Andrew Wippler's Sketchpad - Web

feeling super productive

2025-09-12T15:55:56.778969+00:00

Since August, I have been updating my digital life, which began with organizing my digital collection of books. I had never truly looked too indepth at Calibre before August 2025, but I am clearly blown away at its capabilities. I feel a bit awkward keeping the library on my desktop computer, but I have a script to periodically backup my home folder to my NAS. Today I finished organizing them in Calibre. I have discovered that I have 458 digital books - I have read 131, and have 135 on my reading list. The remainder are my wife's digital collection and reference material.

I read books for information. Sometimes the information is good, so I highlight it for later consumption. I have build SpeakerWindows</a> as a means to organize those highlights and other thoughts for later use. This past month, I created two importers - readwise and play books. Readwise gathered my highlights from the Amazon's kindle, while Google Play Books sync their highlights in Google Drive. The end result was over 5,000 highlights that needed to be sorted.

At first, I updated 5 a day through a prompts to ChatGPT, but that process was slow. So, I built a script that asked a local LLM to categorize the content of my notes and thoughts. It took about 2 hours to churn through those notes and create relavant tags for all of them. In the end, I am very happy with the results.

I am now motivated to read books as fast as I can in Google Play Books, export them to Google Drive, and import them to SpeakerWindows.

Additional insight into collaborative editors

2025-09-10T06:13:21.365082+00:00

I think I had it all wrong when I accused OnlyOffice of sending data to the Russian goverment. This architectural design is called WOPI and was created for web applications that want to integrate with Microsoft Office. That means the architecture was really designed for the CIA to intercept a target's documents saved to Office 365.1</a> I think good targets would asummably be those people who were subscribed to or read</a> a certain magazine in the early 2010's</a>.

As a software design spec, WOPI appears to be robost for online collaborations, but when configured incorrectly, it can become an easy target for interception. I do not have that warm, fuzzy feeling that Russia does not have a backdoor to OnlyOffice, China does not have a backdoor to WPS Office, and the US government does not have a backdoor to Office 365 - so I think I will stay away from those implementations.2</a> Although, as a US Citizen, I know that there is a due process of law before any sort of surveillance can occur. A judge has to be convinced that there is ample evidence of wrongdoing before any sort of warrant will be granted for surveillance. The other two countries do not seem to afford that legal roadblock.

A fourth option of the WOPI protocol is Collabora, which is the original web implementation of LibreOffice. This appeals to me as an alternative to my current OnlyOffice setup. Collabora has great docs</a> and even an example low-footprint WOPI server</a>. This will be better than my Vibe coded OnlyOffice middleware server</a>.

This is a totally sarcastic statement, but has a vague realism to it. ↩</a> </li>
I stay away from Mircrosoft products for other reasons too. Mainly, they are jumbled pieces of software designed for their largest US consumers, who have no idea what they want in a product</a>. ↩</a> </li> </ol> </section>

Only Office for personal use

2025-09-08T07:18:03.408003+00:00

Vibe coding is supposedly going to replace actual programmers. I can’t wait for it to go away. Robots have a terrible way of doing things, and they are not very good at writing code. That, however, has not kept me from regularly dabbling with ChatGPT and code generation.

Programming is my hobby - not my livelihood. So when it comes to solving an personal issue with code, ChatGPT appeals to me. I am too busy in life to spend hours catching myself up from recent advancements in technology in order to find the right framework, read the docs, and use that knowledge to write good, secure code.

I am still not convinced that ChatGPT is smart enough to replace anything of value. In my haste of finding an alternative to Google Docs, I asked ChatGPT to help me code a simple middleware to load OnlyOffice behind authentication.1</a> OnlyOffice required a JSON Web Token, but their docs were very vague - a vice of all companies that want free fixes from Open Source Software enthusiasts, yet also want money.

What was supposed to be a simple task ended up to be a conversaion where ChatGPT said, "Ah, OnlyOffice does x,y,z, but I wrote a,b,c instead. Here, let me fix that for you." When that did not work, ChatGPT would say, "Ah, let's try this instead." To save others from having to spend hours repeating the conversation I had with a robot to generate boilerplate code, let me provide you with the end result.

To host and OnlyOffice locally, you need middleware that signs a JSON Web Token, and passes it to OnlyOffice's Document Server for identification. This Document server stores your text and sends it to Vladimir Putin and the Kremlin</del> your storage server after you close your browser window. If anyone wants ~~to send their important documents to dubious destinations</del> to self host OnlyOffice, you may find help with this generated code:~~

Middleware Server</h2>

require</span></span>(</span>"</span>dotenv"</span></span>)</span>.</span>config</span></span>(</span>)</span>;</span>
</span>const</span> express</span></span> </span>=</span> require</span></span>(</span>"</span>express"</span></span>)</span></span>;</span>
</span>const</span> axios</span></span> </span>=</span> require</span></span>(</span>"</span>axios"</span></span>)</span></span>;</span>
</span>const</span> jwt</span></span> </span>=</span> require</span></span>(</span>"</span>jsonwebtoken"</span></span>)</span></span>;</span>
</span>const</span> qs</span></span> </span>=</span> require</span></span>(</span>"</span>querystring"</span></span>)</span></span>;</span>
</span>const</span> fs</span></span> </span>=</span> require</span></span>(</span>"</span>fs"</span></span>)</span></span>;</span>
</span>const</span> path</span></span> </span>=</span> require</span></span>(</span>"</span>path"</span></span>)</span></span>;</span>
</span>const</span> session</span></span> </span>=</span> require</span></span>(</span>"</span>express-session"</span></span>)</span></span>;</span>
</span>const</span> officegen</span></span> </span>=</span> require</span></span>(</span>"</span>officegen"</span></span>)</span></span>;</span>
</span>
</span>const</span> app</span></span> </span>=</span> express</span></span>(</span>)</span></span>;</span>
</span>const</span> port</span></span> </span>=</span> process</span>.</span>env</span>.</span>PORT</span> ||</span> 3000</span></span>;</span>
</span>
</span>const</span> {</span>
</span></span></span>  DEX_ISSUER</span></span>,</span>
</span></span></span>  CLIENT_ID</span></span>,</span>
</span></span></span>  CLIENT_SECRET</span></span>,</span>
</span></span></span>  JWT_SECRET</span></span>,</span>
</span></span></span>  DOCUMENTSERVER_URL</span></span>,</span>
</span></span></span>  MIDDLEWARE_SERVER</span></span>,</span>
</span></span></span>  NODE_ENV</span></span>
</span></span></span>}</span> </span>=</span> process</span>.</span>env</span></span>;</span>
</span>
</span>if</span> (</span>!</span>DEX_ISSUER</span> ||</span> !</span>CLIENT_ID</span> ||</span> !</span>CLIENT_SECRET</span> ||</span> !</span>JWT_SECRET</span> ||</span> !</span>DOCUMENTSERVER_URL</span> ||</span> !</span>MIDDLEWARE_SERVER</span>)</span> {</span>
</span></span>  console</span>.</span>error</span></span>(</span>"</span>Missing required env vars. Please set DEX_ISSUER, CLIENT_ID, CLIENT_SECRET, JWT_SECRET, DOCUMENTSERVER_URL, MIDDLEWARE_SERVER"</span></span>)</span>;</span>
</span></span>  process</span>.</span>exit</span></span>(</span>1</span>)</span>;</span>
</span></span>}</span></span>
</span>
</span>if</span> (</span>NODE_ENV</span> ===</span> "</span>production"</span></span>)</span> {</span>
</span></span>  app</span>.</span>set</span></span>(</span>"</span>trust proxy"</span></span>,</span> 1</span>)</span>;</span>
</span></span>}</span></span>
</span>
</span>//</span></span> Body parsers</span>
</span>app</span>.</span>use</span></span>(</span>express</span>.</span>json</span></span>(</span>)</span>)</span>;</span>
</span>app</span>.</span>use</span></span>(</span>express</span>.</span>urlencoded</span></span>(</span>{</span> extended</span></span>:</span></span> true</span> </span>}</span></span>)</span>)</span>;</span>
</span>
</span>//</span></span> Session</span>
</span>app</span>.</span>use</span></span>(</span>session</span></span>(</span>{</span>
</span></span>  secret</span></span>:</span></span> JWT_SECRET</span></span>,</span>
</span></span>  resave</span></span>:</span></span> false</span></span>,</span>
</span></span>  saveUninitialized</span></span>:</span></span> false</span></span>,</span>
</span></span>  cookie</span></span>:</span></span> {</span>
</span></span></span></span>    secure</span></span>:</span></span> NODE_ENV</span> ===</span> "</span>production"</span></span></span>,</span>
</span></span></span></span>    httpOnly</span></span>:</span></span> true</span></span>,</span>
</span></span></span></span>    sameSite</span></span>:</span></span> "</span>lax"</span></span>
</span></span></span></span></span>  </span>}</span></span>
</span></span></span></span>}</span></span>)</span>)</span>;</span>
</span>
</span>//</span></span> Files directory</span>
</span>const</span> FILES_DIR</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>__dirname</span>,</span> "</span>files"</span></span>)</span></span>;</span>
</span>if</span> (</span>!</span>fs</span>.</span>existsSync</span></span>(</span>FILES_DIR</span>)</span>)</span> fs</span>.</span>mkdirSync</span></span>(</span>FILES_DIR</span>,</span> {</span> recursive</span></span>:</span></span> true</span> </span>}</span></span>)</span>;</span>
</span>
</span>//</span></span> Utility: create empty docx</span>
</span>function</span> createEmptyDocx</span></span>(</span>filePath</span>)</span></span> {</span>
</span></span></span>  return</span> new</span> Promise</span>(</span>(</span>resolve</span>,</span> reject</span>)</span></span> </span>=></span> {</span>
</span></span></span></span></span></span>    const</span> docx</span></span> </span>=</span> officegen</span></span>(</span>"</span>docx"</span></span>)</span></span>;</span>
</span></span></span></span></span></span>    const</span> out</span></span> </span>=</span> fs</span>.</span>createWriteStream</span></span>(</span>filePath</span>)</span></span>;</span>
</span></span></span></span></span></span>
</span></span></span></span></span></span>    out</span>.</span>on</span></span>(</span>"</span>error"</span></span>,</span> err</span> </span>=></span> </span>reject</span></span>(</span>err</span>)</span>)</span>;</span>
</span></span></span></span></span></span>    docx</span>.</span>on</span></span>(</span>"</span>error"</span></span>,</span> err</span> </span>=></span> </span>reject</span></span>(</span>err</span>)</span>)</span>;</span>
</span></span></span></span></span></span>    out</span>.</span>on</span></span>(</span>"</span>close"</span></span>,</span> (</span>)</span></span> </span>=></span> </span>resolve</span></span>(</span>filePath</span>)</span>)</span>;</span>
</span></span></span></span></span></span>
</span></span></span></span></span></span>    docx</span>.</span>generate</span></span>(</span>out</span>)</span>;</span>
</span></span></span></span></span></span>  }</span></span></span>)</span></span>;</span>
</span></span></span>}</span></span></span>
</span>
</span>//</span></span> Middleware: login required</span>
</span>function</span> requireLogin</span></span>(</span>req</span>,</span> res</span>,</span> next</span>)</span></span> {</span>
</span></span></span>  if</span> (</span>!</span>req</span>.</span>session</span>.</span>user</span>)</span> {</span>
</span></span></span></span>    req</span>.</span>session</span>.</span>redirectAfterLogin</span> =</span> req</span>.</span>originalUrl</span>;</span>
</span></span></span></span>    return</span> res</span>.</span>redirect</span></span>(</span>"</span>/login"</span></span>)</span>;</span>
</span></span></span></span>  }</span></span>
</span></span></span>  next</span></span>(</span>)</span>;</span>
</span></span></span>}</span></span></span>
</span>
</span>/*</span> ---------------- Routes ---------------- */</span></span>
</span>
</span>//</span></span> Root</span>
</span>
</span>//</span></span> Dashboard</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/"</span></span>,</span> requireLogin</span>,</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  const</span> user</span></span> </span>=</span> req</span>.</span>session</span>.</span>user</span></span>;</span>
</span></span></span>  const</span> files</span></span> </span>=</span> fs</span>.</span>readdirSync</span></span>(</span>FILES_DIR</span>)</span>.</span>filter</span></span>(</span>f</span> </span>=></span> </span>f</span>.</span>endsWith</span></span>(</span>"</span>.docx"</span></span>)</span>)</span></span>;</span>
</span></span></span>
</span></span></span>  const</span> fileLinks</span></span> </span>=</span> files</span>.</span>length</span> ?</span> files</span>.</span>map</span></span>(</span>f</span> </span>=></span> </span>`</span><li><a href="/edit/${</span></span>encodeURIComponent</span></span>(</span>f</span>)</span></span>}</span></span>">${</span></span>f</span></span>}</span></span></a></li>`</span></span>)</span>.</span>join</span></span>(</span>"</span>"</span></span>)</span> :</span> "</span><li>No documents yet</li>"</span></span></span>;</span>
</span></span></span>
</span></span></span>
</span></span></span>  res</span>.</span>send</span></span>(</span>`</span>
</span></span></span></span>    <!DOCTYPE html>
</span></span></span></span>    <html>
</span></span></span></span>    <head><title>Dashboard</title>
</span></span></span></span>      <style>
</span></span></span></span>    body {
</span></span></span></span>      font-family: "Segoe UI", Tahoma, Geneva, Verdana, sans-serif;
</span></span></span></span>      margin: 0;
</span></span></span></span>      padding: 20px;
</span></span></span></span>      background: #f7f8fa;
</span></span></span></span>      color: #333;
</span></span></span></span>    }
</span></span></span></span>    h1, h2 {
</span></span></span></span>      color: #222;
</span></span></span></span>    }
</span></span></span></span>    ul {
</span></span></span></span>      list-style-type: none;
</span></span></span></span>      padding-left: 0;
</span></span></span></span>    }
</span></span></span></span>    li {
</span></span></span></span>      margin-bottom: 8px;
</span></span></span></span>    }
</span></span></span></span>    a {
</span></span></span></span>      text-decoration: none;
</span></span></span></span>      color: #0078d4;
</span></span></span></span>    }
</span></span></span></span>    a:hover {
</span></span></span></span>      text-decoration: underline;
</span></span></span></span>    }
</span></span></span></span>    form {
</span></span></span></span>      margin-bottom: 20px;
</span></span></span></span>      background: #fff;
</span></span></span></span>      padding: 15px;
</span></span></span></span>      border-radius: 8px;
</span></span></span></span>      box-shadow: 0 2px 6px rgba(0,0,0,0.1);
</span></span></span></span>    }
</span></span></span></span>    input[type="text"] {
</span></span></span></span>      padding: 6px 10px;
</span></span></span></span>      width: 250px;
</span></span></span></span>      border-radius: 4px;
</span></span></span></span>      border: 1px solid #ccc;
</span></span></span></span>    }
</span></span></span></span>    button {
</span></span></span></span>      padding: 6px 12px;
</span></span></span></span>      background-color: #0078d4;
</span></span></span></span>      color: #fff;
</span></span></span></span>      border: none;
</span></span></span></span>      border-radius: 4px;
</span></span></span></span>      cursor: pointer;
</span></span></span></span>    }
</span></span></span></span>    button:hover {
</span></span></span></span>      background-color: #005a9e;
</span></span></span></span>    }
</span></span></span></span>    .topbar {
</span></span></span></span>      margin-bottom: 20px;
</span></span></span></span>      font-size: 0.9rem;
</span></span></span></span>    }
</span></span></span></span>    .topbar a {
</span></span></span></span>      margin-left: 10px;
</span></span></span></span>    }
</span></span></span></span>  </style>
</span></span></span></span>    </head>
</span></span></span></span>    <body>
</span></span></span></span>      <h1>Welcome, ${</span></span>user</span>.</span>name</span></span>}</span></span></h1>
</span></span></span></span>
</span></span></span></span>      <h2>Your Documents</h2>
</span></span></span></span>      <ul>${</span></span>fileLinks</span></span>}</span></span></ul>
</span></span></span></span>
</span></span></span></span>      <h2>Create New Document</h2>
</span></span></span></span>      <form action="/create" method="post">
</span></span></span></span>        <input type="text" name="filename" placeholder="Document name" required>
</span></span></span></span>        <button type="submit">Create</button>
</span></span></span></span>      </form>
</span></span></span></span>
</span></span></span></span>      <h2>Rename Document</h2>
</span></span></span></span>      <form action="/rename" method="post">
</span></span></span></span>        <select name="oldName">
</span></span></span></span>          ${</span></span>files</span>.</span>map</span></span>(</span>f</span> </span>=></span> </span>`</span><option value="${</span></span>f</span></span>}</span></span>">${</span></span>f</span></span>}</span></span></option>`</span></span>)</span>.</span>join</span></span>(</span>"</span>"</span></span>)</span></span>}</span></span>
</span></span></span></span>        </select>
</span></span></span></span>        <input type="text" name="newName" placeholder="New name" required>
</span></span></span></span>        <button type="submit">Rename</button>
</span></span></span></span>      </form>
</span></span></span></span>
</span></span></span></span>      <p><a href="/logout">Logout</a></p>
</span></span></span></span>    </body>
</span></span></span></span>    </html>
</span></span></span></span>  `</span></span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Create new document</span>
</span>app</span>.</span>post</span></span>(</span>"</span>/create"</span></span>,</span> requireLogin</span>,</span> async</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  let</span> {</span> filename</span></span> }</span> </span>=</span> req</span>.</span>body</span></span>;</span>
</span></span></span>  filename</span> =</span> filename</span>.</span>replace</span></span>(</span>/</span>[</span>\/</span>\\</span>?%*:|"<>]</span></span>/</span>g</span></span>,</span> '</span>'</span></span>)</span>.</span>replace</span></span>(</span>/</span>[</span> ]</span></span>/</span>g</span></span>,</span> '</span>-'</span></span>)</span> +</span> "</span>.docx"</span></span>;</span>
</span></span></span>  const</span> filePath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> filename</span>)</span></span>;</span>
</span></span></span>
</span></span></span>  if</span> (</span>fs</span>.</span>existsSync</span></span>(</span>filePath</span>)</span>)</span> return</span> res</span>.</span>send</span></span>(</span>"</span>File exists. <a href='/'>Back</a>"</span></span>)</span>;</span>
</span></span></span>
</span></span></span>  try</span> {</span>
</span></span></span></span>    await</span> createEmptyDocx</span></span>(</span>filePath</span>)</span>;</span>
</span></span></span></span>    res</span>.</span>redirect</span></span>(</span>`</span>/edit/${</span></span>encodeURIComponent</span></span>(</span>filename</span>)</span></span>}</span></span>`</span></span>)</span>;</span>
</span></span></span></span>  }</span></span> catch</span> (</span>err</span>)</span> {</span>
</span></span></span></span>    console</span>.</span>error</span></span>(</span>err</span>)</span>;</span>
</span></span></span></span>    res</span>.</span>send</span></span>(</span>"</span>Error creating file. <a href='/'>Back</a>"</span></span>)</span>;</span>
</span></span></span></span>  }</span></span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Rename document</span>
</span>app</span>.</span>post</span></span>(</span>"</span>/rename"</span></span>,</span> requireLogin</span>,</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  let</span> {</span> oldName</span></span>,</span> newName</span></span> }</span> </span>=</span> req</span>.</span>body</span></span>;</span>
</span></span></span>  newName</span> =</span> newName</span>.</span>replace</span></span>(</span>/</span>[</span>\/</span>\\</span>?%*:|"<>]</span></span>/</span>g</span></span>,</span> '</span>'</span></span>)</span>.</span>replace</span></span>(</span>/</span>[</span> ]</span></span>/</span>g</span></span>,</span> '</span>-'</span></span>)</span> +</span> "</span>.docx"</span></span>;</span>
</span></span></span>
</span></span></span>  const</span> oldPath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> oldName</span>)</span></span>;</span>
</span></span></span>  const</span> newPath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> newName</span>)</span></span>;</span>
</span></span></span>
</span></span></span>  if</span> (</span>!</span>fs</span>.</span>existsSync</span></span>(</span>oldPath</span>)</span>)</span> return</span> res</span>.</span>send</span></span>(</span>"</span>Original file not found. <a href='/'>Back</a>"</span></span>)</span>;</span>
</span></span></span>  if</span> (</span>fs</span>.</span>existsSync</span></span>(</span>newPath</span>)</span>)</span> return</span> res</span>.</span>send</span></span>(</span>"</span>Target filename exists. <a href='/'>Back</a>"</span></span>)</span>;</span>
</span></span></span>
</span></span></span>  fs</span>.</span>renameSync</span></span>(</span>oldPath</span>,</span> newPath</span>)</span>;</span>
</span></span></span>  res</span>.</span>redirect</span></span>(</span>"</span>/"</span></span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Dex login</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/login"</span></span>,</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  const</span> redirect_uri</span></span> </span>=</span> `</span>${</span></span>MIDDLEWARE_SERVER</span></span>}</span></span>/callback`</span></span></span>;</span>
</span></span></span>  const</span> authUrl</span></span> </span>=</span> `</span>${</span></span>DEX_ISSUER</span></span>}</span></span>/auth?client_id=${</span></span>encodeURIComponent</span></span>(</span>CLIENT_ID</span>)</span></span>}</span></span>&redirect_uri=${</span></span>encodeURIComponent</span></span>(</span>redirect_uri</span>)</span></span>}</span></span>&response_type=code&scope=openid%20email%20profile`</span></span></span>;</span>
</span></span></span>  res</span>.</span>redirect</span></span>(</span>authUrl</span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Dex callback</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/callback"</span></span>,</span> async</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  try</span> {</span>
</span></span></span></span>    const</span> code</span></span> </span>=</span> req</span>.</span>query</span>.</span>code</span></span>;</span>
</span></span></span></span>    if</span> (</span>!</span>code</span>)</span> return</span> res</span>.</span>status</span></span>(</span>400</span>)</span>.</span>send</span></span>(</span>"</span>Missing code"</span></span>)</span>;</span>
</span></span></span></span>
</span></span></span></span>    const</span> tokenResp</span></span> </span>=</span> await</span> axios</span>.</span>post</span></span>(</span>
</span></span></span></span></span>      `</span>${</span></span>DEX_ISSUER</span></span>}</span></span>/token`</span></span>,</span>
</span></span></span></span></span>      qs</span>.</span>stringify</span></span>(</span>{</span>
</span></span></span></span></span></span>        grant_type</span></span>:</span></span> "</span>authorization_code"</span></span></span>,</span>
</span></span></span></span></span></span>        code</span></span>,</span>
</span></span></span></span></span></span>        redirect_uri</span></span>:</span></span> `</span>${</span></span>MIDDLEWARE_SERVER</span></span>}</span></span>/callback`</span></span></span>,</span>
</span></span></span></span></span></span>        client_id</span></span>:</span></span> CLIENT_ID</span></span>,</span>
</span></span></span></span></span></span>        client_secret</span></span>:</span></span> CLIENT_SECRET</span>
</span></span></span></span></span></span></span>      </span>}</span></span>)</span>,</span>
</span></span></span></span></span>      {</span> headers</span></span>:</span></span> {</span> "</span>Content-Type"</span></span></span></span>:</span></span> "</span>application/x-www-form-urlencoded"</span></span> </span>}</span></span> </span>}</span></span>
</span></span></span></span></span>    )</span></span>;</span>
</span></span></span></span>
</span></span></span></span>    const</span> idToken</span></span> </span>=</span> tokenResp</span>.</span>data</span>.</span>id_token</span></span>;</span>
</span></span></span></span>    if</span> (</span>!</span>idToken</span>)</span> return</span> res</span>.</span>status</span></span>(</span>500</span>)</span>.</span>send</span></span>(</span>"</span>No id_token received"</span></span>)</span>;</span>
</span></span></span></span>
</span></span></span></span>    const</span> userInfo</span></span> </span>=</span> jwt</span>.</span>decode</span></span>(</span>idToken</span>)</span></span>;</span>
</span></span></span></span>    if</span> (</span>!</span>userInfo</span> ||</span> !</span>userInfo</span>.</span>sub</span>)</span> return</span> res</span>.</span>status</span></span>(</span>500</span>)</span>.</span>send</span></span>(</span>"</span>Invalid id_token"</span></span>)</span>;</span>
</span></span></span></span>
</span></span></span></span>    req</span>.</span>session</span>.</span>user</span> =</span> {</span>
</span></span></span></span></span>      id</span></span>:</span></span> userInfo</span>.</span>sub</span></span>,</span>
</span></span></span></span></span>      email</span></span>:</span></span> userInfo</span>.</span>email</span></span>,</span>
</span></span></span></span></span>      name</span></span>:</span></span> userInfo</span>.</span>name</span> ||</span> userInfo</span>.</span>preferred_username</span> ||</span> userInfo</span>.</span>email</span> ||</span> "</span>Unnamed User"</span></span>
</span></span></span></span></span></span>    </span>}</span></span>;</span>
</span></span></span></span>
</span></span></span></span>    if</span> (</span>req</span>.</span>session</span>.</span>redirectAfterLogin</span>)</span> {</span>
</span></span></span></span></span>      const</span> redirectUrl</span></span> </span>=</span> req</span>.</span>session</span>.</span>redirectAfterLogin</span></span>;</span>
</span></span></span></span></span>      delete</span> req</span>.</span>session</span>.</span>redirectAfterLogin</span>;</span>
</span></span></span></span></span>      return</span> res</span>.</span>redirect</span></span>(</span>redirectUrl</span>)</span>;</span>
</span></span></span></span></span>    }</span></span>
</span></span></span></span>
</span></span></span></span>    res</span>.</span>redirect</span></span>(</span>"</span>/"</span></span>)</span>;</span>
</span></span></span></span>  }</span></span> catch</span> (</span>err</span>)</span> {</span>
</span></span></span></span>    console</span>.</span>error</span></span>(</span>"</span>Callback error:"</span></span>,</span> err</span>.</span>response</span>?.</span>data</span> ||</span> err</span>.</span>message</span>)</span>;</span>
</span></span></span></span>    res</span>.</span>status</span></span>(</span>500</span>)</span>.</span>send</span></span>(</span>"</span>Authentication failed"</span></span>)</span>;</span>
</span></span></span></span>  }</span></span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Logout</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/logout"</span></span>,</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  req</span>.</span>session</span>.</span>destroy</span></span>(</span>err</span> </span>=></span> {</span>
</span></span></span></span></span>    const</span> logoutUrl</span></span> </span>=</span> DEX_ISSUER</span> ?</span> (</span>DEX_ISSUER</span>.</span>endsWith</span></span>(</span>"</span>/"</span></span>)</span> ?</span> `</span>${</span></span>DEX_ISSUER</span></span>}</span></span>logout`</span></span> :</span> `</span>${</span></span>DEX_ISSUER</span></span>}</span></span>/logout`</span></span>)</span> :</span> "</span>/"</span></span></span>;</span>
</span></span></span></span></span>    res</span>.</span>redirect</span></span>(</span>`</span>/`</span></span>)</span>;</span>
</span></span></span></span></span>  }</span></span></span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> New document without login</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/new"</span></span>,</span> async</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  try</span> {</span>
</span></span></span></span>    const</span> fileId</span></span> </span>=</span> `</span>new-${</span></span>Date</span>.</span>now</span></span>(</span>)</span></span>}</span></span>.docx`</span></span></span>;</span>
</span></span></span></span>    const</span> newFilePath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> fileId</span>)</span></span>;</span>
</span></span></span></span>    await</span> createEmptyDocx</span></span>(</span>newFilePath</span>)</span>;</span>
</span></span></span></span>    res</span>.</span>redirect</span></span>(</span>`</span>/edit/${</span></span>encodeURIComponent</span></span>(</span>fileId</span>)</span></span>}</span></span>`</span></span>)</span>;</span>
</span></span></span></span>  }</span></span> catch</span> (</span>err</span>)</span> {</span>
</span></span></span></span>    console</span>.</span>error</span></span>(</span>"</span>Error creating new file:"</span></span>,</span> err</span>)</span>;</span>
</span></span></span></span>    res</span>.</span>status</span></span>(</span>500</span>)</span>.</span>send</span></span>(</span>"</span>Failed to create new document"</span></span>)</span>;</span>
</span></span></span></span>  }</span></span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Serve files</span>
</span>app</span>.</span>use</span></span>(</span>"</span>/files"</span></span>,</span> express</span>.</span>static</span></span>(</span>FILES_DIR</span>,</span> {</span>
</span></span>  setHeaders</span></span></span>:</span></span> (</span>res</span>)</span></span> </span>=></span> {</span>
</span></span></span></span></span>    res</span>.</span>setHeader</span></span>(</span>"</span>Cache-Control"</span></span>,</span> "</span>no-cache, no-store, must-revalidate"</span></span>)</span>;</span>
</span></span></span></span></span>    res</span>.</span>setHeader</span></span>(</span>"</span>Pragma"</span></span>,</span> "</span>no-cache"</span></span>)</span>;</span>
</span></span></span></span></span>    res</span>.</span>setHeader</span></span>(</span>"</span>Expires"</span></span>,</span> "</span>0"</span></span>)</span>;</span>
</span></span></span></span></span>  }</span></span></span>
</span></span></span></span>}</span></span>)</span>)</span>;</span>
</span>
</span>//</span></span> Edit OnlyOffice document</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/edit/:filename"</span></span>,</span> requireLogin</span>,</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  const</span> fileId</span></span> </span>=</span> req</span>.</span>params</span>.</span>filename</span></span>;</span>
</span></span></span>  const</span> filePath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> fileId</span>)</span></span>;</span>
</span></span></span>  if</span> (</span>!</span>fs</span>.</span>existsSync</span></span>(</span>filePath</span>)</span>)</span> return</span> res</span>.</span>status</span></span>(</span>404</span>)</span>.</span>send</span></span>(</span>"</span>File not found"</span></span>)</span>;</span>
</span></span></span>
</span></span></span>  const</span> documentUrl</span></span> </span>=</span> `</span>${</span></span>MIDDLEWARE_SERVER</span></span>}</span></span>/files/${</span></span>encodeURIComponent</span></span>(</span>fileId</span>)</span></span>}</span></span>?v=${</span></span>Date</span>.</span>now</span></span>(</span>)</span></span>}</span></span>`</span></span></span>;</span>
</span></span></span>  const</span> documentKey</span></span> </span>=</span> `</span>${</span></span>fileId</span></span>}</span></span>-${</span></span>Date</span>.</span>now</span></span>(</span>)</span></span>}</span></span>`</span></span></span>;</span>
</span></span></span>
</span></span></span>  const</span> user</span></span> </span>=</span> req</span>.</span>session</span>.</span>user</span></span>;</span>
</span></span></span>  const</span> dsPayload</span></span> </span>=</span> {</span>
</span></span></span></span></span>    document</span></span>:</span></span> {</span>
</span></span></span></span></span></span></span>      fileType</span></span>:</span></span> "</span>docx"</span></span></span>,</span>
</span></span></span></span></span></span></span>      key</span></span>:</span></span> documentKey</span></span>,</span>
</span></span></span></span></span></span></span>      title</span></span>:</span></span> fileId</span></span>,</span>
</span></span></span></span></span></span></span>      url</span></span>:</span></span> documentUrl</span>
</span></span></span></span></span></span></span></span>    </span>}</span></span></span>,</span>
</span></span></span></span></span>    editorConfig</span></span>:</span></span> {</span>
</span></span></span></span></span></span></span>      mode</span></span>:</span></span> "</span>edit"</span></span></span>,</span>
</span></span></span></span></span></span></span>      user</span></span>:</span></span> {</span> id</span></span>:</span></span> user</span>.</span>id</span></span>,</span> name</span></span>:</span></span> user</span>.</span>name</span> </span>}</span></span></span>,</span>
</span></span></span></span></span></span></span>      callbackUrl</span></span>:</span></span> "</span>${MIDDLEWARE_SERVER}/onlyoffice-callback"</span></span>
</span></span></span></span></span></span></span></span>    </span>}</span></span></span>,</span>
</span></span></span></span></span>    iat</span></span>:</span></span> Math</span>.</span>floor</span></span>(</span>Date</span>.</span>now</span></span>(</span>)</span> /</span> 1000</span>)</span></span>,</span>
</span></span></span></span></span>    exp</span></span>:</span></span> Math</span>.</span>floor</span></span>(</span>Date</span>.</span>now</span></span>(</span>)</span> /</span> 1000</span>)</span> +</span> 3600</span>
</span></span></span></span></span></span>  </span>}</span></span></span>;</span>
</span></span></span>
</span></span></span>  const</span> dsToken</span></span> </span>=</span> jwt</span>.</span>sign</span></span>(</span>dsPayload</span>,</span> JWT_SECRET</span>,</span> {</span> algorithm</span></span>:</span></span> "</span>HS256"</span></span> </span>}</span></span>)</span></span>;</span>
</span></span></span>
</span></span></span>  res</span>.</span>send</span></span>(</span>`</span>
</span></span></span></span>    <!DOCTYPE html>
</span></span></span></span>    <html>
</span></span></span></span>    <head>
</span></span></span></span>      <meta charset="utf-8">
</span></span></span></span>      <title>Editing ${</span></span>fileId</span></span>}</span></span></title>
</span></span></span></span>      <style>
</span></span></span></span>  html, body { height: 100%; margin: 0; background: #f7f8fa; font-family: "Segoe UI", Tahoma, Geneva, Verdana, sans-serif; }
</span></span></span></span>  #placeholder { width: 100%; height: 100%; }
</span></span></span></span>  .topbar {
</span></span></span></span>    position: absolute;
</span></span></span></span>    top: 8px;
</span></span></span></span>    right: 12px;
</span></span></span></span>    z-index: 10;
</span></span></span></span>    font-family: "Segoe UI", Tahoma, Geneva, Verdana, sans-serif;
</span></span></span></span>    background: rgba(255,255,255,0.9);
</span></span></span></span>    padding: 6px 10px;
</span></span></span></span>    border-radius: 6px;
</span></span></span></span>    box-shadow: 0 2px 6px rgba(0,0,0,0.1);
</span></span></span></span>  }
</span></span></span></span>  .topbar a {
</span></span></span></span>    margin-left: 8px;
</span></span></span></span>    color: #0078d4;
</span></span></span></span>    text-decoration: none;
</span></span></span></span>  }
</span></span></span></span>  .topbar a:hover {
</span></span></span></span>    text-decoration: underline;
</span></span></span></span>  }
</span></span></span></span></style>
</span></span></span></span>    </head>
</span></span></span></span>    <body>
</span></span></span></span>      <div id="placeholder"></div>
</span></span></span></span>      <div class="topbar">Logged in as ${</span></span>escapeHtml</span></span>(</span>user</span>.</span>name</span>)</span></span>}</span></span> | <a href="/logout">Logout</a></div>
</span></span></span></span>      <script src="${</span></span>DOCUMENTSERVER_URL</span></span>}</span></span>/web-apps/apps/api/documents/api.js"></script>
</span></span></span></span>      <script>
</span></span></span></span>        const config = {
</span></span></span></span>          document: ${</span></span>JSON</span>.</span>stringify</span></span>(</span>dsPayload</span>.</span>document</span>)</span></span>}</span></span>,
</span></span></span></span>          documentType: "word",
</span></span></span></span>          editorConfig: ${</span></span>JSON</span>.</span>stringify</span></span>(</span>dsPayload</span>.</span>editorConfig</span>)</span></span>}</span></span>,
</span></span></span></span>          token: ${</span></span>JSON</span>.</span>stringify</span></span>(</span>dsToken</span>)</span></span>}</span></span>
</span></span></span></span>        };
</span></span></span></span>        const docEditor = new DocsAPI.DocEditor("placeholder", config);
</span></span></span></span>      </script>
</span></span></span></span>    </body>
</span></span></span></span>    </html>
</span></span></span></span>  `</span></span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> ONLYOFFICE callback</span>
</span>app</span>.</span>post</span></span>(</span>"</span>/onlyoffice-callback"</span></span>,</span> async</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  const</span> data</span></span> </span>=</span> req</span>.</span>body</span></span>;</span>
</span></span></span>  console</span>.</span>log</span></span>(</span>"</span>ONLYOFFICE callback:"</span></span>,</span> data</span>)</span>;</span>
</span></span></span>
</span></span></span>  if</span> (</span>[</span>2</span>,</span>6</span>,</span>7</span>]</span></span>.</span>includes</span></span>(</span>data</span>.</span>status</span>)</span> &&</span> data</span>.</span>url</span>)</span> {</span>
</span></span></span></span>    try</span> {</span>
</span></span></span></span></span>      const</span> originalFilename</span></span> </span>=</span> data</span>.</span>key</span>.</span>split</span></span>(</span>"</span>.docx"</span></span>)</span>[</span>0</span>]</span></span> +</span> "</span>.docx"</span></span></span>;</span>
</span></span></span></span></span>      const</span> filepath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> originalFilename</span>)</span></span>;</span>
</span></span></span></span></span>
</span></span></span></span></span>      const</span> response</span></span> </span>=</span> await</span> axios</span>.</span>get</span></span>(</span>data</span>.</span>url</span>,</span> {</span> responseType</span></span>:</span></span> "</span>arraybuffer"</span></span> </span>}</span></span>)</span></span>;</span>
</span></span></span></span></span>      fs</span>.</span>writeFileSync</span></span>(</span>filepath</span>,</span> response</span>.</span>data</span>)</span>;</span>
</span></span></span></span></span>
</span></span></span></span></span>      console</span>.</span>log</span></span>(</span>`</span>Saved document: ${</span></span>filepath</span></span>}</span></span>`</span></span>)</span>;</span>
</span></span></span></span></span>    }</span></span> catch</span> (</span>err</span>)</span> {</span>
</span></span></span></span></span>      console</span>.</span>error</span></span>(</span>"</span>Error saving document:"</span></span>,</span> err</span>.</span>response</span>?.</span>data</span> ||</span> err</span>.</span>message</span>)</span>;</span>
</span></span></span></span></span>    }</span></span>
</span></span></span></span>  }</span></span>
</span></span></span>
</span></span></span>  res</span>.</span>json</span></span>(</span>{</span> error</span></span>:</span></span> 0</span> </span>}</span></span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> Serve individual files</span>
</span>app</span>.</span>get</span></span>(</span>"</span>/files/:filename"</span></span>,</span> (</span>req</span>,</span> res</span>)</span></span> </span>=></span> {</span>
</span></span></span>  const</span> filename</span></span> </span>=</span> req</span>.</span>params</span>.</span>filename</span></span>;</span>
</span></span></span>  const</span> filepath</span></span> </span>=</span> path</span>.</span>join</span></span>(</span>FILES_DIR</span>,</span> filename</span>)</span></span>;</span>
</span></span></span>
</span></span></span>  if</span> (</span>fs</span>.</span>existsSync</span></span>(</span>filepath</span>)</span>)</span> res</span>.</span>sendFile</span></span>(</span>filepath</span>)</span>;</span>
</span></span></span>  else</span> res</span>.</span>status</span></span>(</span>404</span>)</span>.</span>send</span></span>(</span>"</span>File not found"</span></span>)</span>;</span>
</span></span></span>}</span></span></span>)</span>;</span>
</span>
</span>//</span></span> XSS helper</span>
</span>function</span> escapeHtml</span></span>(</span>str</span>)</span></span> {</span>
</span></span></span>  return</span> String</span></span>(</span>str</span>)</span>.</span>replace</span></span>(</span>/</span>&/</span>g</span></span>,</span>"</span>&amp;"</span></span>)</span>.</span>replace</span></span>(</span>/</span></</span>g</span></span>,</span>"</span>&lt;"</span></span>)</span>.</span>replace</span></span>(</span>/</span>>/</span>g</span></span>,</span>"</span>&gt;"</span></span>)</span>.</span>replace</span></span>(</span>/</span>"/</span>g</span></span>,</span>"</span>&quot;"</span></span>)</span>.</span>replace</span></span>(</span>/</span>'/</span>g</span></span>,</span>"</span>&#039;"</span></span>)</span>;</span>
</span></span></span>}</span></span></span>
</span>
</span>app</span>.</span>listen</span></span>(</span>port</span>,</span> (</span>)</span></span> </span>=></span> </span>console</span>.</span>log</span></span>(</span>`</span>OnlyOffice middleware listening on port ${</span></span>port</span></span>}</span></span>`</span></span>)</span>)</span>;</span>
</span></code></pre>
Package.json</h2>
{</span>
</span></span>  </span>"</span>name"</span></span></span>:</span> </span>"</span>onlyoffice-middleware"</span></span>,</span>
</span></span>  </span>"</span>version"</span></span></span>:</span> </span>"</span>1.0.0"</span></span>,</span>
</span></span>  </span>"</span>main"</span></span></span>:</span> </span>"</span>index.js"</span></span>,</span>
</span></span>  </span>"</span>dependencies"</span></span></span>:</span> </span>{</span>
</span></span></span>    </span>"</span>express"</span></span></span>:</span> </span>"</span>^4.18.2"</span></span>,</span>
</span></span></span>    </span>"</span>jsonwebtoken"</span></span></span>:</span> </span>"</span>^9.0.0"</span></span>,</span>
</span></span></span>    </span>"</span>axios"</span></span></span>:</span> </span>"</span>^1.6.0"</span></span>,</span>
</span></span></span>    </span>"</span>dotenv"</span></span></span>:</span> </span>"</span>^16.0.0"</span></span>,</span>
</span></span></span>    </span>"</span>express-session"</span></span></span>:</span> </span>"</span>^1.17.3"</span></span>,</span>
</span></span></span>    </span>"</span>officegen"</span></span></span>:</span> </span>"</span>^0.6.4"</span></span>
</span></span></span>  }</span></span>
</span></span>}</span></span>
</span>
</span></code></pre>
Dockerfile</h2>
FROM node:20-alpine
</span>WORKDIR /app
</span>COPY package*.json ./
</span>RUN npm install --production
</span>COPY . .
</span>EXPOSE 3000
</span>CMD ["node", "index.js"]
</span>
</span></code></pre>
Environment Variables</h2>
The needed Environment variables are:</p>

DEX_ISSUER: The domain name to your OAuth2 server</li>
CLIENT_ID: OAuth2 client ID</li>
CLIENT_SECRET: OAuth2 client secret</li>
JWT_SECRET: What you set in OnlyOffice Document Server as the JWT Secret</li>
DOCUMENTSERVER_URL: The DocumentServer doman name</li>
MIDDLEWARE_SERVER: the domain name serving this application</li>
</ul>
Kubernetes deployment example</h2>
I host this application in my kubernetes cluster.^{2</a></sup> with the following deployment manifest:</p>}
apiVersion</span></span>:</span> apps/v1</span>
</span>kind</span></span>:</span> Deployment</span>
</span>metadata</span></span>:</span>
</span>  name</span></span>:</span> onlyoffice-middleware</span>
</span>  namespace</span></span>:</span> onlyoffice</span>
</span>spec</span></span>:</span>
</span>  replicas</span></span>:</span> 1</span>
</span>  selector</span></span>:</span>
</span>    matchLabels</span></span>:</span>
</span>      app</span></span>:</span> onlyoffice-middleware</span>
</span>  template</span></span>:</span>
</span>    metadata</span></span>:</span>
</span>      labels</span></span>:</span>
</span>        app</span></span>:</span> onlyoffice-middleware</span>
</span>    spec</span></span>:</span>
</span>      imagePullSecrets</span></span>:</span>
</span>      -</span> name</span></span>:</span> regsecret</span>
</span>      containers</span></span>:</span>
</span>        -</span> name</span></span>:</span> middleware</span>
</span>          image</span></span>:</span> d.domain.tld/onlyoffice-middleware:latest</span>
</span>          imagePullPolicy</span></span>:</span> Always</span>
</span>          ports</span></span>:</span>
</span>            -</span> containerPort</span></span>:</span> 3000</span>
</span>          resources</span></span>:</span>
</span>            requests</span></span>:</span>
</span>              cpu</span></span>:</span> "</span>100m"</span></span>
</span>              memory</span></span>:</span> "</span>128Mi"</span></span>
</span>            limits</span></span>:</span>
</span>              cpu</span></span>:</span> "</span>500m"</span></span>
</span>              memory</span></span>:</span> "</span>512Mi"</span></span>
</span>          env</span></span>:</span>
</span>            -</span> name</span></span>:</span> DEX_ISSUER</span>
</span>              value</span></span>:</span> "</span>https://dex.domain.tld"</span></span>
</span>            -</span> name</span></span>:</span> CLIENT_ID</span>
</span>              value</span></span>:</span> "</span>onlyoffice-middleware-domain.tld"</span></span>
</span>            -</span> name</span></span>:</span> DOCUMENTSERVER_URL</span>
</span>              value</span></span>:</span> "</span>https://office.domain.tld"</span></span>
</span>            -</span> name</span></span>:</span> CLIENT_SECRET</span>
</span>              valueFrom</span></span>:</span>
</span>                secretKeyRef</span></span>:</span>
</span>                  name</span></span>:</span> onlyoffice-secrets</span>
</span>                  key</span></span>:</span> MIDDLEWARE_SECRET</span>
</span>            -</span> name</span></span>:</span> JWT_SECRET</span>
</span>              valueFrom</span></span>:</span>
</span>                secretKeyRef</span></span>:</span>
</span>                  name</span></span>:</span> onlyoffice-secrets</span>
</span>                  key</span></span>:</span> JWT_SECRET</span>
</span>          volumeMounts</span></span>:</span>
</span>            -</span> name</span></span>:</span> files-storage</span>
</span>              mountPath</span></span>:</span> /app/files</span>
</span>      volumes</span></span>:</span>
</span>        -</span> name</span></span>:</span> files-storage</span>
</span>          persistentVolumeClaim</span></span>:</span>
</span>            claimName</span></span>:</span> middleware-files-pvc</span>
</span></code></pre>
Conclusion</h2>
The middleware has a simple gui for creating new documents and editing existing ones. There is a delay when you save in the web app and see the changes in the actual file. For my use case, these documents will be short lived. According to one hackernews post</a>, OnlyOffice has Russian ties. While I like free software, I do not support Russia's agression in Ukraine.3</a></sup> The free world has imposed sanctions on Russia, and I participate in those by not using Russian-based software. So, if you know of a good lightweight editor that is not markdown based, let me know.</p>



I have Dex which is connected to my local LDAP server. ↩</a></p>
</li>

At least until I find a better lightweight word processor that has easy footnote support. ↩</a></p>
</li>

I have even gone as far as removing nginx from my kubernetes cluster. ↩</a></p>
</li>
</ol>
</section>

Word processor to replace Google Docs

2025-09-06T16:22:14.660761+00:00

The problem</h2>
I have a few frustrations with Google Docs</a>. It has gotten slow over the years. There is now a sudden push to migrate to Google Workspaces, which is something I do not want to do. There a few routes I can go in an endeavor to switch away from Google Docs.

Web Options</h3>

Office 365</li>
Etherpad-lite</li>
Hedgedoc</a></li>
OnlyOffice</li>
Other various options that do not support footnotes</li> </ul>
Desktop Options</h3>

LibreOffice</li>
VSCode</li>
Geany</li>
Other options not as good as the ones listed</li> </ul>
The Direction</h2>
I really only need a word processor. I do not need a full blown office replacement. LibreOffice is nice, but I would like something that looks more modern. Hedgedoc is a great option, but footnotes are a bit clunky.1</a> Etherpad-lite says it will do what I need, but all of the plugins that I would want to use do not work with the latest version. VSCode and Geany do not support footnotes as I would need them. That left me with only one option to try OnlyOffice.2</a>
OnlyOffice</h2>
OnlyOffice is bundled with well known third-party solutions, such as CryptPad, NextCloud, and OwnCloud. Those options offer more than a document processor, and I am only looking to add a word processor. This meant I had to custom supply my own OnlyOffice solution.3</a> In a followup post, I will post how I accomplished to vibe code middleware to handle the Document server oddities behind an OAuth2 authentication flow.
Conclusion</h2>
I thought there would be more free wordprocessing options available in 2025, but it appears everyone stopped developing new things once Google created their free Google Docs product. It appears others paid OnlyOffice to write competitive software in 2015. I am just thankful there is an AGPL v3.0 license .... even if the Documentation is difficult to understand.

I would have to manually type the references. While this is what I do on this blog, when I write, I want fast footnote insertion. If Hedgedoc had a button I could press, it would have switched to it in a heartbeat. ↩</a> </li>

Worst case scenario, I could code my own option, but this is not ideal. ↩</a> </li>

This is more difficult than it seems. The Docs were lacking in this area. ↩</a> </li> </ol> </section>

An open letter to Google

2025-09-06T16:17:10.887031+00:00

Dear Google,

I want a functioning product that is fast. That means I do not want to participate in your “simulate slowness experiments.” I use your product because I think it is good. You do not have to annoy me about trying your new Google workspace. If I want to try it, I will try it.

When I dismiss your notifications, it means I have acknowledged your banner, read the contents, and do not want to try this new offering. It does not mean you need to prompt me about Google Workspace at every opportunity. This behavior has become very annoying to me and has now caused me to seek other options for word processing.

I wish I could stay with your Google Doc application, but my writing time needs to be without interruption. Even the little change (such as nesting page numbers in a sub menu, which adds another click) can be tolerated for a time, but this 90px banner is just too much for me.

Sincerely, Andrew

Goodbye Wordpress

2025-09-03T07:53:48.094453+00:00

I have delayed switching away from Wordpress on my personal blog to something different for quite some time. I liked the new idea of a flat-file static html concept, but Jekyll did not appeal to me. Then, Hugo appeared on the scene and appeared to take the rightful place as the cool kid on the block. Hugo has a simple concept and drew my interest from being written in Go, but from my delay in switching, I have been able to discover a potential flaw in my workflow. Occasional bloggers like me are fighting with updates just to add a new post.1</a>

In my opinion, markdown has its own challenges. It seems very clunky and difficult to memorize the correct ordering of braces 2</a> compared to the old-stlye BB code or regular html. Switching to a new blogging platform that adds more complexity AND forces me to move to markdown is not appealing. However, I came across Zola</a>, which I heard updates "once every other glacial age."3</a> That explanation that enough to pique my interest and switch this blog over.

Wordpress has served me well over the years, and I still have one application running a Wordpress frontend. I have another with Wordpress as a Headless CMS. I will continue to use Wordpress whenever I need an easy admin interface that a simpleton like myself can use when half asleep.4</a> However, I like the idea of removing another MySql/MariaDB database as I slowly port over to PostgreSQL.5</a>

It took several hobby hours on my day off to make the change, but I have a fairly good workflow now. I asked ChatGPT to create a script for new post generation, and it gave me this python 6</a> file:

import</span> os</span></span></span>
</span>from</span></span> datetime</span></span> import</span></span></span></span></span> datetime</span></span>
</span>
</span>#</span> Step 1: Get the current date and timestamp
</span></span>now</span></span> =</span> datetime</span></span>.</span></span>now</span></span></span></span>(</span>)</span></span>
</span>date_str</span></span> =</span> now</span></span>.</span></span>strftime</span></span></span></span>(</span>"</span></span></span>%Y</span>-%m</span>-%d</span>"</span></span></span>)</span></span>
</span>timestamp</span></span> =</span> now</span></span>.</span></span>isoformat</span></span></span></span>(</span>)</span></span>
</span>
</span>#</span> Step 2: Prompt user for title and tags
</span></span>title</span></span> =</span> input</span></span></span></span>(</span>"</span></span></span>Enter title: "</span></span></span>)</span></span>.</span></span>strip</span></span></span></span>(</span>)</span></span>
</span>tags_input</span></span> =</span> input</span></span></span></span>(</span>"</span></span></span>Enter comma-separated tags: "</span></span></span>)</span></span>.</span></span>strip</span></span></span></span>(</span>)</span></span>
</span>tags</span></span> =</span> [</span>tag</span></span>.</span></span>strip</span></span></span></span>(</span>)</span></span> for</span> tag</span> in</span></span> tags_input</span></span>.</span></span>split</span></span></span></span>(</span>"</span></span></span>,"</span></span></span>)</span></span> if</span> tag</span></span>.</span></span>strip</span></span></span></span>(</span>)</span></span>]</span></span>
</span>
</span>#</span> Step 3: Prepare directory and file path
</span></span>safe_title</span></span> =</span> title</span></span>.</span></span>replace</span></span></span></span>(</span>"</span></span></span> "</span></span></span>,</span> "</span></span></span>-"</span></span></span>)</span></span>.</span></span>replace</span></span></span></span>(</span>"</span></span></span>/"</span></span></span>,</span> "</span></span></span>-"</span></span></span>)</span></span>  #</span> sanitize title
</span></span>filename</span></span> =</span> f</span>"</span></span></span>{</span>date_str</span></span></span></span>}</span></span>-</span>{</span>safe_title</span></span></span></span>}</span></span>.md"</span></span></span>
</span>content_dir</span></span> =</span> os</span>.</span>path</span></span>.</span></span>join</span></span></span></span>(</span>os</span></span>.</span></span>getcwd</span></span></span></span>(</span>)</span></span>,</span> "</span></span></span>content"</span></span></span>)</span></span>
</span>filepath</span></span> =</span> os</span>.</span>path</span></span>.</span></span>join</span></span></span></span>(</span>content_dir</span></span>,</span> filename</span></span>)</span></span>
</span>
</span>#</span> Step 4: Write content
</span></span>content</span></span> =</span> f</span>"""</span></span></span>+++
</span></span></span>title = "</span>{</span>title</span></span></span></span>}</span></span>"
</span></span></span>date = </span>{</span>timestamp</span></span></span></span>}</span></span>
</span></span></span>[taxonomies]
</span></span></span>tags = [</span>{</span>'</span></span></span>, '</span></span></span>.</span></span>join</span></span></span></span>(</span>[</span>f</span>'</span></span></span>"</span>{</span>tag</span></span></span></span>}</span></span>"'</span></span></span> for</span> tag</span> in</span></span> tags</span></span>]</span></span>)</span></span></span></span>}</span></span>]
</span></span></span>+++
</span></span></span>
</span></span></span>"""</span></span></span>
</span>
</span>with</span> open</span></span></span></span>(</span>filepath</span></span>,</span> "</span></span></span>w"</span></span></span>,</span> encoding</span>=</span>"</span></span></span>utf-8"</span></span></span>)</span></span> as</span></span></span> f</span>:</span></span>
</span>    f</span></span>.</span></span>write</span></span></span></span>(</span>content</span></span>)</span></span>
</span>
</span>print</span></span></span></span>(</span>f</span>"</span></span></span>File created: </span>{</span>filepath</span></span></span></span>}</span></span>"</span></span></span>)</span></span>
</span>
</span></code></pre>
I have added a few of my edits to the script it output. For instace, I removed the line creating the directory because I know it already exists and I added a few new lines to the content so I do not have to add them in when I open the file.</p>
My future workflow of creating a blog post is:</p>
python new-post.py
</span><edit file>
</span>./build-container.sh
</span>./update-container.sh
</span>python announce-to-socials.py
</span></code></pre>
This seems like a lot of steps for one post. I have not even created the script to update or announce to socials yet. I will probably create the announcement cod in golang - so I can include it in the update-container script.</p>
Footnotes</h2>



https://commaok.xyz/post/on_hugo/</a> ↩</a></p>
</li>

I think I will have to visit https://github.com/pulldown-cmark/pulldown-cmark/blob/f4a326d225e79412b5ecabd1c241c851e8160815/guide/src/cheat-sheet.md</a> regularly ↩</a></p>
</li>

https://mamot.fr/@thibaultamartin/115123535906012521</a> ↩</a></p>
</li>

This is the true test of application robustness. ↩</a></p>
</li>

I like that PostgreSQL has an easy admin interface with PgAdmin, better integration with Prometheus, and had easier options to load the data into RAM for faster queries. ↩</a></p>
</li>

Python is another one of those languages that I try to stay away from. I prefer more elegant looking code like TypeScript, Ruby, or Go. ↩</a></p>
</li>
</ol>
</section>

From nginx to traefik (and solving X-Forwarded-For)

2023-07-18T11:23:43+00:00

I recently switched my home setup from nginx to traefik. I had to get used to the new configuration styles and weird doc style of traefik, but suffice to say, I am happy at the end results.
Traefik ships with SNI, allowing me to snoop the connection and prevent unauthorized access to my file server. (One must have the correct hostname to see my shared photos.) My first action was to replace my edge nginx reverse proxy with traefik. If this was a success, then I would move onto replacing nginx in my k8s cluster. I was surprized that after zero OS tuning changes, traefik was able to serve pages faster for my k8s cluster. I initially thought that traefik would perform marginally slower than nginx due to additional HostSNI checks, but that was totally disproved by the first page load.
After switching to traefik inside my k8s cluster, performance improved even more. However, a new problem emerged: I was getting the IPs of my internal traffic logged instead of the real origin IP. While I would not normally care, malicious bots were attempting to brute force my WordPress installations, and I need to block their IPs.
I was able to get the X-Forwarded-For header populated with the true ip by enabling the Proxy Protocol on my edge traefik, setting externalTrafficPolicy: Local on my traefik k8s service, and finally telling traefik to accept the proxyProtocol information from the edge server.
# Edge Router providers.yaml ... tcp: routers: to-web: service: web rule: HostSNIRegexp(`www.andrewwippler.com`, `andrewwippler.com`, ...) entryPoints: - web to-websecure: service: websecure rule: HostSNIRegexp(`www.andrewwippler.com`, `andrewwippler.com`, ...) entryPoints: - websecure tls: passthrough: true services: web: loadBalancer: proxyProtocol: version: 2 servers: - ... websecure: loadBalancer: proxyProtocol: version: 2 servers: - ... ... </code></pre> # traefik k8s deployment and service # missing service account definition and CRDs apiVersion: apps/v1 kind: Deployment metadata: name: traefik spec: replicas: 3 #<-- one for each of my nodes, for failover strategy: #<-- forces k8s to update pods on configuration change rollingUpdate: maxSurge: 1 maxUnavailable: 1 type: RollingUpdate selector: matchLabels: app: traefik template: metadata: labels: app: traefik spec: affinity: #<-- one replica per node podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: app operator: In values: - traefik topologyKey: "kubernetes.io/hostname" serviceAccountName: traefik-ingress-controller containers: - name: traefik image: traefik:v2.10.3 args: - --entrypoints.web.address=:80 - --entrypoints.websecure.address=:443 - --entrypoints.websecure.http.tls - --entrypoints.websecure.http3 - --experimental.http3=true - --providers.kubernetesingress - --providers.kubernetescrd - --log.level=DEBUG - --entrypoints.web.http.redirections.entrypoint.scheme=https - --entrypoints.web.http.redirections.entrypoint.to=websecure # - --accesslog - --entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 #<-- local CIDRs - --entryPoints.websecure.proxyProtocol.trustedIPs=127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 #<-- local CIDRs ports: - name: web containerPort: 80 - name: websecure containerPort: 443 --- apiVersion: v1 kind: Service metadata: name: traefik spec: type: NodePort selector: app: traefik ports: - protocol: TCP port: 80 name: web targetPort: 80 - protocol: TCP port: 443 name: websecure targetPort: 443 externalTrafficPolicy: Local # <--- changed </code></pre>
WordPress Containerization Boilerplate 2018-11-29T15:17:59+00:00 As a step further to my previous post, I have created a boilerplate for future WordPress projects. It can be accessed at https://github.com/andrewwippler/WordPress-Containerization-Boilerplate</a>. To quickly start a WordPress environment, simply run the following commands: git clone git@github.com:andrewwippler/WordPress-Containerization-Boilerplate.git cd WordPress-Containerization-Boilerplate/ docker-compose up </code></pre> and by visiting http://localhost:8080</a> More instructions are in the repo README. Happy Plugin/Theme development. Docker-izing WordPress for Kubernetes 2018-11-27T20:16:55+00:00 WordPress is amazingly popular considering how antiquated the file structure and code appears to be. Even still, it is the easiest CMS that I have used and the community has created plugins to make the copy-folder-for-a-new-theme/plugin at least tolerable. A challenge comes when one wants to use the 1990's method of serving web applications in a more modern way (such as running inside a container on top of Kubernetes). Containers are meant to be immutable and treated as read-only. (No change to files in the container after they are built.) Containers are supposed to be a point-in-time release of software. As such, I can roll-back to a specific container version and have that specific code running. This causes a problem when one wants to use a file-dependent application such as WordPress. The best I could come up with for running WordPress in a container is a forward-only method of deploying code (basically, giving up the ability to use a previous version of code.) There is a way to keep that functionality, but it would mean storing everything (including uploads) inside an ever-growing container or using a central object store such as S3 for uploads. It would also require a re-build of the container every time a plugin is updated - which would presumably be every hour. My deployments of WordPress are so little that I can hardly justify using S3 for uploads, keeping the plugins in sync, and going backwards in time. When deploying to Kubernetes, one can scale the replicas to N copies. Keeping plugins, themes, and updates the same across all replicas will require a READ WRITE MANY (rwx) volume to be shared. This could be a GlusterFS volume or NFS, but it cannot be a AWS EBS volume or any other single-use block storage. When looking at the available WordPress images, there are three that seem interesting. With the official image, I like that I can use php-fpm and alpine. The next top two implementations of WordPress have very</a> bloated</a> docker files. I have come to the conclusion that my WordPress container will have to be built from scratch. The Dockerfile</a> is very similar to the official WordPress container. It uses php:7.2-fpm-alpine</code> as the base image, adds in nginx, and inserts a generic wp-config.php</a> file. The folder structure for the container is as follows: WordPress Container Folder ├── docker-entrypoint.sh ├── Dockerfile ├── html │ └── ... Contents of wordpress-X.Y.Z.zip ├── nginx.conf └── wp-config.php </code></pre> It can be built by running a command similar to docker build -t andrewwippler/wordpress:latest .</code> nginx.conf</a> is a very basic configuration file with gzip and cache headers. The real neat things come in the docker-entrypoint.sh</a> file. I borrowed</a> the database creation script; however, since PHP was already installed in the container, I ran a few more checks in PHP rather than bash. For instance, the container places the local code in /var/www/html-original</code> and rsyncs it to /var/www/html</code> where the webserver sees it, but it only does this if the code in html-original</code> is newer than html</code>. This allows an operator to mount a storage volume at /var/www/html</code> which can be shared across Kubernetes Deployment replicas. The code for this is: // see if we need to copy files over include '/var/www/html-original/wp-includes/version.php'; $dockerWPversion = $wp_version; if (file_exists('/var/www/html/wp-includes/version.php')) { include '/var/www/html/wp-includes/version.php'; $installedWPversion = $wp_version; } else { $installedWPversion = '0.0.0'; } fwrite($stderr, "dockerWPversion: $dockerWPversion - installedWPversion: $installedWPversion\n"); if(version_compare($dockerWPversion, $installedWPversion, '>')) { fwrite($stderr, "Installing wordpress files\n"); exec('rsync -au /var/www/html-original/ /var/www/html'); } </code></pre> I have also included a theme-only check that will update the theme if it has changed. This is necessary to update the theme files when the version of WordPress has not changed. if (filemtime('/var/www/html-original/wp-content/themes') > filemtime('/var/www/html/wp-content/themes')) { fwrite($stderr, "Updating theme files\n"); exec('rsync -au --delete-after /var/www/html-original/wp-content/themes/ /var/www/html/wp-content/themes'); } </code></pre> All files I have referenced in this article are located in a gist</a>. In addition to those files a local docker-compose.yml file might be helpful for your local development: version: '2' services: db: image: mariadb:10 volumes: - ./tmp/db:/var/lib/mysql environment: - MYSQL_ROOT_PASSWORD=secretPASS wordpress: build: wordpress volumes: - ./html:/var/www/html - ./nginx.conf:/etc/nginx/nginx.conf:ro links: - db environment: - WORDPRESS_DB_NAME=wordpress - WORDPRESS_DB_HOST=db - WORDPRESS_DB_USER=root - WORDPRESS_DB_PASSWORD=secretPASS ports: - 8080:80 </code></pre> Using Puppet to host a private RPM repository 2016-11-18T14:00:46+00:00 A repository is a place where files are stored, indexed, and available through a package manager to anyone who has the repository information. With rpm</code> based systems, a repository is created with a tool called createrepo</code>. Most of the time, publicly available repositories already offer the packages your server needs. When you have a custom application you want to deploy (or even rebuild an existing application with your patches), it is best to distribute that package with a repository rather than a file share or some other means. Often a folder structure is created so that differing client OS versions can connect to the same repository and access versions compiled to that specific release. In my example below, I am not creating this folder structure as I am only serving one major release - Centos 7 - and the packages I am generating are website directories which are just a collection of portable code. A private repository is not a tricky feat - all you have to do is serve the repository via https and require http basic authentication. You then configure the clients to connect to the repository with the basic authentication in the URL string (i.e. baseurl=https://user:pass@repo.example.com/</code>). The HTTPS protocol is not required to serve a repository, but it does prevent network snoopers from seeing your repository credentials. Now that we know what is needed for a private repository, we can then define it in our puppet code. node 'repo.example.com' { file { '/var/yumrepos': ensure => directory, } createrepo { 'yumrepo': repository_dir => '/var/yumrepos/yumrepo', repo_cache_dir => '/var/cache/yumrepos/yumrepo', enable_cron => false, #optional cron job to generate new rpms every 10 minutes } package { 'httpd': ensure => installed, } httpauth { 'repouser': ensure => present, file => '/usr/local/nagios/etc/htpasswd.users', password => 'some-long-password', mechanism => basic, require => Package['httpd'], } file { '/usr/local/nagios/etc/htpasswd.users': ensure => file, owner => 'nginx', mode => '0644', } class{'nginx': manage_repo => true, package_source => 'nginx-mainline', } nginx::resource::vhost{"$::fqdn": www_root => '/var/yumrepos/yumrepo', index_files => [], autoindex => 'on', rewrite_to_https => true, ssl => true, auth_basic => 'true', auth_basic_user_file => '/usr/local/nagios/etc/htpasswd.users', ssl_cert => "/etc/puppetlabs/puppet/ssl/public_keys/$::fqdn.pem", ssl_key => "/etc/puppetlabs/puppet/ssl/private_keys/$::fqdn.pem", vhost_cfg_prepend => { 'default_type' => 'text/html', } } } </code></pre> For the above code to work, we need the required modules: mod 'palli/createrepo', '1.1.0' mod "puppet/nginx", "0.4.0" mod "jamtur01/httpauth", "0.0.3" </code></pre> We can then use the following declaration on our nodes to use this repository. yumrepo {'private-repo': descr => 'My Private Repo - x86_64', baseurl => 'https://repouser:some-long-password@repo.example.com/', enabled => 'true', gpgcheck => 'false', metadata_expire => '1', } </code></pre> You now have a fully functional private repository - deploy your awesome software. Website protection 2016-11-11T14:00:00+00:00 There are several factors that go into securing a web application. Most are second nature to seasoned system administrators, but it is still too common to talk to someone who does not know how to properly secure a web application. Here is the common checklist I go through when I determine if a website is secured. Is it using a firewall?</li> Am I using unique passwords that are over 20 characters?</li> Are passwords required to alter data?</li> Is my codebase up to date?</li> Are the only public facing ports HTTP and HTTPS?</li> Do I protect data in transit from the user to my site by enforcing HTTPS?</li> Do I protect data from my website to the database with SSL?</li> Is my database only accessible to my application?</li> Do I have my database and application on different servers?</li> Can a malicious user drop/delete/alter data from my database from a form/switch/button that is publicly accessible on my website or do they need to login to perform that operation?</li> Do I have separate connections and users to the database for writing and reading data?</li> Do I rate limit connections via web application firewall or utility like fail2ban?</li> Am I reading and blocking malicious inputs via web application firewall or mod_security?</li> Can anyone brute force a login or am I blocking it after 5 tries?</li> </ul> Common problems with Web Developers configuring LAMP/LEMP 2016-08-05T14:00:00+00:00 I am a SysAdmin who likes to code. I would say I know a fair amount of web developing, but do not understand it like a web developer uunderstands it. I think the reverse is true as well - web developers know how to set up a LAMP/LAMP stack, but they do not understand it as well as SysAdmin might understand it. To be a successful SysAdmin, you need to relearn your field every 3-5 years. New versions of software come out, new OSes, new features, new methods, and new ideas come out every several months. It takes somebody dedicated to read news blogs, mailing lists, and following the appropriate people on social media to keep up with the rapid trends. Web developers do not have that time to dedicate to operations work. They only need infrastructure to work for their project and it doesn't matter how well tuned the software is - if it works, that is all they need. Below are some common pitfalls I see with web developers. Using Apache with mod_fastcgi</li> </ol> While this is the only option for php-fpm in Apache 2.2, Apache 2.4 brings along the better, high performing mod_proxy_fcgi. This method should be the standard in deploying an application in Apache. Using nginx with reverse proxy is also an alternative. Not befriending a SysAdmin.</li> </ol> Contrary to popular belief, SysAdmins are not the preventers of productivity. Some Web Developers would benefit from being nice to a SysAdmin, speaking to them, and interacting more often. SysAdmins like to tell their "server stories" of how their application, server, or network equipment is actually performing in production. Using maximum power on their dev machine's VM</li> </ol> Most dev VMs I see are over 2 vCPU and 4GB RAM. This brings an unreliable view of how the application will perform in production. A better way would be to create a 1 vCPU with 512 RAM and test on that. The smaller server footprint your application needs, the easier, faster, and cheaper we can scale it. Wayfinding with RPi 2016-05-13T14:00:00+00:00 A few years ago I was tasked at looking at solutions for digital, static wayfinding. While there are some cool solutions available now for free with minimum setup, none of these were available to me. We currently were locked in with a digital signage company that charged $7,000/year for generating 640x480 graphics with events that showed up in our Exchange 2007 calendar. The jump to Exchange 2010/2013 was dependant upon our vendor to upgrade their software to support the new EWS protocol over the older protocols. This was a classic case of vendor lock-in which is a horrible state to be in. Maintaining legacy software to keep an outdated system running should be avoided like the plague. After taking a trip to Google HQ in mountain view, CA (back when they did tours), I was encouraged by the motto they plastered all over the buildings: "the most complex problems are rarely solved with blunt force objects." What also intrigued me was their form of digital wayfinding. It was an e-ink display with a wireless antenna which showed all of its circuitry - definitely made in house. This allowed me to formulate my own configuration after seeing the release of the Raspberry Pi. After about a week of coding, I was able to make RPi-wayfinding</a>. It is a simple PHP website that pulls in information from Exchange 2007+ (using EWS), a Google Calendar, or Planning Center Online Resources and displays it on a 1920x1080 resolution. This setup has been running smoothly for close to 3 years. Linux, nginx, MySQL 5.7, and PHP 7 (LEMP) on AWS with free SSL 2016-04-26T13:01:00+00:00 A stack is a group of software that creates a foundation to build upon. The LEMP stack is a web software stack which allows for delivering web applications. It is one of the most common of the web stacks to deliver a PHP application. LEMP uses a Linux kernel, Nginx for the webserver, MySQL or MariaDB for the database, and PHP for the scripting language. Nearly all distributions of GNU/Linux will have the same instructions to install the required packages. There is also little change between versions of Ubuntu to warrant a special blog post entitled "LEMP on Ubuntu 14.04" and "LEMP on Ubuntu 16.04" as they will contain the same exact instructions. There are a few oddities on the Amazon Linux AMI to get Let's Encrypt working on the t2.nano (1 CPU, 512 RAM) instance which I will cover here. Once you launch your instance, the packages you need to install are: sudo yum localinstall http://rpms.famillecollet.com/enterprise/remi-release-6.rpm sudo yum localinstall https://dev.mysql.com/get/mysql57-community-release-el6-8.noarch.rpm sudo yum install nginx.x86_64 php70-php-fpm php70-php-cli php70-php-mysqlnd mysql-community-server --enablerepo=epel </code></pre> Now enable the services to run at boot: sudo chkconfig nginx on sudo chkconfig mysqld on sudo chkconfig php70-php-fpm on sudo service nginx start sudo service mysqld start sudo service php70-php-fpm start </code></pre> Congratulations, you installed a LEMP stack! Now let us go a step further and set up SSL and a WordPress website. Type the following commands to set up our document root and create our virtual host: sudo -i cat << EOF > /etc/nginx/conf.d/wordpress.conf # Upstream to abstract backend connection(s) for php upstream php { server unix:/tmp/php-cgi.socket; server 127.0.0.1:9000 backup; } # comment the below if not using SSL server { listen 80 default_server; listen [::]:80 default_server; server_name _; return 301 https://$host$request_uri; } server { # comment the next line when not using SSL. Don't forget to comment out the above server block and uncomment the listen 80 line below. listen 443 ssl default_server; #listen 80 default_server; server_name example.com www.example.com; ## Your only path reference. root /var/www/html/wordpress/; # comment if not using SSL ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; index maint.php index.php; # Disables serving gzip content to IE 6 or below gzip_disable "MSIE [1-6]\."; gzip_static on; # Sets the default type to text/html so that gzipped content is served # as html, instead of raw uninterpreted data. default_type text/html; location /.well-known/acme-challenge { root /var/www/html/letsencrypt/wordpress/; } location = /favicon.ico { log_not_found off; access_log off; } location = /robots.txt { allow all; log_not_found off; access_log off; } # Use cached or actual file if they exists, otherwise pass request to WordPress location / { try_files \$uri \$uri/ /index.php?\$args ; } location ~ \.php$ { #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini include fastcgi.conf; fastcgi_intercept_errors on; fastcgi_pass php; } location ~* \.(ico|jpg|webp|jpeg|gif|css|png|js|ico|bmp|zip|woff|woff2)$ { access_log off; log_not_found off; add_header Pragma public; add_header Cache-Control "public"; expires max; } location ~* \.(php|html)$ { access_log on; log_not_found on; add_header Pragma public; add_header Cache-Control "public"; expires 3d; } #including this file which some caching plugins use include /var/www/html/wordpress/nginx.conf; # We don't want to allow the browsers to see .hidden linux/unix files or our own custom file location ~ /\.ht { deny all; access_log off; log_not_found off; } location ~ /nginx.conf { deny all; } } EOF </code></pre> The above commands are intended to be copied and pasted into a terminal. If you edited the file and pasted the contents in, remove the backslashes ( \</code> ) from the try_files</code> line. Next let's verify our php-fpm configuration to see how it is listening for requests.sudo grep -in ^listen /etc/opt/remi/php70/php-fpm.d/www.conf</code> We can either edit the listen directive in /etc/opt/remi/php70/php-fpm.d/www.conf</code> to match our unix socket in our wordpress.conf</code> nginx virtual host file or leave it as is. We have already made nginx look at the unix socket first (which is faster) and revert to the IP address as a backup option. Now let's make our document root, download WordPress, and extract it to our specified directory. sudo mkdir -p /var/www/html/ cd /var/www/html wget https://wordpress.org/latest.tar.gz tar xvf latest.tar.gz </code></pre> Our next step is to set the appropriate permissions on the files and directories. sudo chown nginx:apache -R /var/www/html/wordpress sudo find /var/www/html/wordpress -type d -exec chmod 755 {} \; sudo find /var/www/html/wordpress -type f -exec chmod 644 {} \; </code></pre> Now let's create a database user and secure our database. If you remember from a previous post</a> mysql generates a temporary password. Let us grab that and run mysql_secure_installation</code>. Answer all questions and provide a secure root password. sudo grep 'temporary password' /var/log/mysqld.log sudo mysql_secure_installation </code></pre> New we need to set up a database for WordPress. mysql -u root -p mysql> CREATE DATABASE word_press; mysql> GRANT ALL PRIVILEGES ON word_press.* TO "word_press_user"@"localhost" IDENTIFIED BY "S3cur3_WordPress_DB!Password"; mysql> FLUSH PRIVILEGES; mysql> EXIT; </code></pre> Now let's set up our SSL certificate with Let's Encrypt. To install the client, we need additional software and a swap file. sudo yum install make automake gcc gcc-c++ kernel-devel git-core python27-devel # change to python 2.7 if you have an old Amazon AMI sudo alternatives --config python sudo easy_install pip sudo pip install pip virtualenv --upgrade git clone https://github.com/letsencrypt/letsencrypt /home/ec2-user/letsencrypt cd /home/ec2-user/letsencrypt # create a 2GB RAM swap for machines with less than 2GB RAM sudo dd if=/dev/zero of=/swapfile bs=16M count=128 sudo mkswap /swapfile sudo chmod 0600 /swapfile sudo swapon /swapfile # now to build letsencrypt ./letsencrypt-auto --help --debug # Optional: Disable swapfile sudo swapoff /swapfile # Request certificates sudo mkdir -p /var/www/html/letsencrypt/wordpress/ sudo chown apache:nginx /var/www/html/letsencrypt/wordpress/ sudo service nginx reload ./letsencrypt-auto certonly --webroot -w /var/www/html/letsencrypt/wordpress/ -d example.com -d www.example.com </code></pre> Fill out the prompted information to get a certificate (we have already filled out the pertinent information in our nginx conf). All that is left to do is to make sure we get automatic renewals. To do that set up your crontab (sudo crontab -e</code>) to include this line: @monthly /home/ec2-user/letsencrypt/letsencrypt-auto renew && /sbin/service nginx reload </code></pre> We are now all set to continue with the installation of WordPress using the built in installer. This can be accessed by visiting your website at https://example.com/ After installing WordPress, I recommend installing the jetpack module. Not only does it allow for posting to social media, but it has a setting to keep your WordPress installation on the latest version (a huge security plus). High performant chat application 2016-02-12T15:00:52+00:00 In a fictitious world where I started my own company and developed a LEMP-stack chat application, this is how I would do it in 2016: I would use WebSockets as the protocol in which data is being sent to and from the server. WebSockets has built-in support by nginx (since version 1.3). For caching, I would use the expires max;</code> function of nginx for my static content (images, css, js, fonts, etc). I would also ensure static content was named in the scheme of name-md5hash.ext</code>. This would allow the caching on the client side to shine. I would ensure my php files are gzip compressed (with .gz extension) to allow fast transferring of data between client and server. Nginx finds the .gz files when gzip compression is turned on and uses them if they exist. I would design small php-fpm servers that can support ~2,000 users at a time (basically, a dual core processor with 4gb of ram). This would allow ease of scaling at lower costs. I would use GlusterFS for fault-tolerant storage. I would use the mount -t gluster</code> option on the servers as it would allow distributed nfs capability for storage of uploaded content. I would use MariaDB MaxScale as the database as it would allow for ease of scaling. In short, it would look similar to the following diagram: </a> To-do for 2016 2016-02-05T15:00:11+00:00 As an IT worker, I have to re-learn my position every 3 years. This is due to the fact that Microsoft releases a new version (of their Server software, Exchange, office suite, etc.), or there has been a technology shift from one Linux specialty to another. To combat this change and to stay ahead of the technology bubble, I have to be self-motivated to be on the front-end. Here is what I have scheduled for 2016:Reading Goals Databases for Small Business by Anna Manning</li> Programming in Go by Mark Summerfield</li> The Rails 4 Way by Obie Fernandez</li> Bootstrap for Rails by Syed Fazle Rahman</li> Bible in a Year (McCheyne)</li> The Varnish Book by Varnish Software</li> Nginx HTTP Server Second Edition by Clement Nedelcu</li> Nginx High Performance by Rahul Sharma</li> Making Home Work by Paul Chappell</li> MySQL High Availability by Charles Bell, Mats Kindahl, and Lars Thalmann</li> </ul> Video Course Goals Ruby Essential Training</a></li> Ruby on Rails 4 Essential Training</a></li> RSpec Testing Framework with Ruby</a></li> </ul> Personal Goals Achieve RHSCA Certification</li> Make 15 commits to an Open Source project</li> Take my family on a monthly activity</li> Blog once a week (Fridays)</li> </ul> Planning the Deployment of oVirt 2015-12-04T15:00:46+00:00 After I played with oVirt I needed to do several items: Migrate the oVirt engine to a new host</li> Migrate the storage from a single NFS share to GlusterFS</li> Move my VMs from Hyper-V to oVirt</li> Test my setup</li> </ol> Migrate the oVirt Engine to a new host</h2> This task was to prepare me for the disaster recovery scenario - what if my server room blew up - how would I recover my virtualization backbone? It might not be that important (considering I back up my VMs and can restore them anywhere), but when disaster strikes, tasks need to be simple because concentration will be difficult. As of version 3.5, oVirt had a good back up and restore operation: #backup example /usr/share/ovirt-engine/bin/engine-backup.sh --mode=backup --scope=all --file=/root/engine_backup --log=/root/backup_log #restore example /usr/share/ovirt-engine/bin/engine-backup.sh --mode=restore --scope=all --file=/root/engine_backup --log=restore_lg engine-setup </code></pre> All I had to do was run the backup script, copy the file, restore it, and run engine-setup</code>. To further harden my installation, I placed the backup line in my daily crontab</code> an hour earlier than my scheduled duplicity</code> run. Migrate the storage from a single NFS share to GlusterFS</h2> This next step was a bit under-sighted on my part. In my test lab, I had 4 VMs running on 1 NFS server. The NFS server I chose in the lab environment began to choke around 30 VMs and eventually crashed when I hit the 35 mark. It was not a limitation on oVirt or NFS, but on my hardware. GlusterFS</code> was extremely simple to set up and their documentation is easy to follow. Move my VMs from Hyper-V to oVirt</h2> I will discuss this in more detail in a following post. It was mostly running virt-p2v</code> on Windows and CentOS and import-to-ovirt.pl</code> on Debian and Ubuntu VMs. Test my setup</h2> During the transition, I had the opportune time to experience what it was like when my single point of failure (the one NFS server) crashed. It was also painful when DNS and DHCP were on servers on the failed storage server (oVirt didn't like that). Through this process, I have formulated several key steps to prevent a failure like that from happening again. Switching from Hyper-V to oVirt 2015-11-27T15:00:31+00:00 For quite some time I have heard that Hyper-V was a low player when it came to virtualization. It came with Windows and was the hypervisor of choice, but it had its limitations. In my environment, we had local storage and no clustering of hosts and consequently no high availability or fail over. This brought the first pain point - we need high availability. On one of my hosts, the broadcom Ethernet driver kept triggering flow control and would not resume causing all of the VM Guests to go offline. This triggered the second pain point - I need high availability yesterday. What matters most in a hypervisor environment is the tools you use to manage it. </blockquote> I took this principle as a guide when searching for a hypervisor environment. I first looked at Hyper-V and the new licensing costs it would accrue. Next I looked at the popular VMWare ESXi, but I heard the neat features were at a premium price and all I needed was high availability. I looked at Open Source versions like KVM, Xen, and OpenStack (which appeared to be too big for my 40 VM environment). Then I found RHEV's community version - oVirt. It had all the bells and whistles I needed - Linux hosts and high availability. oVirt's install documents were surprisingly simple as I quickly found 3 servers to set up: an engine server, a file server, and a VM Host. Once set up, I tinkered with it, and to my delight - everything worked right out of the box (on old hardware too!) My next step was to install a few VMs and test the high availability features. It was evident that oVirt was the solution to my pain points. Paying for Open Source 2015-11-13T14:59:38+00:00 While Open Source software is free to download, use, and depending on the license, free to distribute, it is not free to creator. The Open Source creators have to pay for hosting, branding (domain, etc.), coding (in time), and distribution. While some are offloading the costs by hosting the project on Open Source aware distribution channels such as GitHub</a> or BitBucket</a>, many projects still lack the funds they need. The general rule is: if you use it, you should pay for it. How you should pay for it is entirely up to you. Below are several ways you can pay for open source software. For Corporations</h3> Hire an Open Source Developer to work on the project he contributes to</li> Estimate how much it would cost annually with proprietary software and donate 10-30% of the amount evenly to various projects</li> Open Source internally developed software</li> Provide a publicly accessible mirror to an Open Source project</li> </ul> For Individuals</h3> Donate a fixed amount annually to an Open Source Foundation such as the Linux Foundation</a> or the Document Foundation</a></li> Donate a fixed amount to the specific project you use</li> Submit a patch that fixes a bug</li> Submit a patch that adds a feature (bonus points if it was previously requested by another user)</li> Offer support to other users using the program via the channels the creators recognize (mailing lists, forums, etc.)</li> Create a plugin that enhances the project</li> Promote the project you use most</li> Suggest your company switch to the project (using the paid version)</li> </ul> Have a suggestion that was not listed? Submit it in the comments below. Switching to Wordpress 2015-11-08T04:44:37+00:00 I have completed the migration of my blog to Wordpress. The reasons for the change are very simple: I was spending 45 minutes extra just to post 1 web page</li> I wanted to post to Google+ for every post I make - the service I was using only allowed for twitter.</li> I wanted an easier way to manage my RSS feed.</li> I wanted to spend more time writing and less time coding my website</li> </ol> Named Virtual Hosts on AWS EC2 2015-06-11T22:25:42+00:00 Named virtual hosts are not enabled by default on an Amazon AMI. To enable them, edit /etc/httpd/conf/httpd.conf and uncomment line 991: NameVirtualHost *:80 </code></pre> You can then begin adding your named virtual hosts in the /etc/httpd/conf.d/ directory. Below is an example of a named virtual host file: <VirtualHost *:80> ServerAdmin me@example.com DocumentRoot /var/www/example.com ServerName example.com ServerAlias www.example.com ErrorLog /var/log/httpd/error_example_com.log CustomLog /var/log/httpd/access_example_com.log common </VirtualHost> </code></pre> The difference between a named virtual host and an IP-based virtual host is that you need an additional IP address on your server for each virtual host you want to implement. Named virtual hosts come in handy when you only have 1 external IP address or if you want to host multiple websites on the same web server.

Andrew Wippler's Sketchpad - Web

feeling super productive

Additional insight into collaborative editors

Only Office for personal use

Dockerfile</h2> FROM node:20-alpine </span>WORKDIR /app </span>COPY package*.json ./ </span>RUN npm install --production </span>COPY . . </span>EXPOSE 3000 </span>CMD ["node", "index.js"] </span> </span></code></pre> Environment Variables</h2> The needed Environment variables are:</p>

Environment Variables</h2> The needed Environment variables are:</p>

Word processor to replace Google Docs

The problem</h2> I have a few frustrations with Google Docs</a>. It has gotten slow over the years. There is now a sudden push to migrate to Google Workspaces, which is something I do not want to do. There a few routes I can go in an endeavor to switch away from Google Docs.</p>

Web Options</h3> Office 365</li> Etherpad-lite</li>

Desktop Options</h3> LibreOffice</li> VSCode</li> Geany</li>

An open letter to Google

Goodbye Wordpress

From nginx to traefik (and solving X-Forwarded-For)

WordPress Containerization Boilerplate

Docker-izing WordPress for Kubernetes

Using Puppet to host a private RPM repository

Website protection

Common problems with Web Developers configuring LAMP/LEMP

Wayfinding with RPi

Linux, nginx, MySQL 5.7, and PHP 7 (LEMP) on AWS with free SSL

High performant chat application

To-do for 2016

Planning the Deployment of oVirt

Switching from Hyper-V to oVirt

Paying for Open Source

For Corporations</h3> Hire an Open Source Developer to work on the project he contributes to</li> Estimate how much it would cost annually with proprietary software and donate 10-30% of the amount evenly to various projects</li> Open Source internally developed software</li>

Switching to Wordpress

Named Virtual Hosts on AWS EC2

The problem</h2>
I have a few frustrations with Google Docs</a>. It has gotten slow over the years. There is now a sudden push to migrate to Google Workspaces, which is something I do not want to do. There a few routes I can go in an endeavor to switch away from Google Docs.</p>