradmin
| GitHub = ptdradmin
| Personal site = [https://www.stud-in.be/ stud-in.be]
}}

User:Dereckson/timeless.css

2026-08-23T11:21:34Z

Dereckson: Switch to full t-rex

User:Dereckson/Devserver/Git

2026-08-23T04:29:07Z

Dereckson: Documentation by GPT-5.6-Sol for git bye / newbug and the new receive / resend / land new version

== Introduction ==
A small set of custom Git commands for working with short-lived feature branches is added to $HOME/bin.

The commands implement a change-centric workflow inspired by Phabricator's <code>arc land</code> model and Gerrit:

* the default branch is the canonical project history;
* one feature branch represents one logical change;
* the feature commit may be amended while the change is under development;
* feature branches may be published to a remote for review, testing or deployment;
* once accepted, the change is landed on the default branch;
* feature branches are disposable and are removed after landing.

The normal lifecycle is:

<syntaxhighlight lang="text">
newbug → edit/commit → resend ↔ receive → land
↘
bye
</syntaxhighlight>

<code>land</code> is used when landing the change locally.

<code>bye</code> is used when the change has already been merged elsewhere, for example through a forge or code-review interface.

== Command reference ==

{| class="wikitable"
! Command
! Purpose
! Typical use
|-
| <code>git get-default-branch</code>
| Determine the repository's integration branch
| Used directly and by the other workflow commands
|-
| <code>git newbug BRANCH</code>
| Start a new change from an updated default branch
| Beginning a task
|-
| <code>git resend</code>
| Amend and republish the current feature commit
| Send a new revision for testing or review
|-
| <code>git receive</code>
| Replace the local feature checkout with its published version
| Development or deployment machine
|-
| <code>git land</code>
| Integrate the feature commit and clean up the branch
| Completing a locally landed change
|-
| <code>git bye</code>
| Return to the default branch and remove the feature branch
| Change already merged elsewhere
|-
| <code>git delete-remote-branch</code>
| Delete a branch from a remote repository
| Explicit remote branch cleanup
|}

== Philosophy ==

These commands deliberately use Git as a change-oriented version-control system.

The permanent artifact is the clean history of accepted changes on the default branch.

A feature branch is temporary infrastructure around one of those changes. While the change is being prepared, its commit can be amended and republished as many times as necessary.

Consequently:

* rewriting a private feature branch is normal;
* rewriting the default branch is not;
* feature branches are short-lived;
* intermediate correction commits do not need to survive forever;
* landing turns the final version of the change into permanent project history;
* local and remote feature branches can then be discarded.

This is closer to the change model used by Phabricator or Gerrit than to workflows where the complete development history of every feature branch is retained after merging.

== Git subcommands ==

The commands are installed as executables named <code>git-NAME</code> in the user's <code>PATH</code>.

Git automatically exposes such executables as subcommands.

For example:

<syntaxhighlight lang="console">
$ git get-default-branch
main
</syntaxhighlight>

invokes the <code>git-get-default-branch</code> executable.

== Typical workflow ==

=== Start a change ===

Start from the repository's default branch and create a new feature branch:

<syntaxhighlight lang="console">
$ git newbug fix-vault-policy
</syntaxhighlight>

<code>git newbug</code>:

# determines the repository's default branch;
# switches to it;
# updates it from the remote repository;
# creates the requested feature branch.

The resulting history is conceptually:

<syntaxhighlight lang="text">
A---B---C main
\
D fix-vault-policy
</syntaxhighlight>

The feature branch is intended to contain one logical change.

After editing files, create the initial commit normally:

<syntaxhighlight lang="console">
$ git add -p
$ git commit
</syntaxhighlight>

For example:

<syntaxhighlight lang="console">
$ git commit -m "vault: restrict access to production secrets"
</syntaxhighlight>

=== Amend and republish a change ===

During development, the commit may be updated instead of accumulating fixup commits.

Use:

<syntaxhighlight lang="console">
$ git resend
</syntaxhighlight>

The command interactively stages changes with:

<syntaxhighlight lang="console">
git add -p
</syntaxhighlight>

and amends the current commit while retaining its commit message.

The updated feature branch is then published.

If a remote named <code>datacube</code> exists, it is preferred:

<syntaxhighlight lang="text">
workstation
|
| git resend
v
datacube/fix-vault-policy
</syntaxhighlight>

Otherwise, the branch is pushed to <code>origin</code>.

Because amending a commit changes its object ID, publishing a new revision requires replacing the previously published feature-branch commit.

This rewriting is expected for short-lived feature branches. It must not be used to rewrite shared permanent branches such as <code>main</code>.

==== DevCentral repositories ====

For repositories hosted on DevCentral, <code>git resend</code> does not automatically push to <code>origin</code>.

Use Arcanist:

<syntaxhighlight lang="console">
$ arc diff
</syntaxhighlight>

or configure a <code>datacube</code> remote for the workstation-to-server sharing workflow.

=== Receive a published revision on another machine ===

A development or deployment machine can synchronize its current feature branch with the version published from the workstation:

<syntaxhighlight lang="console">
$ git receive
</syntaxhighlight>

The command fetches the remote repositories and then resets the current feature branch to:

<syntaxhighlight lang="text">
datacube/<current-branch>
</syntaxhighlight>

when <code>datacube</code> exists, or otherwise:

<syntaxhighlight lang="text">
origin/<current-branch>
</syntaxhighlight>

For example, after publishing a Salt change from the workstation:

<syntaxhighlight lang="console">
workstation$ git resend
</syntaxhighlight>

the development server can receive and test it:

<syntaxhighlight lang="console">
devserver$ git receive
devserver$ salt-call saltutil.sync_modules
</syntaxhighlight>

'''Warning:''' <code>git receive</code> uses <code>git reset --hard</code>.

Tracked changes in the index and working tree which are not present in the selected remote branch are discarded.

Untracked files are not removed.

The command is therefore intended for feature branches on development or deployment checkouts where the remote version is authoritative.

== Landing a change ==

When the feature commit is ready to become part of the repository's canonical history, run:

<syntaxhighlight lang="console">
$ git land
</syntaxhighlight>

The command:

# fetches remote changes;
# switches to the default branch;
# updates the default branch;
# cherry-picks the feature commit;
# pushes the updated default branch;
# deletes the local feature branch;
# deletes the published feature branch from <code>datacube</code>, or from <code>origin</code> when no <code>datacube</code> remote exists.

For example:

<syntaxhighlight lang="text">
Before:

A---B---C---E main
\
D' fix-vault-policy

git land

After:

A---B---C---E---D'' main
</syntaxhighlight>

The feature branch is then removed.

<code>D'</code> and <code>D''</code> represent the same logical change at different points of its Git history: cherry-picking creates a new commit on the default branch.

=== One change per branch ===

<code>git land</code> lands the commit at the tip of the current feature branch.

The workflow therefore expects a feature branch to represent one logical commit.

During review or testing, update that commit with:

<syntaxhighlight lang="console">
$ git resend
</syntaxhighlight>

rather than adding a succession of commits such as:

<syntaxhighlight lang="text">
Implement feature
Fix typo
Actually fix test
Address review
Fix lint
</syntaxhighlight>

Those intermediate states are useful while developing the change, but do not need to become part of the permanent project history.

== Cleaning up an externally merged branch ==

Sometimes the change is landed by another system, for example after merging a pull request or accepting a code review.

In that case, there is nothing left for <code>git land</code> to integrate.

From the feature branch, run:

<syntaxhighlight lang="console">
$ git bye
</syntaxhighlight>

The command switches back to the repository's default branch, updates it when appropriate, and deletes the previous local feature branch.

Example:

<syntaxhighlight lang="console">
$ git status --short --branch
## fix-vault-policy

$ git bye

$ git status --short --branch
## main...origin/main
</syntaxhighlight>

<code>git bye</code> force-deletes the local feature branch.

Use it only when the change has already been integrated elsewhere or when the local branch is deliberately no longer needed.

== Determining the default branch ==

Use:

<syntaxhighlight lang="console">
$ git get-default-branch
main
</syntaxhighlight>

The command determines the branch which should be treated as the repository's integration branch.

Examples include:

<syntaxhighlight lang="text">
main
master
production
dev
</syntaxhighlight>

Other workflow commands use this helper instead of assuming that every repository uses <code>main</code>.

For example:

<syntaxhighlight lang="console">
$ git get-default-branch
production

$ git newbug update-webserver
</syntaxhighlight>

will create <code>update-webserver</code> from <code>production</code>.

== Deleting a remote branch ==

A remote branch can be explicitly removed with:

<syntaxhighlight lang="console">
$ git delete-remote-branch origin old-feature
</syntaxhighlight>

which is equivalent to:

<syntaxhighlight lang="console">
$ git push origin --delete old-feature
</syntaxhighlight>

The current implementation also supports using only the branch name:

<syntaxhighlight lang="console">
$ git delete-remote-branch old-feature
</syntaxhighlight>

In that form, <code>origin</code> is used as the remote.

The historical default with no arguments is:

<syntaxhighlight lang="console">
$ git delete-remote-branch
</syntaxhighlight>

which deletes <code>origin/master</code>.

'''Warning:''' the zero-argument form is intended for historical <code>master</code>-to-<code>main</code> migration work. An explicit branch name should normally be provided.

== Remote selection ==

Some commands recognize a remote named <code>datacube</code>.

This remote is intended as an intermediate location for sharing work-in-progress branches between a workstation and development or deployment machines.

When <code>datacube</code> exists:

<syntaxhighlight lang="text">
workstation
|
| git resend
v
datacube
|
| git receive
v
development server
</syntaxhighlight>

Without <code>datacube</code>, the equivalent workflow uses <code>origin</code> where appropriate.

This separates two concepts:

* the repository hosting service used for permanent collaboration;
* an optional branch transport used to send a work-in-progress change to another machine.

User:Dereckson/Devserver

2026-08-23T04:25:01Z

Dereckson:

== Git ==
[[/Git]]

== MediaWiki ==
=== Logs ===
tail -n 100 -f /var/log/www/dereckson.be/mediawiki-php.log

=== Reinstall ===
* /var/51-wwwroot/mediawiki-dereckson/core: wikimedia/core repository
* /var/51-wwwroot/mediawiki-dereckson/core/extensions: symlink to <code>../extensions</code>
** Clone all needed extensions in /var/51-wwwroot/mediawiki-dereckson/extensions
* /var/51-wwwroot/mediawiki-dereckson/core/skins: symlink to <code>../skins</code>
** Same with git clone ssh://review/mediawiki/skins/
* /var/dataroot/mediawiki.dereckson.be/data contains:
** my_wiki.sqlite for the content
** wikicache.sqlite for the cache

=== Update ===
* '''Core:''' mw-update-core (currently writing it)

=== Create a new extension ===
;I. Wikimedia side
* [[mw:Manual:Developing_extensions]]
* [[mw:Gerrit/New repositories/Requests]]
* [https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?projects=Project-Admins Create task for new Phabricator project]

;II. WindRiver

<syntaxhighlight lang="shell">
$ setenv MW_EXTENSION foo
$ cd ~/dev/wikimedia/mediawiki/extensions
$ git clone ssh://review/mediawiki/extensions/$MW_EXTENSION || git init $MW_EXTENSION
</syntaxhighlight>

Extension is actually stored at /var/51-wwwroot/mediawiki-dereckson/extensions, so can immediately be configured to test locally.

;III. SaaS deployment
* {{Ops file|pillar/saas/mediawiki.sls}}
* [https://devcentral.nasqueron.org/source/saas-mediawiki/browse/main/config/Settings.php config/Settings.php]

=== Troubleshoot ===
==== SQLite database is read-only ====
Runtime error near line 2: attempt to write a readonly database (8)

<syntaxhighlight lang="shell">
chown -R web-be-dereckson-mw:dereckson /var/dataroot/mediawiki.dereckson.be/data
chmod 771 /var/dataroot/mediawiki.dereckson.be/data
chmod 660 /var/dataroot/mediawiki.dereckson.be/data/my_wiki.sqlite
</syntaxhighlight>

=== Permissions to run tests and maintenance scripts ===
To run tests against wiki and maintenance scripts as user can be tricky:

<syntaxhighlight lang="shell">
touch /tmp/mw-GlobalIdGenerator5001-UID-nodeid /tmp/mw-GlobalIdGenerator5001-UUID-128
chown web-be-dereckson-mw:dereckson /tmp/mw-GlobalIdGenerator5001-*
chmod 664 /tmp/mw-GlobalIdGenerator5001-*

chmod 771 /var/dataroot/mediawiki.dereckson.be/data/locks
</syntaxhighlight>

== Zed ==
=== Useful paths ===
{| class="wikitable"
|+ Paths for Zed development
|-
! File path !! Managed by !! Notes
|-
| /usr/local/etc/nginx/vhosts/dereckson.be/zed51.conf || Salt :: webserver-alkane
|-
| /var/51-wwwroot/zed/ || Salt :: wwwroot-51 (still to do) || Git repo: git@github.com:dereckson/zed.git
|-
| /var/dataroot/zed/content/ || Manually || Git repo: git@github.com:hypership/content.git
|}

=== Logs ===
* nginx: <code>tail -n 100 -f /var/log/www/dereckson.be/zed51-error.log</code>
* PHP: <code>tail -n 100 -f /var/log/www/dereckson.be/zed51-php.log</code>

=== Staging ===

'''Note. Keruald is currently symlinked from the monorepo to vendor/keruald.'''

To recreate Zed staging area:

$ cd /var/dataroot/zed/content
$ git init .
$ git config --global --add safe.directory /var/dataroot/zed/content
$ git remote add origin git@github.com:hypership/content.git
$ git fetch --all
$ git reset --hard origin/main
$ git clone git@github.com:hypership/content_users.git users

$ sudo -u web-be-dereckson-zed51 mkdir /var/dataroot/zed/cache/sessions
$ sudo mkdir -p /var/dataroot/zed/content/users/_photos/tn
$ sudo chown -R web-be-dereckson-zed51:dereckson /var/dataroot/zed/content/users/_photos
$ sudo chmod 771 /var/dataroot/zed/content/users/_photos /var/dataroot/zed/content/users/_photos/tn

$ mkdir -p /home/dereckson/dev/zed/hypership
$ cd /home/dereckson/dev/zed/hypership
$ ln -s /var/dataroot/zed/content

Note: Zed currently not defined in wwwroot-51 in rOPS, should be done for /var/51-wwwroot/zed

== IRC ==

=== Troubleshoot ===
==== Error loading module proxy/irc ====
When trying to load proxy module, I got:

22:00:09 -!- Irssi: Error loading module proxy/irc: /home/dereckson/.irssi/modules/libirc_proxy.so: Undefined symbol "g_input_add"

Proxy is now compiled by default, personal module needs to be deleted.

User:Dereckson/timeless.css

2026-08-22T19:21:14Z

Dereckson: Import GPT 5.6-Sol experiment

Operations grimoire/Router

2026-08-22T18:20:49Z

Dereckson: /* Routers */

= Routers =

== Checklist for new router IP ==
* SPF record for nasqueron.org and other mail using our system

== Troubleshoot ==

=== Switch primary router ===

This procedure can be used when the current primary router doesn't allow access and network access through the GRE/CARP setup is degraded.

Typical symptoms observed:
* ICMP may still work, but TCP sessions cannot actually be used
* `nc` can connect to TCP ports, but SSH or Vault requests hang
* Vault queries time out during TLS handshake
* access through Windriver becomes unstable
* router-003 does not appear to restore SSH access properly when it becomes primary
* the issue may disappear temporarily after switching the primary router but can come back later

Observed troubleshooting notes:
* the issue can reappear after about 1 hour, but sometimes only after up to 48 hours
* GRE tunnels may remain pingable while application access times out
* when the issue occurs, routing and primary router state should be checked

==== Procedure ====

If `router-002` is currently primary and needs to be switched out temporarily, disable `vmx1` on `router-002` so that `router-003` can take over:

<syntaxhighlight lang="bash">
ifconfig vmx1 down on router-002 / ifconfig vmx1 up on router-003
</syntaxhighlight>

the unused router needs to be in INIT status and not BAKCUP, as BACKUP status blocks access for an unknown reason.

Check CARP logs after finishing the procedure.

<syntaxhighlight lang="bash">
tail -f /var/log/carp.log
</syntaxhighlight>

This is currently a workaround, not a permanent fix.

The network issue is still unstable and requires further investigation.

Operations grimoire/External services

2026-08-22T12:50:06Z

Dereckson:

== Amazon Web Services (AWS) ==
S3, account managed by Sandlayth.

== Docker Hub ==
Organization account, administrative access by Sandlayth and Dereckson.

2021-09-12: request for open source as part of the https://www.docker.com/blog/expanded-support-for-open-source-software-projects done, mainly as automated builds have been disabled in the free team plan.

== GeoLite2 ==
Account at MaxMind for GeoLite2 databases, created by Dereckson.

Account credentials stored in Vault under <code>ops/infra/maxmind</code>.
There aren't the API credentials, for example Sentry ones are stored at <code>ops/secrets/nasqueron/sentry/geoipupdate</code>.

== Gandi ==
Some domains names:
* eglide.org, account managed by Sandlayth
* ook.space, account managed by Dereckson

== GitHub ==
;Organization account
:Administrative access by Sandlayth and Dereckson
:''Some OAuth could be on Dereckson account. When found, should be switched to Nasqueron (see [https://devcentral.nasqueron.org/T1109 T1109]).''

;Alken-Orin
:As automated agent, there is an '''Alken-Orin''' account to link GitHub to CI/CD.
:This account is also used to fetch code from GitHub through the `staging_private_repository` Salt state. To that end, the Salt deploy SSH key is added to this account.
:Credentials at [https://devcentral.nasqueron.org/K53 K53].

== Google ==
OAuth for DevCentral, account managed by Dereckson (under espace-win.org Google Apps organization)

== Hurricane Electric ==
IPv6 connectivity, DNS for nasqueron.org: account 'nasqueron'.

'''Note:''' DNS for some other domains are currently handled on the 'dereckson' account, they'll be moved to 'nasqueron' account when defined as secondary.

== instances.mastodon.xyz ==
Credentials for this account are stored in [https://devcentral.nasqueron.org/K103 K103].

== JetBrains ==
Licenses for open-source contributions in the nasqueron organization.

Have access as org admins: Dereckson, Dorian.

== Mailgun ==
Account managed by Dereckson.

2020-02-28: account upgraded to Flex, as it's not possible anymore to add custom domains to the free plan. From July, mails will cost 0.80$ / 1000. To avoid any financial abuse, (i) a 1000 mail accounts limit is currently in (we can update it in account settings) (ii) the credit card associated for this account is limited to 5 € / month.

== Microsoft ==
=== Reporting for mail sent to Outlook.com ===
For mail reporting, Outlook.com offers a "[https://sendersupport.olc.protection.outlook.com/ Smart Network Data Service]" to report statistics about abused IP.

Any op can subscribe with their own Microsoft account on https://sendersupport.olc.protection.outlook.com/snds/addnetwork.aspx / authorization request should ideally be sent to postmaster for tracking.

It's also configured to send report about mails marked as spam by Outlook users to postmaster.

== Mural ==
Mural non-profit plan for Wolfplex Hackerspace ASBL, Sébastien has access.

Personal notes:
* We have 10 seats
* To add an user: [https://app.mural.co/t/nasqueron8788/settings/members workspace > settings > members]
* Mail about access requests go to Wolfplex mail

== PURL ==
/NET/Nasqueron is managed by the Dereckson Internet Archive account.

== Online / Scaleway ==
;Online
* [[Ysul]], account managed by Dereckson, billed to Dereckson
* [[WindRiver]], account managed by Dereckson, billed to Trantorium
;Scaleway
* [[Eglide]], account managed by Sandlayth, billed to Sandlayth
** Following organization account introduction, Dereckson has now access too.

== OVH / SoYouStart ==
Servers:
* [[hyper-001]], account managed by Dereckson, billed to ?
* [[CloudHugger]], account managed by Dereckson, billed to Trantorium

Registrar for nasqueron.org and nasqueron-user-content.org

== Sendgrid ==
Account managed by Dereckson.

== Stud'in ==
Account managed by Dereckson.

== Wikimedia ==
OAuth authentication, managed by Dereckson

User:Dereckson/Arcane Grove/BlueDrake

2026-08-08T22:09:05Z

Dereckson: /* Software */

'''BlueDrake''' is the name of the hybrid productivity-gaming workstation.

== Hardware ==
=== Components ===
{| class="wikitable sortable"
|+ BlueDrake parts
|-
! Category !! Brand !! Model !! Links
|-
| Case || Lian Li || [https://lian-li.com/product/lancool-iii/ Lancool III] || [https://drive.google.com/file/d/1kd9ku_raF2uXWeLD7voGfT4ZZ10XOizy/view?usp=sharing 📖]
|-
| Motherboard || Asus || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/ ROG Strix B650E-E Gaming WiFi] || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_manual/ 📖] [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_download/ 📥]
|-
| CPU || AMD || [https://www.amd.com/en/products/processors/desktops/ryzen/7000-series/amd-ryzen-9-7900x.html Ryzen 9 7900X] || [https://www.amd.com/en/support/downloads/drivers.html/processors/ryzen/ryzen-7000-series/amd-ryzen-9-7900x.html 📥]
|-
| CPU Cooler || Noctua || [https://noctua.at/en/nh-d15s NH-D15S] || [https://noctua.at/en/nh-d15s/manuals 📖]
|-
| GPU || Sapphire / AMD || PURE Radeon RX 7700 XT 12GB || [https://www.sapphiretech.com/en/consumer/pure-radeon-rx-7700-xt-12g-gddr6-frostpunk2 📖]
|-
| RAM || G.Skill || Trident Z Neo DDR5 96 GB (2×48 GB) || [https://www.gskill.com/product/165/374/1682577390/F5-5600J4040D48GX2-TZ5RK 📖]
|-
| Storage || Kingston || Fury Renegade 2 TB NVMe M.2 (×2) || [https://www.kingston.com/en/ssd/gaming/fury-renegade-nvme-pcie-ssd 📖]
|-
| PSU || Seasonic || Core GX-750 || [https://seasonic.com/core-gx#specification 📖]
|-
| Screen || Alienware || AW3425DWM || [https://dl.dell.com/content/manual56809116-alienware-34-gaming-monitor-aw3425dwm-quick-start-guide.pdf?language=en-us 📖]
|}

== Software ==
=== Fedora partition ===
* Blocked at Fedora 42, we've still some software incompatible with Wayland
* Configuration as code: https://github.com/dereckson/wynter-salt-workstation

=== FreeBSD partition ===
Things to check for GPU:
* Ollama on FreeBSD -> https://www.reddit.com/r/freebsd/comments/1d3hmmz/comment/lqiulx9/ / https://github.com/ollama/ollama/pull/4172 (<code>pkg install go122 cmake vulkan-headers vulkan-loader</code>)
* GPU passthrough with bhyve -> https://wiki.freebsd.org/bhyve/pci_passthru

User:Dereckson/Arcane Grove/BlueDrake

2026-08-05T01:57:11Z

Dereckson: /* Components */

'''BlueDrake''' is the name of the hybrid productivity-gaming workstation.

== Hardware ==
=== Components ===
{| class="wikitable sortable"
|+ BlueDrake parts
|-
! Category !! Brand !! Model !! Links
|-
| Case || Lian Li || [https://lian-li.com/product/lancool-iii/ Lancool III] || [https://drive.google.com/file/d/1kd9ku_raF2uXWeLD7voGfT4ZZ10XOizy/view?usp=sharing 📖]
|-
| Motherboard || Asus || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/ ROG Strix B650E-E Gaming WiFi] || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_manual/ 📖] [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_download/ 📥]
|-
| CPU || AMD || [https://www.amd.com/en/products/processors/desktops/ryzen/7000-series/amd-ryzen-9-7900x.html Ryzen 9 7900X] || [https://www.amd.com/en/support/downloads/drivers.html/processors/ryzen/ryzen-7000-series/amd-ryzen-9-7900x.html 📥]
|-
| CPU Cooler || Noctua || [https://noctua.at/en/nh-d15s NH-D15S] || [https://noctua.at/en/nh-d15s/manuals 📖]
|-
| GPU || Sapphire / AMD || PURE Radeon RX 7700 XT 12GB || [https://www.sapphiretech.com/en/consumer/pure-radeon-rx-7700-xt-12g-gddr6-frostpunk2 📖]
|-
| RAM || G.Skill || Trident Z Neo DDR5 96 GB (2×48 GB) || [https://www.gskill.com/product/165/374/1682577390/F5-5600J4040D48GX2-TZ5RK 📖]
|-
| Storage || Kingston || Fury Renegade 2 TB NVMe M.2 (×2) || [https://www.kingston.com/en/ssd/gaming/fury-renegade-nvme-pcie-ssd 📖]
|-
| PSU || Seasonic || Core GX-750 || [https://seasonic.com/core-gx#specification 📖]
|-
| Screen || Alienware || AW3425DWM || [https://dl.dell.com/content/manual56809116-alienware-34-gaming-monitor-aw3425dwm-quick-start-guide.pdf?language=en-us 📖]
|}

== Software ==
=== FreeBSD ===
Things to check for GPU:
* Ollama on FreeBSD -> https://www.reddit.com/r/freebsd/comments/1d3hmmz/comment/lqiulx9/ / https://github.com/ollama/ollama/pull/4172 (<code>pkg install go122 cmake vulkan-headers vulkan-loader</code>)
* GPU passthrough with bhyve -> https://wiki.freebsd.org/bhyve/pci_passthru

User:Dereckson/Arcane Grove/BlueDrake

2026-08-05T01:54:47Z

Dereckson: /* Components */

'''BlueDrake''' is the name of the hybrid productivity-gaming workstation.

== Hardware ==
=== Components ===
{| class="wikitable sortable"
|+ BlueDrake parts
|-
! Category !! Brand !! Model !! Links
|-
| Case || Lian Li || [https://lian-li.com/product/lancool-iii/ Lancool III] || [https://drive.google.com/file/d/1kd9ku_raF2uXWeLD7voGfT4ZZ10XOizy/view?usp=sharing 📖]
|-
| Motherboard || Asus || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/ ROG Strix B650E-E Gaming WiFi] || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_manual/ 📖] [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_download/ 📥]
|-
| CPU || AMD || Ryzen 9 7900X || [https://www.amd.com/en/products/cpu/amd-ryzen-9-7900x 📖]
|-
| CPU Cooler || Noctua || [https://noctua.at/en/nh-d15s NH-D15S] || [https://noctua.at/en/nh-d15s/manuals 📖]
|-
| GPU || Sapphire / AMD || PURE Radeon RX 7700 XT 12GB || [https://www.sapphiretech.com/en/consumer/pure-radeon-rx-7700-xt-12g-gddr6-frostpunk2 📖]
|-
| RAM || G.Skill || Trident Z Neo DDR5 96 GB (2×48 GB) || [https://www.gskill.com/product/165/374/1682577390/F5-5600J4040D48GX2-TZ5RK 📖]
|-
| Storage || Kingston || Fury Renegade 2 TB NVMe M.2 (×2) || [https://www.kingston.com/en/ssd/gaming/fury-renegade-nvme-pcie-ssd 📖]
|-
| PSU || Seasonic || Core GX-750 || [https://seasonic.com/core-gx#specification 📖]
|-
| Screen || AOC || C27G1 || [https://aoc.com/be-fr/gaming/products/monitors/c27g1/downloads 📥]
|-
| Screen || Alienware || AW3425DWM || [https://dl.dell.com/content/manual56809116-alienware-34-gaming-monitor-aw3425dwm-quick-start-guide.pdf?language=en-us 📖]
|}

== Software ==
=== FreeBSD ===
Things to check for GPU:
* Ollama on FreeBSD -> https://www.reddit.com/r/freebsd/comments/1d3hmmz/comment/lqiulx9/ / https://github.com/ollama/ollama/pull/4172 (<code>pkg install go122 cmake vulkan-headers vulkan-loader</code>)
* GPU passthrough with bhyve -> https://wiki.freebsd.org/bhyve/pci_passthru

User:Dereckson/Arcane Grove/BlueDrake

2026-08-05T01:54:09Z

Dereckson: /* Components */

'''BlueDrake''' is the name of the hybrid productivity-gaming workstation.

== Hardware ==
=== Components ===
{| class="wikitable sortable"
|+ BlueDrake parts
|-
! Category !! Brand !! Model !! Links
|-
| Case || Lian Li || [https://lian-li.com/product/lancool-iii/ Lancool III] || [https://drive.google.com/file/d/1kd9ku_raF2uXWeLD7voGfT4ZZ10XOizy/view?usp=sharing 📖]
|-
| Motherboard || Asus || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/ ROG Strix B650E-E Gaming WiFi] || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_manual/ 📖] [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_download/ 📥]
|-
| CPU || AMD || Ryzen 9 7900X || [https://www.amd.com/en/products/cpu/amd-ryzen-9-7900x 📖]
|-
| CPU Cooler || Noctua || NH-D15S || [https://noctua.at/en/nh-d15s 📝] [https://noctua.at/en/nh-d15s/manuals 📖]
|-
| GPU || Sapphire / AMD || PURE Radeon RX 7700 XT 12GB || [https://www.sapphiretech.com/en/consumer/pure-radeon-rx-7700-xt-12g-gddr6-frostpunk2 📖]
|-
| RAM || G.Skill || Trident Z Neo DDR5 96 GB (2×48 GB) || [https://www.gskill.com/product/165/374/1682577390/F5-5600J4040D48GX2-TZ5RK 📖]
|-
| Storage || Kingston || Fury Renegade 2 TB NVMe M.2 (×2) || [https://www.kingston.com/en/ssd/gaming/fury-renegade-nvme-pcie-ssd 📖]
|-
| PSU || Seasonic || Core GX-750 || [https://seasonic.com/core-gx#specification 📖]
|-
| Screen || AOC || C27G1 || [https://aoc.com/be-fr/gaming/products/monitors/c27g1/downloads 📥]
|-
| Screen || Alienware || AW3425DWM || [https://dl.dell.com/content/manual56809116-alienware-34-gaming-monitor-aw3425dwm-quick-start-guide.pdf?language=en-us 📖]
|}

== Software ==
=== FreeBSD ===
Things to check for GPU:
* Ollama on FreeBSD -> https://www.reddit.com/r/freebsd/comments/1d3hmmz/comment/lqiulx9/ / https://github.com/ollama/ollama/pull/4172 (<code>pkg install go122 cmake vulkan-headers vulkan-loader</code>)
* GPU passthrough with bhyve -> https://wiki.freebsd.org/bhyve/pci_passthru

User:Dereckson/Arcane Grove/BlueDrake

2026-08-05T01:53:04Z

Dereckson: /* Components */

'''BlueDrake''' is the name of the hybrid productivity-gaming workstation.

== Hardware ==
=== Components ===
{| class="wikitable sortable"
|+ BlueDrake parts
|-
! Category !! Brand !! Model !! Links
|-
| Case || Lian Li || [https://lian-li.com/product/lancool-iii/ Lancool III] || [https://drive.google.com/file/d/1kd9ku_raF2uXWeLD7voGfT4ZZ10XOizy/view?usp=sharing 📖]
|-
| Motherboard || Asus || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/ ROG Strix B650E-E Gaming WiFi] || [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_manual/ 📖] [https://rog.asus.com/motherboards/rog-strix/rog-strix-b650e-e-gaming-wifi-model/helpdesk_download/ 📥]
|-
| CPU || AMD || Ryzen 9 7900X || [https://www.amd.com/en/products/cpu/amd-ryzen-9-7900x 📖]
|-
| CPU Cooler || Noctua || NH-D15S || [https://noctua.at/en/nh-d15s 📖] [https://noctua.at/en/nh-d15s/manuals
|-
| GPU || Sapphire / AMD || PURE Radeon RX 7700 XT 12GB || [https://www.sapphiretech.com/en/consumer/pure-radeon-rx-7700-xt-12g-gddr6-frostpunk2 📖]
|-
| RAM || G.Skill || Trident Z Neo DDR5 96 GB (2×48 GB) || [https://www.gskill.com/product/165/374/1682577390/F5-5600J4040D48GX2-TZ5RK 📖]
|-
| Storage || Kingston || Fury Renegade 2 TB NVMe M.2 (×2) || [https://www.kingston.com/en/ssd/gaming/fury-renegade-nvme-pcie-ssd 📖]
|-
| PSU || Seasonic || Core GX-750 || [https://seasonic.com/core-gx#specification 📖]
|-
| Screen || AOC || C27G1 || [https://aoc.com/be-fr/gaming/products/monitors/c27g1/downloads 📥]
|-
| Screen || Alienware || AW3425DWM || [https://dl.dell.com/content/manual56809116-alienware-34-gaming-monitor-aw3425dwm-quick-start-guide.pdf?language=en-us 📖]
|}

== Software ==
=== FreeBSD ===
Things to check for GPU:
* Ollama on FreeBSD -> https://www.reddit.com/r/freebsd/comments/1d3hmmz/comment/lqiulx9/ / https://github.com/ollama/ollama/pull/4172 (<code>pkg install go122 cmake vulkan-headers vulkan-loader</code>)
* GPU passthrough with bhyve -> https://wiki.freebsd.org/bhyve/pci_passthru

Operations grimoire/Deploy with Terraform

2026-07-23T13:19:56Z

Dereckson: /* Troubleshoot */ Document tofu state rm

== Where to work? ==
We deploy from [[Complector]] using <code>/opt/salt/nasqueron-operations</code> as our local copy of rOPS, authoritative for both Salt and Terraform

You need to belong to the <code>ops</code> group to be able to have access and have write-rights on the repository

It's important to work from there to save a shared Terraform state.

== Specific deployment notes ==
=== Vault / OpenBao ===
==== General notes ====
;OpenTofu support
As of 2026-02-07, the Vault provider isn't compiled for FreeBSD. You need to use Terraform instead.

;Vault
You need a Vault token to allow the provider to connect.

You also need to set VAULT_ADDR to https://172.27.27.7:8200 as Vault doesn't listen on 127.0.0.1

<syntaxhighlight lang="shell">
$ export VAULT_ADDR=https://172.27.27.7:8200
$ sudo /opt/salt/nasqueron-operations/utils/vault/issue-admin-token.py > ~/.vault-token

$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply
</syntaxhighlight>

It could be interesting to maintain an alternative policy to admin for the Terraform provider, restricted to the current actions. Note benefits would be limited as those include policies management.

==== Propagate secrets (DRP) ====
;No automatic secret rotation
Secrets rotation is disabled with a lifecycle management <code>ignore_changes = [ secret_id, ]</code>.

To rotate a secret, it needs first to be destroyed from terraform state:
<code>terraform destroy -target=module.viperserv_approle.vault_approle_auth_backend_role_secret_id.this</code>

;Full procedure
Once the AppRole have been created in Vault, they need to be provisioned to the relevant configuration files.

<syntaxhighlight lang="shell">
$ cd /opt/salt/nasqueron-operations/terraform/openbao
$ terraform init # if you've a new entry requiring a module, it needs to be installed
$ terraform plan
$ terraform apply

$ cd /opt/salt/nasqueron-operations
$ salt windriver state.sls_id /usr/local/etc/secrets/rhyne-wyse.yaml roles/reports/rhyne-wyse/config
$ salt windriver state.sls_id /srv/viperserv/.credentials roles/viperserv/eggdrop/config
# Missing for router
</syntaxhighlight>

<div class="alert">Important. Each time you'll reprovision the secrets, they will change.

Don't forget to always apply this full procedure.
</div>

=== CARP OVH secrets usage ===

The OVH credentials used by the CARP failover script are stored in Vault at:

'''apps/network/carp-hyper-001-switch'''

These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

The AppRole credentials (role_id and secret_id) used by the script are stored in:

'''ops/secrets/network/router/vault'''

Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

The Vault Secrets may need to be rotated, so we need a simple way to propagate
updated credentials to routers. This is enabled by the mechanism
introduced in D4026.

== Table of Terraform states ==

{| class="wikitable"
|+ Terraform and OpenBao states
|-
! Configuration !! State back-end !! Path !! Software to use
|-
| openbao || On disk || /opt/salt/nasqueron-operations/terraform/openbao/terraform.tfstate || Terraform
|}

On disk paths are stored in Complector.

== Troubleshoot ==
=== Error: Module not installed ===

You need to run <code>tofu init</code> to prepare for any new provider.

<syntaxhighlight lang="shell">
$ tofu plan

│ Error: Module not installed
│
│ on rhyne_wyse.tf line 23:
│ 23: module "rhyne_wyse_approle" {
│
│ This module is not yet installed. Run "tofu init" to install all modules required by this configuration.
</syntaxhighlight>

=== Error: Incompatible provider version ===

<syntaxhighlight lang="shell">
$ tofu init

Initializing the backend...
Initializing modules...
- rhyne_wyse_approle in modules/app_credentials

Initializing provider plugins...
- Finding hashicorp/vault versions matching "5.3.0"...
╷
│ Error: Incompatible provider version
│
│ Provider registry.opentofu.org/hashicorp/vault v5.3.0 does not have a package available for your current platform, freebsd_amd64.
│
│ Provider releases are separate from OpenTofu CLI releases, so not all providers are available for all platforms. Other versions of this provider may have different platforms supported.
</syntaxhighlight>

On OpenTofu, some modules are only compiled for Linux, not for FreeBSD.
Switch to Terraform pending a solution to help the OpenTofu builds.

=== State rollback ===

When declaring new Terraform resources, it's possible to remove from the state an item, without actually destroying it at infrastructure level:

$ tofu state rm <state name>
Removed ….…
Successfully removed 1 resource instance(s).

[[Category:Operations grimoire]]
[[Category:Terraform]]

Operations grimoire/Operations repository

2026-07-18T20:43:06Z

Dereckson: /* Python dependencies */ Works on Linux too

Our configuration as code is stores in the operations (rOPS) repository.

== Repository layout ==
{| class="wikitable sortable"
|+ Content of rOPS
|-
! Path !! Description
|-
| _modules || Custom execution modules
|-
| _states || Custom states modules
|-
| _tests || Unit tests for custom modules, scripts, tests for repo
|-
| hotfixes || Fixes you need to run to solve a problem on the servers
|-
| pillar || Configuration data structures to use in the states
|-
| roles || The states to deploy, divided in roles and then in units
|-
| utils || Helper scripts to maintain the repository
|-
| terraform || OpenTofu / Terraform infrastructure configuration
|-
| map.jinja || As we deploy on several OS and distros, mapping of packages names or directories
|-
| top.sls || topfile: what we deploy where?
|-
| PORTS || Documentation of the ports used in the configuration
|-
| UIDs || Documentation of the users used in the configuration
|-
| GIDs || Documentation of the groups used in the configuration
|}

== Contributions howto ==
=== Repository source ===
You'll find the Operations repository at https://devcentral.nasqueron.org/source/operations/

If DevCentral isn't available, a mirror of the repository can be found at https://github.com/nasqueron/operations.

=== Workflow of contributions ===
We follow the general workflow is described at [[How to contribute code]].

Before committing a change to the main branch, you can test a deployment on a server.
In that case, merge in main immediately after the deployment as the repository is the source of truth for the server state.

Log what you do on #nasqueron-ops, so it will be included at https://infra.nasqueron.org/servers-log/

=== Code conventions ===
''See also: [[Code conventions]].''

* Python code: run `black` before committing
* YAML: indent with two spaces, including list bullets

<syntaxhighlight lang="yaml">
id:
method:
- somekey: value
- otherkey: value
</syntaxhighlight>

== Environment setup ==

Use of WindRiver is recommended if you wish to get an environment already installed for your contributions.

=== Everywhere setup ===
This section cover topics needed both on our development servers or in your laptop.

==== Python dependencies ====

Create a virtual environment, then install dependencies from {{Ops file|requirements.txt}}:

mkdir -p $HOME/dev/python/ops
python3 -m venv $HOME/dev/python/ops
source $HOME/dev/python/ops/bin/activate
pip install -r requirements.txt

As of July 2026, it seems possible to also install Salt in the virtual environment and run tests:

pip install salt==3006.26
make test

(tested on WindRiver: with FreeBSD 15.1, Python 3.12.13, Salt 3006.26)
(tested on local workstation BlueDrake: with Fedora 42 Python 3.13.13, Salt 3006.26)

==== Datacube ====

If you're in the ops group, you'll need sometimes to deploy from branches. As our deployment server Complector doesn't have PHP installed (so no arc), you need to exchange branches through our datacube.

On WindRiver:

git remote add datacube /datacube/git/operations.git

Anywhere else:

git remote add datacube ssh://windriver.nasqueron.org/datacube/git/operations.git

If you aren't in the ops groups, and have access to our devserver, you'll still be able to clone or pull from that directory, but not to write there (ie push branches).

=== Local computer setup ===

This section cover topics NOT needed on our development servers.

==== macOS ====

To run tests properly, install first:

brew install bats
brew install python3.13

You can now setup the virtual environment per everywhere setup instructions.

Salt behaves correctly on macOS, so you can install it safely in the virtual environment:

pip install salt==3006.26

Check the version on WindRiver or Complector with <code>salt --versions</code>.

Finally, to run the tests, you need a recent version of make, but the BSD make currently shipped, as of Tahoe 26.5, isn't up-to-date:

brew install gmake
(cd _tests && gmake)

==== Arcanist ====

To use arc with the operations repository, our collection of patches is needed.

If arcanist isn't installed through Git repository, best is to do like on devserver role:

mkdir /opt/phabricator && cd /opt/phabricator
git clone https://github.com/nasqueron/arcanist.git
(cd arcanist && git checkout production)
ln -s /opt/phabricator/arcanist/bin/arc /usr/local/bin/
git clone https://devcentral.nasqueron.org/source/shellcheck-linter.git

If you've already cloned Arcanist repository, switch to our branch production:

git remote add nasqueron git@github.com:nasqueron/arcanist.git
git fetch --all
git checkout production

As of August 2024, there is no plan to make that repository available on DevCentral.

You'll also need shellcheck library-linter library, normally at the same level than your arcanist repository.

==== IDE configuration ====
[[File:PyCharm-TemplateLanguages.png|thumb|right|Screenshot of correctly configured template languages]]
The states .sls file are Jinja2 templates producing YAML files, or "jinja2+yaml". If this case can't be handled by your IDE, it works best to use YAML syntax highlighting.

If you use PyCharm or IntelliJ IDEA Ultimate, you can configure this scheme:

* Allow YAML files to be Jinja2 templates
** Go to Settings > Languages & Frameworks > Template Languages
** Select Jinja2 as template language
** Add YAML in the list
* Open SLS as YAML

== Linting ==

=== pre-commit ===
You can use '''pre-commit''' you can install with <code>make</code> to get a hook running Python code to lint the repository before a commit.

Beware if you use <code>arc diff</code> without a commit first: your message will be lost if pre-commit raises an error, always use <code>git commit</code> first.

On FreeBSD, there is an issue to build with clang 16+ the ruamel yaml clib library. You can build the FreeBSD port devel/py-ruamel.yaml.clib and copy the .whl to a stable path, then install it in your virtual environment.

On WindRiver, the .whl is available in /opt/python/py311, so you can:

$ python3 -m venv /path/to/your/virtualenv
$ source /path/to/your/virtualenv/bin/activate
$ pip install /opt/python/py311/ruamel.yaml.clib-0.2.8-cp311-cp311-freebsd_14_0_release_p3_amd64.whl
$ pip install pre-commit
$ make
pre-commit install
pre-commit installed at .git/hooks/pre-commit
$ rehash
$ pre-commit

== Refactoring ==

=== Rename a lot of files ===

To move a directory and rename the ''Source file'' headers:

git mv roles/webserver-legacy/nginx/files roles/webserver-alkane/nginx/
cd roles/webserver-alkane/nginx/
find . -type f -name '*.conf' | xargs gsed -i s/webserver-legacy/webserver-alkane/g

== See also ==
* [[/FAQ]] - Frequently asked questions about the Operations repository
* [[How to contribute code]]
* [[Devserver reference]]

Operations grimoire/Operations repository

2026-07-18T20:40:18Z

Dereckson: /* Python dependencies */

Our configuration as code is stores in the operations (rOPS) repository.

== Repository layout ==
{| class="wikitable sortable"
|+ Content of rOPS
|-
! Path !! Description
|-
| _modules || Custom execution modules
|-
| _states || Custom states modules
|-
| _tests || Unit tests for custom modules, scripts, tests for repo
|-
| hotfixes || Fixes you need to run to solve a problem on the servers
|-
| pillar || Configuration data structures to use in the states
|-
| roles || The states to deploy, divided in roles and then in units
|-
| utils || Helper scripts to maintain the repository
|-
| terraform || OpenTofu / Terraform infrastructure configuration
|-
| map.jinja || As we deploy on several OS and distros, mapping of packages names or directories
|-
| top.sls || topfile: what we deploy where?
|-
| PORTS || Documentation of the ports used in the configuration
|-
| UIDs || Documentation of the users used in the configuration
|-
| GIDs || Documentation of the groups used in the configuration
|}

== Contributions howto ==
=== Repository source ===
You'll find the Operations repository at https://devcentral.nasqueron.org/source/operations/

If DevCentral isn't available, a mirror of the repository can be found at https://github.com/nasqueron/operations.

=== Workflow of contributions ===
We follow the general workflow is described at [[How to contribute code]].

Before committing a change to the main branch, you can test a deployment on a server.
In that case, merge in main immediately after the deployment as the repository is the source of truth for the server state.

Log what you do on #nasqueron-ops, so it will be included at https://infra.nasqueron.org/servers-log/

=== Code conventions ===
''See also: [[Code conventions]].''

* Python code: run `black` before committing
* YAML: indent with two spaces, including list bullets

<syntaxhighlight lang="yaml">
id:
method:
- somekey: value
- otherkey: value
</syntaxhighlight>

== Environment setup ==

Use of WindRiver is recommended if you wish to get an environment already installed for your contributions.

=== Everywhere setup ===
This section cover topics needed both on our development servers or in your laptop.

==== Python dependencies ====

Create a virtual environment, then install dependencies from {{Ops file|requirements.txt}}:

mkdir -p $HOME/dev/python/ops
python3 -m venv $HOME/dev/python/ops
source $HOME/dev/python/ops/bin/activate
pip install -r requirements.txt

As of July 2026, it seems possible to also install Salt in the virtual environment and run tests:

pip install salt==3006.26
make test

(tested on WindRiver, so with FreeBSD 15.1, Python 3.12.13, Salt 3006.26)

==== Datacube ====

If you're in the ops group, you'll need sometimes to deploy from branches. As our deployment server Complector doesn't have PHP installed (so no arc), you need to exchange branches through our datacube.

On WindRiver:

git remote add datacube /datacube/git/operations.git

Anywhere else:

git remote add datacube ssh://windriver.nasqueron.org/datacube/git/operations.git

If you aren't in the ops groups, and have access to our devserver, you'll still be able to clone or pull from that directory, but not to write there (ie push branches).

=== Local computer setup ===

This section cover topics NOT needed on our development servers.

==== macOS ====

To run tests properly, install first:

brew install bats
brew install python3.13

You can now setup the virtual environment per everywhere setup instructions.

Salt behaves correctly on macOS, so you can install it safely in the virtual environment:

pip install salt==3006.26

Check the version on WindRiver or Complector with <code>salt --versions</code>.

Finally, to run the tests, you need a recent version of make, but the BSD make currently shipped, as of Tahoe 26.5, isn't up-to-date:

brew install gmake
(cd _tests && gmake)

==== Arcanist ====

To use arc with the operations repository, our collection of patches is needed.

If arcanist isn't installed through Git repository, best is to do like on devserver role:

mkdir /opt/phabricator && cd /opt/phabricator
git clone https://github.com/nasqueron/arcanist.git
(cd arcanist && git checkout production)
ln -s /opt/phabricator/arcanist/bin/arc /usr/local/bin/
git clone https://devcentral.nasqueron.org/source/shellcheck-linter.git

If you've already cloned Arcanist repository, switch to our branch production:

git remote add nasqueron git@github.com:nasqueron/arcanist.git
git fetch --all
git checkout production

As of August 2024, there is no plan to make that repository available on DevCentral.

You'll also need shellcheck library-linter library, normally at the same level than your arcanist repository.

==== IDE configuration ====
[[File:PyCharm-TemplateLanguages.png|thumb|right|Screenshot of correctly configured template languages]]
The states .sls file are Jinja2 templates producing YAML files, or "jinja2+yaml". If this case can't be handled by your IDE, it works best to use YAML syntax highlighting.

If you use PyCharm or IntelliJ IDEA Ultimate, you can configure this scheme:

* Allow YAML files to be Jinja2 templates
** Go to Settings > Languages & Frameworks > Template Languages
** Select Jinja2 as template language
** Add YAML in the list
* Open SLS as YAML

== Linting ==

=== pre-commit ===
You can use '''pre-commit''' you can install with <code>make</code> to get a hook running Python code to lint the repository before a commit.

Beware if you use <code>arc diff</code> without a commit first: your message will be lost if pre-commit raises an error, always use <code>git commit</code> first.

On FreeBSD, there is an issue to build with clang 16+ the ruamel yaml clib library. You can build the FreeBSD port devel/py-ruamel.yaml.clib and copy the .whl to a stable path, then install it in your virtual environment.

On WindRiver, the .whl is available in /opt/python/py311, so you can:

$ python3 -m venv /path/to/your/virtualenv
$ source /path/to/your/virtualenv/bin/activate
$ pip install /opt/python/py311/ruamel.yaml.clib-0.2.8-cp311-cp311-freebsd_14_0_release_p3_amd64.whl
$ pip install pre-commit
$ make
pre-commit install
pre-commit installed at .git/hooks/pre-commit
$ rehash
$ pre-commit

== Refactoring ==

=== Rename a lot of files ===

To move a directory and rename the ''Source file'' headers:

git mv roles/webserver-legacy/nginx/files roles/webserver-alkane/nginx/
cd roles/webserver-alkane/nginx/
find . -type f -name '*.conf' | xargs gsed -i s/webserver-legacy/webserver-alkane/g

== See also ==
* [[/FAQ]] - Frequently asked questions about the Operations repository
* [[How to contribute code]]
* [[Devserver reference]]