Suffix

2025 Movie List

2026-01-08T11:00:00+01:00

As the new year begins, it’s the time to look back. This year, I was reminded by @hyde’s post that I noted down each of the movies I watched in 2025. Many of the films were rewatches that I enjoyed with the kids. While some were fantastic—Parasite being my favorite—and others simply acceptable, some of the sequels were a waste of time.

Watched	Movie	Released
1 Jan	Night at the Museum	2006
7 Jan	Lara Croft: Tomb Raider	2001
8 Jan	Number 24	2024
13 Jan	Lara Croft: Tomb Raider - The Cradle of Life	2003
18 Jan	The Last Full Measure	2020
22 Jan	Flow	2024
25 Jan	Airplane!	1980
25 Jan	Den of Thieves	2018
28 Jan	Den of Thieves 2: Pantera	2025
28 Jan	Moana 2	2024
4 Feb	Avatar: The Way of Water	2022
14 Feb	Die Hard	1988
3 Mar	Mission: Impossible - Dead Reckoning Part One	2023
15 Mar	Dune: Part Two	2024
27 Mar	Monty Python and the Holy Grail	1975
28 Mar	TRON: Legacy	2010
28 Mar	Star Trek: First Contact	1996
30 Mar	Léon: The Professional	1994
28 Apr	Jurassic World	2015
7 May	Happy Feet	2006
15 Jun	Happy Feet Two	2011
13 Jul	Tomorrowland	2015
30 Aug	Pirates of the Caribbean: The Curse of the Black Pearl	2003
31 Aug	Pirates of the Caribbean: Dead Man’s Chest	2006
31 Aug	The Thursday Murder Club	2025
5 Sep	Pirates of the Caribbean: At World’s End	2007
12 Sep	Beauty and the Beast	2017
13 Sep	A Minecraft Movie	2025
2 Oct	Unbroken	2014
3 Oct	The Little Mermaid	2023
4 Oct	Passengers	2016
10 Oct	Pirates of the Caribbean: On Stranger Tides	2011
10 Oct	Johnny English	2003
25 Oct	Mission: Impossible - Rogue Nation	2015
27 Oct	Pirates of the Caribbean: Dead Men Tell No Tales	2017
29 Oct	Guardians of the Galaxy	2014
11 Nov	Jurassic Park III	2001
25 Nov	Blade Runner 2049	2017
30 Nov	Ford v Ferrari	2019
3 Dec	Champagne Problems	2025
6 Dec	The Martian	2015
12 Dec	Woodwalkers	2024
20 Dec	Zootopia 2	2025
20 Dec	Parasite	2019
22 Dec	The Naked Gun: From the Files of Police Squad!	1988
23 Dec	Johnny English Reborn	2011
30 Dec	Dumb and Dumber	1994

2025 in Review

2025-12-30T15:00:00+01:00

Life Changes

Alcohol

For reasons I can’t quite explain, I began tracking my alcohol consumption in 2025. While I don’t drink excessively—my wife and I stopped drinking alcohol at home when she was pregnant—I still enjoy a drink occasionally during social gatherings. This year, I logged 40 alcoholic consumptions using the iOS Health app, and surprisingly, it led to me drinking less. The simple act of keeping track seemed to unconsciously curb my consumption.
Running

Throughout most of 2025, I met up with a friend once a week to run just over 5 kilometers. Nothing to write home about. However, come autumn, I decided to gradually increase my runs to three times a week, aiming to hit 10 kilometers by the end of the year. So far, so good—now I just need to keep it up to achieve some real distances in 2026.

Reading & Writing

Reading

The Life of Puppets by T.J. Klune was my favorite book discovery of the year. I shared my thoughts on the other books I read in my 2025 Reading List. Unfortunately, reading has remained mostly a holiday activity. I wish I could immerse myself in more books throughout the year, but life always seems to get in the way.
Writing

In 2025, I wrote 12 blog posts, including this one. While it’s not huge, I feel content as long as I keep writing a few times each year. It’s a fun way to look back on different phases of my life.

Purchases

3D Printer

I’ve contemplated getting a 3D printer for years, unsure whether it would be a useful tool or just an expensive toy once the novelty wore off. This year, I discovered that Prusa offers kits that you can assemble yourself. With my kids at the perfect age for this kind of project, it sounded like a fantastic opportunity—essentially, a grown-up LEGO kit. We built our first printer together, and we had an absolute blast!
Slim Wallet

A few months ago, I bought myself a Bellroy Card Pocket on a whim. It’s a slim wallet designed to hold around five credit cards and some pocket change. I even replaced my old booklet-style driver’s license with a new credit card-sized version for it to fit. This has probably been one of my best purchases this year. If only it had RFID blocking.

Goals

What I would like to achieve in 2026.

Carless

In late autumn the car mechanic told us a routine maintenance would no longer cut it; more expensive repairs would be needed. We took this as an excuse to take a last trip to Switzerland with our car and sell it. We’ll try to get by without a car in 2026. We already do most by bike and public transport, but having a car is a convenience, of course. I am really looking forward to a carless life again; my family not so. We’ll see how this goes.
Marathon

I hope to run a marathon with my dad next year; we’re aiming for the Bruges Marathon in October because the course is flat and close to home. Finishing a marathon with my father would be a personal highlight!
Travel

Plan a trip with the kids somewhere outside of Europe; they’ve been asking to visit some more exotic destinations.

Sharing Sensitive Documents

2025-12-19T11:00:00+01:00

Sharing sensitive personal information online—whether it’s a national ID, driver’s license, or passport—always makes me uneasy. With data breaches being a matter of “when, not if,” it’s important to minimize our digital footprint.

While the best defense is simply not sharing the data at all, modern life often makes that impossible. Whether you’re renting a holiday cottage, opening a bank account, or complying with some website’s verification process, you eventually have to share sensitive documents.

I like “dirtying” my documents to make them less valuable to hackers and easier to track if a leak occurs.

Lower Quality

Before I upload anything, I strip the EXIF data (metadata like location and device info), resize the image, and convert it to grayscale.

If my data is stolen, it’s easier to prove the source if the scan is low-resolution and looks “off.” It hopefully also makes the document less useful for identity theft if the quality is lacking.

No one needs a 4000×3000 pixel, high-fidelity photo of my ID. High resolution only helps bad actors. I downsize the image with squoosh.app and convert it to a JPEG with around 70% quality. This intentional quality loss is a bonus; it remains legible for verification but loses the pristine look in case of forgery.

Visual Watermark

Next, I add an almost transparent watermark. This helps identify who lost my data in the case of a data breach. I include the name of the service I am sharing it with.

ImageMagick can do this, of course. It places the text in the center with low opacity—enough to be legible, but not so much that it jumps out too much.

magick input.jpg -pointsize 72 -gravity center -fill "rgba(255,255,255,0.3)" -annotate 0 "EXAMPLE.COM" to_share.jpg

I often play with the RGBA settings to fine-tune the opacity depending on the document’s background.

Steganography

This week, I added an extra layer of invisible tracking using steganography to my workflow. This embeds a hidden text note directly into the image data.

You must do this after watermarking and resizing, as those processes will destroy the hidden metadata.

steghide embed -cf to_share.jpg -ef <(echo "Shared with example.com in 2025")

Alternatively, you can use the hyphen method shown below. However, note that passing a password directly within the command is less secure, as it may be recorded in your shell history.

echo "Shared with example.com in 2025" | steghide embed -cf to_share.jpg -p "" -ef -

Now, the file itself contains a hidden “receipt” of when and where it was uploaded. The embedded data can be extracted via:

steghide extract -sf to_share.jpg -xf extract.txt

Reality Check

It is important to note that these methods are not waterproof:

Steganography is fragile; if the receiving website automatically resizes my upload, the hidden note is gone.
Watermarks can, of course, be manually edited out.

However, these steps provide me some peace of mind. By adding layers of friction, my data is that little harder to use for automated identity theft.

2025 Reading List

2025-12-14T15:00:00+01:00

Following the habit of my 2014 and 2024 reading lists, I keep track of the books I read during the year. I matched last year’s reading volume. At 9 books per year, that is not something to brag about. I still find myself falling into the trap of watching an unmemorable YouTube video instead of reading a few pages before bed. Perhaps 2026 can bring a change?

The Murderbot Diaries

2017 & 2018, Martha Wells, ★★★★☆

I dove into Martha Wells’ “The Murderbot Diaries” series, and I absolutely loved the first two installments.

The story is narrated by a self-aware, part-human, part-robot Security Unit who calls itself “Murderbot.” It has secretly hacked its governor module, gaining independence, but mostly just wants to be left alone to watch endless hours of media. Murderbot is assigned to protect a team of scientists surveying a planet. When the mission is unexpectedly compromised, Murderbot must reluctantly stop binging its soap operas and protect the humans.

While the stories aren’t deeply complex or filled with unexpected plot twists, I thoroughly enjoyed the easy, fast-paced read and Murderbot’s character development. The first book was immediately engaging, though I found the second one slightly less compelling.

Snow Crash

1992, Neal Stephenson, ★★★★☆

Keeping with the sci-fi theme, I finally made time for Snow Crash—a true classic of the cyberpunk genre.

Snow Crash is a cyberpunk novel set in a dystopian future America where the government has been replaced by privatized, corporate-run gated communities. Hiro Protagonist—a hacker, samurai swordsman, and Mafia pizza delivery driver—uncovers the secret of “Snow Crash,” a powerful neuro-linguistic virus. This virus operates as both a digital drug in the Metaverse (a term the book coined) and a real-world biological agent, threatening to infect and control everyone.

I particularly enjoyed its distinct early-90s vibe. Despite being set in the future, the hacking culture and nascent internet brought me back to my own teenage years.

In the Lives of Puppets

2023, T.J. Klune, ★★★★☆

This book had been languishing on my shelf for quite some time. I finally picked it up, somewhat reluctantly, during the holidays when I had run out of other books. What a delightful surprise—it turned out to be my best read of the year.

In the Lives of Puppets is a post-apocalyptic sci-fi story loosely inspired by the story of Pinocchio. Victor is raised in a forest home by his father, alongside two eccentric robot companions: the abrasive nurse machine Nurse Ratched and the anxious vacuum Rambo. Their peaceful, found-family existence is shattered when Victor salvages and repairs a mysterious, amnesiac android.

I went into this story blind, and it rewarded me with plot twists and turns I genuinely didn’t expect. While the relationship between Victor and his father is the heart of the story, my favorite character was undoubtedly his sidekick, Nurse Ratched, with her hilarious dark humor.

1Q84

1012, 村上春樹, ★★★☆☆

1Q84 is a parallel-narrative love story set in an altered version of 1984 Tokyo, which one protagonist dubs “1Q84.” The story alternates between two lonely individuals: Aomame, a fitness instructor with a secret life as an assassin, and Tengo, a math teacher and aspiring writer. Their lives become intertwined as both characters encounter a religious cult.

While I connected with the story and appreciated the deep character development, it is undeniably a long book—perhaps too long. Having a colleague reading the book gave me the motivation to keep plowing through. The parallel dual-protagonist approach is well executed. The alternate perspectives of the two main characters explain their insights into their evolving realities. It certainly took a while for the separate threads of the story to click into place. It’s a novel that demands patience, but it’s a memorable read.

Identified

2022, John Wilander, ★★★☆☆

Unfortunately, “memorable” is not a word I can use for Wilander’s Identified. I finished the novel a few months ago and gave it a decent 3 out of 5 rating at the time. Yet, now, while writing this post, I realize I cannot recall any of the plot details. It seems I enjoyed the immediate experience of reading the book, perhaps the pace or the action, but the overall story ultimately failed to stick with me long-term.

The Lion, the Witch and the Wardrobe

1970, C.S. Lewis, ★★★☆☆

The second book in the Narnia series is, of course, the one where the children discover the famous entrance to the magical land through the old wardrobe. The children soon enter Narnia, which is trapped in an eternal winter under the tyrannical rule of the White Witch.

I made a point of reading this classic because my kids were reading the series, and I wanted to be up to speed to join in on their discussions. We even visited Velika Planina last year, a place said to have serious Narnia vibes. While I can now check it off my list, the fantastical style isn’t my kind of story.

The Worm Ouroboros

1922, Erik Rücker Eddison, ★★☆☆☆

A high fantasy novel set on the fictional planet of Mercury about a long and epic war between the valiant Demonland and the tyrannical Witchland. The Demon Lords, including the brothers Juss, Goldry, Spitfire, and King Corund, engage in chivalric battles, political maneuvers, and perilous quests to defeat Witchland and rescue the captured Goldry, all within a grand, archaic, and consciously heroic style.

I had high hopes for this one, especially knowing that Tolkien held it in high regard, but the archaic language and heavy style made it a difficult read. Its age is certainly beginning to show, making it a challenging read for me.

The Four Agreements

1997, Don Miguel Ruiz, ★☆☆☆☆

A self-help book based on ancient Toltec wisdom that provides a simple code of conduct for achieving personal freedom and happiness. The premise is that humans are “domesticated” by society to live by self-limiting beliefs and rules that cause needless suffering. Ruiz proposes replacing these agreements with four new ones: Be Impeccable With Your Word, Don’t Take Anything Personally, Don’t Make Assumptions, and Always Do Your Best.

I’m still not entirely sure why I picked this one up, as I typically steer clear of self-help literature. Unfortunately, this one didn't change my mind. While the advice offered is largely self-explanatory and rooted in common sense, the tone of the writing felt overly preachy. The author seems to claim, “Just do these four simple things and you will be happy”—which, yeah, sure…

Assembling a 3D Printer

2025-11-11T11:00:00+01:00

Interior of the assembled Prusa CORE One.

Ever since the RepRap arrived on the scene way back in 2005, I’ve been debating whether I should buy a 3D printer.

They look undeniably cool, but do I really need more plastic clutter in my life? Probably not. So, I held off. I’d occasionally peek into 3D model libraries like Printables and Thingiverse to see what people were making. And, honestly, most of the uploads seemed to be figurines, fidget toys, or attachments for the printer itself. If those prints bring you joy, more power to you, but I had a different idea.

I imagined a world where manufacturers would release 3D models to replace broken parts—the way you can download a firmware upgrade today. That world didn’t quite materialize; instead, we got our “throw it out and buy a new one—don’t even dare repairing it” economy.

Why Now?

Spoiler alert, as the title gives away, I finally bought a printer! What changed my mind?

First, there was the rise of the Bambu Lab printers a few years ago. The reviews were raving about how much easier 3D printing had become. But then came the backlash over locking down their machines.

That’s what brought me back to Prusa. They are a long-time player in the market; they have a solid track record, and they are openly friendly to the open-source community—plus, they’re European. I noticed they sell their printers either assembled or as a kit, and that was what finally pulled me over. Assembling it with my kids sounded like a fun time, an advanced LEGO build, so to say.

A floor full of Prusa part boxes.

The Family Build

The printer, a Prusa CORE One, arrived last week, and we had an absolute blast! The assembly took a little over two full weekend days of focused work. My son was completely hooked, constantly nagging me to continue after dinner and peppering me with 3D-printing questions.

They use a 3D printer at his school, mainly for small projects like keychains, but the teacher always handles the actual printing. While we were building ours, he kept remarking on how much better he now understood the mechanics. The assembly is time-consuming but definitely not hard—my 10-year-old could probably build the next one solo.

Once assembled, the printer runs a self-test. Ours identified a screw that was too tightly fixed, which took us maybe 10 minutes to locate and adjust. Then, it was time for the first print: the example keychain that comes with the machine. Watching an object materialize out of thin air, tiny layer by tiny layer, was truly magical. A big sense of achievement after building for hours. High fives all around.

The Printing Process

A 3D printer is a touch more complex than your standard paper printer. You have to create or download a 3D model, and then prepare it for printing using a specialized application called a “slicer.”

Think of the “slicer” as the print preview for a paper document, but on steroids. When printing a document, you select paper size, color, and orientation. With 3D printing, the slicer literally carves your 3D model into hundreds of flat layers. You have to specify settings like layer thickness, which filament (the “ink”) you are using, how to fill the object’s interior (infill), and more. It’s more involved than a paper printer, but easy enough to learn.

The Prusa CORE One impressed me right out of the gate. Given my lack of 3D printing experience, I was expecting thick, rough, and highly visible layers. But today’s printers are way beyond that. You can still tell it’s a printed object, of course, but the level of detail these machines achieve is stellar. How does it even print a layer at one-tenth of a millimeter?!

Moving Beyond Toys

After the keychain, we tried some downloaded models: a crown my daughter used for a book presentation, and a handy bottle drying rack, which was a great exercise in learning about overhangs and infill strength.

These are all still “toy” objects, though, and I believe the printer will only truly prove its worth when I can use it to fix broken items around the house. So, our next project is a bracket to mount a Velux window remote to the wall. Amazingly, even obscure objects like the bracket can be found online.

We only have PLA filament right now. It’s the easiest to print with, but it’s not as strong as PETG, which is generally recommended for items that need to snap together or handle stress. I’ll order a spool of PETG to see how it differs from PLA. Once that bracket is successfully mounted, I can try my hand at designing and printing my own objects from scratch.

Safe to say, these past few days have been a ton of fun. We’ve learned a lot about machine assembly, slicing, and the 3D community in general—and we’ve barely scratched the surface!

Was it worth it? Only time will tell. We’ll have to wait until the excitement fades to see if I actually use the printer for practical fixes.

Paperless note-taking

2025-09-27T12:00:00+02:00

I’ve been on the hunt for a paperless note-taking solution for a while now. I needed something to capture random ideas, jot down meeting minutes, or take quick reminders during phone calls. Of course, I could just use paper—and I have been. It’s cheap, abundant, and it always works. I can come up with many excuses as to why my note-taking needs to be digital (easy to search, history always available, etc.), but these are just rationalizations. The reality is that digital gadgets are simply more fun.

Version 1: The iPad mini

I had been eyeing the reMarkable tablet since it first launched back in 2017, but I never pulled the trigger. Two years later, in 2019, I bought an iPad mini (€459) with an Apple Pencil (€59) instead. I was a bit reluctant since I’m a sucker for all things e-paper, but I figured the iPad was a better deal as it’s a more capable device.

Looking back now, it was the right call, but not for the reason I expected. The 6-year old iPad still sees daily use. I use it for video calls, watching the occasional movie, browsing the web, and my son even plays games on it. The one thing I don’t use it for? Note-taking, the very reason I bought it! The feeling of the pencil on the glass screen just doesn’t feel right, and the pencil’s battery is predictably dead every time I actually want to use it.

To summarize: yes, the iPad gets lots of use, but not for its original purpose in my life.

Version 2: Supernote Nomad

Fast forward to last week. My interest was piqued once more when reMarkable released a new, smaller version of their tablet. This led me down a rabbit hole where I found the Supernote Nomad, a competitor. Its main selling point over the reMarkable? The lack of a monthly subscription. I am allergic to subscriptions, and this was always the deal-breaker with the reMarkable.

My Supernote Nomad (€280), Heart of Metal 2 Pen (€75), and folio (€49) arrived last week. I’ve been using it to take notes during meetings, doodle, and write the draft of this blog post. It’s the complete opposite of the iPad; its features are limited, and that’s intentional. It’s a device designed for one thing: writing.

Here are my initial thoughts:

The Writing Experience: The display is gorgeous and designed to mimic paper. While writing on it feels much better than the iPad, I personally wouldn’t compare it to real paper. It’s very responsive—traditionally a weakness for E Ink—but the surface feels a little too smooth to be a true paper replacement.
The Pen: The pen does not have a battery. This is a big deal, as it means it will always be ready to use. Unlike the reMarkable, the tips are designed not to need replacing. This is more convenient, though I can’t compare the writing feel to the reMarkable pen. The Supernote pens also don’t come with an eraser, which would have been handy.
Openness and Connectivity: The Supernote works fully offline. There’s no account required, no tracking or ads, and no vendor lock-in. You can create a Supernote account for optional syncing and free cloud storage, but you don’t have to. It also supports Dropbox, Google Drive, and OneDrive. WebDAV, my personal choice, is on their roadmap. For local transfers, you can connect over Wi-Fi, use a USB cable, or just pop out the SD card.
No Color: The Supernote doesn’t have a color display like the small reMarkable, but while that feature would be nice, I don't expect to miss it. The Supernote is also about €100 cheaper with similar accessories.
Company Ethos: reMarkable is a Norwegian company, while Supernote is based in Singapore and Japan. I try to buy “European” when possible, so reMarkable would have had the advantage here if it weren’t for their subscription model. However, the company behind Supernote, Ratta, seems great. They publish their development roadmap and support the right-to-repair movement by selling replacement parts. You can even assemble your own pen. They also claim not to run promotions or sales to prevent impulse buying.

It’s only been a week, but so far I’m impressed by the openness of the platform and the ethos of the company. E-notebooks are pricey, especially when compared to good old paper. Is it worth the cost? It’s too soon to tell, but it’s off to a strong start.

How I take backups

2025-06-20T11:00:00+02:00

This post documents my current backup system, mostly as a reminder for my future self. My laptop is my primary machine; while it usually sits on my desk, it also accompanies me to work a few times a week. Here’s the two-tiered strategy I use to make sure my data is safe.

Tier 1: Clonezilla for Bare-Metal Recovery

My primary, full-system backup solution is Clonezilla. I run it from a bootable USB stick to create a complete, bit-for-bit disk image on an external drive. This ensures that I don’t miss a single configuration file or dependency I might need later. If the laptop’s internal drive ever fails, I can simply swap in a new one, restore the latest Clonezilla image, and be back up and running in a matter of hours.

I don’t encrypt the Clonezilla backups. The external drive is kept physically locked away and is only connected during the backup process. This simplifies things and means there’s no master password for me to forget.

However, Clonezilla isn’t perfect for daily use. It comes with a few drawbacks:

Its ncurses-based interface can be confusing, and I always worry about accidentally overwriting my source drive instead of the destination.
Because it creates an identical clone, the image may not work correctly on different hardware. A drive replacement is fine, but restoring to an entirely new laptop could cause compatibility issues. (I can still mount the image and restore individual files, so it’s not a complete deal-breaker).
Clonezilla backups are not deduplicated. Since I’m imaging the entire drive, I can only store one or two versions on the external disk before running out of space.
The backup process is time-consuming, and I can’t use my laptop while it’s running. While this guarantees a consistent state (no files are changing), it also means I don’t perform these backups as often as I should. My last one was four months ago, which is far from ideal.

These limitations led me to my secondary backup solution, which is faster, automated, and encrypted.

Tier 2: Restic for Automated, Incremental Backups

Restic is a modern, command-line backup tool. It creates versioned snapshots of specified directories and stores them in a “repository,” which can be a local folder or a remote system. The real magic is that it compresses, deduplicates, and encrypts all data by default. The initial backup can be slow, but subsequent snapshots are incredibly fast because they only copy the changed data blocks.

My restic repository lives on my Synology NAS, and the backups are sent securely over SFTP.

Setup and Configuration

1. Enable SFTP on the Synology NAS

In the Synology Control Panel, go to File Services → FTP. On that screen, find and enable the SFTP service (do not use the standard FTPS service). I kept the default port 22. Next, you need to grant your user permission to connect. Go to Control Panel → User & Group, edit your user, and in the Applications tab, check the “Allow” box for SFTP.

2. Configure the SSH Client

You should now be able to connect to the NAS. If you have many SSH keys, you might get a “Too many authentication failures” error. You can fix this by telling SSH to only use the specific identity file for this connection. To make this permanent and simplify the command, I added the following to my ~/.ssh/config file:

Host nas
  HostName nas.example.com
  User me
  IdentitiesOnly yes

3. Initialize the Restic Repository

With SFTP access configured, you can now initialize a new restic repository on the NAS. This command is run from the laptop; restic connects over SFTP and creates the necessary directory structure.

restic init --repo sftp:nas:/drop/restic-repo

Common Restic Commands

Here is a list of commands I use most frequently.

Create a Backup

This command backs up my documents directory. Restic can store snapshots from multiple directories (and even multiple machines) in the same repository.

restic backup --repo sftp:nas:/drop/restic-repo ~/Documents/

List Snapshots

After a backup, you can confirm it worked by listing the snapshots in the repository.

restic snapshots --repo sftp:nas:/drop/restic-repo

Compare Snapshots

You can see the exact changes between any two snapshots using their IDs.

restic diff --repo sftp:nas:/drop/restic-repo d56ed9d5 1c100c47

Restore Files

Restic can restore a backup in place, but this will overwrite newer files and remove any files not present in the snapshot. That’s a bit too YOLO for my taste, so I always restore to a temporary directory to be safe.

restic restore --repo sftp:nas:/drop/restic-repo --target /tmp latest

Maintain the Repository

Over time, the repository will grow. I periodically run a check to verify its integrity.

restic check --repo sftp:nas:/drop/restic-repo

To clean up old snapshots, I use the forget command with a retention policy. The --prune flag is necessary to actually delete the orphaned data and free up disk space.

# This policy keeps 3 daily, 5 weekly, 7 monthly, and 9 yearly snapshots
restic forget --repo sftp:nas:/drop/restic-repo \
    --keep-daily 3 --keep-weekly 5 --keep-monthly 7 --keep-yearly 9

I automate the backup and forget commands using a systemd timer, which runs daily.

Why Use Both?

This two-tiered system gives me the best of both worlds.

Clonezilla is my disaster recovery plan. I am certain it backs up my whole drive, so no configuration is ever missed. The USB drive is stored offline, making it invulnerable to accidental deletion or malware.
restic is my daily, automated safety net. It’s always connected and running, making it easy to perform frequent backups and restore individual files quickly. However, being online makes it more vulnerable to user error or a security breach.

By using two different backup solutions, I’m not putting all my eggs in one basket. If a critical bug were ever discovered in Clonezilla or restic that could corrupt backups, I’d still have an alternative to fall back on.

Synology Password-less SSH

2025-06-16T11:00:00+02:00

My goal is to set up automated restic backups to a Synology NAS from my laptop. Manually entering a password for each backup defeats the purpose of the automation. Just as we use public/private key pairs in UN*X to bypass password prompts, we can apply the same idea for automated access our Synology. It’s built on Linux after all.

This guide is based on a Synology system running DSM 7.1.1. Keep in mind that future DSM versions might introduce changes, so some steps could vary.

We’ll assume we have already generated a public and private key pair. If not, there are numerous resources available online, such as this one.

Enable SSH

First, we need to enable SSH on the Synology NAS. Navigate to “Control Panel → Terminal & SNMP” and check the "Enable SSH service” option. At this point, we can connect from our laptop using ssh user@synology (replace the username and Synology address), but we’ll still be prompted for a password.

User Home Folders

To enable automated authentication, we need to upload a public key to the Synology. This requires enabling user home folders. Go to “Control Panel → User & Groups”, select the “Advanced” tab, and in the “User Home” section, check “Enable user home service”. We should now see a new ‘home’ directory in the Synology File Station.

Adding a Public Key

Now, let’s add a public key to our user’s home folder on the NAS. Using File Station, locate the /home directory for the user used for the automation. Inside this directory, create a new subdirectory named .ssh. Within this directory, create a file named authorized_keys (with no extension). Finally, paste the entire contents of the public key into this ‘authorized_keys’ file. The public key of course, the private one should never leave the laptop.

For SSH to function correctly, we need to change the permissions for the .ssh folder and its contents. Start by logging in via SSH with the password. Once connected, change the permissions of the .ssh folder to ‘drwxr-xr-x’. Similarly, for the authorized_keys file within that folder, set its permissions to ‘-rw-r--r--’.

$ chmod 0755 .ssh/
$ chmod 0644 .ssh/authorized_keys

With these steps completed, we now have password-less SSH access to the Synology NAS via ssh user@synology. We won’t be promted for a password any longer.

Rails’ Connection Pool

2025-06-04T11:00:00+02:00

Encountering a production issue that works perfectly on your local machine is a classic developer’s dilemma. Today I faced this while debugging “ActiveRecord::ConnectionTimeoutError” issues in a Ruby on Rails application.

could not obtain a connection from the pool within 5.000 seconds (waited 5.000 seconds); all pooled connections were in use

The error indicated that the Rails application was running out of database connections. By default, Rails opens 5 concurrent connections to the PostgreSQL database. The fix is usually straightforward: increase the “pool” size in the “database.yml” configuration.

Here’s what the initial configuration looked like:

default: &default
  adapter: postgresql
  pool: 10

development:
  <<: *default
  database: my-dev-database

I tested this on my local development machine, and everything seemed fine. It works on my machine, right? Running ActiveRecord::Base.connection_pool.size in my local Rails console confirmed the pool size was indeed increased to 10. Feeling confident, I deployed to production.

However, the errors persisted. Checking the connection pool size on the production server via the Rails console still showed 5, not the expected 10. Can you spot the mistake?

My first thoughts was to the production environment itself. Was Scalingo, the managed hosting platform this application runs on, overriding the configuration? Was there a smaller default pool size for the one-off containers in which I was testing?

Turns out, the problem was much simpler and lay in my understanding of YAML syntax. I had assumed that since “production”, “testing”, and “staging” weren’t explicitly defined in the “database.yml” file, they would automatically inherit from the “default” block. The “development” key is mentioned since it needs a different database name. This application had been running for years, so this couldn’t be wrong, right?

Wrong.

Rails does not automatically pick up the “default” configuration unless the environments are explicitly defined. Even if an environment doesn’t have any specific overrides, you still need to include its key in the database configuration to ensure Rails uses the configuration parameters from the “default” block. I am unsure if this is according to the YAML spec or a Rails specific rule.

The solution was to explicitly define the “production” environment key, even if it just inherits from the “defaults” block:

default: &default
  adapter: postgresql
  pool: 10

production:
  <<: *default

development:
  <<: *default
  database: my-dev-database

After deploying the corrected configuration file and restarting the production server, ActiveRecord::Base.connection_pool.size now shows a connection pool of 10 and the “ActiveRecord::ConnectionTimeoutError” issues were resolved.

Today was a good reminder that even subtle misconfigurations in seemingly straightforward YAML files can lead to unexpected behavior in production.

Getting Started with Meshtastic

2025-03-23T10:00:00+01:00

Meshtastic offers a glimpse into off-grid communication, and the Heltec V3 boards are a popular entry point. While there are fancier devices like the LilyGO T-Deck or Muzi.works, we’ll start with the basics. I picked up two Heltec V3 boards for €22 each (check TinyTronics, hamparts.shop or Nettigo for some European stores).

First, I attached the included stubby antennas. Always connect antennas first with devices that transmit, or you might damage them. Then, using the Meshtastic web flasher, I flashed the first board with the latest firmware. The flasher worked flawlessly with Chromium on Linux (Firefox does not support WebUSB).

The Phone Node

Meshtastic offers multiple configuration options: a mobile app, a web UI, and a Python CLI (more on that later). For this first device, we’ll use the mobile app over Bluetooth, which is likely the most common approach. We’ll refer to this first board as the phone node.

Powered by a LiPo battery (a USB power bank or adaptor would also work), the phone node was ready for configuration. Connecting via Bluetooth using the Meshtastic app is straightforward. The device’s name is displayed on its screen and shows a pairing code when connecting through the Meshtastic mobile app. After pairing, I set the device’s region and saved the configuration, triggering a reboot. We’ll leave other settings at their defaults.

The Computer Node

Next, we’ll flash the second board, designated the computer node, using the same web flasher. However, we’ll configure this node via the Meshtastic CLI. Since the device is already connected via USB for flashing, it’s convenient to configure it immediately.

First, let’s verify connectivity (the --port parameter might be optional). This will print the node’s configuration.

meshtastic --port /dev/ttyUSB0 --info

If successful, we’ll proceed with configuration. Note that the following settings are specific to my location in Belgium (EU_868 and CEST). Adjust them as needed for your region.

meshtastic \
--set lora.region EU_868 \
--set device.tzdef CET-1CEST,M3.5.0,M10.5.0/3 \
--set-time $(date +%s) \ # Current UNIX timestamp, will be forgotten on reset
--set device.led_heartbeat_disabled true # The blinking light annoyed me

↑ While these commands should theoretically run in a single execution, I needed to run them individually.

Both nodes now operates entirely offline, without Wi-Fi connectivity.

Sending Messages

Upon reboot, the computer node might be detected by the phone node, triggering a notification on your phone. The nodes can see each other!

To test message relay, we’ll use the --reply command on the computer node. This will listen to incoming messages and reply automatically.

meshtastic --reply

On your phone, ensure you’re subscribed to the phone node via BLE and open the "Primary channel" in the messages section. I went all out and texted an extremely creative "hi." After a brief "waiting for acknowledgment" period, the computer node should receive and reply to the message, which will then appear on your phone.

Now, don’t be rude and answer your phone from the computer node with the command line client:

meshtastic --no-nodes --no-time --sendtext "Hi me, got your message! Cheers, other me."

Bravo, you are now living the off-grid life and can send messages, without the need for any intermediary, completely self-reliant to… yourself.

Private Channels

While I didn’t detect other Meshtastic nodes in range, the "Primary channel" means that any nearby node would receive the message as well, it’s public.

For private communication, we can create a new channel on any of the nodes and share its encryption key. On the computer node:

meshtastic --ch-add "MyPrivateChannel" --ch-set psk random
meshtastic --info # Verify the new channel
mesttattic --qr-all

Scanning the generated QR code with your phone adds the private channel with the correct password, ensuring encrypted communication.

Direct Messaging

Direct messaging is also possible:

meshtastic --sendtext "Hi there" --dest '!a01bc234'

↑ The !a01bc234 is an example destination, use the ID of your phone node.

While the message was received by my phone (indicated by a push notification and a red counter on the speech bubble icon), it didn’t appear in the message list. This highlights the beta nature of Meshtastic, with its occasional quirks.

Internet Bridging

Meshtastic's true potential as a mesh network is realized when multiple nodes are within range, allowing messages to hop from one node to the next and extending the network's reach. However, we can further expand this connectivity by connecting to the internet through MQTT, enabling communication between nodes across the continent.

By enabling internet connectivity, we can bridge the gap between local Meshtastic networks. While this clearly deviates from the fully off-grid concept, it provides a fallback when nearby nodes are scarce. Let's configure the computer node for internet connectivity and MQTT:

meshtastic \
--set network.wifi_enabled true \
--set network.wifi_ssid MyWiFiNetwork \
--set network.wifi_psk MyWifiPa$$w0rd

After executing this command, the device’s display will show a new screen indicating its WiFi connection status. This alone is not enough to send and receive messages via the internet, we also have to enable MQTT:

meshtastic \
--set mqtt.enabled true \
--set lora.ignore_mqtt false \
--set lora.config_ok_to_mqtt true \
--ch-index 0 \
--ch-set uplink_enabled true \
--ch-set downlink_enabled true

This setup allows the phone node, still without an internet connection, remember, to communicate with distant nodes. Messages are relayed through the computer node to the MQTT server, which then forwards them to internet-connected nodes. The phone node needs “Ok to MQTT” (under the LoRa config) enabled for this to work.

Nodes on a Map

To make your node visible on a map, ensure WiFi is enabled as described above. Although the Heltec lacks GPS functionality, we can assign a fixed position for it to show up on the map. By default, the node sends MQTT updates every 15 minutes, but this interval can be adjusted.

meshtastic
--set mqtt.enabled true \
--set mqtt.map_reporting_enabled true \
--set position.fixed_position true \
--setlat 50.8449861 \
--setlon 4.3499932

Range Test

I was intrigued by the range of these little Heltec devices. I placed one node in the attic and took the other with me on a short walk, sending occasional messages along the way. The solid green lines indicate messages that were successfully received by my attic node, while the red dashed lines represent those that failed to go through. It’s worth noting that this informal test was in a dense urban area with some elevation changes; take it for what it’s worth.