Month: July 2016

Outdoor Project – AnyaLand Phase 1

Instead of trying to build a whole Anya play land under the maple tree in our front yard, I’m starting a one-thing-at-a-time approach. I picked up a slackline to run between the big maple and another maple just under fifty feet to the South.

The next step is to make a swing of sorts. I am basing her swing on a woven one I found at Magic Cabin:

WovenSwing

I got a lot of 550 paracord. I will bend a metal tube to form the circle and wrap that circle in purple paracord. More purple paracord will be woven into the wrapping to give me a mount point for the web. I’ll then weave inward around the circle going through the rainbow colors. The final step will be to weave some black paracord into the circle to give us a couple of ropes to hang up in a tree.

That’ll give us a swing and balance activity. Next year we can work on getting a fort, slide, and rock wall.

 

Peanut Butter Oat Bites

Ingredients:

1 1/2 cup old fashioned oats
1/2 cup shredded coconut
1 t vanilla extract
1 T carob powder
2 cups unsweetened peanut butter

Method:

Toast oats in a pan. Powder 1/2 cup of the oats in a food processor.

Toast the shredded coconut in a pan.

Place the peanut butter in a bowl. Stir in the vanilla.

Slowly add the powdered toasted oats and stir to combine. Add the carob powder.

Add the shredded coconut and whole oats. Stir to combine.

Using a tablespoon (or something similar – small ice cream scoop, small melon baller), scoop out some of the mixture. Using your hands, roll it into a ball. Place the balls on a lined cookie sheet and refrigerate for several hours.

These are a little bit like cookie dough — not as sweet since there’s no sugar added. You can add a tablespoon or two of honey if you prefer a sweeter treat.

Beware: an un-monitored tiny person may imitate the rolling process when eating these. They’re a little crumbly and make a huge mess.

Reverse Proxying WebSockets to An MQTT Server

If you are trying to reverse proxy OpenHab – that’s over here. This post is about maintaining your own private MQTT server and making it accessible through a reverse proxy.

We want to be able to update our presence automatically (without publishing our location information to the Internet). Scott found a program called OwnTracks that uses an MQTT server – and there’s an MQTT binding from OpenHab that should be able to read in the updates.

We didn’t want to publish our home automation server to the Internet, but we do want to send updates from the cellular data network when we leave home. To accomplish this, I set up a reverse proxy on our Apache server.

The first step is to get an MQTT server up and working — we Installed a mosquitto package from Fedora’s dnf repository

Once it is installed, create a directory for the persistence file & chown the folder to mosquitto uid

Generate a bunch of certs using the ot-tools (git clone https://github.com/owntracks/tools.git). I edited the generate-CA.sh file in the ot-tools/tools/TLS folder prior to running the script. It will more or less work as-is, but modifying the organisation names makes a cert with your name on it. Not that anyone will notice. Or care 🙂 Modifying the IPLIST and HOSTLIST, on the other hand, will get you a cert that actually matches your hostname — which isn’t a problem for something that doesn’t verify host name information, but saves trouble if you get your hostnames to match up.
IPLIST & HOSTLIST
CA_ORG and CA_DN

Then use generate-CA.sh to generate a CA cert & a server cert. Copy these files into /etc/mosquitto/

Edit the config (/etc/mosquitto/mosquitto.conf) – LMGTFY to find settings you want. Specify a location for the persistence file, password file, and add in the websockets listeners (& ssl certs for the secure one)
persistence_file /var/lib/mosquitto/mosquitto.db

password_file /etc/mosquitto/passwd

listener 9001
protocol websockets

listener 9002
protocol websockets
cafile /etc/mosquitto/ca.crt
certfile /etc/mosquitto/mosquittohost.rushworth.us.crt
keyfile /etc/mosquitto/mosquittohost.rushworth.us.key

Add some users
/usr/bin/mosquitto_passwd /etc/mosquitto/passwd WhateverUID

Start mosquitto
mosquitto -c /etc/mosquitto/mosquitto.conf

Monitor mosquitto for the owntracks ‘stuff’
mosquitto_sub -h mosquittohost.rushworth.us -p 1883 -v -t ‘owntracks/#’ -u WhateverUID -P PWDHereToo

Setting up the reverse proxy
The big sticking point I had was that the Apache WebSockets reverse proxy has a problem (https://bz.apache.org/bugzilla/show_bug.cgi?id=55320) which is marked as closed. Fedora has 2.4.23, so I expected it was sorted. However using tshark to capture the traffic showed that the relayed traffic is still being send as clear.

Downloaded the exact same rev from Apache’s web site and checked the mod_proxy_wstunnel.c file for the changes in the bug report and found they were indeed committed. In spite of the fact I *had* 2.4.23, I decided to build it and see if the mod_proxy_wstunnel.so was different.

Make sure you have all the devel libraries (openssl-devel for me … run the config line and it’ll tell you whatever else you need)

Get apr and apr-util from Apache & store to ./srclib then gunzip & untar them. Rename the version-specific folders to just apr and apr-util

Once you have everything, configure and make
./configure –prefix=/usr/local/apache –with-included-apr –enable-alias=shared –enable-authz_host=shared –enable-authz_user=shared –enable-deflate=shared –enable-negotiation=shared –enable-proxy=shared –enable-ssl=shared –enable-reqtimeout=shared –enable-status=shared –enable-auth_basic=shared –enable-dir=shared –enable-authn_file=shared –enable-autoindex=shared –enable-env=shared –enable-php5=shared –enable-authz_default=shared –enable-cgi=shared –enable-setenvif=shared –enable-authz_groupfile=shared –enable-mime=shared –enable-proxy_http=shared –enable-proxy_wstunnel=shared

Rename your mod_proxy_wstunnel.so to something like mod_proxy_wstunnel.so.bak and the grab mod_proxy_wstunnel.so that just got built.

Grab the CA public key & the server public and private keys that were generated earlier & place them whereever you store your SSL certs on your Apache server

Create a new site config for this reverse proxy – SSL doesn’t do host headers so you need a unique port. Clear text you can use a host header. Don’t forget to add listen’s to your httpd.conf and ssl.conf files!

ProxyRequests Off
<VirtualHost #.#.#.#:##>
ServerName mosquitto.rushworth.us
ServerAlias mosquitto
DocumentRoot “/var/www/vhtml/mosquitto”

SetEnv force-proxy-request-1.0 1
SetEnv proxy-nokeepalive 1
SetEnv proxy-initial-not-pooled
SetEnv proxy-initial-not-pooled 1

ProxyPreserveHost On
ProxyTimeOut    1800

ProxyPass               /       ws://mosquittohost.rushworth.us:9001/
ProxyPassReverse        /       ws://mosquittohost.rushworth.us:9001/
</VirtualHost>

<VirtualHost #.#.#.#:##>
ServerName mosquitto.rushworth.us
ServerAlias mosquitto
DocumentRoot “/var/www/vhtml/mosquitto”

SetEnv force-proxy-request-1.0 1
SetEnv proxy-nokeepalive 1
SetEnv proxy-initial-not-pooled
SetEnv proxy-initial-not-pooled 1

ProxyPreserveHost On
ProxyTimeOut    1800

SSLEngine On
SSLProxyEngine On
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLCertificateFile /etc/httpd/conf/ssl/mosquittohost.rushworth.us.crt        # These are the public and private key components
SSLCertificateKeyFile /etc/httpd/conf/ssl/mosquittohost.rushworth.us.key        #     generated from generate-CA.sh earlier.
SSLCertificateChainFile /etc/httpd/conf/ssl/ca.crt                # This is the public key of the CA generated by generate-CA.sh

ProxyPass               /       wss://mosquittohost.rushworth.us:9002/
ProxyPassReverse        /       wss://mosquittohost.rushworth.us:9002/
</VirtualHost>

Reload apache. Create a DNS hostname internally and externally to direct the hostname to your reverse proxy server.

Configure the client — generate a key for yourself & merge it into a p12 file (make sure your ca cert files are still in the directory – if you *moved* them into /etc/mosquitto … copy them back:
sh generate-CA.sh client lisa
openssl pkcs12 -export -in lisa.crt -inkey lisa.key -name “Lisa’s key” -out lisa.p12
You’ll need to supply a password for the p12 file.

Put the ca.crt (*public* key) file and your p12 file somewhere on your phone (or Google Drive).

Client config – Install Owntracks from Play Store
Preferences – Connection
Mode:    Private MQTT
Host:    hostname & port used in your **SSL** config. Select use WebSockets
Identification:    uid & password created above. Device ID is used as part of the MQTT path (i.e. my lisa device is /owntracks/userid/lisa). Tracker ID is within the data itself
Security:    Use TLS, CA certificate is the ca.crt created above. Client cert is the p12 file – you’ll need to enter the same password used to create the file

If it isn’t working, turn off TLS & change the port to your clear text port. This will allow you to isolate an SSL-specific problem or a more general service issue. Once you know everything is working, you can drop the clear text reverse proxy component.

Voila – reverse proxied WebSockets over to Mosquitto for OwnTracks.

Pad Thai Recipe

The Pad Thai recipe that I’ve developed isn’t authentic, but it is a tasty version that avoids fish sauce, pickled radish, and dried shrimp (all of which are not generally stocked in our house).

Ingredients:
Sauce:
1/3 cup tamarind paste
1/3 cup vegetable stock
1/3 cup tamari sauce
1/4 cup palm sugar

Veggies:
Shredded carrots
Shredded radish
Diced onion
Thinly sliced red peppers

Protein:
Tofu (frozen and thawed, pressed to drain)
Shrimp
Eggs

Other:
Rice noodles
Chopped peanuts
Bean sprouts
Lime
Sesame oil

Method:
Soak rice noodles in cold water while preparing the rest of the dish.

Combine the sauce ingredients in a pot and simmer over low heat, stirring until the sugar dissolves.

Put a little sesame oil in a pan. Add the tofu & cook until crispy. Remove from pan.

Put a little sesame oil in a pan. Add the onion & saute until soft. Remove from pan.

Put a little sesame oil in a pan and cook the shrimp. Remove from pan & wipe out pan.

Slice lime into very thin circles.

Scramble the egg.

Make sure the rice noodles are soft – you should be able to wrap them around your finger without breaking.

Heat the pan over medium heat. Put a quarter of the sauce into the pan, stir in a quarter of the rice noodles to coat with the sauce. Cook for two or three minutes. The noodles should be *almost* completely cooked.

Stir in protein and cook for another minute. Remove from heat and add in veggies. Serve topped with peanuts, bean sprouts, and thinly sliced lime. Drizzle a little extra sauce over the dish.

Put another quarter of the sauce into the pan & repeat.

Chocolate Peanut Butter Dip

We picked up a piece of peanut butter pie on our way back from New York this weekend. It was incredible — tangy, sweet, and peanut buttery. I found a recipe that sounds similar (ours had a chocolate cookie crust) on Epicurious. I can see making it again – and topping it with curled dark chocolate shavings.

We didn’t want Anya eating too much of it though. It was late, and even a little bit of sugar means half an hour of running in circles. She was still hungry, though … so I made a carob peanut butter dip for her that was pretty close to this pie. I took two tablespoons of plain Greek yogurt, added a tablespoon of real peanut butter (no additives, no sweeteners), and then added carob powder until it was sweet and chocolaty enough. Mixed it all together with a fork (it would be interesting to make more of it and whip it to achieve the same consistency as the pie). Served with sliced apples, it’s a quick not-too-sugary snack.

DSC_9554

Mmmmm!

Cultural Heroin

One of the most astute observations of what Trump has to offer comes from JD Vance in The Atlantic: https://www.theatlantic.com/politics/archive/2016/07/opioid-of-the-masses/489911/

“Trump is cultural heroin. He makes some feel better for a bit. But he cannot fix what ails them, and one day they’ll realize it.”

I think Trump has a cathartic release of anger and frustration. He has someone to blame. He has a simple solution that sounds great unless you bother to question if summoning unicorns actually can cure Aunt Sally’s meth addiction or if pouring billions of dollars into “the wall” would actually bring back mining jobs lost to automation. It’s not real, but the idea makes someone feel better for a bit.