Git and .gitignore

I posted a few days ago that I'd deployed Gitea (a git server).

I basically pushed my /opt/stacks directory to Gitea.

Well, I'm now finding that I pushed non-IaC files to my repos, and I'm only supposed to push IaC files (e.g., compose.yml files or any config files that I normally create/manipulate).  I discovered that many files were either plugins or gz files, for example...neither of those are IaC filetypes.  

Additionally, I realized that I should not push .env files (or any files that contain secrets/passwords) to Git.

I was not aware that I could filter out files/directories, nor was I aware of .gitignore until I researched how to exclude files.  

I also created .gitignore files within each stack, which, later on, I found wasn't optimal.  Instead of having a separate ignore file for each stack (e.g., /opt/stacks/wordpress and /opt/stacks/dockge), the more efficient method would be to place the ignore file at /opt/stacks, so I ended up redoing all of my repos.

A .gitignore file is just a hidden file to exclude files from being pushed to Gitea (or whatever Git solution you're using).

For example, my .gitignore contents on my hosted public server is:

# --- General Backups, Archives & Logs ---

*.tar.gz

*.gz

*.zip

*.bak

*.bak.*

*.old

*.10*

*.log

# --- App Data & Databases ---

**/data/

**/portainer-data/

pihole/etc-pihole/

pihole-old/etc-pihole/

# --- WordPress Core, Backups & Bloat ---

wordpress/wp-admin/

wordpress/wp-includes/

wordpress/*.php

!wordpress/wp-config-sample.php

!wordpress/.htaccess

!wordpress/index.php

wordpress/*.txt

wordpress/*.html

# --- WordPress Content / Plugins / Backups / Logs ---

wordpress/wp-content/uploads/

wordpress/wp-content/cache/

wordpress/wp-content/upgrade/

wordpress/wp-content/plugins/

wordpress/wp-content/themes/

wordpress/wp-content/bps-backup/

wordpress/wp-content/updraft/

wordpress/wp-content/wflogs/

wordpress/wp-content/wpo-cache/

# --- System & Temp Files ---

.DS_Store

.env

As I learn Git, I find that it can be very satisfying to track/truth my IaC files.

I've not yet used Git at work, although I've an account - I typically do not use IaC content for the work I'm currently doing, but I'm sure I'll eventually use IaC content to streamline my work.  The main concern for me is to learn best practices for IaC and Git.  I'm just hoping I'm not teaching myself bad habits now, to have to correct myself later on - definitely don't want mistakes to happen at work, either, which is why I'm practicing at home.

If Your're Using PHP On An Exposed Host, Beware!

If you're running Wordpress or ANYTHING that uses PHP, there are two critical vulnerabilities with exploits in the wild right now.

You should ensure that you're not using anything outside of what's recommended in the PHP advisory I mentioned above.  New (fixed) versions of PHP were released today, so those can be applied as fixes.

In my case, I'm running a containerized Wordpress.  I waited all day for the Docker images to be released that fixes the issues.  I'm using Alpine images and thought that I could just install Alpine PHP packages, but the Docker images were available before the new Alpine PHP packages were released.  My site is repaired of those two particular vulnerabilities.

We'll see how many websites get compromised over the next few months because folks ignored the warnings.

I've Backed Up My OneNote Notes to Markdown!

I wanted to try to back up my OneNote notebooks, as I've been using it a long while now.  Even though I'm using it with Microsoft's OneDrive (cloud-based), I feel that it's always good to have backups.

The plan was to back up the files to Markdown format and then store them in my private Gitea (Git) server.

It took a bit to understand what I needed to do.

I used Obsidian to synch up with OneNote to import the notebooks and then convert them to Markdown format.  There were close to 400 pages between 4 notebooks.  It took a few minutes for Obsidian to do it's thing but it ALMOST finished.  OneNote started rate-limiting Obsidian at the 90% completion mark.  I stopped the import process and waited 15 minutes before trying again.  

There's a feature that you can enable that skips files that have already been processed, so it basically started at the 90% mark and fininshed.  This means that I can continue to document in OneNote and periodically back up the files, where only the new notes and images are backed up.  Obsidian is pretty nice - it has allowances for a bunch of other file types and can import/backup other software files, as well.

I Now Have A Functional (and Private) Git Server

I've been struggling with wrapping my head around Git the past 4-5 years.  It sounds silly, yeah, but I'm old school.  

I started my first position in the IT Security field in 2003.  There was no such thing as Infrastructure as Code (IaC).  The first time I remember hearing of IaC was in 2017.  Note that I didn't enter the sub-field of security engineering in a dedicated fashion up until 2017.  In my prior positions, I didn't need to be familiar with such information.

I didn't even start being involved with Docker up until 5 years ago.  I was initially pushed to it by work - my supervisor wanted each team to be familiar with it, so I tool an ACloudGuru course.  I didn't use it at work after finishing the course (and the course didn't cover Git), either, but I got some ideas on how to use it at home (in the home lab).  

I wanted to use Docker containers to replace a lot of my old computers within my lab, but actually ended up using it to install Wordpress on a Docker instance, hoping to replace my Wodrpress website with a dockerized instance.  I intially set up Wordpress on my LAN as a container stack.  When I saw how easy it was to set up, and after I tested and ran it maybe 6 months on my LAN, I replaced the server instance with a docker instance on the hosted server (Linode).  It was super easy and I think it runs more efficiently.  I just restored a good known backup onto the Dockerized Wordpress.

At this point, I've tested several containerized Wordpress setups, seeking greater efficiency, so there were tons of compose files that I wasn't tracking because I kept avoiding Git (and couldn't even understand it).

Only tonight, after speaking with a coworker about it, after gaining understanding of it when researching it (and Terraform usage), and after asking Gemini AI questions, I was able to give it a shot.

For Git, I'm using a Gitea as a container.  I used Gemini to ask questions on how to set up a private Git that I could keep track of all my code (across 3 different Docker host systems, on the LAN and from a public server, as well).

For each Docker host, I've created a repo to track that host's Docker code.  It took a long while to understand that I had to push the IaC files to the Gitea server.  I initially didn't even have an idea of how to map out the repos.  I was a total mess.

Now that I've the repos set up, I do not want to have to set it all up again, but if I had to, it would probably go a lot quicker in setting things up.  I'd love to be able to back up the repos to my NAS (if that's even possible).

The next steps will be to pull repo files, edit them, and merge them, or to use it to create new repos (with new files, instead of just pushing large batches of old code to a GIT UI).

Jeep Wrangler Modification

I'm a car guy.  I'm usually into sports cars and motorcycles.  As this blog is named "All Things Tech", this post fits.

I bought a 2018 Jeep Wrangler Sport S in the fall of 2018, trading in my 2011 Subaru WRX STI sedan.  Before then, I had a 2001 Jeep Wrangler Sport, and bought it used, but it had very bad frame rot, so I had to get rid of it.  I still wanted a Wrangler, so I bought a new one.

It was basically unmodified up until last year (other than a roof rack and side steps).  Last year, I needed new tires and I decided to have larger tires installed.  No, I didn't have it lifted.  I installed the largest tires that wouldn't rub against the undercarriage and/or suspension.  I installed Toyo Open Country AT IIIs (C load) in 285/75/17, which is basically Rubicon size but with a wider footprint.

Those larger sized tires will throw off the speedometer (was aware of that before I bought them).  It took me a year to get around to correcting the speedometer.

I bought a vLinker MC+, which is a bluetooth-enabled OBD II reader.  The reader is designed for use with the Jeep Wrangler.  I also installed Jscan on my iPhone, which is an OBD II tuner - I had to buy a user license to use it, but it was maybe $30.

I also had to by a set of $20 security bypass cables, as the Jeep has an integral firewall.  The cables bypass the firewall.

I used Jscan to reconfigure the tire size within the ECU.

I took a long trip to NC last weekend and found that the speedometer was spot on - I used Waze (car nav software) to determine my true speed and compared it to the speedometer's measurement...it was spot-on at all speeds.

I shouldn't have waited a full year to do this, but as I get older (I'm almost 60 now), I've less patience with car things, which is why I got the Jeep in the first place - the STI ended up being too much work for me...I'll always love STIs but mine was modded and you can't fire and forget with Subarus (you can, but it will eventually catch you out).

Testing Out Dockge

I've decided to give Dockge a test run.

I installed it on the Rasberry Pi 500+ (as I also did with Arcane).  It's simplistic.  Sometimes I think Portainer is a bit too busy.  Arcane is less so, and Dockge is lesser so.

One thing I like about Dockge is that it is also designed to work as an agent.  I wanted to also manage the containers that I'm hosting on a non-Pi device (there are mabye 7-8 containers on that host).  I installed Dockge on that machine and then pointed the Pi Dockge console to it - it now shows containers that reside on two hosts!

Dockge was also created by the Uptime Kuma developer, as well, which is another great tool for a home lab.

Portainer Alternatives?

I've been using Portainer for a while now.  I'm not using it as efficiently as I should, but that's a discussion for another day.

I wanted to explore other alternatives to Portainer and landed on Arcane.

I had serious issues getting Arcane set up as a Docker instance, but there's an alternative method - I ran the following command:

curl -fsSL https://getarcane.app/install.sh | sudo bash

No, this does not leverage Docker, but I was frustrated in getting Arcane to run within a container.  I'll double back to get that working later.

What I like is that Arcane detects all the pre-existing containers.  I didn't have to set anything up.

One thing I've noticed is that, when I restarted a Wordpress container, Arcane froze and wouldn't let me back in.  As I was going to restart the Arcane service, it came back up.  Arcane is running on a Pi 500, but it is pretty robust as far as Pis go.

Another thing - I'm unable to see the containers' compose files from the Arcane console.  Maybe I'm not looking in the correct areas of the console.  This is something to research.

The very cool thing is that Arcane has security findings if you enable container security scanning!  I think it's using the Trivy scanner.  As well, if you click on a discovered CVE, it points directly to the NIST CVE entry.

I'll also be testing Dockge, Dokploy, Coolify, and Dockhand, as well.  I'll share my thoughts as I test.

Uptime Kuma Has No Built-In Backup Strategy!

I've been using Uptime Kuma to monitor my LAN and external systems.

I'd noticed that Uptime Kuma had an update.  I was hesistant to apply the update because I might lose my configuration data, but tried it anyways.  Yeah, I lost everything.

I'd looked into the settings to see if there was a backup strategy but didn't see anything.

I used AI to determine if there was an alternative backup solution.  The AI stated that the Uptime Kuma (UK) developer had issues with a configuration backup solution and had reverted what existed.

I asked it to give me a script to use as a backup solution.  Based on the Docker compose file that I'm using (which I provided to the AI), it presented me this:

#!/bin/bash

# --- CONFIGURATION ---

CONTAINER_NAME="uptime-kuma"

#SOURCE_DIR="/app/data" # Or your specific host path found in Step 1

SOURCE_DIR="/data/compose/28/uptime-kuma-data"

BACKUP_DIR="/opt/stacks/backups/uptime-kuma"

TIMESTAMP=$(date +"%Y%m%d_%H%M%S")

BACKUP_NAME="kuma_backup_$TIMESTAMP.tar.gz"

RETENTION_DAYS=30

# ---------------------

# Ensure backup directory exists

mkdir -p "$BACKUP_DIR"

echo "Starting Uptime Kuma backup..."

# 1. Stop the container to freeze the SQLite DB safely

docker stop "$CONTAINER_NAME"

# 2. Compress the data directory

tar -czf "$BACKUP_DIR/$BACKUP_NAME" -C "$(dirname "$SOURCE_DIR")" "$(basename "$SOURCE_DIR")"

# 3. Restart the container immediately

docker start "$CONTAINER_NAME"

# 4. Clean up backups older than X days

find "$BACKUP_DIR" -type f -name "kuma_backup_*.tar.gz" -mtime +$RETENTION_DAYS -exec rm {} \;

echo "Backup completed successfully: $BACKUP_DIR/$BACKUP_NAME"

I tested it several times.  There was an issue with the source directory values, which I sorted.  Once I sorted that, the script worked.

I then created a cron job for the script:

# Backup of Uptime-Kuma

0 2 * * 1 /usr/local/bin/backup-kuma.sh > /dev/null 2>&1

One cool option is that I can set the retention days for the backup data.  Anything older than 30 days, for example, gets removed.  That value can also be changed (it was initially set to backup on a daily basis).

I also asked the AI to present restoration steps, which it did.  I documented that for later use.  I will ask it, later, to create a script of the restoration steps.

That is my backup solution.

The backup solution is mainly so that I do not have to recreate the UK monitors if I lose them during an upgrade of Uptime Kuma.