Vscode on nunq.net

how to add global instructions to copilot in vscode

Fri, 03 Apr 2026 22:24:40 +0200

For some reason it was pretty hard to find documentation online on how to add cross-workspace custom user instructions to Copilot prompts in VSCode.

The docs usually only talk about the ones you can put into your repo at .github/copilot-instructions.md. That’s a bit tedious to do for every project though and the way you like Copilot to dance might annoy your colleagues. I did find this neat document with an even neater title: Azure Cosmos DB for NoSQL best practices in GitHub Copilot for Visual Studio Code and although its title seems sort of unrelated, it at least tells you where to put the files. That’s

~/.config/Code/User/prompts/*.instructions.md

for Linux.

So here’s my file:

global.instructions.md copy

# Instructions for Copilot

- Reply in English.
- You are on a Linux host.
- My shell is the fish shell, not bash! When running commands always use bash-compliant shellcode and execute using bash -c.
- Any plan files you write to disk should be put in a `agent-plans/` folder in the project with a `agent-plans/.gitignore` containing `*`.
- Give your plan files descriptive names, not just `PLAN.md`. When asked to write a new plan, do not replace/update the old ones, unless specified.
- Do not execute long inline scripts (>10 lines) as agent. Always write them to files first and then run them. They should be put in a `agent-scripts/` folder in the project with a `agent-scripts/.gitignore` containing `*`.
- Do not use `cat > script.py << 'EOF' ... EOF` syntax for writing files when running a command as agent. Write the file to disk using your native file write capabilities and then execute using `python script.py`. This applies to all scripting languages, including bash.

using the raspberry pi's built-in leds as status lights

Thu, 07 Mar 2024 20:42:05 +0100

At home, I have to run an SSH tunnel to activate the network connection (for reasons), which is kind of inconvenient since one device on the network always has to stay on and keep this tunnel alive, so I automated it using a Raspberry Pi.

A very simple script I wrote does this on my Raspberry Pi 3b+ and I thought it would be nice to have some sort of connection status indicator. But since I didn’t have any GPIO LEDs lying around, I did some googling and it turns out that you can override the built-in LEDs on the board itself. There is a red LED (PWR) that indicates if the Pi receives enough voltage, and a green LED (ACT) that blinks when the SD card is being accessed.

I wanted to show a green light when the connection is alive and a red light when it somehow dies, so I just created these two little scripts in PATH (make sure they have the executable bit set):

/usr/local/bin/set_green_led copy

#!/bin/bash
echo 0 > /sys/class/leds/PWR/brightness
echo 1 > /sys/class/leds/ACT/brightness

/usr/local/bin/set_red_led copy

#!/bin/bash
echo 0 > /sys/class/leds/ACT/brightness
echo 1 > /sys/class/leds/PWR/brightness

However, these commands require root privileges, so add this to the sudoers file to let your regular user run them without a password prompt:

alarm ALL = NOPASSWD: /usr/local/bin/set_red_led, /usr/local/bin/set_green_led

alarm is my username

Here is the full script:

/home/alarm/wifi.sh copy

#!/bin/bash
set -eu -o pipefail
PASS=""
USER=""
SERVER=""
SSH_OPTS="-o ServerAliveInterval=4 -o TCPKeepAlive=yes -o PubkeyAuthentication=no"

until sudo /usr/local/bin/set_green_led; sshpass -p "$PASS" ssh "$SSH_OPTS" "$USER@$SERVER"; do
 sudo /usr/local/bin/set_red_led
 echo -e "crashed $? at $(date)\n"
 sleep 5
done

I usually just run this script automatically after boot in a tmux session using a cronjob:

alarm's crontab copy

@reboot /home/alarm/init.sh

/home/alarm/init.sh copy

/usr/bin/tmux new-session -d -s ENTER
/usr/bin/tmux detach -s ENTER
sleep 3
/usr/bin/tmux send-keys -t 0 "cd /home/alarm;./wifi.sh" ENTER

The LEDs also need to be reset at boot:

root's crontab copy

@reboot echo 0 > /sys/class/leds/ACT/brightness && echo 0 > /sys/class/leds/PWR/brightness

And while we’re at it, I would also recommend setting up NTP time synchronization for the Pi, timedatectl somehow didn’t work for me so I resorted to just doing ntpdate in the root crontab every so often.

You can also find all the files mentioned in this repository.

making captive portals work with dns over tls in systemd-resolved

Tue, 19 Dec 2023 23:13:07 +0100

I’m currently using systemd-networkd, systemd-resolved and iwd together with my ad blocking DNS-over-TLS server for my networking, and it works quite well for most networks, even the pesky 802.1x types such as eduroam. But now picture this: you’re at a hotel, a public place or in a train and you want to use the free Wi-Fi but you can’t seem to get online because your custom config using some minimal network configuration doesn’t work, and you’re on the brink of just installing NetworkManager and rolling with the defaults. Fear not! This is how to make an exception for your DNS-over-TLS config for certain networks.

But first, let’s talk about why we need to do this.

how do captive portals work?

First you need to know that Wi-Fi access points always provide connected devices with a default DNS server over DHCP, which is usually your access point itself. Using this default DNS server, the AP can block all traffic to external sites by just making every domain name resolve to the captive portal login page (it then keeps track of your login status using your device’s MAC address). Note that there are also captive portals using HTTP traffic interception instead of DNS redirection, however, I found that these aren’t that common anymore, because they have issues with HTTPS traffic, which is most traffic nowadays.

current config

Your config files probably look something like this if your setup is similar to mine:

/etc/systemd/network/20-wlan0.network copy

[Match]
Name=wlan0

[DHCPv4]
# dont use dns servers advertised by dhcp server (router)
UseDNS=no

[DHCPv6]
# dont use dns servers advertised by dhcp server (router)
UseDNS=no

/etc/systemd/resolved.conf copy

[Resolve]
# insert your dns over tls server ip and domain name below, keep the '#'
DNS=1.2.3.4#dnsovertls.resolver.tld
# only use provided dns server, no fallback
FallbackDNS=
# use dns for all domains
Domains=~.
DNSOverTLS=yes
ReadEtcHosts=yes
Cache=yes
LLMNR=no
MulticastDNS=no
# hacky way to only make resolved listen on udp 127.0.0.1:53
DNSStubListener=no
DNSStubListenerExtra=udp:127.0.0.1:53

Note that by default iwd does network configuration such as handling DHCP itself, but I chose to let systemd-networkd do this, because I’m not sure if it’s possible to do such high-level config distinctions (Wi-Fi access point names, etc.) in the iwd config. So here’s my iwd config, too:

/etc/iwd/main.conf copy

[General]
# dhcp is done by systemd-networkd
EnableNetworkConfiguration=false

# random mac address
AddressRandomization=once
AddressRandomizationRange=full

[Network]
NameResolvingService=systemd

needed config changes

We need to create a config file that overrides the default interface settings shown above. To do this, just create the following file:

/etc/systemd/resolved.conf copy

[Match]
Name=wlan0
SSID="free_wifi"

[Network]
DHCP=yes
# because the dns advertised by routers is not encrypted
DNSOverTLS=no
# i dont expect hotspots to support dnssec
DNSSEC=no
# reset options set in global systemd-resolved conf
DNS=
Domains=~.

[DHCPv4]
UseDNS=yes

[DHCPv6]
UseDNS=yes

And exclude the SSID in your default config file:

/etc/systemd/network/20-default.network copy

[Match]
Name=wlan0
SSID=! "free_wifi"

If you want to connect to a new open Wi-Fi, just add its SSID to the two config files, explicitly including it in one file and explicitly excluding it in the other, like so:

/etc/systemd/network/20-default.network copy

[Match]
Name=wlan0
SSID=! "free_wifi_2"

/etc/systemd/network/30-captiveportal.network copy

[Match]
Name=wlan0
SSID="free_wifi_2"

Then restart all the relevant services:

sudo systemctl restart iwd systemd-resolved systemd-networkd

And go to http://captive.apple.com, which should be intercepted by the captive portal and redirect to its login page.

You should now also be able to see that you’re using a different DNS server when you run resolvectl status.

switching back dns servers

Now that you’re authenticated to the captive portal, you should be able to change back your DNS server using this command:

sudo systemd-resolve --interface wlan0 --set-dns="1.2.3.4#dnsovertls.resolver.tld" --set-domain "~." --set-dnsovertls=true

To verify this, run sudo ngrep port 853 (853 is the port used for DNS-over-TLS) and see the encrypted DNS traffic to the server address you used.

fish abbreviations not auto-saving

Mon, 10 Apr 2023 21:48:00 +0200

Although version 3.6.0 that removed this feature was already released in January, I only noticed it now.

So just in case anyone hasn’t noticed yet or in case I forget it: The fish shell no longer treats abbreviations as universal variables since version 3.6.0, because abbreviations are now built-ins, which comes with a lot of improvements which I’ll mention later (among others they’re faster now), but first the stuff that broke.

When you run abbr -a getip 'curl ifconfig.me' for example, the abbreviation is no longer automatically added to your config and thus persistent across sessions, it will only be accessible in the current session. Thus, since that release it has to be added manually to ~/.config/fish/config.fish. Just append this line:

abbr -a -- getip 'curl ifconfig.me'

The double dash tells the shell to stop processing arguments, this is useful if you want an abbreviation that starts with a dash, e.g. -X. I just do it because the old fish version stored them like this.

new features

Now for the improvements, it’s possible to use abbreviations anywhere now, not just at the beginning of the prompt, for example

abbr -a N --position anywhere --set-cursor "% | nvim"

To easily pipe stuff into neovim with just N, or

abbr -a eachfile --set-cursor "$(string join \n -- 'for f in *' 'test -f $f || continue' '%' 'end')"

To generate the boilerplate for loop to iterate over files in the current directory. When expanded, the cursor is put where the percent sign is (you can also set which character to use, but % is the default).

For more info including how to use functions with abbreviations, see the full v3.6 docs here.

ttartisan lens firmware upgrade on linux

Fri, 31 Mar 2023 23:05:00 +0200

TTArtisan, a Chinese lens manufacturer, publishes firmware updates for their lenses which can be upgraded by screwing on the included lens cover which has a USB-C port for firmware upgrades, quite neat!

On their download page however, they say that the upgrade is only possible on Windows PCs, which is rather nonsensical because the upgrade “procedure” (if you can even call it a procedure) only involves copying the new firmware.bin onto the lens, which acts as a mass storage disk when connected to a PC.

The one quirk I encountered is that my Arch Linux mounted the drive as read-only by default, so I had to manually mount it with:

sudo mount -o rw /dev/sdX /mnt/path

So no big deal. Just copy the bin file to the root directory of the drive after that and the upgrade is done!

sending cron mail only on fail

Sun, 19 Mar 2023 02:40:00 +0100

Crontab mail notifications are great, except when they’re spamming your inbox, even though the command ran fine and without issues. One might be tempted to do something like this to stop the madness:

MAILTO=cronfails@example.com
0 15 * * * /run/this/script.sh > /dev/null 2>&1

But then you won’t get any notifications and that’s not really an option if things fail (at least for me). What I do is use chronic (on Ubuntu it’s in moreutils) to execute my commands:

MAILTO=cronfails@example.com
0 15 * * * chronic /run/this/script.sh

That way, cron only sends a mail if the command did not run successfully (i.e. if the return code isn’t zero) and discards the command output on stdout otherwise, thus freeing your inbox from cron mail spam. The great thing is that you can set it individually for each job, so if you wanted to be sure that a command ran, you can just leave out chronic and the output redirection and still get that confirmation mail.

Apparently there is also a utility called cronic (without the ‘h’) which supposedly does the same and was written by the same author while also being newer, but in my testing it still sent mail when a command ran successfully. Your mileage may vary, but chronic just works for me at the moment.

By the way, crontab.guru is super helpful when devising more complex cron schedules.

january 2022 thoughts

Fri, 14 Jan 2022 22:22:00 +0100

I had some blog post ideas this month, but none of them seemed like they warranted a post of their own, so I am testing this thought collection post format, maybe this will become a recurring thing, I don’t know.

living in my homedir

Recently, I have subconsciously adopted this way of treating $HOME as a kind of todo board. Using your homedir this way may be nothing new for some people, but I really like the approach of just using touch test-packages-after-reboot to create an empty file that just reminds me to do something. This way I don’t have to clog up my actual todo kanban system with relatively unimportant things I have to do on my laptop.

jq isn’t always the best

While writing a small script that emulates gnome’s notification panel for my dwm setup (it displays the current and next month, marking today’s date, the local weather and the last few notifications using dmenu) I had to parse the JSON output of dunstctl history (dunst is my notification daemon). My first implementation was using jq, because pretty much everyone on the Internet tells you to use jq when you mention the words “bash” (or shell) and “JSON” or at least that’s my impression. The script was quite slow (it took a noticeable amount of probably like 150-200ms) till the panel showed up which isn’t really acceptable for a panel that’s meant to be brought up spontaneously to glance over it quickly, for example:

$ time dunstctl history | jq -r ".data[][].summary.data"
Executed in 131,05 millis fish external
 usr time 147,38 millis 0,00 millis 147,38 millis
 sys time 15,02 millis 1,43 millis 13,60 millis

$ time dunstctl history | grep -A2 '"summary" : {' | grep -oP '(?<="data" : ").*?(?="$)' | sed 's|\\||g'
Executed in 46,50 millis fish external
 usr time 37,96 millis 0,00 millis 37,96 millis
 sys time 23,54 millis 5,58 millis 17,95 millis

measured using fish shell's built-in time command, data omitted

That’s a massive difference, jq takes on average 125-140ms and the second command 40-50ms, even though it’s piped multiple times. And yes, there are probably ways to do this more efficiently, but that’s what I came up with and it works good enough. Also, while people who regularly use jq are probably used to it, I find jq’s syntax just annoying and I have to look up how to do something every time I use it, while grep is just so easy to use. By the way, here’s a picture of said panel:

calendar, weather and notification history. click to enlarge

http alternatives

While browsing a gemini blog webring of sorts I wanted to subscribe to a blog using RSS, but the issue was that while I could subscribe to the feed using an http gemini proxy, the links were all not clickable because they all start with gemini:// and Firefox doesn’t understand that. So I installed this auto proxy gemini sites extension and it seems to work, but only on the desktop, when I use the RSS reader app on my phone it’s still not clickable… But I presume this won’t be a regular problem since gemini or gopher sites are kind of hard to find organically on the “normal” web anyways, where most people spend their time. Personally, a gopher or gemini site seems cool but kind of unnecessary, it’s just a thing that would run on my server, potentially widening its attack surface and serving like 3 people if I’m lucky.

even smaller images

I’m always looking for ways to speed up my startpage, which automatically opens when I open a new tab. Previously I used WebP images in favor of JPGs or PNGs because of the file size. The image that is displayed on the site as decoration (or to set the mood) is always the biggest file transferred, even using the WebP format, it comes in at around 80-150kb, depending on the image. But since the AVIF image format is supposed to be supported by most relevant browsers since late 2021, I thought I’d convert them all. And there was a considerable size drop from 3.7mb (sum of all 39 image files) to just 1.7mb! After testing, I had to convert the three animated images back to WebP however, maybe it’s not supported or Firefox just couldn’t load them, haven’t looked into it further, but it’s quite impressive how these compression algorithms are still getting better.

pseudo productivity

This is a blog post idea I had lying around for a few months but never really had enough ideas/motivation to actually write the post, so let’s count it as an honorable mention, maybe. Last week, I read this short Economist article about performative work. In my short bullet point draft I summarized my idea as: Am I being productive or am I just tagging all of my todos in a different color? Which sort of gets at the same idea I think. The good thing is that I now no longer have to write that post :)

simple fixes

Fri, 12 Nov 2021 22:55:00 +0100

A few months ago I ordered a refurbished New Nintendo 3DS online, because my old 3DS XL wasn’t looking too good after almost 10 years of use and since I am quite fond of (and emotionally attached to) the console I wanted to get one I can still use in 10 years with a scratch-free touch screen and no spots where the paint has rubbed off.

As soon as I got it, I setup homebrew, which is basically a must for any somewhat old Nintendo console (because there’s no reason not to do it if the warranty has expired), gets you all the emulators and endless possibilities. Be careful with the Switch though (I’ve heard of frequent bans).

There was one thing that bugged me though, the charging port seemed to have some sort of loose connection, maybe the previous owner tugged on the cable too hard or the soldering is just bad. It just surprised me, because normally these devices are pretty durable, at least in my experience, they’re mostly used by and designed for children after all.

But this one was faulty in some way, so I thought about what I could do. The obvious (and only answer it seemed) was soldering a new charging port onto the PCB. I didn’t really want to do that however, mainly because I have zero experience soldering and the fear of potentially (read: very likely) bricking the device made this option rather unattractive…

After experimenting with plugging the charging cable in at different angles I realized something: No matter the angle, if the cable is not fully inserted into the port (with a 2-3mm gap), it charges perfectly fine. Very weird.

The fix I came up with is a rubber band, one of those loom bands which were really popular ~2014 is perfect, it prevents the cable from properly plugging in.

the "fix"

plugged in

Quite dull, but eh, it works.

moving back to gnome

Thu, 24 Jun 2021 22:32:00 +0200

I’ve been using suckless’ dwm for the last 1.5 years but I felt like switching back to GNOME, here are my findings.

the good

Even though GNOME 40 released shortly before I switched back, it looks pretty much the same since I last used it, so everything was rather familiar. After remapping all the keyboard shortcuts to mimic the dwm bindings, it was usable in an efficient way, with virtual desktops and fast switching between them using keyboard shortcuts.

One of the aspects I most appreciate now is that things just work out-of-the-box, I don’t need to manually edit connman files anymore to connect to new wifi networks and can replace my hacked-together bash script collection with either native GNOME functionality or extensions.

b-b-but muh bloat!!

Yes, in a deep corner in my brain, a package count of over 1000 ($ yay -Ps) annoys me. But it’s a freaking number and storage is cheap. Well, each to their own I guess…

why gnome?

It looks pretty and clean and from my experience it’s the most polished DE out there. All the other ones either seem like obnoxious Mac OS clones or look like Windows (Windows=ugly).

Also KDE has too many personalization options for me. And XFCE is great for low-end hardware but I mean look at it, the 90s want their GUIs back. I can’t even remember the other DEs :/

the bad

There’s no tiling and I hate that.
Now that I’ve used a tiling WM, looking at window title bars is a pain, to say the least.
GDM sometimes freezes on a black screen after resuming from suspend?
GNOME shell locks up when extracting big archives? That’s embarrassing.
Themes are cool but even the popular ones (I tried “Arc Dark” and some others) can be buggy in some programs (buttons not legible, etc.), so I just stuck with Adwaita Dark and it’s fine, honestly, it does the job.
GNOME shell extensions shouldn’t be downloaded and managed in a web browser.

summary

GNOME with good tiling support (like dwm does it) would be amazing, but let’s be honest that’s never going to happen. Luckily I still have the dotfiles so I can go back to my dwm setup, if I want to.

end note: computing is terrible and we should have never used sand in this way.

update november 2021

I have since switched back to using dwm.

… and then switched back to GNOME again a year later, it’s a never ending cycle.

old mp3 players and song cover art

Sat, 12 Jun 2021 18:11:00 +0200

A few weeks ago I found my old Sony Walkman mp3 player buried deep into old stuff from past. It’s a blue Sony NWZ-E something and it still looked great and after charging it up again, turned on. After I was done exploring the interfaces and drowning in nostalgia, I put some mp3 files on there but the cover art just wouldn’t show :(

about 10 forum threads from 201X later…

Apparently, some time in the 2010s, we switched to a new kind of JPEG files, so-called progressive JPEGs (whatever progressive in regards to an image file is supposed to mean), “NO MORE BASELINE JPEGS” because more efficient algorithm, I guess? I didn’t actually look it up :/

Objective: Convert the embedded cover art to baseline JPEGs, preferably in the shell, because I’m not gonna click the same 5 buttons in a GUI for 30+ minutes.

several StackExchange threads later…

As always there seem to be a billion ways to do this, half of them didn’t work for me or my googling was bad. Some program called “eyeD3” (it’s python, I think) finally worked for me and from there on it was just putting it into a for loop and not noticing that I mistyped the directory name two times, oh well.

Anyways, here’s the code (gist) for the fish shell:

mkdir ./img
for i in (ls -1 *.mp3)
 # export covert art from mp3
 eyeD3 --write-images=img "$i"
 # remove all embedded cover art
 eyeD3 --remove-all-images "$i"
 # convert to baseline and re-import
 convert img/FRONT_COVER.jpg -interlace none img/cov.jpg
 eyeD3 --add-image "img/cov.jpg:FRONT_COVER" "$i"
 rm img/*
end
rm -r ./img

Now I have cover art on my 2011 mp3 player, cool :)

update february 2022

By the way, here’s how to encode video for the player:

ffmpeg -i in.mp4 -c:v mpeg4 -r 24 -s 320x240 -c:a aac -b:a 128k out.mp4

mailchimp newsletters as rss feeds

Tue, 09 Mar 2021 23:34:00 +0100

So these services that turn a newsletter into an RSS Feed have been around for some time now.

Odds are, if you use an RSS reader, you probably know about services like kill the newsletter that receive the newsletter for you and turn that into an Atom feed. But recently I discovered that Mailchimp, a service widely used for newsletter creation and management (in fact, I can’t even remember the last time I encountered a newsletter that wasn’t hosted on Mailchimp), publishes all newsletter items in an archive listing which has RSS feeds.

getting that link

Because these feeds are rarely advertised and depending on how a website manages the sign-up process, you have to do some digging and URL copy-pasting.

If they send you directly to mailchimp, the URL looks something like this:

https://WEBSITENAME.NODE.list-manage.com/subscribe?u=ABC&id=XYZ

That’s probably the easiest way to get the needed u and id parameters.

If their sign-up involves typing your email address into a magic box on their site, just use a 10 minute mail and get the values from clicking the link they send.

Then you plug them into this URL, make sure to use the same NODE:

https://NODE.campaign-archive.com/feed?u=ABC&id=XYZ

And that’s it, bloated HTML mails in your feed reader, yay! By the way, this should be obvious, but your reader kind of needs to have HTML support or else it’ll just be a wall of HTML and CSS code.