refactor: migrate to the screen system

Migrate all the existing activities to screens. Take example on the HomeScreen.
We will not be able to launch them in an other way than changing what is launched from MainActivity at first.
Issue #39 will enable us to switch between screens by using the equivalent of a router (it's called navigation in compose).
DoD :

[WONTDO (this sprint)] The activities that already existed in the previous sprint are migrated to screens, and there is some way to navigate to them (buttons in the navbar or buttons in other screens)
[x] There is a clear explanation on how to migrate activities to screens for in-dev activities

Done !


Briefcase abandon fix

Added a check before abandoning briefcase if it owns any locks. This prevents users without appropriate permissions from attempting to release briefcase locks.
Added tests to ensure correct behavior

 Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.You have signed the CLA already but the status is still pending? Let us recheck it.


What files are necessary for browser usage ?

Hello,
First, thank you for this nice library.
If I want to use csvtojson in the browser, which files are necessary ? csvtojson.min.js is not enough. I think I can delete the bin folder, and what else ?

Hi,
I use
https://cdn.rawgit.com/Keyang/node-csvtojson/e963d121/dist/csvtojson.js
in http://keyangxiang.com/csvtojson/
~Keyang
On 23 March 2017 at 15:50, stla<EMAIL_ADDRESS>wrote:

Hello,
First, thank you for this nice library.
If I want to use csvtojson in the browser, which files are necessary ?
csvtojson.min.js is not enough. I think I can delete the bin folder, and
what else ?
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/Keyang/node-csvtojson/issues/153, or mute the thread
https://github.com/notifications/unsubscribe-auth/ABCs97dG8xh5JNNyEerRb-FQphxWFSpGks5ropSsgaJpZM4Mm9Io
.

This file is enough but not the min.js ?
Thank you, I will try.

Indeed, this works. Thanks!


Cmdtool

Add command line arguments
-t For choosing multiple tests or ranges of tests
-v Shows version, Copywrite and Licence
-i Forces the tests to not abord on the first error
-l lists all tests with their number
-h for help

The -v option doesn't work for me.
cave02:txt-suite kai$ ./txt-suite -v
Can't open license file

Also, it's copyright, not Copywrite.
Please document that -t accepts ranges. Also, it should say that tests are ordered by their number, not the numbers itself.
Please don't capitalize "test" in -l and replace "Help!" with the name of the tool and it's usage. Something like this:
Intel TXT test suite.
Usage: txt-suite [-l] [-h] [-v] [-t TESTSPEC]
(detailed docs about command switches)

Rebased and merged


Toolbar not handled correctly while viewing a thread

While viewing a thread in full view, the plugin currently removes the More button instead of the Member List button, leaving the user with two Member List buttons and no More button.
Discord layout update:
A new problem has appeared; the Member List button should be removed while viewing a thread in partial view as clicking it in this state will not do anything. There also appears to be an issue with the member list refreshing incorrectly that results in it becoming temporarily broken after a thread is opened (in partial view).

Fixed in pre-release


Rename CLI argument to json-config-url

All other CLI arguments use kebab-case, this keeps it consistent.
That argument has not been released yet, so we don't need to keep the old spelling as a fallback.

BTW https://crystal-lang.org/api/versions.json is uploaded already, we can change the doc generation in the CI to start using that.
Would the docs work still for local usages if they were built with --json-config-url, right?

Would the docs work still for local usages if they were built with --json-config-url, right?

Of course.


Need good guidance on tabris2/nightly/scratchpad

Problem description
Unable to get the latest syntax per migration guide workig for collectionView on scratchpad

Actual Behavior: collectionView is using old syntax in ScratchPad but nightly build expects them to have new syntax
Expected Behavior: Scratchpad to support tabris2 syntax for collectionView.

Environment

Device (name and OS version):
Tabris.js version: nightly

Code snippet
// A minimal, *self-contained* code snippet to reproduce the problem:

Duplicate of #1194

@ralfstx Please let us know what settings one has to use in Build settings & Dependencies. Hope ScratchPad is latest.

@natanraj Check the other (linked) ticket you created

@natanraj The scratchpad is currently bound to the latest development version, 2.0 RC 1.
Please note that you don't have to use the scratchpad to try out your snippets. You can easily serve them from your local machine using the Tabris CLI.

$ npm install -g tabris-cli
$ git clone https://github.com/eclipsesource/tabris-js.git
$ cd tabris-js/snippets
$ tabris serve button.js


push more cofree operations through the trampoline

Right now only a few operations (such as <$>) are pushed through the trampoline, the remainder are executed on the stack which will mean the cofree data structures must be small enough to process recursively.

Since this was opened in 2014 (7 years ago!?) I'm not sure whether this issue is still relevant.


[Feature request] Be able to scan Github wiki page repo

Hi,
I have a Github repo and I'd like to check its wiki page repo for broken links as well.
https://github.com/kaktusztea/km100/wiki
Created a workflow for it:
https://github.com/kaktusztea/km100/blob/master/.github/workflows/markdown_links_wiki.yml
But it fails and I don't know why.
https://github.com/kaktusztea/km100/actions/runs/9646569412
Run umbrelladocs/action-linkspector@v1
Run reviewdog/action-setup@v1
Run set -eu
🐶 Installing reviewdog ... https://github.com/reviewdog/reviewdog
Run set -eu
📖 reviewdog -h
Run $GITHUB_ACTION_PATH/script.sh
🔗💀 Installing linkspector ... https://github.com/UmbrellaDocs/linkspector
 Running linkspector with reviewdog 🐶 ...
  reviewdog: failed to unmarshal rdjson (DiagnosticResult): proto: unexpected EOF
  Error: Process completed with exit code 1.

Additionally on wiki page you don't use link like "Something.md", but only as "Something" that points to the selected page.

It should have an enhancement label instead of "bug", but I can not change it.


update homu

Brings in https://github.com/servo/homu/commit/d3f13516128de34cc3f77a9d879f84e5f5f3833b

This change is

r=me, although the build is busted so we can't land this right now.

:umbrella: The latest upstream changes (presumably #622) made this pull request unmergeable. Please resolve the merge conflicts.


About the tested IXI images

Hello, author of InverseSR.
We are trying to utilize your nice work as our baseline in our paper for SR.
Due to the large resource requirement, we just want to use the same test images and then compare the evaluated PSNR, .. and other factors written in your paper.
I wonder the test images are the list below ( I saw it on your github code).
Thank you so much for your nice work.

Hi,
Thanks for your interest in our work! Yes, these are 100 subjects used for testing.
Please don't hesitate to let me know if you have future questions!
Jueqi

Hello, may I ask why the reconstructed syns images is incomplete and half missing when I test T1 images in IXI dataset?

Can you share with me what test T1 image and code you use?

The dataset dataset T1 022：http://brain-development.org/ixi-dataset/

one is syns,the others is target.
The code I'm running is /job_script/InverseSR(ddim).sh

Hi, the image put into the model should be registered into a MNI space (the brain needs to be roughly in the center of the image), following what the pretrained Brain LDM has done, we use UniRes to perform that.

Hello I have one more question.
I tried to use BRGM_decoder, but I found that the top of the skull is prone to blurred.
Is it inherited shortcoming of the inverseSR due to using corrupted image, or do you think there is any possible reason for this?
Thanks for you attention.

Hi, I do think it is because the pre-trained model used corped images (it said in the Brain LDM paper, they cropped the image to obtain a volume of 160 × 224 × 160) for training. So for some images, the top of the skull is cropped, making the generated skull blurry.
Thanks,

Hi, the image put into the model should be registered into a MNI space (the brain needs to be roughly in the center of the image), following what the pretrained Brain LDM has done, we use UniRes to perform that.
Hi,I tested the image diretly using nii format,and the pre-dim was axial.The result is the same as before,only half and generation is fuzzy,syns is not clear as the target.

Hello,cloud you help me slove the problem?

数据集 T1 022：http://brain-development.org/ixi-dataset/   一个是 syns，另一个是 target。我正在运行的代码是 /job_script/InverseSR（ddim）.sh

@wendy-xiaozong @06Liz

Can you give us the details to slove the problem of only half of images? @wendy-xiaozong

Hi @06Liz ,
I uploaded a new file: ur_IXI022-Guys-0701-T1.nii.gz to the google drive link: https://drive.google.com/drive/folders/110l68um6gUJzECIv0AyF-4Fcw0rrQgA9
I think you can get the whole image from it. The half image problem to me is still that the brain is not in the center and should go through the UniRes before being put into the model.

Why is the voxel 1X1X1 before and after reconstruction? Where is the super-resolution reconstruction represented? Where is the 3D reconstruction represented?Because the output is the two-dimensional.

How to see the input is 3D how many mm to reconstruction?Target is 1mm，so where are the 4mm
and 8mm inputs respresents? Where is the 3D reconstruction represented?Because the output is the two-dimensional. @wendy-xiaozong


Encrypting User Data with Kairos - missing kubectl command(s)

the document mentions some kubectl commands are needed to add the TPM hash, but I couldn't find the kubectl command or examples.

I guess you mean here: https://kairos.io/docs/advanced/partition_encryption/#register-a-node
There is a sealedvolume resource that you have to apply right below but I agress, we can make it more clear.


Update tests

A bunch of updates:

Fixed and updated tests to Rspec3
Fixed integration tests
Reverted the resolution of key paths

Last introduces a somewhat breaking change so an adjustment in logic to follow.

@erjohnso - Please merge

LGTM - thank you very much @Temikus!


mistake in train.py for anchor settings

Hi zhengyuan!
At line 107 of the train.py file, it should be 'referit' and not 'refeit'.
I found this problem when loading the ReSC_base_referit.tar model file you provided to run on the test set.
The test set performance was 35% when I used anchor set:
if args.dataset=='refeit':
        anchors = '30,36,  78,46,  48,86,  149,79,  82,148,  331,93,  156,207,  381,163,  329,285'

and reached the performance reported in the paper when I used anchor set:
else:
        anchors = '10,13,  16,30,  33,23,  30,61,  62,45,  59,119,  116,90,  156,198,  373,326'

Hi @nku-shengzheliu,
Thank you so much for catching this!
I'll remove the referit-specific anchor, and add a comment to point to this issue for reference.
Thank you :)


Update default colors of components to orange/primary

Summary
It would be great if we updated all the default colors of the components from blue to orange (or as close to primary as possible).
This would greatly improve the visual impact of the component library in accordance with the new docs layout.
Basic example
For example, here's how the cards looks now:

How it would look better in the context of Flowbite Svelte:

For this to take place I updated the Button.svelte code:
| 'redToYellow' = group ? (outline ? 'dark' : 'alternative') : 'primary'; // primary as fallback

Of course, we would have to update the tailwind.config.js file to automatically set the primary color via the Flowbite plugin or at least clearly document this via the theming documentation for colors.
Ideally, we could also use the the Flowbite Svelte CLI issue (https://github.com/themesberg/flowbite-svelte/issues/723) to update the tailwind.config.js file of the user with the default primary colors and other settings.
Motivation
It would greatly improve the look and feel of the component library and we should make it easier for users to use a primary color across their application for better theming experience as opposed to just flat colors - we should still keep that feature available but we should shift to using primary, secondary, light, dark colors.

I also update the docs.

We need to apply primary color to checkbox and radio components as well.

We need to apply primary color to checkbox, range, select, textarea, toggle and radio components as well.

Hello @shinokada - the change is great! As you've said, we need to apply this to the other components too.
I think we can keep this issue open as a "parent" issue until all of these are solved.
Quick question - does the primary color work out of the box when installing flowbite-svelte or do the users need to set the primary colors manually inside the tailwind.config.js file? Asking this to make sure that it's documented.
Cheers,
Zoltan

You need to set the primary color. I explained on quickstart and introduction pages.

Todo list

[ ] Stepper indicator
[ ] Range
[ ] Select
[ ] Textarea
[ ] Toggle
[ ] Radio
[ ] Banner page
[ ] List group page
[ ] Progressbar
[ ] Score rating
[ ] Speeddial
[ ] Default spinner
[ ] Tab
[ ] Timeline
[ ] Toast
[ ] Change Flowbite blue logo in examples to Flowbite Svelte

I don't like that solution with the modification of the tailwind.config.js.
Try to use the <Button>Default</Button> in REPL. You can be surprised.

@jjagielka Do you have any suggestions?

@shinokada  Is it maybe possible to define the primary color, if not explicitly set in the config, as blue? <Button>Default</Button> would now be blue by default, as it was before this change. I myself was quite confused after updating to the newest version why all my buttons were no longer blue but white, and it took me a while to get behind the reason.

@shinokada Thank you, I defined the primary color as blue in the tailwind.config.cjs file and now it works again. I appreciate your quick response!


Spelling and grammar

/assign @munnerz
Fixes some spelling and grammar with a pass through the docs

/lgtm

/lgtm


[Question] Compatibility with upcoming 1.20.5/1.21 technical features & changes

Hello! Just wanted to query about how Magic is likely to play with the various upcoming technical changes due to arrive in the next few Minecraft updates. It seems that many existing functions for Datapacks, Resourcepacks, and other base game features are being completely overhauled/changed. For example, there are changes to item & entity tags, enchantments, attributes, entity data, and much more far beyond my own scope of understanding. Myself and some others on Discord just wanted to check & see if any of these changes are likely to interfere with Magic when it updates to these versions, perhaps causing any delays or incompatibilities when updating? Of course, it may be too difficult to say whether these will cause an issue ahead of their release (and ahead of any Spigot/Paper builds) but I just thought I'd ask anyway just in case, no worries if it's too early to say. Thanks!

My hope is always that Spigot is able to abstract away such changes, leaving only the sensitive parts of the plugin that don't rely on the Spigot API.
There's not a whole lot of that anymore, though. I'd like to reduce it as much as I can, so probably if anything comes up that's the direction I will go in.
I had planned (and started developing on) a new version of Magic that would be API-only, but I'm not sure I'll ever really finish it. It's also almost impossible to do while maintaining backwards compatibility since I rely on NBT tags outside of the way Spigot item metadata works.
Anyway, that all said, it is probably too early to say and I'll never really know until the update drops, and then only after the Spigot API updates.

Thanks so much for the speedy response! Here's hoping things will be smooth sailing once Spigot begins to update :)

Looking at 1.20.5 today, and there indeed are some pretty complex changes.
Lots of big changes to Mob AI and pathfinding which look messy.
Also changes to things that never get touched, like item NBT tags which are of course crucial to the plugin.
So this may take me a while. It may also accelerate my desire for an API-only (or close to it) version of Magic.

Ah, that's unfortunate... Though I suppose it's to be expected, given how much has changed in this update in relation to item NBT which of course Magic relies heavily on. (Though I will say it's strange that such massive changes came in a relatively minor version, rather than 1.21+.)
No worries about any delays in updating though, this clearly seems like a monumental task and as always your work is greatly appreciated! :)
I would also love to hear about the mechanisms/major differences of this potential API-only version of Magic- e.g. would this be functionally similar/different to how Magic works at the moment? Potentially be more future-proof?

The main idea would be to future-proof it, yeah.
Ideally I'd like to get to a point where the plugin generally doesn't need to update anymore when new Minecraft versions come out. Other than updating and fixing major bugs I don't really do much here anymore. So the ultimate goal would be to put the plugin into an indefinite "maintenance mode" sort of lifecycle and probably not update much anymore.
I know that's maybe not great to hear, but the truth is I just don't have time (and to a degree, interest) in the amount of work it takes to manage the plugin anymore. So having a future-proof base would take the pressure off and allow me to spend what time I do spend here on important (or maybe even fun) changes instead of the mundanity of slogging through these updates.
There are a few major obstacles to this mythical API-only plugin though:

Compatibility with existing magic items. Spigot now has a way to store data on items, I could switch to this but there would be no way to read data off of existing items. So without some migration step, which would require an add-on or other plugin that would require updating, anyone moving to Magic 11 would basically have to do a server reset. I want to avoid that at all costs but can't really think of a good way. Some of these NBT changes may force my hand, we will see.
Some deeper system, particularly mob AI, have no API equivalents. Without investing the time in creating and submitting a mob API (for instance), getting it approved and integrated into Spigot- it would be impossible to keep these features in an API-only Magic. I am considering throwing in the towel on mob AI since MythicMobs is so prevalent, but again we will see.
Backwards compatibility. I'd probably just drop it. If/when Magic 11 ever happens it would likely only be compatible with the current Minecraft version (e.g. 1.21) and forward.

That's totally understandable, the sheer scope and capabilities of Magic are pretty monumental, so I can only imagine that constant maintenance to keep it all in working order with every new update must get exhausting, and I can 100% empathize with wanting to spend your time on more interesting things/occasional fun updates rather than constant version upgrades. In that case, an API-only version of Magic would be pretty phenomenal (if possible) to save the hassle & burnout from maintenance updates, as well as ensuring server-owners can update quickly. Speaking for myself here, I would be more than happy to migrate to this version & rebuild my servers and configs from the ground up in order to use it going forward. However, I can definitely see it being a struggle for others who rely on backwards compatibility, which Magic has always gone above and beyond to ensure compatibility with. Though it does get to a point where it becomes too much work to be worth maintaining, so if Magic 11 was only compatible with a certain version onwards, I expect many would understand.
I may not be very experienced in plugins or coding, but if you do ever decide to go forward with the API-only version, I'd be more than happy to help out rebuilding some of the base configs or doing any resourcepack work/maintenance if needed!


WIP: Optimize sourcemaps (collapse spurious mappings)

A WIP to try and implement the source-map-compactor optimizations straight into magic-string.
This will keep the functionality of the hi-res sourcemaps, while collapsing all the unneeded one-character mapping (keeping mappings for longer stretches of text).

@mourner I'm afraid that implementing this optimization is no longer a priority for me.

Closing as stale.


Setting Node Scale to 0 unlocks component ratio lock (even if it still shows as locked)

Godot version
v4.1.stable.mono.official [970459615]
System information
Windows 10 - v4.1.stable.mono.official [970459615]
Issue description
When setting a node's scale to 0, even if the Component Ratio lock is enabled, the scale axis edited next will update as if the Component Ratio is unlocked. During this, the component ratio icon does not update to show Unlocked. Even if set to 0, I would expect changing the scale to remain with a locked Component Ratio and update all axes equally.
Steps to reproduce
Place any node with Transform > Scale property into scene.
Set scale to 0.
Update any single axis to a new scale. Works by dragging or typing.
Minimal reproduction project
N/A

What would be the expected behavior here? Currently it appears to be intentional that a field's ratio is set to 0 when its value is set to 0:
https://github.com/godotengine/godot/blob/6916349697a4339216469e9bf5899b983d78db07/editor/editor_properties_vector.cpp#L106-L110
And the value for components with a ratio of 0 is never updated:
https://github.com/godotengine/godot/blob/6916349697a4339216469e9bf5899b983d78db07/editor/editor_properties_vector.cpp#L61-L63
We can't really use the previous ratio (from before the field was set to zero), as this is not persisted anywhere and is lost when switching the inspected node.

I think if the ratio is not expected to remain locked once a value of 0 is set, the expectation is simple: set the ratio explicitly to Unlocked.
If the locked icon shows as locked, regardless of the value, I would anticipate that changing the x scale will equally change the y scale. I would still expect the values to update equally even if it's set to 0, unless the icon updates to show that the ratio is now unlocked.

I would anticipate that changing the x scale will equally change the y scale.
This isn't how the locked behavior currently works - it's based on the ratio between values at time of locking.

For example, if you have:

And you increase the X scale to 2, the other scales are updated using their ratios to the value you changed:

That's why when a value is 0, it doesn't really have a "ratio" to the value you changed.

Understood. I guess it's not so much of a bug. However, in the cases shown above with varying axes values, the ratio must be unlocked, and then locked again. In the case of setting the scale to 0 (for all), each axis value becomes independent of the remaining values.
I can see that it makes sense for the relative values from 0 to update relative to 0. But it's unintuitive, at the very least!

They don't really become independent, there's just no way to know what ratio to use for incrementing the values. A default raito of 1 might work for fields with a value of 0, but that may only make sense for scale (this also applies to transform and any other vector input).

Perhaps a tooltip or warning informing the user can be useful. Since it's no longer able to persist the original ratio, the editor has to make an assumption. But the user might not be aware that this happens. it could help explain why the user is getting a different result from what they might expect.

A 1:1 ratio would match expected behavior in what I assume is the most common case: scaling a transform, which by default comes with a locked 1:1 scale ratio. (Anecdotally, that case is also where I encountered this bug.)


Drawing line for slice

Adjustable and all 3 views slices in align

https://kitware.github.io/vtk-js/examples/Cutter.html


Integration with crowdsecurity/cs-nginx-bouncer

Is your feature request related to a problem? Please describe.
I would like to add protection for sites to NPM and be able to block IP's based on reputation/scenario using Crowdsecurity https://github.com/crowdsecurity which is a log analyzer and reactive firewall, something like fail2ban but in a much modern architecture and suitable for the containers world and having a distributed banlist generated from users around the world.
The question/feature request is how/where to add the https://github.com/crowdsecurity/cs-nginx-bouncer module to nginx config.
This bouncer leverages nginx lua's API, namely access_by_lua_file.
New/unknown IPs are checked against crowdsec API, and if request should be blocked, a 403 is returned to the user, and put in cache. The exact desired action can be configured in Crowdsec, like displaying captcas etc.
Describe the solution you'd like
I would like to have an easy way (example maybe) to deploy the bouncer without breaking things in npm.
Describe alternatives you've considered
None so far since it might take you minutes to offer a solution and it would take me hours to tweak things and break them :)
Additional context
Please have a look at https://crowdsec.net/  to understand what is crowdsec and how it works.
I use jc21/nginx-proxy-manager:latest for NPM and https://github.com/crowdsecurity/crowdsec/tree/master/docker for Crowdsec containers analyzing the nginx logs allready written by NPM on disk (docker map volumes ./npm_data/logs/:/var/log/nginx/ and have a quick look at acquis.yaml which tells crowdsec which logs to parse, mine looks like this):
`filenames:

/var/log/nginx/*.log
labels:
type: nginx`

Thank you and hope you'd consider this as a valuable addition to NPM

Referencing https://github.com/jc21/nginx-proxy-manager/issues/39.

Yeah, it was not my intention to say this issue was the same thing as the fail2ban one, I just wanted to cross-link these issues, since this they seem mutually exclusive.

I didn't thought you were saying that, just wanted to clarify a little bit since with appearance of crowdsec (v0.0.1 - May 15, 2020), supporting an old tool and reinventing the wheel and wasting time building around f2b seeamd like a bad idea.
Hope you like my proposal and looking forward to see it integrated in NPM.

Hello, I'll add my vote for this feature. I thinks this is very different from fail2ban in which follows the crowdsourcing approach.
Thanks!

I am head of community at CrowdSec (and an avid user myself). I think it's a great idea to add support for CrowdSec as well. Also I would like to offer my assistance and a way into the CrowdSec dev team if you need any help implementing it.
I would also like to point any technical questions regarding CrowdSec to our discourse where all devs are available to help out.

@nisargjoshi95  Did you ever get this working? If not, feel free to ask on the discourse :-)

@Sparkxxx please give me a buzz on the discourse, on twitter @klausagnoletti or send me a mail<EMAIL_ADDRESS>I'd like to ask about your experience with CrowdSec etc.

I am here to cast my vote, I haven't started looking in depth yet but does anyone have crowdsec setup with the bouncer and NPM?
@klausagnoletti - Should I just go to the discourse and ask there or are there any crowdsec docs on how to set it all up while utilizing NPM? Thanks.

@nisargjoshi95
I'll think your docker-compose wont work because nginx proxymanager is storing it's logs in other than the default nginx folders.
change your acquis.yml to - /var/log/nginx/*.log and then try this docker-compose: it reads the logs folder which is mounted by nginx-proxymananger container. it will read the logs but the parsing isn't that good

services:
 #crowdsec : it will be fed nginx's logs
 #and later we're going to plug a firewall bouncer to it
 crowdsec:
   image: crowdsecurity/crowdsec:v1.2.1
   restart: always
   environment:
     #this is the list of collections we want to install
     #https://hub.crowdsec.net/author/crowdsecurity/collections/nginx
     COLLECTIONS: "crowdsecurity/nginx"
     GID: "${GID-1000}"

   volumes:
     - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
     - /fullpath-to-nginx-proxymanager/data/logs:/var/log/nginx
     - crowdsec-db:/var/lib/crowdsec/data/
     - crowdsec-config:/etc/crowdsec/
   networks:
     crowdsec_test:
       ipv4_address: <IP_ADDRESS>
  #metabase, because security is cool, but dashboards are cooler
 dashboard:
   #we're using a custom Dockerfile so that metabase pops with pre-configured dashboards
   build: ./crowdsec/dashboard
   restart: always
   ports:
     - 3000:3000
   environment:
     MB_DB_FILE: /data/metabase.db
     MGID: "${GID-1000}"
   depends_on:
     - 'crowdsec'
   volumes:
     - crowdsec-db:/metabase-data/
   networks:
     crowdsec_test:
       ipv4_address: <IP_ADDRESS>

volumes:
 logs:
 crowdsec-db:
 crowdsec-config:

networks:
 crowdsec_test:
   ipam:
     driver: default
     config:
       - subnet: <IP_ADDRESS>/24

INFO[26-11-2021 04:58:54 PM] Buckets Metrics:
+--------------------------------------+---------------+-----------+--------------+--------+---------+
|                BUCKET                | CURRENT COUNT | OVERFLOWS | INSTANCIATED | POURED | EXPIRED |
+--------------------------------------+---------------+-----------+--------------+--------+---------+
| crowdsecurity/http-bad-user-agent    | -             | -         |            2 |      2 |       2 |
| crowdsecurity/http-crawl-non_statics | -             | -         |           77 |     77 |      77 |
+--------------------------------------+---------------+-----------+--------------+--------+---------+
INFO[26-11-2021 04:58:54 PM] Acquisition Metrics:
+---------------------------------------------+------------+--------------+----------------+------------------------+
|                   SOURCE                    | LINES READ | LINES PARSED | LINES UNPARSED | LINES POURED TO BUCKET |
+---------------------------------------------+------------+--------------+----------------+------------------------+
| file:/var/log/nginx/default-host_access.log |         37 |           30 |              7 |                     32 |
| file:/var/log/nginx/fallback-access.log     |         34 | -            |             34 | -                      |
| file:/var/log/nginx/fallback_error.log      |         23 |           23 | -              |                     20 |
| file:/var/log/nginx/proxy-host-1_access.log |        216 | -            |            216 | -                      |
| file:/var/log/nginx/proxy-host-1_error.log  |         28 |           28 | -              |                     27 |
+---------------------------------------------+------------+--------------+----------------+------------------------+
INFO[26-11-2021 04:58:54 PM] Parser Metrics:
+--------------------------------+------+--------+----------+
|            PARSERS             | HITS | PARSED | UNPARSED |
+--------------------------------+------+--------+----------+
| child-crowdsecurity/http-logs  |  243 |    100 |      143 |
| child-crowdsecurity/nginx-logs |  646 |     81 |      565 |
| crowdsecurity/dateparse-enrich |   81 |     81 | -        |
| crowdsecurity/geoip-enrich     |   30 |     30 | -        |
| crowdsecurity/http-logs        |   81 |     14 |       67 |
| crowdsecurity/nginx-logs       |  338 |     81 |      257 |
| crowdsecurity/non-syslog       |  338 |    338 | -        |
| crowdsecurity/whitelists       |   81 |     81 | -        |
+--------------------------------+------+--------+----------+
INFO[26-11-2021 04:58:54 PM] Local Api Metrics:
+----------------------+--------+------+
|        ROUTE         | METHOD | HITS |
+----------------------+--------+------+
| /v1/alerts           | GET    |    1 |
| /v1/decisions/stream | GET    | 7021 |
| /v1/watchers/login   | POST   |    3 |
+----------------------+--------+------+
INFO[26-11-2021 04:58:54 PM] Local Api Machines Metrics:
+-----------+------------+--------+------+
|  MACHINE  |   ROUTE    | METHOD | HITS |
+-----------+------------+--------+------+
| localhost | /v1/alerts | GET    |    1 |
+-----------+------------+--------+------+
INFO[26-11-2021 04:58:54 PM] Local Api Bouncers Metrics:
+---------------------+----------------------+--------+------+
|       BOUNCER       |        ROUTE         | METHOD | HITS |
+---------------------+----------------------+--------+------+
| HostFirewallBouncer | /v1/decisions/stream | GET    | 7021 |
+---------------------+----------------------+--------+------+

@baudneo did this work for you? I would have thought there would be issues with NPM's custom log.

@klausagnoletti - Should I just go to the discourse and ask there or are there any crowdsec docs on how to set it all up while utilizing NPM? Thanks.

Sorry for my late reply. I don't get notifications from Github even though I enabled it :-/
Just go to the Discorse and ask. To my knowledge noone has tried integrating with npm yet.

@jakern, it is a strange situation. If NPM is already running and proxying requests and I start up crowdsec with the newest config that @2Wanderer posted, everything is ok. When I reboot NPM no longer will come up citing an error binding to port :80 and :443 due to the crowdsec nginx bouncer using port :80 or :443. I am playing around trying to get things to mesh properly.

I tried creating a docker container extending the npm container and installing crowdsec-nginx-bouncer. It didn't work. Turns out npm doesn't use nginx but openresty, wghich we don't (yet) support. But it's on the roadmap. So I guess it'a a bit of a PITA to get working before then.

Can you give a rough estimation when this will probably happen?

No, it is not scheduled. Maybe the community will contribute it. It's open source after all :-)

I already tried it with a custom dockerfile:
FROM jc21/nginx-proxy-manager:latest

RUN curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash
RUN apt install -y crowdsec crowdsec-nginx-bouncer
RUN sed -i '1s/^/filenames:\n - \/data\/logs\/*.log\nlabels:\n  type:nginx/' /etc/crowdsec/acquis.yaml

but I get some weird errors. here are some of these:
Unpacking crowdsec-nginx-bouncer (0.0.7) ...
Setting up lua-logging (1.3.0-1) ...
Setting up libxpm4:amd64 (1:3.5.12-1) ...
Setting up nginx-common (1.14.2-2+deb10u4) ...

Configuration file '/etc/nginx/mime.types'
 ==> File on system created by you or by a script.
 ==> File also in package provided by package maintainer.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** mime.types (Y/I/N/O/D/Z) [default=N] ? dpkg: error processing package nginx-common (--configure):
 end of file on stdin at conffile prompt
Setting up lua-socket:amd64 (3.0~rc1+git+ac3201d-4) ...
dpkg: dependency problems prevent configuration of nginx-full:
 nginx-full depends on nginx-common (= 1.14.2-2+deb10u4); however:
  Package nginx-common is not configured yet.

dpkg: error processing package nginx-full (--configure):
 dependency problems - leaving unconfigured
Setting up libjbig0:amd64 (2.1-3.1+b2) ...
Setting up libicu63:amd64 (63.1-6+deb10u2) ...
Setting up lua-sql-sqlite3:amd64 (2.3.4-1+b1) ...
dpkg: dependency problems prevent configuration of libnginx-mod-http-xslt-filter:
 libnginx-mod-http-xslt-filter depends on nginx-common (= 1.14.2-2+deb10u4); however:
  Package nginx-common is not configured yet.

dpkg: error processing package libnginx-mod-http-xslt-filter (--configure):
 dependency problems - leaving unconfigured
Setting up libjpeg62-turbo:amd64 (1:1.5.2-2+deb10u1) ...
dpkg: dependency problems prevent configuration of libnginx-mod-http-auth-pam:
 libnginx-mod-http-auth-pam depends on nginx-common (= 1.14.2-2+deb10u4); however:
  Package nginx-common is not configured yet.

dpkg: error processing package libnginx-mod-http-auth-pam (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-http-geoip:
 libnginx-mod-http-geoip depends on nginx-common (= 1.14.2-2+deb10u4); however:
  Package nginx-common is not configured yet.

dpkg: error processing package libnginx-mod-http-geoip (--configure):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-http-ndk:
 libnginx-mod-http-ndk depends on nginx-common (= 1.14.2-2+deb10u4); however:
  Package nginx-common is not configured yet.

maybe you can help? or is this the error you mentioned, that not the real nginx but openresty is used?

This is the error I mentioned. Openresty != nginx (and they're not compatible). So the .deb complains that dependencies are not installed. So it won't work, unfortunately.

Anyways I have good news @leon1995. I asked the developers just to be sure. And it turns out they're working on it as we speak. Only a new bouncer is needed as logfiles are the same, apparently. I'll ping you here once it's out in some usable shape or form. Are you willing to do a beta test?

@klausagnoletti Running on unRaid with NPM and willing to beta test if you need more people. To be honest: I have a pretty private server, so not many visitors. I can imagine you'd rather like a beta tester with some spicey logs.

I can imagine you'd rather have a beta tester with some spicey logs.

Not gonna lie: That would be more fun. But it won't prevent you to join the fun :-)

@klausagnoletti I would also join the beta. However, mine is also a private server with multiple services and just a few people using it (maybe up to ten I think)

So... @leon1995 and I will visit each other's servers like crazy til steam's coming out of our logs. Will that work for you, @klausagnoletti? 🤪

Sure, hit me up at klaus (at) crowdsec (dot) net. You'd have to do a Docker container on your own (but would be happy to help :-)

I sent you an email

I can help testing if you wish. I have a host with Dietpi for x86, several dockers containers, one with Nginx proxy manager, other with crowdsec with the logs from Nginx proxy manager logs mapped, and also the firewall bouncer installed on the host and connected to Crowdsec's docker container.
I have installed Crowdsec last week, so my knowledge about it is very limited.

I can help testing if you wish. I have a host with Dietpi for x86, several dockers containers, one with Nginx proxy manager, other with crowdsec with the logs from Nginx proxy manager logs mapped, and also the firewall bouncer installed on the host and connected to Crowdsec's docker container. I have installed Crowdsec last week, so my knowledge about it is very limited.

Cool, please send me an email so I have your information in my inbox :-)

Now there's interesting news! @dhernan3 @leon1995 @sanderdatema @baudneo @2Wanderer @nisargjoshi95 @Sparkxxx
https://docs.crowdsec.net/docs/bouncers/openresty/
The bouncer is out. It should be easy to extend the existing npm Dockerfile with that since it's available as a .deb and npm is based on Debian.
For log parsing and scenarios the normal nginx collection can be used. Contrary to my former believe, the log format is indeed the same. Find it here: https://hub.crowdsec.net/author/crowdsecurity/collections/nginx
Let me know what comes out of experimenting with it :-)

Would be great if anyone can get this working and write some quick instructions :)

I might give it at go myself when I have the time.

Actually there's many ways to use it. The quick and dirty way is to have the agent and firewall installed in the host, point to the log files in the /etc/crowdsec/aquis.yaml (of course adjusted to your environment):
#NPM - Openresty logs
filenames:
  - /home/klaus/containers/npm/data/logs/*.log
    #  - /home/klaus/containers/npm/data/logs/proxy-host-2_access.log
    #  - /home/klaus/containers/npm/data/logs/proxy-host-3_access.log
labels:
  type: nginx
---

Protip: remember the --- as a separator between entries or you get weird errors :-)
After this, install the nginx collection: sudo cscli collections install crowdsecurity/nginx and reload crowdsec sudo systemctl reload crowdsec.
Another approach would be to extend the npm container with the new openresty bouncer and run the CrowdSec agent either on the docker host or in its own container (and maybe share data between the containers using docker volumes. This is not yet tested but knock yourselves out :-)
Let me know what comes out of it!

Actually there's many ways to use it. The quick and dirty way is to have the agent and firewall installed on the host (which I have on my own instance as of a couple of days), point to the log files in the /etc/crowdsec/aquis.yaml (of course adjusted to your environment):

Let me know what comes out of it!

Perfect, thanks - I'll give it at go as soon as i get the change :)

I'll probaly try using the docker container, seeing as pretty much everything else in my setup is containerized.

I'll probaly try using the docker container, seeing as pretty much everything else in my setup is containerized.

You're most welcome - only issue with that approach is that you'd have to either containerize the openresty bouncer or the firewall bouncer (which would be messy since it would need root permissions) or install just the firewall bouncer on the host and find a way for the CrowdSec container to talk to it in order to be able to block anything. Feel free to post at https://discourse.crowdsec.net if you run into problems.

Hey!
So there has been a recent development in the case. We have modificed log parsers and have a PR ready:
https://github.com/crowdsecurity/hub/pull/358
The big question - and what we need your help for - is input to how this should be integrated with NPM to be as usable to the NPM community as possible. If you have good suggestions wither write them here or in our Discord (in #dev-general)
Also I added an issue on logging Admin panel by default. Currently it's disabled which makes it hard (e.g. impossible for CrowdSec or anything else to protect it): https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1800
Let me know what you think!

I have been trying and trying to get the openresty bouncer to work with no success. All my other bouncers work fine except for openresty. I added the LOG_FILE directive to the openresty bouncer file and the log file is never created. cscli bouncers list shows this
`
NAME                        IP ADDRESS  VALID  LAST API PULL         TYPE                         VERSION
FirewallBouncer-1643162803  ::1         ✔      2022-01-26T02:40:25Z  crowdsec-firewall-bouncer    v0.0.22-debian-pragmatic-f64e94b59a948717c3dc848f9abebb27b5974714
zm-iptables                 <IP_ADDRESS>   ✔      2022-01-26T02:40:22Z  crowdsec-firewall-bouncer    v0.0.21-debian-pragmatic-eebd0b02ac6bb8cb330b3fcacc1f400595fbc6f7
local-cloudflare            ::1         ✔      2022-01-26T02:40:30Z  crowdsec-cloudflare-bouncer  v0.0.8-debian-pragmatic-38768ad6e47bc7ce058668ef286de303f897d705
local-openresty                         ✔      2022-01-26T02:13:59Z
---------------------------------------------------------------------------------------------------------------------------------------------------------------------`
openresty and openresty-opm installed by the openresty bouncer do not have logging enabled and I am uncertain how to enable it properly as the openresty docs only point towards nginx docs.
I cant debug the bouncer without logging, can someone point me in the right direction to enable logging in openresty so that the bouncer can attempt to output log files for debug?
Can anyone post a working non-docker config where the openresty bouncer is actually working?

I have been trying and trying to get the openresty bouncer to work with no success. All my other bouncers work fine except for openresty. I added the LOG_FILE directive to the openresty bouncer file and the log file is never created. cscli bouncers list shows this
`
NAME IP ADDRESS VALID LAST API PULL TYPE VERSION
FirewallBouncer-1643162803 ::1 ✔ 2022-01-26T02:40:25Z crowdsec-firewall-bouncer v0.0.22-debian-pragmatic-f64e94b59a948717c3dc848f9abebb27b5974714 zm-iptables <IP_ADDRESS> ✔ 2022-01-26T02:40:22Z crowdsec-firewall-bouncer v0.0.21-debian-pragmatic-eebd0b02ac6bb8cb330b3fcacc1f400595fbc6f7 local-cloudflare ::1 ✔ 2022-01-26T02:40:30Z crowdsec-cloudflare-bouncer v0.0.8-debian-pragmatic-38768ad6e47bc7ce058668ef286de303f897d705 local-openresty ✔ 2022-01-26T02:13:59Z ---------------------------------------------------------------------------------------------------------------------------------------------------------------------`
openresty and openresty-opm installed by the openresty bouncer do not have logging enabled and I am uncertain how to enable it properly as the openresty docs only point towards nginx docs.
I cant debug the bouncer without logging, can someone point me in the right direction to enable logging in openresty so that the bouncer can attempt to output log files for debug?
Can anyone post a working non-docker config where the openresty bouncer is actually working and confirm, that someone has the openresty bouncer actually working?
Edit: Also it seems the nginx collection and its nginx parser do not accept the NPM logs
NPM log message:
[26/Jan/2022:03:27:25 +0000] - 200 200 - GET https xxx.EXAMPLE.com \"/zm/index.php?view=login\" [Client IPADDRESS] [Length 2321] [Gzip -] [Sent-to <IP_ADDRESS>] \"Dalvik/2.1.0 (Linux; U; Android 11; SM-N975W Build/RP1A.200720.012)\" \"-\"

nginx parser patterns
pattern: '(%{IPORHOST:target_fqdn} )?%{IPORHOST:remote_addr} - (%{NGUSER:remote_user})? \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"( %{NUMBER:request_length} %{NUMBER:request_time} \[%{DATA:proxy_upstream_name}\] \[%{DATA:proxy_alternative_upstream_name}\])?'

pattern: '(%{IPORHOST:target_fqdn} )?%{NGINXERRTIME:time} \[%{LOGLEVEL:loglevel}\] %{NONNEGINT:pid}#%{NONNEGINT:tid}: (\*%{NONNEGINT:cid} )?%{GREEDYDATA:message}, client: %{IPORHOST:remote_addr}, server: %{DATA:target_fqdn}, request: "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:http_version}", host: "%{IPORHOST}"'

custom crowdsec GROK patterns:
NGINXERRTIME %{YEAR}/%{MONTHNUM2}/%{DAY2} %{HOUR}:%{MINUTE}:%{SECOND}
DAY2 \d{2}

IT APPEARS THE 'MONTHNUM2' PATTERN IS MISSING!
grep -R MONTHNUM2 /etc/crowdsec
/etc/crowdsec/patterns/nginx:#NGINXERRTIME %{YEAR:year}/%{MONTHNUM2:month}/%{DAY2:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second}
/etc/crowdsec/patterns/nginx:NGINXERRTIME %{YEAR}/%{MONTHNUM2}/%{DAY2} %{HOUR}:%{MINUTE}:%{SECOND}

I will write a parser for the NPM format, but it would be great if someone could confirm they have the openresty bouncer working.

Did you get anywhere with this? If not, I'll arrange for you to get in touch with the dev. Ping me on Discord :-)

Ok got the openresty bouncer working in jlesage/docker-nginx-proxy-manager docker image and created a pull
I'm self hosting the image currently at lepresidente/nginx-proxy-manager
which is based off my fork

Good job!

I have forked and successfully created a docker image that incorporates openresty bouncer into NPM as it is. This means you can docker pull baudneo/nginx_proxy_manager:latest and directly replace the existing jc21/nginx_proxy_manager images.  It is only 35 ish MB more than the source image. I also added  the GeoIP2 with lib-MindMax DB module directly to openresty.
I added 2 new features.

Enable logging for the admin dashboard, if enabled the logs will be in /data/logs/admin_panel_[access/error].log.
Enable DEBUG level logging for the default openresty error.log (/data/logs/fallback_error.log) file (default level is warn).

New ENV vars

CROWDSEC_BOUNCER = 1 OR '1' to enable CrowdSec OpenResty bouncer.
ADMIN_PANEL_LOG = 1 OR '1' to enable admin dashboard logging to logs/admin_panel_[access/error].log.
OPENRESTY_DEBUG = 1 OR '1' to enable DEBUG level logging for the openresty error.log (fallback_error.log) file

Thie bouncer is only version 0.1.0 as 0.1.1 is currently pre-release, I will upgrade to 0.1.1 soon though.
Forked repos:

nginx-full (base image) - https://github.com/baudneo/docker-nginx-full/tree/crowdsec_openresty
nginx_proxy_manager - https://github.com/baudneo/nginx-proxy-manager/tree/crowdsec_openresty

Docker hub

https://hub.docker.com/repository/docker/baudneo/nginx_proxy_manager

Docker pull (both the same image just different tags):

docker pull baudneo/nginx_proxy_manager:latest
docker pull baudneo/nginx_proxy_manager:crowdsec

Example docker-compose.yaml, literally just change the image: and add the 3 new ENV
version: "3"
services:
  npm:
    #image: 'jc21/nginx-proxy-manager:latest'
    image: 'baudneo/nginx_proxy_manager:latest'
    restart: always
    container_name: npm-crowdsec
    ports:
      # Public HTTP Port:
      - '80:80'
      # Public HTTPS Port:
      - '443:443'
      # Admin Web Port:
      - '81:81'
    environment:
      ADMIN_PANEL_LOG: "1"
      CROWDSEC_BOUNCER: "1"
      CROWDSEC_LAPI_URL: "http://IP TO CROWDSEC LOCAL API:8080"
      API_KEY: "xxxxxxxxxxxxxxxxxxxxxxxx"

      # These are the settings to access your db
      DB_MYSQL_HOST: "db"
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: "npm"
      DB_MYSQL_PASSWORD: "PASSw0rD"
      DB_MYSQL_NAME: "npm"
      # If you would rather use Sqlite uncomment this
      # and remove all DB_MYSQL_* lines above
      # DB_SQLITE_FILE: "/data/database.sqlite"
      # Uncomment this if IPv6 is not enabled on your host
      # DISABLE_IPV6: 'true'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    depends_on:
      - db
  db:
    image: 'jc21/mariadb-aria:latest'
    restart: always
    container_name: npm_db
    environment:
      MYSQL_ROOT_PASSWORD: 'xxXXxxXXXxxxXXX'
      MYSQL_DATABASE: 'npm'
      MYSQL_USER: 'npm'
      MYSQL_PASSWORD: 'DB Passw0rd'
    volumes:
      - ./data/mysql:/var/lib/mysql

@baudneo - This is excellent. Thank you for everyone's contributions. I will be testing this in my lab soonish.

I have since added modsecurity to a new image. Now crowdsec and modsecurity are installed and working. The new image that has modsec is docker pull baudneo/nginx-proxy-manager:cs-modsec . I installed OWASP-CRS for modsec, all config files for modsec are located in /data/modsec the OWASP rules are in /data/crowdsec/ruleset/. The modsec audit log is in /data/logs/modsec_audit.log by default, you can turn it off though by editing /data/modsec/modsecurity.conf
To enable modsec you need to add these 2 lines to each hosts 'advanced' config.
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;

I tried adding those lines to the server blocks but in my testing the only way to guarantee modsecurity is enabled for each host is to add it in each 'Advanced' config.
Some logs from modsec_audit.log
---C3KCgGTx---F--
HTTP/2.0 403
Server: nginx
Date: Tue, 22 Feb 2022 06:16:02 GMT
Content-Length: 552
Content-Type: text/html
Connection: close
Strict-Transport-Security: max-age=63072000;includeSubDomains; preload

---C3KCgGTx---H--
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:exec' (Value: `/bin/bash' ) [file "/etc/nginx/modsec/ruleset/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "480"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/bash found within ARGS:exec: /bin/bash"] [severity "2"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "<IP_ADDRESS>"] [uri "/zm/"] [unique_id "1645510562"] [ref "o1,8v14,9t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/ruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "<IP_ADDRESS>"] [uri "/zm/"] [unique_id "1645510562"] [ref ""]

Will this also work with the CrowdSec agent installed directly on Docker host?

Will this also work with the CrowdSec agent installed directly on Docker host?

Yes just edit the bouncer config file and put the ip:port of the docker host in the API_URL.

Thanks. I am using a Docker bridged network totally standardized. If one configures the agent to listen on <IP_ADDRESS> it can be reached from the container using it's docker network ip. Remember to firewall the port so it's not internet exposed (which reminds me that I asked the devs if there's a CrowdSec parser + scenario for CrowdSec. There should be. Very meta :-)

I just ugrade my NPM with "baudneo/nginx-proxy-manager:cs-modsec" on my OpenWrt server (with NextCloud).
so all broken now :
stderr: standard_init_linux.go:228: exec user process caused: exec format error

# uname -ar
Linux STARGATE 5.4.124 #0 SMP Sun Jun 13 22:02:19 2021 aarch64 GNU/Linux

@erdoukki - What's the CPU architecture for your OpenWRT server?

architecture : aarch64
cortex-a53 arm64
Marvell armada37xx

I don't see an ARM build for baudneo/nginx_proxy_manager on dockerhub . Which is most likely causing your issue. You could try editing the Dockerfile to build an ARM image or ask the owner to include ARM architecture.

Good idea.
Thanks.

https://github.com/NginxProxyManager/nginx-proxy-manager/pull/1875#issuecomment-1047956739

This is an automated message from CI:
Docker Image for build 5 is available on DockerHub as jc21/nginx-proxy-manager:github-pr-1875
Note: ensure you backup your NPM instance before testing this PR image! Especially if this PR contains database changes.

I am trying with this "PR"... ;-)

Thanks!

Okay, just rebuild the docker and now works fine:
INFO[02-03-2022 01:56:04 PM] Local Api Bouncers Metrics:
+-----------------------------+----------------------+--------+------+
|           BOUNCER           |        ROUTE         | METHOD | HITS |
+-----------------------------+----------------------+--------+------+
| crowdsec-firewall-bouncer   | /v1/decisions/stream | GET    | 1067 |
| docker-crowdsec-npm-bouncer | /v1/decisions/stream | GET    |   37 |
+-----------------------------+----------------------+--------+------+

I have added ModSecurity to a new image with CrowdSec

@baudneo Where can I submit issues for your fork? I have two:

Specifying enviromental variables like this doesn't work. The bouncer is not started unless I edit the crowdsec-openresty-bouncer.conf file.

    environment:
      CROWDSEC_BOUNCER: "1"
      CROWDSEC_LAPI: "http://1xxxx:8080"
      CROWDSEC_KEY: "xxxx"

There's a memory leak in the current openresty bouncer that currently is fixed with a workaround. Will you implement it in your fork?

Lastly I have a suggestion: Could you implement more environmental variables so everything in the bouncer configuration can configured like this. Especially the reCAPTCHA stuff..
Thanks - keep up the good work!

I have added ModSecurity to a new image with CrowdSec
Now CrowdSec and ModSecurity are installed and working. The new image that has modsec is docker pull baudneo/nginx-proxy-manager:cs-modsec. I installed OWASP-CRS for modsec. The modsec audit log is in /data/logs/modsec_audit.log by default, you can turn it off by editing /data/modsec/modsecurity.conf.
NOTE

All config for modsec is in /data/modsec which is symbolically linked to /etc/nginx/modsec
The OWASP rules are in /data/modsec/ruleset/
The main rules file is /data/modsec/main.conf which just Includes the OWASP ruleset.
The only ENV VAR for modsec is MODSEC_CREATE which will force create the directory structure into /data/modsec. This is usually only run on the first run of the modsec image when this directory does not exist. this ENV VAR will allow you to force it for whatever reason.

To enable modsec you need to add these 2 directives to the config somewhere.
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;

Here are some pointers.

To enable modsec for ALL HTTP hosts put the above directives in /data/nginx/custom/http_top.conf.
To enable modsec for ALL STREAM hosts put the above directives in /data/nginx/custom/stream.conf.
To enable modsec for ONE certain HTTP host put the above directives in the 'Advanced' tab configuration.
To enable modsec for ONE certain HTTP host in a certain LOCATION put the above directives in the location {} block instead of outside of it in the 'Advanced' tab config.
To enable on a per-stream basis you need to enable the streams in the dashboard and then edit the stream file by hand to add those directives into the stream {} block you want.

Some logs from modsec_audit.log to confirm modsecurity is working. This was a test using ?exec=/bin/bash in the URI.
---C3KCgGTx---F--
HTTP/2.0 403
Server: nginx
Date: Tue, 22 Feb 2022 06:16:02 GMT
Content-Length: 552
Content-Type: text/html
Connection: close
Strict-Transport-Security: max-age=63072000;includeSubDomains; preload

---C3KCgGTx---H--
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:exec' (Value: `/bin/bash' ) [file "/etc/nginx/modsec/ruleset/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "480"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/bash found within ARGS:exec: /bin/bash"] [severity "2"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "<IP_ADDRESS>"] [uri "/zm/"] [unique_id "1645510562"] [ref "o1,8v14,9t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/ruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.2"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "<IP_ADDRESS>"] [uri "/zm/"] [unique_id "1645510562"] [ref ""]

I don't know JavaScript so I am unable to add to the UI to make things pretty. Ideally there would be a ModSecurity tab that has a toggle switch for on/off and a text input box for the rules file. This tab would be in the proxyhost modal where you set what domain/target host/target port etc. It would be nice to have some sort of UI for corwdsec as well to turn it off and on and to edit the config file. I don't think having a rule editor for modsec would matter much, but it would be nice to have it.
I might take the time to teach myself some JS just to implement this to make it all pretty. Things are working for CrowdSec and ModSecurity though. The people who want that functionality should not have an issue with configuring things from the CLI anyways, for now.

Do I still have to add the log path to /etc/crowdsec/acquis.yaml here?

Awesome! Thanks for updating it!

Hello baudneo, thanks for this new image. I've tried to update, however docker can't pull the image, it complains about missing manifest. I've verified docker hub and think the image is not updated, is that ok?
$ docker pull baudneo/nginx-proxy-manager:cs-modsec Error response from daemon: manifest for baudneo/nginx-proxy-manager:cs-modsec not found: manifest unknown: manifest unknown

Any chance this is being merged back into the base jc21/nginx-proxy-manager image ?

ModSec is EoL now/soon and also has known memory leaks which are HUGE, so I won't be building images with it. I am currently working on ZoneMinder ML object detection stuff, as soon as I am done that I will create a new image with current NPM and add crowdsec openresty bouncer into it.
I think the options for WAF are slim, coraza and open-appsec which I may or may not look into adding either of them into an NPM image.
Coraza parses modsec security language, so the rules files like OWASP (who develop coraza as well) lists can be used with it. Furthermore, Coraza seems to need to be implemented in a Go language app. It is not as simple as download, point it at configs/rules and run it, someone needs to write a Go app using coraza libraries. That may have changed as I have not kept up with Coraza.
open-appsec uses ML instead of signatures for threat detection which is neat but, I can't speak to its effectiveness. At the time when I realized ModSec had issues, open-appsec did not have a nginx connector, which I think they do now. They require you to have a cloud control panel of sorts, so IDK how feasible it is to integrate into NPM if you can't do a stand alone install. Again, things may have changed as I haven't kept up on open-appsec either.
I stopped using NPM in favour of Cloudflare tunnels but, CF's new browser security check stuff is causing me grief so, I will need to move back to NPM.

Hello,
Before asking for help, this is my config:
`version: "3"
services:
npm:
#image: 'jc21/nginx-proxy-manager:latest'
image: 'baudneo/nginx-proxy-manager:latest'
restart: always
container_name: npm-crowdsec
ports:
# Public HTTP Port:
- '1080:80'
# Public HTTPS Port:
- '10443:443'
# Admin Web Port:
- '1081:81'
environment:
TZ: "Europe/Helsinki"
ADMIN_PANEL_LOG: "1"
CROWDSEC_BOUNCER: "1"
OPENRESTY_DEBUG: "0"
  CROWDSEC_LAPI: "<IP_ADDRESS>:8080"
  CROWDSEC_KEY: "222c3exxxxxxxxxxxxxxxxxd9aa475"

  # These are the settings to access your db
  DB_MYSQL_HOST: "<IP_ADDRESS>"
  DB_MYSQL_PORT: 3306
  DB_MYSQL_USER: "npm_user"
  DB_MYSQL_PASSWORD: "gggghgggg"
  DB_MYSQL_NAME: "npm_db"
  # If you would rather use Sqlite uncomment this
  # and remove all DB_MYSQL_* lines above
  # DB_SQLITE_FILE: "/data/database.sqlite"
  # Uncomment this if IPv6 is not enabled on your host
  DISABLE_IPV6: 'true'
volumes:
  - ./data:/data
  - ./letsencrypt:/etc/letsencrypt
depends_on:
  - db

db:
image: 'jc21/mariadb-aria:latest'
restart: always
container_name: npm_db
environment:
MYSQL_ROOT_PASSWORD: 'ffffffffffff'
MYSQL_DATABASE: 'npm_db'
MYSQL_USER: 'npm_user'
MYSQL_PASSWORD: 'ffffffffffff'
volumes:
- ./data/mysql:/var/lib/mysql

Hello,
I do have a little pb concerning the config of Nginx proxy manager + crowdsec running on an Unraid server last version.

version: "3"
services:
npm:
#image: 'jc21/nginx-proxy-manager:latest'
image: 'baudneo/nginx-proxy-manager:latest'
restart: always
container_name: npm-crowdsec
ports:
# Public HTTP Port:
- '1080:80'
# Public HTTPS Port:
- '10443:443'
# Admin Web Port:
- '1081:81'
environment:
TZ: "Europe/Helsinki"
ADMIN_PANEL_LOG: "1"
CROWDSEC_BOUNCER: "1"
OPENRESTY_DEBUG: "0"

  CROWDSEC_LAPI: "<IP_ADDRESS>:8080"
  CROWDSEC_KEY: "222c3e052a2bef1884b78832bd9aa475"

  # These are the settings to access your db
  DB_MYSQL_HOST: "<IP_ADDRESS>"
  DB_MYSQL_PORT: 3306
  DB_MYSQL_USER: "npm_user"
  DB_MYSQL_PASSWORD: "BvSfSd48W492u"
  DB_MYSQL_NAME: "npm_db"
  # If you would rather use Sqlite uncomment this
  # and remove all DB_MYSQL_* lines above
  # DB_SQLITE_FILE: "/data/database.sqlite"
  # Uncomment this if IPv6 is not enabled on your host
  DISABLE_IPV6: 'true'
volumes:
  - ./data:/data
  - ./letsencrypt:/etc/letsencrypt
depends_on:
  - db

db:
image: 'jc21/mariadb-aria:latest'
restart: always
container_name: npm_db
environment:
MYSQL_ROOT_PASSWORD: '7QsjYU9wB3k63'
MYSQL_DATABASE: 'npm_db'
MYSQL_USER: 'npm_user'
MYSQL_PASSWORD: 'BvSfSd48W492u'
volumes:
- ./data/mysql:/var/lib/mysql

Is there any hope of this being revived? I would love to have the option of integrating Crowdsec with NPM.

@baudneo
I have the following problem. When I want to login to npm and change the email as it asks me, the response is Forbidden.
If I want to create a new user, I can't apply rights or change the password = Forbidden.
I saw this problem in a very old version of npm without having been confronted with the problem.
But I read it on the web.
I have a working npm instance which I temporarily shut down, Crowdesc installed with no errors.
The changes made in the conf files are ok, I created a separate base for this fork in mariadb.
My concern is only on the change of email and password.
So I tell myself that further on it might not be so good as well.
Note : The correct permissions are applied to the folders in your fork. (I'm under unraid)

where has baudneo/nginx-proxy-manager gone? I can't seem to find it anymore.

👍

up news ?

please integrate this into npm base image, shouldn't be hard to keep up and massive help for those using npm


Refactor composition unit tests

Moves composition unit tests to integration tests
Introduces TestHelper for test utility

Motivation for this PR is to rather test through full integration test rather than isolated unit tests.
Later planned PRs will move remaining unit tests to integration tests.
Depends on

https://github.com/orcalabs/dockertest-rs/pull/4
https://github.com/orcalabs/dockertest-rs/pull/5

A proper rebase is needed against HEAD.


add sofaboot banner

feature https://github.com/alipay/sofa-boot/issues/72

Pull Request Test Coverage Report for Build 218

0 of 0   changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.05%) to 68.037%

Totals

Change from base Build 215:
-0.05%

Covered Lines:
2035

Relevant Lines:
2991

💛  - Coveralls


add: SMPK BPK Penabur Singgasana Pradana Bandung

https://bpkpenabur.or.id/bandung/smpk-bpk-penabur-singgasana

@zlataovce Thank you for your patience while waiting for a review and processing your request. Pull request merged.


Unable to upload/import a bpmn2 file, or any supported file extension containing capital letters, to KIE Sandbox

Uploading and importing a bpmn2 file, or a file with any supported file extension containing capital letters, results in a "Can't open file" error. This is due to a recent change in how we handle extensions

@kbowers-ibm This is on main? What change introduced this error? This is a regression. Please attach a video, add clear steps to reproduce and write the acceptance criteria for this issue...


What are the mark-up conventions for the VBA documentation?

Hello @Linda-Editor,
Can you explain when text that works also as VBA code, should be wrapped with two ` characters either side of the text (so that markdown interprets it as code)?
For example, in your post here, you've indicated certain such texts shouldn't be wrapped as such.
In contrast, on the Writing assignment statements page, certain such texts are wrapped in such manner, as can be seen from the following excerpt:

...
In the following example, the Set statement assigns a range on Sheet1 to the object variable myCell.
...

Thanks.

@MarkFern Good question. "Sheet1" should actually not be enclosed in code tags; I'll do a search and replace on that. But we have been adding them for object variables. We also add them for anything that won't appear correctly without them, such as items wrapped in "< >" tags, which just disappear on the live site. I also use them when referencing characters that might otherwise get lost on the page, like + and - signs; see https://docs.microsoft.com/en-us/office/vba/language/reference/user-interface-help/operator-summary for an example. I also sometimes use them for strings of code mentioned in text to set them apart from the rest of the text. If you're not sure what to do in a situation, ping me with a question on this thread. Thanks.

@Linda-Editor, for any characters that have a special meaning in markdown, you can turn them into literals (escape the characters) by prefixing a '\' character to the character that you want displayed as a literal (see here for more information). So for example, in order to display the text '<Test>', you can use the following markdown:
\<Test\>

Cumulative collected information answering the topic of this ISSUE

Procedure to follow if you're unsure how to mark-up a particular text.
Leave a comment in the comments thread of this ISSUE (procedure indicated by @Linda-Editor)

Mark-up conventions collected so far

... "Sheet1" should actually not be enclosed in code tags; ... . But we have been adding them for object variables. We also add them for anything that won't appear correctly without them, such as items wrapped in "< >" tags, which just disappear on the live site. I also use them when referencing characters that might otherwise get lost on the page, like + and - signs; ...  I also sometimes use them for strings of code mentioned in text to set them apart from the rest of the text. ...

From comment made by @Linda-Editor that can be seen here.

...
Tip: I've noticed that you tend to put apostrophes around links or sections; that is not necessary, ...

From comment made by @Linda-Editor that can be seen here. 'Sections' is supposed to mean text that refers to a particular section.

... enumerations and constants should be bold, not in code tags. ...

From comment made by @Linda-Editor that can be seen here.

@MarkFern Thanks for keeping such a precise log of everything I've said! :-)  I know about the backslash thing; I think for the <> tags, I'd prefer to use the code tags.

@Linda-Editor (+ anyone else), do you know what, if any, coding conventions Microsoft advises in respect of the VBA language?
I've been trying to follow the naming conventions advised by Microsoft for the .NET framework, documented here. However, it doesn't explicitly mention the naming of variables and also isn't specifically for VBA.
There's something on widely-recognised VBA variable-naming conventions here.
If slightly adjusting a pre-existing code example, I normally adopt the conventions already used in the example (for continuity).

@MarkFern thanks for these links, VBA naming conventions need dusting! The .net naming conventions apply to VB.NET, which is essentially the successor of VB6 and is also a case-insensitive language; there is no reason to not modernize the VBA conventions after 25 years of Hungarian notation, and starting with the official documentation is probably the single best way to help VBA programmers write code that doesn't look & feel like 1995... which weights quite a lot in the balance of things that make VBA such a "dreaded" language.
Official documentation code examples should also avoid late-bound member calls and declare intermediate variables with an explicit type; Worksheets("Sheet1") returns an Object, so any member call chained to it doesn't get compile-time validation. VBA is much easier to learn when you can take an example and see all the types involved and retype the dots and see all the available members. Compare to late bound code, which feels like some magic incantation that needs to be copy-pasted as-is, because when you try to actually type it by hand you lose the IDE's help with autocompletion and if you don't know what you're doing you're only going to know it's wrong when you try to run it (compiles fine!).
IMO code examples in documentation are meant to be read, not executed: making them as readable as possible (by avoiding late bound calls and horrific prefixed names) works in that direction.

@MarkFern Thanks for bringing this up. I don't know about the code itself; I just know the formatting for the document text. I'll see what I can find out.

Hello @retailcoder (& others).
Thanks for your input on this ISSUE.
I agree with you regarding best practices for learning VBA & for making production code.
However, when I read through VBA documentation, I quite often like that code examples don't bother with explicit variable declarations. It makes the screen area used by the code smaller, which can help with the reading of a page. It can also be easier to understand, in a similar vein to how pseudo-code can be easier to understand due to implementation specific details being removed.
I also agree that variable names in code examples should be more meaningful than they currently seem to be. I haven't found clear direction from Microsoft indicating that Hungarian notation should never be used for names. It appears that something like Hungarian notation is advised by Microsoft when naming interfaces (by prefixing 'I' to the name).
Does anyone else have any opinions on this?
I suggest that we set-up the VBA documentation such that users can choose between seeing a simple version & a standard-implementation version, for any code example. The standard-implementation version would contain explicit variable declarations, thereby inclining users to generally good programming practices. You could also have any useful error-handling code in the standard-implementation versions. Code like the code shown here can possibly be used to implement this. Remembering the last version selected by users, can possibly be implemented using cookies.
Any thoughts on this?

Newly discovered Microsoft VB coding conventions

Language
Link
Comments

VB .NET
https://docs.microsoft.com/en-us/dotnet/visual-basic/programming-guide/program-structure/program-structure-and-code-conventions.

VB6
https://docs.microsoft.com/en-us/previous-versions/visualstudio/visual-basic-6/aa240822(v%3dvs.60).
Advocates Hungarian notation; VBA7 (current version of VBA is 7.1) is almost identical to VB6.

Cumulative collected information answering the topic of this ISSUE
Procedure to follow if you're unsure how to mark-up a particular text.
Leave a comment in the comments thread of this ISSUE (procedure indicated by @Linda-Editor).
Conventions collected so far

... "Sheet1" should actually not be enclosed in code tags; ... . But we have been adding them for object variables. We also add them for anything that won't appear correctly without them, such as items wrapped in "< >" tags, which just disappear on the live site. I also use them when referencing characters that might otherwise get lost on the page, like + and - signs; ...  I also sometimes use them for strings of code mentioned in text to set them apart from the rest of the text. ...

From comment made by @Linda-Editor that can be seen here.

...
Tip: I've noticed that you tend to put apostrophes around links or sections; that is not necessary, ...

From comment made by @Linda-Editor that can be seen here. 'Sections' is supposed to mean text that refers to a particular section.

... enumerations and constants should be bold, not in code tags. ...

From comment made by @Linda-Editor that can be seen here.

More mark-up conventions are indicated at the following documentation page: https://docs.microsoft.com/en-gb/office/vba/language/concepts/getting-started/document-conventions-visual-basic-for-applications (it might be worth updating this page if it is not complete.)

I think it's safe to say that all VBA code examples should parse & compile.

Another convention is described or hinted at, @ https://github.com/MicrosoftDocs/VBA-Docs/issues/987#issuecomment-502127007.

Note
When you have a single column of numeric data in a table, and it is expected that users will compare cell data in the column with other cell data in the column, it is appropriate to right-align the integral portion of such data to a fixed position for the decimal points. This makes comparison easier for users.
Eg. don't do the following:

Data

1

14

105

Instead do the following:

Data

1

14

105

Note
There are computer programmers who use screen readers for their work. See https://channel9.msdn.com/blogs/dan/saqib-shaikh-and-scott-hanselman-designing-for-accessibility. As a consequence, the VBA documentation should be accessible to those using screen readers.

VBA documentation should be accessible to users with no programming experience
Because of the nature of VBA, non-programmers should be able to use VBA's documentation in order to do simple programming tasks.

@MarkFern Regarding one-column tables, I usually change them to bulleted lists; it doesn't make sense to have a table with one column. That said, markdown alignment doesn't appear to work in tables, even when we use the colons in the headers as specified in the GitHub markdown help (|:--|, |:--:|, |--:|). For example, I've tried centering items in a column, but it doesn't publish that way on the live site.

Hello @Linda-Editor, I've updated the example so that it uses two columns. Since you've now posted to this ISSUE re. the inappropriateness of one column tables, it will now be included amongst all the other conventions & rules documented in this ISSUE.
Re. markdown alignment, right-aligning columns seems to be working in preview mode. Are you saying that when we actually get round to publishing such right-aligned content, the live published content ignores the right-alignment? Can you possible give me an example live page where this has happened? Re. centring, can you also give me an example of a live page where centring has failed? Thanks.

@MarkFern I don't have any examples on hand at the moment; I just remember when I've tried to do this, it doesn't work in the docs.microsoft.com publishing system (the live site). I'll send you some examples when I run into them...

@MarkFern Our beloved vendor @Linda-Editor is no longer supporting this repo. Sadly, we don't have the resources to keep up with it. I'm playing catch-up when I have the time. How much of this converstation/thread is there left to fix? Can you please paraphrase and let me know if there's any searching and replacing that I need to do to make these docs easier to read? Thanks, lindalu

Hello @lindalu-MSFT,
This ISSUE is ongoing, and meant to attract to it notes on conventions and rules to be used in the VBA docs. The contents of this ISSUE can be summarised and placed in the contributing.md file. ISSUE #1051 was partly about doing this.
Sorry for not completing my contributions to this repo for a while. Just been busy, but should hopefully have some spare time soon to work on them.
My advice is to leave this ISSUE open as it is useful for the purposes mentioned above. Am a bit too busy to paraphrase the conversation at the moment.
Thanks.


Unify some inference and segmentation functionality

To avoid code duplication in https://github.com/computational-cell-analytics/synaptic-reconstruction/tree/main/synaptic_reconstruction/inference .
This should be based on the new bioimage.io prediction functionality, so is pending https://github.com/bioimage-io/core-bioimage-io-python/pull/406.

This is done.


maintainers: add genofire (me)

Motivation for this change
Things done

Built on platform(s)

[ ] x86_64-linux
[ ] aarch64-linux
[ ] x86_64-darwin
[ ] aarch64-darwin

[ ] For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
[ ] Tested, as applicable:

NixOS test(s) (look inside nixos/tests)
and/or package tests
or, for functions and "core" functionality, tests in lib/tests or pkgs/test
made sure NixOS tests are linked to the relevant packages

[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
[ ] Tested basic functionality of all binary files (usually in ./result/bin/)
21.11 Release Notes (or backporting 21.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module
[ ] (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes

[ ] Fits CONTRIBUTING.md.

Please squash e728d563553453d55122cdd6ffa54a9324432c00 08e690289e78a4d0c11ce231b39dcf9574258d06 3aca25cb089f4410483ec1d68423664a22ae4c99 into one, then it should be good to go.

Ops @genofire I think that rebased went a bit too far :P

Make sure to rebase on master
Add your maintainers info and commit
Add yourself to gotfy-desktop maintainer and make sure that it can build (nix-build -A gotify-desktop on nixpkgs root)
Push it!

sorry something goes wrong with rebase - a old master branch version ...


Create  a cafe menu page

Describe the project you want to add with tech stack
I will create a menu page for a cafe using html and css.
Expected behavior
It will contain list of coffee and desserts.
Screenshots (optional)
.
Additional context (optional )

@pranjay-poddar can u please assign me this issue.


Different rootElement than in jQuery based tests

Not sure if this is an issue or designed like that by intention, but at least it leads to some CSS selectors not working the same as in jQuery-based tests.
When rendering a component in integration tests, the resulting DOM will look like this:

For find the rootElement is explicitly set to #ember-testing, while for this.$() the equivalent is the #ember139 view. This results in the following incompatible difference when using the :first-child selector:
find(':first-child') -> #ember139 (the wrapping view)
this.$(':first-child') -> #ember187 (the actual component under test)
So when migrating, one would have to rewrite all those selectors. I would assume that it should actually behave the same, at least that would make migrating more straightforward. (I actually used this selector in ember-bootstrap quite often)
Would you consider this a bug? If not it should probably be documented. Also relates to #51, could make an automatic migration if this is not considered a bug and will stay like this...

How does the DOM look if you render two components in the same test? Is there still that ember139 wrapper?

How does the DOM look if you render two components in the same test?

the same.
I digged a bit into it. The wrapping view comes from ember-test-helpers: https://github.com/emberjs/ember-test-helpers/blob/master/lib/ember-test-helpers/test-module-for-component.js#L183.
Here you can see how jQuery's rootElement is set: https://github.com/emberjs/ember-test-helpers/blob/master/lib/ember-test-helpers/test-module-for-component.js#L250-L260
I guess we could use the same for https://github.com/cibernox/ember-native-dom-helpers/blob/master/addon-test-support/settings.js#L8?

@rwjblue I think I delegate on you. Do you want to have any opinion on your RFC?
I'm fine with both, although I don't understand why we have this wrapper.

+1 for this. It's fairly a bit odd that the root element of the test DOM using find() is different from the root element when using this.$(), since, for most cases, the root component element is desired.
Although I can see use cases where getting the test DOM wrapper is necessary. One idea is to allow no parameters to be passed to find() and just return the same thing this.$() returns. Is that possible?

Ya, I'm game to fix this so that it generally matches what this.$()[0] returns.

Oops, yeah this.$()[0] is what I meant--sorry. Maybe we should also make findAll() (with no parameters) return this.$() also?


stable docker version

the original docker repos we have been testing against are now docker-experimental builds. this bumps to the latest stable docker version in the repos.
fedora 26 is currently not supported by docker. versioning to fedora-25.
before this PR is merged in chef-apt-docker cookbook needs to be updated. chef-yum-docker is already complete.
https://github.com/chef-cookbooks/chef-yum-docker/pull/7

Let's keep the helper logic but "remove support" by dropping it from the test matrix.


Assert jobs have different names

The error appears when different jobs with the same name start working at the same time. The cleaner performing these jobs thinks it's one. Thus, the timer and history work for these jobs as for one


CJS support

Hi @ingalls,
We're looking at supporting some TAK use cases and came across this library. Kudos on the library. It's very well written and easy to follow, and seems like a solid foundation to get us started!
I went to test out a trial implementation, but unfortunately quickly hit a wall. We have a NestJS backend and are unfortunately stuck on CommonJS as a result. While I may normally use dynamic imports to get around this issue, the inclusion of ESM specific artifacts such as import.meta break this approach.
Now, I could fork the repo, or copy the existing code base, but I thought I'd reach out to see if you might be interested in adding CJS support to your publish step. I could certainly contribute to this effort, but this may require some modifications. I'm not terribly experienced in this particular area of library publishing, but I assume it would require removing ESM specific artifacts such as import.meta.
Would you be interested in my contribution here? Or would you rather we fork the repo for our own use case?

Hey, glad you might find it useful, I'd be happy to answer questions and add docs as needed. So far it's only been used internally to power CloudTAK so I haven't spent a ton of time on external facing docs. I do however do my best to follow SemVer and not break things for folks
Yeah I took a quick look at dual publishing with something like tsup via
tsup index.ts --format cjs,esm

but ran into the same issue. If this is something you are interested in looking into and cutting a PR for I'd glady review and get it merged. We're in the middle of wildfire season so I'm a little pinched for time to dive into this myself. I'm not attached to import.meta in any way if there is a non hacky alternative we can use (I'd like to avoid the new Error() stacktrace hack if possible!)

@jmroon I wonder if something like:
const __dirname = __dirname || fileURLToPath(import.meta.url);

would work?

@jmroon Have a proof of concept up here https://github.com/dfpc-coe/node-CoT/pull/30

@jmroon Have a proof of concept up here https://github.com/dfpc-coe/node-CoT/pull/30

I gave it a go. There were a few issues I was able to get around and got it up and running. I'm off for the next week but I'll be happy to put up a PR with the necessary changes!
The dirname issue actually ends up being even easier in practice. Tsup actually has a shim for it! Beyond that, it's mainly up to you how you'd like it distributed. Tsup could be used for both cjs/esm, and they can be delivered side by side (JS extension for ESM, CJS extension for CommonJS). Or they can be their own individual builds.
I have a branch up but it's mainly the result of experimentation right now. I'm off on vacation next week but I'll try to get a PR the week of Sept 9!

@jmroon Perfect, yup if you can cut a PR I'm happy to review and get this out. I have no issues with the dual build via tsup  if you want to sketch out that route.

Ok great I'll try to get it up this week!


createCurlString doesn't work if queries are sent via the GET method

createCurlString method doesn't work if queries are sent via the GET method because it expects the data attribute of ajaxConfig to be available (see here). However, data is set only if the yasqe.options.sparql.requestMethod is not GET (see here). If the request method is GET, YASQE does its own encoding of the query params into the endpoint's URL (see #78 and here), so data is not provided.

A thorough bug report, thanks, I'll take a look

I've fixed this issue (together with another CURL related bug #86 ). Released as version 2.10.1


Incomplete export to PBI: Items without matching links filtered out when selecting "Return all top level items"

Hi, when I select “Return all top level items”, the query results in all top level items correctly, however when exporting to PBI, it filters out the use cases without linked work items.
Query:
image.png

Thanks,
Natalia

I have the same issue. Big disappointment. The project itself is great - there is no other way to get linked records from Azure DevOps in this format (the only right format BTW - both source and target in one row).
If it would be a way to combine 2 queries in one Power BI report, it would solve the problem, but...

We ran into this issue with my team and I think I fixed it locally through a function update:
Update for just the WiqlRunOneHopWorkItemLinkQuery function (replace it via advanced editor in Power Query, starts at line 283 in the Functions definition).

WiqlRunOneHopWorkItemLinkQuery_Only.txt

Update if you want to just replace the entire text of Functions without tracking down the one specific function that needs an update (this still just applies changes to a single function, the WiqlRunOneHopWorkItemLinkQuery function).

Wiql.Functions.Updated.txt

Fix involved separately defining the Source ID table and the Target ID table, and then re-doing the join between them, to remove several steps that would cause Source to be filtered out if no Target (i.e. linked item) was present.

Many thanks for this workaround. I was scratching my head trying to figure out why I wasn't getting the same results in Power BI as I was seeing in ADO.


Error on _hdaServer.Connect

I cannot get your code to run.
I am running Matrikon simulation server, on Win 8 with VS 2015.
Don't ask me about the OPC redistributables cause I do not know how to install them successfully on my system.

Thanks for your time.

You need to add the OPC assemblies to your bin folder. You can get them from the OPC portal or share me your email so I can send them to you.

Actually, you can download the assemblies directly from the OPC Foundation website. You only need to create an account.

Could you please send it to me anyways, cause I cannot get them installed via the OPC foundation account - tried gazilion times.
Email<EMAIL_ADDRESS>Tnx


Deploy cert-manager-webook to restrictive PSPs

Is your feature request related to a problem? Please describe.
We have a pod security policy (PSP) that enforces read-only-filesystem. The webhook-deployment violates this by writing to the /tmp dir.
Describe the solution you'd like
Mount an emptyDir to /tmp to allow the webhook-deployment to run successfully under a strict PSP.
Environment details (if applicable):

Kubernetes version (e.g. v1.10.2): 1.16.2
Cloud-provider/provisioner (e.g. GKE, kops AWS, etc): custom
cert-manager version (e.g. v0.4.0): v0.14.3
Install method (e.g. helm or static manifests): static manifests

/kind feature

Thanks for your PR for this - I am also intrigued as to why you are seeing this. Can you confirm this is definitely the case when running v0.14.3, and does it still persist with v0.15.0?
Taking a look at my own installation, I don't see any files in the /tmp directory of the webhook, but I am running v0.15.0 so could be an issue in the older version only, however I don't think much has changed here since v0.14.3...


Independent help document theme from SC-IDE?

Thanks for your great job!
I am still using SC-IDE and your SuperCollider extension for VS Code together.
Is there a way to use two styles of Help document independently for your "SuperCollider extension for VS Code" and "SC-IDE"?
Currently, I have added the following code block to custom.css and I can read the help documents in SC-IDE without any problem, but the readability in vscdoe is slightly worse.
So I think it would be good if the SuperCollider extension for VS Code would use a different file than custom.css, because the help document colour in SC-IDE and your vscode extension are not the same.
@media screen {
    body {
        background: #232430/*#1f1f20*/;
        color: #232430/*#1f1f20*/;
        -webkit-filter: invert(90%);
        filter: invert(90%) ;
    }

    body::-webkit-scrollbar {
      width: 12px;               /* width of the entire scrollbar */
    }

    body::-webkit-scrollbar-track {
      background: #333;        /* color of the tracking area */
    }

    body::-webkit-scrollbar-thumb {
      background-color: #666;    /* color of the scroll thumb */
      border-radius: 20px;       /* roundness of the scroll thumb */
      border: 3px solid #333;  /* creates padding around scroll thumb */
    }
}

This is an issue that has to be resolved in SuperCollider itself - right now, custom.css is applied last, after ide specific style in frontend.css, so it will always override ide-specific changes:
    <link rel='stylesheet' href='../frontend.css' type='text/css' />
    <link rel='stylesheet' href='../custom.css' type='text/css' />

I'm not really sure what a good solution to this problem is, unfortunately

I understand the difficulty! Thank you for your efforts in resolving so many requests!


working on the timestamps of videos-list/03-viola.md

To avoid that several people are working on the same video I opened that issue.  It can be closed when the timestamps are committed.
videos-list/03-viola.md

Thanks @bsenst
I added your GitHub handle to this item in the list:
https://github.com/pymc-devs/video-timestamps/issues/11

The timestamps have been created. The issue can be closed.

@bsenst will keep this issue open until it is merged in.


[T2A2][W09-A3]Yim Chia Hui

Allow “find" to be not case-sensitive

Ready for review

Accepting this PR without a review because another of your PRs for this tutorial was reviewed in detail.


[Nuestro ultimo verano] Some bugs fixed

Changes / Comments
Some bugs fixed
Roll20 Requests
Comments are very helpful for reviewing the code changes. Please answer the relevant questions below in your comment.

[ ] Does the pull request title have the sheet name(s)? Include each sheet name.
[x] Is this a bug fix?
[ ] Does this add functional enhancements (new features or extending existing features) ?
[ ] Does this add or change functional aesthetics (such as layout or color scheme) ?
[ ] If changing or removing attributes, what steps have you taken, if any, to preserve player data ?
[ ] If this is a new sheet, did you follow Building Character Sheets standards ?

If you do not know English. Please leave a comment in your native language.

This seems like you're trying to submit a new sheet, not making edits to an existing one.

Pull request name changed

@Anduh It's a merge conflict: he got the sheet added yesterday, but continued working on his same remote branch for this new PR, so it looks like it's still "adding" stuff because the commit comparison is off.

Oh, that makes things more complicated. I guess thing will be more clear later this week.

I haven't write permissions

You have to merge from roll20 master to your fork/branch in order to resolve merge conflicts.


Docs/fetching data guide

What's the purpose of this pull request?
Creating a guide about Fetching data from the FastStore API

Thanks a lot for your review, @eduardoformiga! I have committed most of your changes and adapted 2 of them.


Consider cleaning up the kube-proxy-clean-up init container

How to categorize this issue?

/area networking
/kind cleanup
What would you like to be added:
https://github.com/gardener/gardener-extension-networking-cilium/commit/c92b7ad5292a42fe44389ad083683ef554f82a26 introduces 2 init containers: cilium-kube-proxy-clean-up and kube-proxy-clean-up. Depending on the value of .Values.kubeProxyCleanup one of the init containers is picked up.
As far as I can see .Values.kubeProxyCleanup is always set to cilium-documentation
https://github.com/gardener/gardener-extension-networking-cilium/blob/9c2fa21844276fec8af5d5899334f2ba9ef76a36/charts/internal/cilium/charts/agent/values.yaml#L25-L26
which means that always the 1st init container (cilium-kube-proxy-clean-up) is picked up and used.
Currently I don't see when and how the kube-proxy-clean-up init container would be picked up and used.
Why is this needed:
No need of init container that is never used/rendered.

@ScheererJ can you confirm my observation that this init container can be safely removed?

@ialidzhikov Your observation is correct that the first of the two cleanup containers is used per default and there is currently no switch exposed to change this at runtime without doing a code change first. Therefore, the container could be safely removed. However, I would not do it. From my point of view, the approach documented by cilium is dangerous as it simply discards rules according to their names. Therefore, I would rather like to have a fallback option, which is the second container.

From my point of view, the approach documented by cilium is dangerous as it simply discards rules according to their names. Therefore, I would rather like to have a fallback option, which is the second container.

It creates confusion for external contributors and I don't see much value keeping something that never gets executed.
The source code is in VCS - if we remove the init container, it won't get lost and we will be still able to check old revisions if we want to switch back to it.
 My point is that like everything that is not used, it is about to get outdated (or break).
If you still see value in keeping it, then I can close this issue (and the corresponding draft PR).

Honestly speaking, I doubt that this init container holds any external contributor back. There are far more components in this repository that are not used in the Gardener setup, but still present as they are part of the upstream cilium distribution, e.g. etcd-operator.
Removing the container will leave it in version control for sure. However, you also need to still have in mind that this container existed in case of an issue to actually look for it. People forget over time...
Let's revisit this topic once @DockToFuture is back beginning of October.