started using github projects for task tracking

How to use github projects - a getting started video - 
https://www.youtube.com/watch?v=oPQgFxHcjAw 

Opened a private repo with issues, and with ChatGPT's help, linked it to a project. (Projects --> New Project in the github web UI for that repo). Automation to create a new issue worked after some tweaking - the github actions yml is copy-pasted below:

name: Instantiate Planetarium Show Task
on:
  workflow_dispatch:
    inputs:
      show_title:
        description: 'Title of the Planetarium Show'
        required: true
      deadline:
        description: 'Deadline'
        required: false

permissions:
  issues: write
  contents: read
  
jobs:
  create_task_issue:
    runs-on: ubuntu-latest
    steps:
      - name: Build issue content
        run: |
          echo "## Show Details" > issue.md
          echo " " >> issue.md
          echo "**Show Title:**  " >> issue.md
          echo "${{ github.event.inputs.show_title }}" >> issue.md
          echo "" >> issue.md
          echo "**Deadline:**  " >> issue.md
          echo "${{ github.event.inputs.deadline }}" >> issue.md
          echo "" >> issue.md
          echo "## Steps" >> issue.md
          echo "" >> issue.md
          echo "- [ ] Create script" >> issue.md
          echo "- [ ] Create Hindi translation" >> issue.md
          echo "- [ ] Create Telugu translation" >> issue.md
          echo "- [ ] Review Hindi translation" >> issue.md
          echo "- [ ] Review Telugu translation" >> issue.md
          echo "- [ ] Record Hindi VO" >> issue.md
          echo "- [ ] Record Telugu VO" >> issue.md
          echo "- [ ] Edit Hindi VO" >> issue.md
          echo "- [ ] Edit Telugu VO" >> issue.md
          echo "- [ ] Warp ready for our theatre" >> issue.md
          echo "- [ ] Eng-Hin-Tel audio" >> issue.md
          echo "- [ ] Final audio mix" >> issue.md
          echo "- [ ] Save backups" >> issue.md
          echo "- [ ] Post on website" >> issue.md
          echo "" >> issue.md
          echo "---" >> issue.md
          echo "" >> issue.md
          echo "" >> issue.md

        
      - name: Create issue from template
        uses: peter-evans/create-issue-from-file@v4
        with:
          title: "[Show] ${{ github.event.inputs.show_title }}"
          content-filepath: issue.md
          token: ${{ secrets.GITHUB_TOKEN }}
          labels: show,task

This script had to be re-written due to ChatGPT repeatedly using heredoc syntax which would clash with github's yml. I had to explicitly ask it to "Please use echo >> on each line, and no heredoc."

One more automation script to automatically move the items in the project from "TODO" to "In Progress" when any of the checkboxes above were clicked, failed. ChatGPT usually fails when the documentation is not complete and / or there are conflicting earlier documentation pages, as in this case. It would repeatedly suggest using

permissions:
  issues: write
  projects: write

when actually such a permission is no longer accepted by Github - it was part of "classic projects" - https://docs.github.com/en/enterprise-server@3.16/issues/planning-and-tracking-with-projects/creating-projects/migrating-from-projects-classic. 

Apparently with projectsV2, the REST api does not work, only GraphQL API works. And it needs a classic personal access token to work. And the code generated by ChatGPT had errors which I could not get it to fix after multiple iterations over multiple days, so I just left updates to be done manually by clicking on the drop-down seen in the linked project for each issue. I could probably read the GraphQL API documentation and try again, but right now, not motivated to do so.

unable to use key-based auth

One of our servers had been upgraded, and after the upgrade, even though my public key was in the authorized_keys file, I was unable to ssh into that machine using a script with key-based authentication. 

It turned out the script which I was using to connect had the parameter

-o PubkeyAcceptedKeyTypes=ssh-rsa

which was necessary for the earlier server - earlier post about this - but not necessary for the current server - removing this parameter allowed the script to log in using key-based auth.

forcing 2FA for all cloudflare users

 After a cloudflare advisory asking us to rotate credentials due to a "Compromise Impacting Cloudflare Salesforce Cases", I was asked to force 2FA for all cloudflare users. 

https://developers.cloudflare.com/fundamentals/user-profiles/2fa/

The force-2FA option is available for super-admins in the cloudflare admin panel, at
Manage Account > Members > Members 2FA enforcement.  

getting referral ids for Moodle course enrolments

There was a request to store and report the referral ids passed via GET request from another site onto one of our Moodle instances. I turned to ChatGPT (free) for help. 

For the immediate need of getting referral ids from past logs, it suggested some python code. Which, of course, did not work on the first try. But 5 iterations later, got something useful out of it, which is shared at
https://github.com/hn-88/moodle-plugin-local-referrals/tree/main/temporary%20python%20code 

Then, it suggested writing a local plugin, and also suggested skeleton code. But the suggested code would not work if the user was not logged in to our site before clicking the referral link on the external site. It suggested saving the referral code to $SESSION. But that did not seem to work. Debugging to the Apache error log using lines like 
error_log('[local_referrals] function on_user_enrolled() ... ');
the referral id in $SESSION was being set to null when the user was logging in to our site.

Tried asking gemini.google.com (free) since ChatGPT seemed to be caught in a loop and unable to provide a fix. Gemini immediately looked up Moodle documentation and said that clearing the session (starting a new session) when a user logs on to Moodle is a known feature - and so we should store the referral id elsewhere - either in the database or in a cookie. Gemini in "Deep Research" mode also wrote a couple of essays about the issue, which could be summarized as my earlier sentence!

Then Gemini generated some code, but the code was incomplete. Asked ChatGPT to complete it - then asked Gemini to correct the errors introduced by ChatGPT - and the result is at
https://github.com/hn-88/moodle-plugin-local-referrals/ 

Some excerpts from the chats with ChatGPT and Gemini are in the wiki of that github repo - 
https://github.com/hn-88/moodle-plugin-local-referrals/wiki

Microsoft Azure - no meaningful way to contact regarding technical issues for non-profits

We're running some VMs on Microsoft Azure with free credits provided to non-profits. This means that in the Azure support section on the Azure portal, only billing support is visible, not technical support - that would probably need a paid plan. 

There was an intermittent network issue with one of our VMs - Ubuntu update not being able to reach the servers, ssh into the VM failing intermittently, and so on. 

I changed the type of support from Technical to Subscription, and then was able to submit the report.

Some more data points for troubleshooting -

1. Our other Azure VMs in other regions do not have this issue.

2. Some of our team members had issues connecting to this server on Aug 19 2025, between 3 & 7 pm IST. At around 8:45 pm IST, I could log on to the server without issues, I used BSNL as my ISP. On Aug 20, 11:30 am, the team at Hyderabad could not connect to the VM using Jiofiber ISP, but I could connect via Telexair located in Bangalore.

3. Rebooting the VM itself did not help - probably some other routing issue at your Central India location.

Edit 25 Sep - But there was no response from Microsoft other than that they would look into it - but the problem seemed to have been resolved in a few hours. Twenty days later, there was an email from the VM team, saying that the network team had passed on the issue to the VM team, so I just replied, "We have not had issues after my last updated to the ticket. You can call me if you wish between 9 and 11.30 am Indian Standard time or between 12.30 and 3.30 pm IST, but I have nothing further to add."

Google's lack of human support is well known. So, Azure is more of the same. I believe this is the norm for all these "cloud" companies.

resizing an Azure VM

Just going to portal.azure.com > VM > Overview > Sizing, choosing a different size, and hitting Resize did not work as planned, though a message popped up saying the VM would be restarted on resizing. After five minutes, stopped the VM - then it resized - then started it up again. MySQL took a couple of minutes to come up, so initially the Moodle instances complained about database connection failure.

connections problems to an AWS server

We were using ssh to connect to an AWS VM, and the developers who would log in from Hyderabad reported that they were unable to ssh into it. I too had problems connecting initially. 

Checking the AWS console to see if the IP address had changed, found that the IP, port etc were unchanged. Later, I was able to connect with ssh. 

So, maybe it was an internet connection issue? Or a routing issue with AWS or with some of the ISPs?

using ABeeZee TTF font on a Moodle instance

There was a request to enable the ABeeZee TTF font on one of our Moodle instances, since it is recommended for inclusivity etc. https://fonts.google.com/specimen/ABeeZee/about says it is a "children's learning font".

It was later clarified that this font was desired for all content on the site and for the custom certificates. So,

1. For adding custom fonts to course content and body text, I believe the method is to edit the CSS of the current theme, as mentioned here - 

https://docs.moodle.org/500/en/How_to_add_custom_fonts_in_a_theme

In our case, the theme is Moove.

2. For the custom certificate plugin, the method followed - adding the font using "Manage PDF fonts" using the TCPDF plugin, is the method we have followed earlier. 

https://hnsws.blogspot.com/2023/10/request-for-new-font-in-moodle-instance.html

So it should be working for creating custom certificates. 

For changing the font in the theme, it is relatively easy to implement if we were to change all content to use this font.

Site administration → Appearance → Additional HTML

and I've added inside the "Within Head" box

<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=ABeeZee&display=swap">

and inside the Moodle theme (which is used on our sites) advanced settings box, (which has the url oursite.org/admin/settings.php?section=themesettingmoove#theme_moove_advanced )

body {

    font-family: 'ABeeZee', sans-serif !important;

}

(which makes the entire body of the html page into ABeeZee.)

This was implemented for two of our sites after first trying it on our development instance.

Virtualbox error - Cannot register - the hard disk already exists

Via https://stackoverflow.com/questions/44114854/virtualbox-cannot-register-the-hard-disk-already-exists

For me, the menu path in Virtualbox 7.1 was:

Tools -> (Hamburger menu) -> Media -> (choose the one to remove) -> Remove button on toolbar

turn off gmail "smart" summaries

 via https://www.digitalinformationworld.com/2025/05/gmail-is-reading-and-summarizing-your.html

On Android --> GMail app --> Hamburger menu --> Settings --> choose the account for which you want to disable --> Untick smart features checkbox

lots of github and Mac learnings

Trying to compile OpenSpace on MacOS - 

https://github.com/hn-88/OpenSpace/tree/ToCompileOnXCode16.4

https://github.com/hn-88/OpenSpace-AppleSiliconMac/actions

https://github.com/hn-88/OpenSpace-IntelMac/actions

Learnt a lot of things from Copilot and ChatGPT - since I didn't have any humans available to ask specific questions. Also bumped against the limitations of the LLMs - sometimes they give wrong advice with full confidence! Perhaps adding prompts to cite sources, mention confidence level etc might help. Some points, in no particular order.

•  XCode support for some C++ features is missing - C++ language support - and in some cases, AppleClang's interpretation is stricter than gnu c++ or MSVC. Also, some flags specific to MacOS would change from old versions to new versions of MacOS. And homebrew support for older Macs is spotty. So, supporting Macs is a challenge.
  
  
• Verifying and testing on github runners has some issues due to their headless nature.
  
  
• Uploading to draft releases works best if that draft release is pre-created - sometimes the tag creation takes a few seconds, leading to failure in uploading the artifact to the draft release. Or, can create a new tag, wait for a few seconds, and then upload the artifact to draft release using a personal access token - PAT.  
  
  
• MacOS, especially after 15.2, does not make it easy to run unsigned apps. Some workarounds which exist now, like removing the quarantine flag from the internal binary, may not work in the future. It is possible that Debug builds may work and (unsigned) Release builds may not work as in the case of Android apk files - unless we add a codesign step after the build.
  
  
• Even with the bundling of dylibs using otool, the binary still seems to look for dylibs in /opt/homebrew etc. So, the bundling code suggested by ChatGPT still has flaws. Or maybe there are some dependency calls which are only at runtime and hence not detected by otool. 

2FA required for Google Workspace admin users

Passed on Google's message that two-factor authentication / 2FA / 2-Step Verification (2SV) is required for Google Workspace admins starting August 13 2025 - 

.... please alert any of the users who have been given access to admin.google.com in case they have not enabled 2FA already.

How to enable 2FA:

Start by logging on to your Google account for our.domain.org

• Click your avatar (top-right) and choose Manage your Google Account.
• Click Security in the left pane.
• In the Signing in to Google section, click 2-Step Verification.
• Click the Get Started button.
• Enter your password (if requested).
• Click Continue.
• Click Send to send a text message to your phone.
• Enter the 6 digit code sent to your phone and click Next.
• Click Turn On to finish the process.
• Your account is now protected with 2 step verification.

manual time sync on Ubuntu 24.04

Asked ChatGPT, and it gave the long answer below. The short answer is:

sudo systemctl restart systemd-timesyncd

Long answer pasted below:

To manually trigger an NTP (Network Time Protocol) time update on Ubuntu, you can use the following steps depending on whether you're using systemd-timesyncd, chrony, or ntpd.

🔍 Step 1: Check which time sync service is in use

Run:

timedatectl show | grep -i ntp

Also try:

systemctl status systemd-timesyncd

systemctl status chronyd

systemctl status ntp

✅ If you're using systemd-timesyncd (default on newer Ubuntu versions):

Trigger a manual update:

sudo systemctl restart systemd-timesyncd

Optionally, you can force immediate sync using timedatectl:

timedatectl timesync-status

To see the current status or wait a bit and verify with:

timedatectl status

⚠️ Note: systemd-timesyncd does not support manual "force now" updates — it syncs on its own schedule after restarting.

✅ If you're using chrony:

Force an update:

sudo chronyc makestep

This forces an immediate correction if the clock is off.

You can verify with:

chronyc tracking

✅ If you're using ntpd:

Force an update:

sudo ntpd -gq

-g allows a large initial offset

-q exits after setting the time

Then restart the daemon:

sudo systemctl restart ntp

🕒 Verify time sync

timedatectl

Look for: System clock synchronized: yes

solution for rendering black frame & moving a Blender keyframe to a different time

The blend file linked from

https://www.youtube.com/watch?v=Jh1p82AJkaU

would not render out of the box on Cycles or Eevee with Blender 4. (the tutorial was made for Blender 2.8). Thought that one possible reason was that I had modified the number of render samples:

"Samples should not be lower than volumetric samples."

But Cycles was rendering with multiple samples, up to the final moment, when the render would go black. ChatGPT confirmed my hunch that this was due to some compositing settings. Disabled compositing in Render properties --> Post-processing - and then the render was showing up. 4K renders of each frame was taking around 5 to 10 minutes on the 1060TX GPU. Sheepit render farm rendered the project in less than a day, after making modifications to the length of the animation and using a 180 degree fisheye "fulldome" panoramic camera.

For moving keyframes - to make the animation 10x longer, move a keyframe at frame 25 to frame 250, as an example - https://blender.stackexchange.com/questions/221434/how-to-move-selected-keyframes-to-current-frame-or-a-specified-frame-number#221446

"Hovering on the action editor or dopesheet you can select the keyframes you want to move, set the time cursor to the desired frame and press S,X,0,Enter."

The final product is below. Fulldome (180 degree fisheye) 4K video suitable for planetariums. The full 4K resolution video is made available at archive.org. 

just git push after git checkout -b existingbranch

If we check out an existing branch, make modifications and want to push to that branch, we just have to do 

git push

and not 

git push -b existingbranch

or else we would get the error

existingbranch already exists

https://stackoverflow.com/questions/53046763/fatal-a-branch-named-new-branch-already-exists

https://www.geeksforgeeks.org/git/default-behaviour-of-git-push-without-a-branch-specified/

descreen and perspective correction with gimp

To remove moire patterns due to silk-screened photos from prints, gmic plugin's fourier filter can be used. To install - gimp-gmic is in software manager of Linux Mint.

https://www.youtube.com/watch?v=3137dDa6P4s

According to this video, the way to do it -
1. first fourier transform in gmic
2. Then make the white dots black for everything except centre
3. then inverse
4. then smooth medium (also in gmic)

(This page refers to a specific descreen plugin, but that is for Gimp 2.0 and the link also seems broken, so didn't try out that.)

For perspective correction, especially for "re-clicked" photos taken with mobile from an angle,

Tools --> Transform tools --> Perspective --> choose Corrective (backward) for Direction, 

put the four corners in the four corners of the photo to be corrected. Then, the four corners will be stretched to the aspect ratio of the original image. After that, some Transform --> Scale changes may be needed, with aspect ratio unlocked, in case the photo being corrected has a different aspect ratio. 

http working but not https

There was a report that one of our websites was down. Reported to PB, his reply was:

Found that http was working but not https

Then did the following:

root@ourserver:openssl s_client -connect our.domain.org:443 -servername our.domain.org

and got the error message

verify error:num=20:unable to get local issuer certificate

# comment out in  /etc/apache2/sites-enabled/our.domain.org-le-ssl.conf

# SSLCertificateChainFile /etc/letsencrypt/live/our.domain.org/chain.pem

and then restarted apache2

download and run an AWS VM snapshot locally on Virtualbox

We took a lot of time to accomplish this - run an AWS VM snapshot locally on Virtualbox and test if all the services are working - apache, mysql, dotnet, wordpress on php. Taking help from ChatGPT, the working method is outlined below.

1. Create an AMI from the snapshot - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html#creating-launching-ami-from-snapshot

2. Export the ami as vmdk - Copy-pasting below from Gemini's howto - (our initial attempts to do the export failed, as the role named "vmimport" had not been created with the required permissions. We could use an AWS cloud shell for the aws cli steps.) 

You can export an AWS AMI as a VMDK file using the AWS VM Import/Export service. This process involves exporting the AMI to an Amazon S3 bucket, from where you can then download the VMDK file.

Here's a detailed breakdown of the steps and important considerations:

1. Prerequisites and Limitations:

Before you start, be aware of these crucial points:

• AWS CLI: You'll primarily use the AWS Command Line Interface (CLI) for this process, as it's the most common and robust way to manage VM Import/Export tasks. Ensure you have it installed and configured with appropriate AWS credentials.
• S3 Bucket: You need an Amazon S3 bucket in the same AWS Region as your AMI to store the exported VMDK file.
• IAM Role (vmimport): AWS VM Import/Export requires an IAM service role (typically named vmimport) with the necessary permissions to read from and write to your S3 bucket. If you don't have this, you'll need to create it. AWS documentation provides the required trust policy and permissions.
• AMI Export Limitations:
  • Not all AMIs can be exported. You generally cannot export AMIs that contain third-party software provided by AWS (e.g., Windows or SQL Server images, or any AMI from the AWS Marketplace), unless they were originally imported as "Bring Your Own License" (BYOL) through VM Import/Export or AWS Application Migration Service (MGN)/AWS Elastic Disaster Recovery (AWS DRS).
  • You cannot export an AMI with encrypted EBS snapshots.
  • VMs with volumes larger than 1 TiB might have limitations (though for larger disks, you might need a manifest file).
  • You can't export an AMI if you've shared it from another AWS account.
  • You can't have multiple export image tasks in progress for the same AMI simultaneously.
  • Volumes attached after instance launch are not exported; only those specified in the AMI's block device mapping are included.
• Consistent AMI: For the best results, ensure your AMI was created from a stopped instance or an application-consistent snapshot to avoid data corruption in the exported VMDK.

2. Steps to Export the AMI as VMDK:

a. Create an S3 Bucket (if you don't have one):

You can do this via the AWS Management Console or AWS CLI.

AWS Console:

1. Go to the S3 service.
2. Click "Create bucket."
3. Provide a unique bucket name.
4. Choose the same AWS Region as your AMI.
5. Keep "Block all public access" enabled unless you have a specific reason to disable it (and understand the security implications).
6. Click "Create bucket."

AWS CLI:

Bash

aws s3 mb s3://your-export-bucket-name --region your-aws-region

b. Create the IAM Role (if you don't have one):

This is crucial for allowing AWS VM Import/Export to interact with your S3 bucket.

1. Create a trust policy file (trust-policy.json):
   JSON

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Service": "vmie.amazonaws.com"
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "vmimport"
           }
         }
       }
     ]
   }
   

2.1 Create the IAM role (vmimport):

bash aws iam create-role --role-name vmimport --assume-role-policy-document file://trust-policy.json

3. Create an inline policy file (role-policy.json):

Replace your-export-bucket-name with your actual bucket name.

json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::your-export-bucket-name", "arn:aws:s3:::your-export-bucket-name/*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": [ "arn:aws:s3:::your-export-bucket-name", "arn:aws:s3:::your-export-bucket-name/*" ] }, { "Effect": "Allow", "Action": [ "ec2:DescribeTags", "ec2:CreateTags" ], "Resource": "*" } ] }

4. Attach the inline policy to the vmimport role:

bash aws iam put-role-policy --role-name vmimport --policy-name vmimport --policy-document file://role-policy.json

c. Start the Export Image Task:

Use the export-image command with the AWS CLI.

Bash

aws ec2 export-image \
    --image-id ami-0123456789abcdef0 \
    --disk-image-format VMDK \
    --s3-export-location S3Bucket=your-export-bucket-name,S3Prefix=exports/ \
    --description "Exported VMDK from MyWebApp AMI"

• Replace ami-0123456789abcdef0 with the actual ID of your AMI.
• Replace your-export-bucket-name with the name of your S3 bucket.
• S3Prefix=exports/ is optional but good practice to organize your exported files within the bucket.
• --disk-image-format VMDK specifies the output format. You can also choose VHD or RAW.

d. Monitor the Export Task:

The export process can take some time, depending on the size of your AMI. You can check the status using the describe-export-image-tasks command:

aws ec2 describe-export-image-tasks 

The Status field will show the progress (e.g., active, completed, deleting, deleted). Wait until the status changes to completed.

3. Download the vmdk - for this, I tried s3cmd which didn't work, based on this discussion. Just installing aws cli with the method outlined here, and 

aws s3 cp  s3://our-vm-export-2025/exports/export-ami-our-vmdk-file.vmdk localfile.vmdk

worked, after 

aws configure 

and entering the access key and secret key (which PB had to generate and give me). 

4. Running the vmdk and verifying it - It turned out that just creating a new VM with the VMDK file as the root file system - (under advanced) - would make it run, but the network interface provided by Virtualbox would be different from that provided by AWS EC2 - so, had to log on to the console. Since there was no password set (or I couldn't remember it), followed this chroot procedure to set a password for root user. For mounting the VMDK file, the easiest way was to go to another virtualbox vm, and in that vm, add this vmdk with a higher SCSI port number as an additional disk - under Settings - Storage for that VM. 

(qemu-img convert -f vmdk -O raw aws-image.vmdk aws-image.raw etc and mounting with a loop filesystem was very very time consuming, since our hard disk was slow. Hence, avoid this method.)

Then, we could log in, and as prompted by chatgpt, modify the cloud-init file - copy-pasting below - 

ip link # to check for interfaces without having ifconfig installed

#Update /etc/netplan/ (for Ubuntu 18.04+, or /etc/network/interfaces for older systems).

Example for Netplan (Ubuntu):

network:

  version: 2

  ethernets:

    enp0s3:

      dhcp4: true

In our case, there was an extra 

set-name: ens5

line which needed to be commented out. Then,

sudo netplan apply

ip a # to check if the interface is up, and if it is down,

sudo ip link set enp0s3 up

and now 

ip a 

should show that the interface has an ip address via dhcp. 

In this case, we tested the VM with NAT networking, with port forwarding set on Virtualbox Settings - Network - 2244 for ssh, 8080 for 80, 8443 for 443.

Then, setting /etc/hosts with the ip address of the host - 192.168.1.6 in this case for the various domains we wished to test, the dotnet app worked fine. Wordpress refused to connect - apparently NATted requests are refused by Wordpress by default, and we would need to make some changes to the config file to make it accept such requests to port 8443, like editing wp-config.php with the lines 

define('WP_HOME', 'https://our.domain.org:8443');

define('WP_SITEURL', 'https://our.domain.org:8443');