[pre-commit.ci] pre-commit autoupdate

updates:
- [github.com/fsfe/reuse-tool: v5.1.1 → v6.0.0](https://github.com/fsfe/reuse-tool/compare/v5.1.1...v6.0.0)

.github/workflows/jekyll.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           submodules: "true"
       - name: Setup Ruby
@@ -52,7 +52,7 @@ jobs:
           JEKYLL_ENV: production
       - name: Upload artifact
         # Automatically uploads an artifact from the './_site' directory by default
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v4
 
   # Deployment job
   deploy:

.pre-commit-config.yaml

@@ -18,7 +18,7 @@ default_language_version:
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
         args: ["--markdown-linebreak-ext", "md,markdown"]
@@ -66,7 +66,7 @@ repos:
           ]
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.33.2
+    rev: 0.34.0
     hooks:
       - id: check-dependabot
       - id: check-github-actions
@@ -76,7 +76,7 @@ repos:
         additional_dependencies: ["pyjson5"]
 
   - repo: https://github.com/fsfe/reuse-tool
-    rev: v5.0.2
+    rev: v6.0.0
     hooks:
       - id: reuse
         exclude: ^.cache\/.*$
@@ -89,7 +89,7 @@ repos:
         language: system
 
   - repo: https://github.com/editorconfig-checker/editorconfig-checker.python
-    rev: "3.2.1"
+    rev: "3.4.0"
     hooks:
       - id: editorconfig-checker
         alias: ec

.ruby-version

@@ -1 +1 @@
-3.4.4
+3.4.6

Gemfile.lock

@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (8.0.2)
+    activesupport (8.0.3)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -18,10 +18,10 @@ GEM
       public_suffix (>= 2.0.2, < 7.0)
     base64 (0.3.0)
     benchmark (0.4.1)
-    bigdecimal (3.2.2)
+    bigdecimal (3.2.3)
     colorator (1.1.0)
     concurrent-ruby (1.3.5)
-    connection_pool (2.5.3)
+    connection_pool (2.5.4)
     csv (3.3.5)
     drb (2.2.3)
     em-websocket (0.5.3)
@@ -40,31 +40,31 @@ GEM
     ffi (1.17.2-x86_64-linux-gnu)
     ffi (1.17.2-x86_64-linux-musl)
     forwardable-extended (2.6.0)
-    google-protobuf (4.31.1)
+    google-protobuf (4.32.1)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-aarch64-linux-gnu)
+    google-protobuf (4.32.1-aarch64-linux-gnu)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-aarch64-linux-musl)
+    google-protobuf (4.32.1-aarch64-linux-musl)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-arm64-darwin)
+    google-protobuf (4.32.1-arm64-darwin)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-x86-linux-gnu)
+    google-protobuf (4.32.1-x86-linux-gnu)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-x86-linux-musl)
+    google-protobuf (4.32.1-x86-linux-musl)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-x86_64-darwin)
+    google-protobuf (4.32.1-x86_64-darwin)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-x86_64-linux-gnu)
+    google-protobuf (4.32.1-x86_64-linux-gnu)
       bigdecimal
       rake (>= 13)
-    google-protobuf (4.31.1-x86_64-linux-musl)
+    google-protobuf (4.32.1-x86_64-linux-musl)
       bigdecimal
       rake (>= 13)
     haml (6.3.0)
@@ -111,7 +111,7 @@ GEM
       jekyll (>= 3.7, < 5.0)
     jekyll-watch (2.2.1)
       listen (~> 3.0)
-    json (2.12.2)
+    json (2.15.0)
     kramdown (2.5.1)
       rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
@@ -128,24 +128,24 @@ GEM
       jekyll-feed (~> 0.9)
       jekyll-seo-tag (~> 2.1)
     minitest (5.25.5)
-    nokogiri (1.18.8)
+    nokogiri (1.18.10)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.18.8-aarch64-linux-gnu)
+    nokogiri (1.18.10-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.8-aarch64-linux-musl)
+    nokogiri (1.18.10-aarch64-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.18.8-arm-linux-gnu)
+    nokogiri (1.18.10-arm-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.8-arm-linux-musl)
+    nokogiri (1.18.10-arm-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.18.8-arm64-darwin)
+    nokogiri (1.18.10-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.8-x86_64-darwin)
+    nokogiri (1.18.10-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.18.8-x86_64-linux-gnu)
+    nokogiri (1.18.10-x86_64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.8-x86_64-linux-musl)
+    nokogiri (1.18.10-x86_64-linux-musl)
       racc (~> 1.4)
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
@@ -156,46 +156,46 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rbs (3.9.4)
+    rbs (3.9.5)
       logger
-    rexml (3.4.1)
+    rexml (3.4.4)
-    rouge (4.5.2)
+    rouge (4.6.1)
     safe_yaml (1.0.5)
-    sass-embedded (1.89.2)
+    sass-embedded (1.93.2)
       google-protobuf (~> 4.31)
       rake (>= 13)
-    sass-embedded (1.89.2-aarch64-linux-android)
+    sass-embedded (1.93.2-aarch64-linux-android)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-aarch64-linux-gnu)
+    sass-embedded (1.93.2-aarch64-linux-gnu)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-aarch64-linux-musl)
+    sass-embedded (1.93.2-aarch64-linux-musl)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-aarch64-mingw-ucrt)
+    sass-embedded (1.93.2-aarch64-mingw-ucrt)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-arm-linux-androideabi)
+    sass-embedded (1.93.2-arm-linux-androideabi)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-arm-linux-gnueabihf)
+    sass-embedded (1.93.2-arm-linux-gnueabihf)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-arm-linux-musleabihf)
+    sass-embedded (1.93.2-arm-linux-musleabihf)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-arm64-darwin)
+    sass-embedded (1.93.2-arm64-darwin)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-riscv64-linux-android)
+    sass-embedded (1.93.2-riscv64-linux-android)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-riscv64-linux-gnu)
+    sass-embedded (1.93.2-riscv64-linux-gnu)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-riscv64-linux-musl)
+    sass-embedded (1.93.2-riscv64-linux-musl)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-x86_64-darwin)
+    sass-embedded (1.93.2-x86_64-darwin)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-x86_64-linux-android)
+    sass-embedded (1.93.2-x86_64-linux-android)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-x86_64-linux-gnu)
+    sass-embedded (1.93.2-x86_64-linux-gnu)
       google-protobuf (~> 4.31)
-    sass-embedded (1.89.2-x86_64-linux-musl)
+    sass-embedded (1.93.2-x86_64-linux-musl)
       google-protobuf (~> 4.31)
     securerandom (0.4.1)
-    syntax_tree (6.2.0)
+    syntax_tree (6.3.0)
       prettier_print (>= 1.2.0)
     syntax_tree-haml (4.0.3)
       haml (>= 5.2)
@@ -205,11 +205,11 @@ GEM
       prettier_print
       rbs
       syntax_tree (>= 2.0.1)
-    temple (0.10.3)
+    temple (0.10.4)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
-    thor (1.3.2)
+    thor (1.4.0)
-    tilt (2.6.0)
+    tilt (2.6.1)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.6.0)
@@ -257,7 +257,7 @@ DEPENDENCIES
   webrick
 
 RUBY VERSION
-   ruby 3.4.4p34
+   ruby 3.4.6p54
 
 BUNDLED WITH
-   2.6.9
+   2.7.2

_config.yml

@@ -120,7 +120,7 @@ exclude:
 # Latest Matrix room version for blog posts or /upgraderoom advice. If I
 # need something from the latest version, this is it once the servers I care
 # about have upgraded. Otherwise this is based on my discretion.
-matrixLatestRoomVersion: 11
+matrixLatestRoomVersion: 12
 
 # {{site.ipfsGateway}}/ipfs/IPFSHASHHERE to get ipfs link via gateway.
 # Hopefully future proof letting me simply swap the link here instead of

assets/main.scss

@@ -10,35 +10,60 @@ $serif-font-family:
   ui-serif, "Roboto Serif", "Noto Serif", Tinos, serif, "Noto Emoji",
   "Noto Color Emoji", "Segoe UI Emoji", emoji;
 $sans-serif-font-family:
-  "Inclusive Sans", ui-sans-serif, "Roboto Flex", "Segoe UI Variable", Roboto,
+  "Atkinson Hyperlegible Next", "Inclusive Sans", ui-sans-serif, "Roboto Flex",
-  "Noto Sans", Arimo, sans-serif, "Noto Emoji", "Noto Color Emoji",
+  "Segoe UI Variable", Roboto, "Noto Sans", Arimo, sans-serif, "Noto Emoji",
-  "Segoe UI Emoji", emoji;
+  "Noto Color Emoji", "Segoe UI Emoji", emoji;
 $monospace-font-family:
-  "Comic Shanns Mono", ui-monospace, "Roboto Mono", "Segoe UI Mono",
+  "Atkinson Hyperlegible Mono", "Comic Shanns Mono", ui-monospace,
-  "Noto Mono", Cousine, monospace, "Noto Emoji", "Noto Color Emoji",
+  "Roboto Mono", "Segoe UI Mono", "Noto Mono", Cousine, monospace, "Noto Emoji",
-  "Segoe UI Emoji", emoji;
+  "Noto Color Emoji", "Segoe UI Emoji", emoji;
 // Must be in the end under threat of undefined variable error.
 $base-font-family: $sans-serif-font-family;
 
 @font-face {
-  font-family: "Inclusive Sans";
+  font-family: "Atkinson Hyperlegible Next";
-  src: url("https://raw.githubusercontent.com/LivKing/Inclusive-Sans/refs/heads/main/fonts/webfonts/InclusiveSans[wght].woff2")
+  src: url("https://raw.githubusercontent.com/googlefonts/atkinson-hyperlegible-next/refs/heads/main/fonts/webfonts/AtkinsonHyperlegibleNext[wght].woff2")
     format("woff2");
   font-weight: normal;
   font-style: normal;
 }
 @font-face {
-  font-family: "Inclusive Sans Italic";
+  font-family: "Atkinson Hyperlegible Next Italic";
-  src: url("https://raw.githubusercontent.com/LivKing/Inclusive-Sans/refs/heads/main/fonts/webfonts/InclusiveSans-Italic[wght].woff2")
+  src: url("https://raw.githubusercontent.com/googlefonts/atkinson-hyperlegible-next/refs/heads/main/fonts/webfonts/AtkinsonHyperlegibleNext-Italic[wght].woff2")
     format("woff2");
   font-weight: normal;
   font-style: italic;
 }
 @font-face {
-  font-family: "Comic Shanns Mono";
+  font-family: "Atkinson Hyperlegible Mono";
-  src: url("https://raw.githubusercontent.com/jesusmgg/comic-shanns-mono/refs/heads/master/fonts/ComicShannsMono-Regular.otf")
+  src: url("https://raw.githubusercontent.com/googlefonts/atkinson-hyperlegible-next-mono/refs/heads/main/fonts/webfonts/AtkinsonHyperlegibleMono[wght].woff2")
-    format("opentype");
+    format("woff2");
 }
+@font-face {
+  font-family: "Atkinson Hyperlegible Mono Italic";
+  src: url("https://raw.githubusercontent.com/googlefonts/atkinson-hyperlegible-next-mono/refs/heads/main/fonts/webfonts/AtkinsonHyperlegibleMono-Italic[wght].woff2")
+    format("woff2");
+}
+
+// @font-face {
+//   font-family: "Inclusive Sans";
+//   src: url("https://raw.githubusercontent.com/LivKing/Inclusive-Sans/refs/heads/main/fonts/webfonts/InclusiveSans[wght].woff2")
+//     format("woff2");
+//   font-weight: normal;
+//   font-style: normal;
+// }
+// @font-face {
+//   font-family: "Inclusive Sans Italic";
+//   src: url("https://raw.githubusercontent.com/LivKing/Inclusive-Sans/refs/heads/main/fonts/webfonts/InclusiveSans-Italic[wght].woff2")
+//     format("woff2");
+//   font-weight: normal;
+//   font-style: italic;
+// }
+// @font-face {
+//   font-family: "Comic Shanns Mono";
+//   src: url("https://raw.githubusercontent.com/jesusmgg/comic-shanns-mono/refs/heads/master/fonts/ComicShannsMono-Regular.otf")
+//     format("opentype");
+// }
 
 // CSS of used Jekyll theme
 @import "{{ site.theme }}";

n/chromium.md

@@ -0,0 +1,28 @@
+---
+title: Chromium launch flags
+excerpt:
+  List of Chromium terminal flags that I keep forgetting and missing
+  occassionally.
+layout: mini
+permalink: /n/chromium.html
+redirect_from:
+  - /n/chromiumflags.html
+  - /n/chromeflags.html
+sitemap: true
+lang: en
+robots: noai
+---
+
+# Chromium terminal flags
+
+- `--ozone-platform=wayland` - Start with `wayland` instead of `X11`. For
+  automatic try `--ozone-platfor-hintm=auto` instead
+- `--disk-cache-dir='/dev/null'` - Disable disk cache (Chromium equivalent of
+  `browser.cache.disk.enable;false`)
+- `--enable-features=WaylandWindowDecorations` - Wayland title bar etc.? No
+  idea, everything just has it. TODO!
+- `--profile-directory=Default` - Chromium profile. Doesn't match the profile
+  name specified in profile manager?
+- `--app-id=` - when autostarting a PWA, this is the appid.
+- `--app-run-on-os-login-mode=windowed` - when autostarting a PWA; this opens it
+  in a PWA window. TODO: What are the other modes than `windowed`?

n/colors.md

@@ -16,7 +16,9 @@ lang: en
 - `#800080` - purple
   - `#8A2BE2` - blue violet via ChatGPT via [dev](https://t.me/devs_chat/131577)
     [meme](https://t.me/devs_chat/131597)
+  - `#750851` - velvet
 
 ## See also
 
 - [shutterstock: purple](https://www.shutterstock.com/color/purple)
+- [figma: velvet](https://www.figma.com/colors/velvet/)

n/essentialsoftware.md

@@ -27,13 +27,16 @@ _{{ page.excerpt }}_
   - [pipx](#pipx)
   - [Homebrew](#homebrew)
 - [Fedora Atomic](#fedora-atomic)
-  - [Additional rpm-ostree install](#additional-rpm-ostree-install)
+  - [`rpm-ostree install` everywhere](#rpm-ostree-install-everywhere)
+  - [`rpm-ostree kargs`](#rpm-ostree-kargs)
+  - [Situational `rpm-ostree install`](#situational-rpm-ostree-install)
   - [Flatpaks](#flatpaks)
     - [Communication](#communication)
     - [Gayming](#gayming)
       - [Flatpakked Steam for the flatpak-unaware](#flatpakked-steam-for-the-flatpak-unaware)
     - [General purpose](#general-purpose)
     - [Office](#office)
+  - [Snaps](#snaps)
   - [Other essential atomic/kinoite/flatpak/gayming reading](#other-essential-atomickinoiteflatpakgayming-reading)
 - [Essential system configuration](#essential-system-configuration)
   - [Debian console](#debian-console)
@@ -51,6 +54,8 @@ _{{ page.excerpt }}_
   - [Encrypted DNS](#encrypted-dns)
   - [`/etc/xdg/autostart`](#etcxdgautostart)
   - [`aminda-*.{service,socket}`](#aminda-servicesocket)
+  - [systemd sockets](#systemd-sockets)
+    - [firewalld for systemd sockets](#firewalld-for-systemd-sockets)
 - [Remember!](#remember)
   - [Accessing UEFI setup without key smashing](#accessing-uefi-setup-without-key-smashing)
   - [Recovering selinux policy issues](#recovering-selinux-policy-issues)
@@ -148,10 +153,10 @@ _{{ page.excerpt }}_
 pipx automatically creates virtualenvs and is basically a package manager for
 apps written in Python. Here is a small list to remember in no particular order.
 
-- (`pipx install "git+https://github.com/fsfe/reuse-tool.git"`)
+- (`pipx install "reuse @ git+https://github.com/fsfe/reuse-tool.git"`)
   - Refer to [n/reuse](/n/reuse.html), development version. Package manager
     version is generally good enough.
-- `pipx install "git+https://github.com/yt-dlp/yt-dlp.git"`
+- `pipx install "yt-dlp @ git+https://github.com/yt-dlp/yt-dlp.git@master"`
   - Downloader for multiple online video services, development version.
 - `pipx install xkcdpass`
   - `correct horse battery stable` needs no introduction, the possibilities are
@@ -161,7 +166,7 @@ apps written in Python. Here is a small list to remember in no particular order.
 - (`pipx install pre-commit`)
   - Synced pre-commit hooks for git, probably in all my repositories by now.
     However I would install it from system package manager instead.
-- `pipx install "git+https://github.com/aajanki/yle-dl"`
+- `pipx install "yle-dl[extra] @ git+https://github.com/aajanki/yle-dl"`
   - Downloader for `{areena,arenan}.yle.fi`, Finnish public broadcaster web
     portal.
 - `pipx install "git+https://github.com/syncplay/syncplay.git"`
@@ -173,10 +178,17 @@ Just remember to `pipx upgrade-all` occassionally!
 
 ### Homebrew
 
-This section is a WIP and to avoid having to install some rpm-ostree...
+In order to avoid having to use `rpm-ostree`, Homebrew is practical for some
+tools and applications.
+
+**_This section is still a WIP and TODO omitting important parts._**
 
 ```
-brew install aircrack-ng btop htop inxi ipfs llvm mpv mtr neovim nmap node pipx pre-commit qrencode ruby smartmontools symlinks zsh
+sudo mkdir /home/linuxbrew
+sudo chown -R $(whoami):$(whoami) /home/linuxbrew
+cd /home/linuxbrew
+git clone https://github.com/Homebrew/brew .linuxbrew
+brew install aircrack-ng bat bat-extras btop htop inxi ipfs llvm mtr neovim nmap node pipx pre-commit qrencode ripgrep ruby smartmontools weechat
 ```
 
 ## Fedora Atomic
@@ -185,27 +197,34 @@ _By which I mean Fedora Kinoite unless otherwise specified._ A system where
 everyone runs the same image, except that as this section shows, I add to it a
 bit...
 
+### `rpm-ostree install` everywhere
+
 ```bash
-# Ensure third party Fedora repos are available, this is part of KDE Prompt?
+# Ensure third party Fedora repos are available, this is part of the KDE
+# welcome prompt, maybe?
 sudo fedora-third-party enable
+
 # Layer packages I need on top of the base image.
-sudo rpm-ostree install android-tools cronie cronie-anacron darkman duperemove foot foot-terminfo gamescope git-lfs haveged iwd mangohud mosh rng-tools setroubleshoot snapd sshguard steam-devices syncthing terminus-fonts-console tmux tor torsocks unbound zsh
+sudo rpm-ostree install android-tools celluloid cronie cronie-anacron darkman duperemove foot foot-terminfo gamescope git-lfs haveged iwd mangohud mosh mpv oidentd rng-tools setroubleshoot snapd sshguard steam-devices symlinks syncthing terminus-fonts-console tmux tor torsocks unbound zsh
-# Remove packages I don't need from the base image. (Challenge to remove
+
-# nothing failed by using rpmfusion codecs anyway)
+# Enable automatic updates (check /etc/rpm-ostreed.conf for
-sudo rpm-ostree override remove firefox firefox-langpacks
+# AutomaticUpdatePolicy=stage (or apply for automatic reboots at probably
-# Enable automatic updates (check /etc/rpm-ostreed.conf for AutomaticUpdatePolicy=stage (or apply for automatic reboots) and LockLayering=false)
+# unwanted times & difficulties with encryption passphrase) and
+# LockLayering=false unless you want to be stuck with the base image)
 sudo systemctl enable rpm-ostreed-automatic.timer --now
-# Disable bootsplash and kernel message hiding, adjust rootfs fstab,
+
-# REMEMBER TO REMOVE SSD FOR NON-SSD setups! Legacy interface names (eth0,
+# Apply changes now, fix permission for my /root config
-# wlan0) are also nice, like is not letting invalid LUKS password drop into
+sudo rpm-ostree apply-live && sudo chmod a+x /var/roothome
-# root emergency shell. Ensure CPU vulnerability mitigation while at kargs too.
+
-sudo rpm-ostree kargs --delete=rhgb --delete=quiet --delete=rootflags=subvol=root --append=rootflags=subvol=root,noatime,compress-force=zstd:0,ssd --append=net.ifnames=0 --append=rd.shell=0 --append=rd.emergency=halt --append=mitigations=auto,nosmt
+# footclient (or server) for all users on-demand. Requires
-# Another reminder to not use flag SSD above if there is no SSD on the system.
+# the previous command or reboot
-# I would additionally use lockdown=confidentiality (or lockdown=integrity if
-# less privacy and security was required, but that prevents shipped osnoise
-# module from working.
-# footclient (or server) for all users on-demand
 sudo systemctl --global enable foot-server.socket
+
+# Uninstall all flatpaks (to get rid of Fedora remote and unnecessary apps,
+# refer to later section of this page for more relevant flatpaks).
+# (Yes, the invalid command is intentional, fix it to acknowledge reading and
+# understanding.)
+sudo flatpak uninstall --all --assumeno
 ```
 
 Consider also adding
@@ -217,17 +236,37 @@ Consider also adding
   there is repository breakage risk stopping system upgrades, at least it will
   upgrade itself as opposed to errorring about being a local not upgraded
   package in the future.
-- You need it when using either Broadcom WiFi or
+- You need it when using e.g. Broadcom WiFi or `mpv` and receiving
-  `Failed to initialize a decoder for codec 'hevc'.` from `mpv` which gets
+  `Failed to initialize a decoder for codec 'hevc'.`
-  resolved by following the instructions for your hardware or software codecs.
 
-### Additional rpm-ostree install
+### `rpm-ostree kargs`
+
+```bash
+# REMOVE ssd FROM rootflags if not on SSD!
+sudo rpm-ostree kargs --delete=rhgb --delete=quiet --delete=rootflags=subvol=root --append=rootflags=subvol=root,noatime,compress-force=zstd:0,ssd --append=net.ifnames=0 --append=rd.shell=0 --append=rd.emergency=halt --append=mitigations=auto,nosmt
+```
+
+- `rhgb quiet` - These enable graphical boot screen and suppressing more verbose
+  kernel messages (the other text than `[OK]` from systemd)
+- `rootflags=` - the `/etc/fstab` entries for `/` as the file has no effect on
+  `/` on Atomic. The parameters are explained later on this page.
+- `net.ifnames=0` - disables the predictable interface names returning to `eth0`
+  and `wlan0`. People say the only predictable thing about them is amount of
+  complaints.
+- `rd.shell=0 rd.emergency=halt` - hardening to not enter debug shell upon wrong
+  encryption password
+- `mitigations=auto,nosmt` - enable automatic mitigations for CPU
+  vulnerabilities including disabling hyperthreading (not default).
+- `lockdown={confidentiality,integrity}` - hardening from secure boot being
+  enabled, locks down realtime changes to kernel including unsigned kernel
+  modules and in form of blocking default `osnoise` increases hardware
+  noisiness.
+
+### Situational `rpm-ostree install`
 
 - In general `neilalexander`'s yggdrasil copr makes life easier with
   `sudo rpm-ostree install yggdrasil`
 - For ThinkPads: `sudo rpm-ostree install tlp tlp-rdw` is good for battery
-- For Broadcom WiFi with `rpmfusion-nonfree` enabled:
-  `sudo rpm-ostree install akmod-wl kernel-devel`
 - For NVIDIA propietary drivers with `sudo fedora-third-party enable`:
   `sudo rpm-ostree install akmod-nvidia xorg-x11-drv-nvidia-cuda`
   - This also requires
@@ -236,11 +275,18 @@ Consider also adding
     [rpmfusion howto nvidia#ostree](https://rpmfusion.org/Howto/NVIDIA#OSTree_.28Silverblue.2FKinoite.2Fetc.29)
 - For Steam Deck and other handhelds with their copr:
   `sudo rpm-ostree install hhd adjustor hhd-ui`
-- Also with rpmfusion for DVD playback
+- rpmfusion packages
-  `sudo rpm-ostree install rpmfusion-free-release-tainted` and
+  - For Broadcom WiFi with `rpmfusion-nonfree` enabled:
-  `sudo rpm-ostree install libdvdcss`
+    `sudo rpm-ostree install akmod-wl kernel-devel`
-- rpmfusion also has `sudo rpm-ostree install pipewire-codec-aptx` which allows
+  - DVD playback: `sudo rpm-ostree install rpmfusion-free-release-tainted` and
-  better quality playback with some BT devices such as Fairbuds XL.
+    `sudo rpm-ostree install libdvdcss`
+  - Bluetooth APTX HD codec: `sudo rpm-ostree install pipewire-codec-aptx` which
+    allows better quality playback with some devices e.g. Fairbuds XL.
+  - For
+    [hevc playback support](https://discussion.fedoraproject.org/t/how-do-i-enable-h265-hevc-playback-in-fedora-41-or-42-2025/147870),
+    `sudo rpm-ostree install libavcodec-freeworld`
+  - VirtualBox? Also at rpmfusion,
+    `sudo rpm-ostree install akmod-VirtualBox VirtualBox`
 
 ### Flatpaks
 
@@ -262,7 +308,7 @@ sudo flatpak remote-add --if-not-exists nheko-nightly https://nheko.im/nheko-reb
 
 ```bash
 sudo flatpak install --assumeyes nheko-nightly im.nheko.Nheko//master
-sudo flatpak install --assumeyes flathub com.discordapp.Discord im.dino.Dino info.mumble.Mumble org.briarproject.Briar org.signal.Signal org.squidowl.halloy org.telegram.desktop
+sudo flatpak install --assumeyes flathub com.discordapp.Discord im.dino.Dino info.mumble.Mumble org.briarproject.Briar org.gajim.Gajim org.signal.Signal org.squidowl.halloy org.telegram.desktop
 ```
 
 - Discord is a Slack competitor and somehow challenging Facebook in necessary
@@ -272,6 +318,7 @@ sudo flatpak install --assumeyes flathub com.discordapp.Discord im.dino.Dino inf
   podcasting than calling
 - Dino is a modern XMPP client
 - Briar is a P2P messenger using Tor or LAN, no bluetooth on desktop yet?
+- Gajim is XMPP client that does everything
 - Signal is E2EE messenger
 - Halloy is a modern IRC client
 - Telegram is a common chat-app although not that secure
@@ -280,8 +327,8 @@ sudo flatpak install --assumeyes flathub com.discordapp.Discord im.dino.Dino inf
 #### Gayming
 
 ```bash
-sudo flatpak install --assumeyes flathub com.heroicgameslauncher.hgl com.valvesoftware.Steam com.valvesoftware.Steam.CompatibilityTool.Proton-GE net.davidotek.pupgui2
+sudo flatpak install --assumeyes flathub com.heroicgameslauncher.hgl com.valvesoftware.Steam com.valvesoftware.Steam.CompatibilityTool.Proton-GE com.valvesoftware.SteamLink eu.usdx.UltraStarDeluxe
-# Note branch numbers for Heroic Games!
+# Note branch numbers!
 sudo flatpak install --assumeyes flathub org.freedesktop.Platform.VulkanLayer.MangoHud//24.08 org.freedesktop.Platform.VulkanLayer.gamescope//24.08
 ```
 
@@ -289,9 +336,9 @@ sudo flatpak install --assumeyes flathub org.freedesktop.Platform.VulkanLayer.Ma
 - Steam needs no explanation
 - Proton GE is improved version of Proton, the WINE based compatibility layer
   for playing Windows games and probably needs no introduction either
-- ProtonUp allows downloading newer versions of Proton including Proton GE, in
+- FOSS Karaoke, possibly fun to try sometime, once courage is gathered.
-  flatpaks it's mainly useful for either SteamOS users or Heroic Games which
+  Spiritual successor of PlayStation 2 SingStar with option for own songs?
-  might actually have its integrated manager...
+- Remote playing for other LAN Steam instances
 - MangoHud and gamescope can be used by Heroic Games or manually in Steam (see
   gayming README below), but they might require specific version or branch, so
   after the dualslash change the branch from `24.08` if they decide to update to
@@ -310,7 +357,7 @@ ln -nsfv $HOME/.var/app/com.valvesoftware.Steam/.steam $HOME/.steam
 #### General purpose
 
 ```bash
-sudo flatpak install --assumeyes flathub app.devsuite.Ptyxis com.calibre_ebook.calibre com.dropbox.Client com.github.tchx84.Flatseal com.github.wwmm.easyeffects com.nextcloud.desktopclient.nextcloud com.rafaelmardojai.Blanket de.haeckerfelix.Shortwave io.github.celluloid_player.Celluloid io.mpv.Mpv it.mijorus.gearlever me.kozec.syncthingtk org.fedoraproject.MediaWriter org.gnome.eog org.kde.haruna org.kde.kate org.pulseaudio.pavucontrol org.kde.kwrite org.kde.okular org.qbittorrent.qBittorrent org.torproject.torbrowser-launcher org.mozilla.firefox org.videolan.VLC
+sudo flatpak install --assumeyes flathub app.devsuite.Ptyxis com.calibre_ebook.calibre com.dropbox.Client com.github.tchx84.Flatseal com.github.wwmm.easyeffects com.nextcloud.desktopclient.nextcloud com.rafaelmardojai.Blanket de.haeckerfelix.Shortwave it.mijorus.gearlever me.kozec.syncthingtk org.fedoraproject.MediaWriter org.gnome.eog org.kde.elisa org.kde.kate org.kde.kcalc org.kde.kolourpaint org.kde.krdc org.pulseaudio.pavucontrol org.kde.kwrite org.kde.okular org.qbittorrent.qBittorrent org.torproject.torbrowser-launcher
 ```
 
 - Ptyxis reminds me of a Windows Terminal for Linux
@@ -326,23 +373,21 @@ sudo flatpak install --assumeyes flathub app.devsuite.Ptyxis com.calibre_ebook.c
 - Blanket gives nice sounds for e.g. focusing, white and nature noise inclued
 - Shortwave is Radio Browser using Internet Radio app and woof approves having
   it at paw
-- Celluloid is a mpv frontend, which can optionally read `mpv.conf`
-- mpv is my media player of choise and while it may be installed on the base
-  system for syncthing, it might not be everywhere and the flatpak may have
-  better codec etc. support on some systems.
 - Gearlever makes appimages less annoying a bit
 - Syncthing-gtk is a GUI for syncthing providing desktop notifications without
   browser.
 - Spread the love of Fedora Kinoite by having Fedora Imagewriter!
 - Eye of GNOME is GNOME picture viewer and if I cannot `eog image.png` I get
   confused
-- Haruna is another Mpv front-end, but this time KDE. It also doesn't read or
+- Elisa is the Fedora Kinoite shipped music player
-  understand mpv.conf at the time of writing, so I ma mor elikely to suggest
-  Celluloid while using mpv directly myself.
 - Kate is my go-to text editor when I want a GUI (otherwise it's the rpm-ostree
   nvim) and if the flatpak didn't exist (and if I wouldn't likely be using nvim
   where flatpaks have no power), I would make it yet another rpm-ostree
   install...
+- Kcalc is calculator
+- Kolourpaint seems to be KDE's response to MS Paint, shipped with Fedora
+  Kinoite
+- Krdc is Fedora Kinoite shipped remote desktop client (VNC, RDP)
 - pavucontrol is the volume manager and needs no introduction especially if one
   looks at it
 - kwrite is the KDE text editor
@@ -352,10 +397,6 @@ sudo flatpak install --assumeyes flathub app.devsuite.Ptyxis com.calibre_ebook.c
   have the capacity to write any image and also restore the USB stick
   afterwards.
 - Tor Browser just must exist everywhere just in case!
-- Firefox is the last major non-Chromium web browser and while installed by
-  default, it may not survive `flatpak uninstall --all`.
-- VLC is a world-famous media player supporting ~everything and the flathub
-  apparently bundles libdvdcss having the capacity to play DVDs.
 
 #### Office
 
@@ -369,6 +410,17 @@ sudo flatpak install --assumeyes flathub org.freedesktop.Sdk.Extension.texlive o
 - LibreOffice is world-famous office suite
 - Voikko is Finnish spellchecking support for it
 
+### Snaps
+
+I heavily prefer flatpaks since they allow multiple simultaneous repositories as
+opposed to Snap tying you into one at a time basically always meaning Canonical.
+Regardless I keep having snapd installed so I can install duplicates of software
+like Signal and run two accounts simultaneously.
+
+```
+sudo snap install tldr
+```
+
 ### Other essential atomic/kinoite/flatpak/gayming reading
 
 - [init-browser-policies.bash](https://codeberg.org/Aminda/shell-things/src/branch/cxefa/etc/init-browser-policies.bash)
@@ -551,6 +603,37 @@ don't forget `/etc/sysctl.d`
 
 - https://codeberg.org/Aminda/shell-things/src/branch/cxefa/etc/systemd/system
 
+### systemd sockets
+
+Starting services on-demand rather than keeping them on all the time. Some of
+these are already on this page, but to recap and have them all in one place:
+
+```bash
+# User services or sockets
+sudo systemctl --global enable foot-server.socket
+# System sockets
+sudo systemctl enable --now ssh.socket sshd.socket avahi-daemon.socket systemd-oomd.socket oidentd.socket
+```
+
+Remember that systemd sockets are silly and listen only to `::` by default and
+since system administrators not-so-uncommonly set that to only mean IPv6 in
+order to avoid dotted-decimals, it may be desirable to have a
+`/etc/systemd/system/socket.d/dualstack-bind.conf` with
+
+```ini
+[Socket]
+BindIPv6Only=both
+```
+
+#### firewalld for systemd sockets
+
+```bash
+sudo firewall-cmd --add-service=ssh --permanent && sudo firewall-cmd --add-service=ssh --permanent --zone=home
+sudo firewall-cmd --add-service=ident --permanent && sudo firewall-cmd --add-service=ident --permanent --zone=home
+sudo firewall-cmd --add-service=mdns --permanent && sudo firewall-cmd --add-service=mdns --permanent --zone=home
+sudo firewall-cmd --reload
+```
+
 ## Remember!
 
 Not quite configuration, but I am not going to start inventing a new place for

n/helen.md

@@ -6,21 +6,21 @@ excerpt:
   Lunttilappu sähkönhintatietosovelluksille paljonko maksan Helenille, sillä
   kaipaan näitä tietoja säännöllisen epäsäännöllisesti jostakin Helenin
   valikoita helpommasta paikasta.
-sitemap: true
+sitemap: false
 robots: noai
 lang: fi
 locale: fi-FI
-date: 2024-09-26
+date: 2025-08-21
 ---
 
 ## Helen pörssisähköhinnasto {{ page.date }}
 
 _{{ page.excerpt }}_
 
-- Perusmaksu: `4.96 €/kk`
+- Perusmaksu: `?.?? €/kk`
-- Marginaali: `0.49 snt/kWh`
+- Marginaali: `?.?? snt/kWh`
-- Siirron perusmaksu: `5.57 €/kk`
+- Siirron perusmaksu: `6.01 €/kk`
-- Siirtomaksu: `4.12 snt/kWh`
+- Siirtomaksu: `4.44 snt/kWh`
 - Sähkövero: `2.83 c/kWh`
 
 Hintatiedot sisältävät ALVn!

package.json

@@ -1,14 +1,14 @@
 {
 	"devDependencies": {
-		"@aminda/global-prettier-config": "2025.26.0",
+		"@aminda/global-prettier-config": "latest",
 		"@prettier/plugin-ruby": "4.0.4",
-		"@prettier/plugin-xml": "3.4.1",
+		"@prettier/plugin-xml": "3.4.2",
 		"corepack": "latest",
 		"prettier": "3.6.2",
 		"prettier-plugin-nginx": "1.0.3",
 		"prettier-plugin-sh": "0.18.0",
-		"prettier-plugin-toml": "2.0.5"
+		"prettier-plugin-toml": "2.0.6"
 	},
-	"packageManager": "pnpm@10.12.4+sha512.5ea8b0deed94ed68691c9bad4c955492705c5eeb8a87ef86bc62c74a26b037b08ff9570f108b2e4dbd1dd1a9186fea925e527f141c648e85af45631074680184",
+	"packageManager": "pnpm@10.18.0+sha512.e804f889f1cecc40d572db084eec3e4881739f8dec69c0ff10d2d1beff9a4e309383ba27b5b750059d7f4c149535b6cd0d2cb1ed3aeb739239a4284a68f40cfa",
 	"prettier": "@aminda/global-prettier-config"
 }

pages/irc/irc.markdown

@@ -1,7 +1,7 @@
 ---
 layout: page
 title: IRC
-navigation: true
+navigation: false
 permalink: /irc/
 excerpt:
   "Where do you find me at IRC and verify that it's me. Also includes my IRC

pages/matrix.markdown

@@ -862,6 +862,9 @@ am just personally unlucky?
    and their [call for volunteers page](https://diasp.in/volunteer) has sunset
    date set for 2024-01-31. As I have been PirateIRC operator since 2017-05-11,
    Diasp.in received a spot in this listing.
+1. 2025-09-02
+   [Matrix.org experienced poor luck with RAID failures](https://www.theregister.com/2025/09/03/matrixorg_raid_failure/)
+   returning about 36 hours later.
 
 #### Why do you use Matrix URI scheme instead of matrix.to?
 

pnpm-lock.yaml

@@ -8,17 +8,17 @@ importers:
   .:
     devDependencies:
       "@aminda/global-prettier-config":
-        specifier: 2025.26.0
+        specifier: latest
-        version: 2025.26.0
+        version: 2025.28.0
       "@prettier/plugin-ruby":
         specifier: 4.0.4
         version: 4.0.4(prettier@3.6.2)
       "@prettier/plugin-xml":
-        specifier: 3.4.1
+        specifier: 3.4.2
-        version: 3.4.1(prettier@3.6.2)
+        version: 3.4.2(prettier@3.6.2)
       corepack:
         specifier: latest
-        version: 0.33.0
+        version: 0.34.0
       prettier:
         specifier: 3.6.2
         version: 3.6.2
@@ -29,14 +29,14 @@ importers:
         specifier: 0.18.0
         version: 0.18.0(prettier@3.6.2)
       prettier-plugin-toml:
-        specifier: 2.0.5
+        specifier: 2.0.6
-        version: 2.0.5(prettier@3.6.2)
+        version: 2.0.6(prettier@3.6.2)
 
 packages:
-  "@aminda/global-prettier-config@2025.26.0":
+  "@aminda/global-prettier-config@2025.28.0":
     resolution:
       {
-        integrity: sha512-Ny0MqK1QGNWRgR1SBbQtoupN0UmK/XYwx4uo12EI8ncEbtH6eyBJzIwes+EtCn/kXu9VzQONqnrryukjbmWOqg==,
+        integrity: sha512-65rmLNrMWMr4NkjiCrBdKAyBQ7GoWTPElXzZQjUIkpBARFJWD4QTVOuffMxfLCuq4x3rmbD0rcyaVWNsUsQIVA==,
       }
 
   "@prettier/plugin-ruby@4.0.4":
@@ -47,10 +47,10 @@ packages:
     peerDependencies:
       prettier: ^3.0.0
 
-  "@prettier/plugin-xml@3.4.1":
+  "@prettier/plugin-xml@3.4.2":
     resolution:
       {
-        integrity: sha512-Uf/6/+9ez6z/IvZErgobZ2G9n1ybxF5BhCd7eMcKqfoWuOzzNUxBipNo3QAP8kRC1VD18TIo84no7LhqtyDcTg==,
+        integrity: sha512-/UyNlHfkuLXG6Ed85KB0WBF283xn2yavR+UtRibBRUcvEJId2DSLdGXwJ/cDa1X++SWDPzq3+GSFniHjkNy7yg==,
       }
     peerDependencies:
       prettier: ^3.0.0
@@ -86,12 +86,12 @@ packages:
         integrity: sha512-wy3mC1x4ye+O+QkEinVJkPf5u2vsrDIYW9G7ZuwFl6v/Yu0LwUuT2POsb+NUWApebyxfkQq6+yDfRExbnI5rcw==,
       }
 
-  corepack@0.33.0:
+  corepack@0.34.0:
     resolution:
       {
-        integrity: sha512-XSX4BNjdwPXjUEk7/2r0vFhs1irwVncJRMyjzDel3PVKWnHQXehciX0WkvDrd1ujLLFJRe8FeZb9ASCqBtF/OA==,
+        integrity: sha512-8D9N/k9hDjoISCDGUzH2wBF0fJD49p3G7ifoEZcc0vhB7Py6r+Mc1SpJ8dvnWY/HMP95K60WkQbN7vgbUgXgpA==,
       }
-    engines: { node: ^18.17.1 || ^20.10.0 || >=22.11.0 }
+    engines: { node: ^20.10.0 || ^22.11.0 || >=24.0.0 }
     hasBin: true
 
   prettier-plugin-nginx@1.0.3:
@@ -109,10 +109,10 @@ packages:
     peerDependencies:
       prettier: ^3.6.0
 
-  prettier-plugin-toml@2.0.5:
+  prettier-plugin-toml@2.0.6:
     resolution:
       {
-        integrity: sha512-WjXXKQyY4TdXWHU1v73UJxK/oDLSppf+b9KrSVl2kC4ZOr9CIVPKTQ/JxttgbYMaH8r3ihw7WYhMpI1EFa1obg==,
+        integrity: sha512-12N/wBuHa9jd/KVy9pRP20NMKxQfQLMseQCt66lIbLaPLItvGUcSIryE1eZZMJ7loSws6Ig3M2Elc2EreNh76w==,
       }
     engines: { node: ">=16.0.0" }
     peerDependencies:
@@ -146,21 +146,21 @@ packages:
       }
 
 snapshots:
-  "@aminda/global-prettier-config@2025.26.0":
+  "@aminda/global-prettier-config@2025.28.0":
     dependencies:
       "@prettier/plugin-ruby": 4.0.4(prettier@3.6.2)
-      "@prettier/plugin-xml": 3.4.1(prettier@3.6.2)
+      "@prettier/plugin-xml": 3.4.2(prettier@3.6.2)
-      corepack: 0.33.0
+      corepack: 0.34.0
       prettier: 3.6.2
       prettier-plugin-nginx: 1.0.3
       prettier-plugin-sh: 0.18.0(prettier@3.6.2)
-      prettier-plugin-toml: 2.0.5(prettier@3.6.2)
+      prettier-plugin-toml: 2.0.6(prettier@3.6.2)
 
   "@prettier/plugin-ruby@4.0.4(prettier@3.6.2)":
     dependencies:
       prettier: 3.6.2
 
-  "@prettier/plugin-xml@3.4.1(prettier@3.6.2)":
+  "@prettier/plugin-xml@3.4.2(prettier@3.6.2)":
     dependencies:
       "@xml-tools/parser": 1.0.11
       prettier: 3.6.2
@@ -181,7 +181,7 @@ snapshots:
     dependencies:
       regexp-to-ast: 0.5.0
 
-  corepack@0.33.0: {}
+  corepack@0.34.0: {}
 
   prettier-plugin-nginx@1.0.3: {}
 
@@ -191,7 +191,7 @@ snapshots:
       prettier: 3.6.2
       sh-syntax: 0.5.8
 
-  prettier-plugin-toml@2.0.5(prettier@3.6.2):
+  prettier-plugin-toml@2.0.6(prettier@3.6.2):
     dependencies:
       "@taplo/lib": 0.5.0
       prettier: 3.6.2

r/helsinkivantaa.md

@@ -0,0 +1,5 @@
+---
+redirect_to: https://yle.fi/tekstitv/txt/426_0001.htm
+permalink: /r/helsinkivantaa.html
+sitemap: false
+---

r/katarina.md

@@ -1,5 +1,5 @@
 ---
-redirect_to: https://www.foodora.fi/restaurant/v5sb/autogrilli
+redirect_to: https://www.katariinaautogrilli.fi/ruokalista
 permalink: /r/katarina.html
 sitemap: false
 ---

r/vaaratiedote.md

@@ -1,5 +1,5 @@
 ---
-redirect_to: https://yle.fi/aihe/tekstitv?P=866
+redirect_to: https://yle.fi/tekstitv/txt/866_0001.htm
 permalink: /r/vaaratiedote.html
 sitemap: false
 ---

txt/obtainium2.txt

@@ -19,6 +19,7 @@ https://github.com/cliambrown/EasyNoise
 https://github.com/c-lis/morelocale
 https://github.com/cvzi/darkmodewallpaper
 https://github.com/d4rken-org/permission-pilot
+https://github.com/davidventura/firefox-translator
 https://github.com/element-hq/element-android
 https://github.com/element-hq/element-x-android
 https://github.com/F0x1d/LogFox
@@ -51,6 +52,7 @@ https://github.com/laurent22/joplin-android
 https://github.com/LibreShift/red-moon
 https://github.com/ligi/SurvivalManual
 https://github.com/ljmc2000/NoiseLooper
+https://github.com/localsend/localsend/
 https://github.com/markusfisch/BinaryEye
 https://github.com/mastodon/mastodon-android
 https://github.com/michaeltroger/greenpass-android
@@ -91,6 +93,7 @@ https://github.com/UnifiedPush/fcm-distributor
 https://github.com/UP-NextPush/android
 https://github.com/yolosec/routerkeygenAndroid
 https://github.com/Zverik/every_door
+https://gitlab.com/Atharok/BtRemote
 https://gitlab.com/AuroraOSS/AuroraStore
 https://gitlab.com/axet/android-hourly-reminder
 https://gitlab.com/guardianproject/proofmode/proofmode-android