You might remember from a previous TIL that I had my Steamdeck configured to push my screenshots into a custom album on Google Photos. Obviously I had to change that now as well, but sadly couldn’t use the existing rclone-based setup for it.

My first idea was to utilize immich-go, as I have just successfully used that for the three day long import of over 50000 pictures from my Google Photos takeout into immich. But that turned out to not be the right tool here: in order to not even try to upload already existing files it will fetch an asset list from immich first, and while that really improves performance for large batch imports, it takes way too long for uploading a single new screenshot.

So instead I went with something self-built which utilizes immich’s API.

A custom upload script

The first part is this little bash script that will take a file as input, upload it to a pre-configured immich instance and also add it to a pre-defined album (which already has to exist). This lives in ~/.local/bin/immich-upload.sh:

#!/bin/bash
set -e

IMMICH_SERVER="https://immich.example.com"
IMMICH_KEY="your api key goes here"
IMMICH_ALBUM="your album id goes here"

INPUT="$1"
if [ "$INPUT" == "" ]; then
    echo "immich-upload.sh <file>"
    exit 0
fi

file_modified=$(stat -c %Y "$INPUT" | date --iso-8601=seconds)
name=$(basename "$INPUT")

# ---

echo "Uploading $INPUT to immich..."

upload=$(curl -sL --request POST "$IMMICH_SERVER/api/assets" \
    -H "Content-Type: multipart/form-data" \
    -H "Accept: application/json" \
    -H "X-API-Key: $IMMICH_KEY" \
    -F "deviceId=\"curl/steamdeck\"" \
    -F "deviceAssetId=\"$name-$file_modified\"" \
    -F "fileCreatedAt=\"$file_modified\"" \
    -F "fileModifiedAt=\"$file_modified\"" \
    -F "assetData=@\"$INPUT\"")

id=$(echo "$upload" | jq -r .id)

echo "Uploaded file, asset id is $id"

# ---

echo "Adding file to album $IMMICH_ALBUM..."

payload=$(jq -n --arg id $id '{ids:[$ARGS.named.id]}')
album=$(curl -sL --request PUT "$IMMICH_SERVER/api/albums/$IMMICH_ALBUM/assets" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -H "X-API-Key: $IMMICH_KEY" \
    -d "$payload")

echo "... done"

Reacting to new screenshots

I use watchexec to listen for changes in my custom screenshot folder (see this TIL post on how to set that up) and calling the upload script with the correct file name. I downloaded a release build of watchexec and threw it into ~/.local/bin, then created another script ~/.local/bin/sync-screenshots that takes care of setting all of the correct parameters¹:

#!/usr/bin/env bash

WATCHEXEC="${HOME}/.local/bin/watchexec"
FOLDER="${HOME}/.steam_screenshots"

${WATCHEXEC} --exts jpg,png,mp4 --fs-events create --emit-events-to environment -w $FOLDER -o queue -p -v -- '/home/deck/.local/bin/immich-upload.sh "$WATCHEXEC_COMMON_PATH/$WATCHEXEC_CREATED_PATH"'

Putting it all together

Finally, a new systemd unit in ~/.config/systemd/user/sync-screenshots.service takes care of starting this bash script and keeping it running:

[Unit]
Description=Sync Steam Screenshots

[Service]
ExecStart=%h/.local/bin/sync-screenshots
Restart=on-failure
RestartSec=5

[Install]
WantedBy=default.target

I enabled and started that:

systemctl --user enable sync-screenshots
systemctl --user start sync-screenshots

Then I took a screenshot and confirmed that the script had run:

Mar 25 15:17:03 steamdeck sync_screenshots[77135]: [Running: /home/deck/.local/bin/immich-upload.sh "$WATCHEXEC_COMMON_PATH/$WATCHEXEC_CREATED_PATH"]
Mar 25 15:17:03 steamdeck sync_screenshots[77188]: Uploading /home/deck/.steam_screenshots/7_20250325151703_1.png to immich...
Mar 25 15:17:04 steamdeck sync_screenshots[77188]: Uploaded file, asset id is 141dc605-edef-48f1-83b5-00bd9d72b13e
Mar 25 15:17:04 steamdeck sync_screenshots[77188]: Adding file to album 0ce35e68-a564-4e26-921e-c486cd9e4725...
Mar 25 15:17:05 steamdeck sync_screenshots[77188]: ... done
Mar 25 15:17:05 steamdeck sync_screenshots[77135]: [Command was successful]

And indeed, upon checking my immich instance, I was also looking at the freshly uploaded screenshot. Mission accomplished!

I’m using Aseprite, and recently came across the “record for aseprite” script for it that allows taking regular snapshots of what I’m currently drawing so a timelapse can be created from that. And that works nicely, but I had to realize that the timelapse would come with transparency until I came to the background during my drawing, which looked really weird when sharing the resulting GIF.

So I looked into adding the usual transparency checkerboard background to the GIF with a quick script, and of course, ImageMagick once more to the rescue. Alas, the resulting GIF was quite large and ImageMagick’s optimization options caused glitches in the GIF. So I looked for another option to optimize the GIF and came across gifsicle.

The result is this bash script which will take a GIF and an optional background image to set, add the background (or a freshly generated checkerboard pattern of the right size) to the GIF, then compress the GIF:

#!/bin/bash

GIF=$1
BG=$2

BASE=$(basename "${GIF%.*}")
OUTPUT="$BASE.bg.gif"

if [ -f "$BG" ]; then
    echo "Adding background image $BG to all frames of $GIF..."
    magick "$GIF" -coalesce null: "$BG" -compose dstOver -layers composite "$OUTPUT"
else
    size=$(gifsicle --sinfo "$GIF" | grep "logical screen" | xargs echo -n | cut -d" " -f 3)

    echo "Generating a $size checkerboard pattern and adding it as background to all frames of $GIF..."
    magick "$GIF" -coalesce null: \( -size $size tile:pattern:checkerboard \) -compose dstOver -layers composite "$OUTPUT"
fi

echo "Optimizing $OUTPUT..."
gifsicle --batch -O3 --lossy=35 "$OUTPUT"

echo "...done!"

Example call:

$ gif_bg 14.gif 
Generating a 256x256 checkerboard pattern and adding it as background to all frames of 14.gif...
Optimizing 14.bg.gif...
...done!

I’m quite happy with the result:

Gina Häußge (@foosel@chaos.social)

Now also with a creation timelapse (after I finally managed to get a proper workflow going for that)

October 14, 2024, 14:43 (UTC)

Since we are talking about several thousand of IPs here in at least 1.5k of CIDR ranges, I was looking for the best way to do that that wouldn’t cause a lot of performance impact - the tracking server needs to be fast.

A list of all CIDR ranges with deny turned out to not work thanks to my endpoint definition in nginx using return statements, and those are apparently evaluated before allow and deny statements. But then I got the hint to look at the geo module and with that it was easy to build a map of IP ranges that should be matched and just combining that with an if.

For a first test I created a converter for this list of IP ranges, filtering for the really big players:

#!/bin/bash

URL=https://raw.githubusercontent.com/PodderApps/ipcat/main/datacenters.csv

if [ $1 != "" ]; then
	DATA=$(curl -s $URL | grep -E "$1")
else
	DATA=$(curl -s $URL)
fi


echo 'geo $is_cloud {'
echo '    default 0;'

while IFS= read -r line; do
	start_ip=$(echo $line | cut -d, -f1)
	end_ip=$(echo $line | cut -d, -f2)
	comment=$(echo $line | cut -d, -f3)

	script="import ipaddress; start_ip=ipaddress.IPv4Address(\"$start_ip\"); end_ip=ipaddress.IPv4Address(\"$end_ip\"); print(next(ipaddress.summarize_address_range(start_ip, end_ip)))"
	cidr=$(python3 -c "$script")

	echo "    $cidr 1; # $comment"
done <<< "$DATA"

echo '}'

Calling this like this then created a conf file:

$ sudo ./generate_is_cloud_map "AWS|DigitalOcean|Google" > /etc/nginx/snippets/is-cloud.conf
$ cat /etc/nginx/snippets/ip-cloud.conf
geo $is_cloud {
    default 0;
    3.0.0.0/15; # Amazon AWS
    # ...
}

which I then could use in my nginx location config through an include and an if statement:

include snippets/is-cloud.conf;

# ...

server {
    location /mylocation {
        if ($is_cloud = 1) {
            return 403;
        }
        # ...
    }
}

For now this seems to work. I’m going to give this a day or so and then look into further IP sources and also blocking off the IPv6 ranges.

I recently acquired a Brother QL-820NWB label printer to be able to quickly create labels for boxes and such, and ideally also print out Deutsche Post’s “print yourself” stamps with it. The Deutsche Post stamp shop allows me to download PDFs targeting the 62mm wide endless labels for that printer, for the two types of stamps I’m interested in (stamp, and address label with stamp). But my attempts in printing those directly to the printer through Gnome’s printer integration weren’t successful, things were too small, the cutter didn’t work etc.

I knew that printing to the printer via my local instance of brother_ql_web works flawlessly, and that the library this is based on, brother_ql, has a command line interface. So I thought, why not just convert the PDFs to individual PNGs, and then print those?

Through the magic of some shell scripting, I’m now able to do just that, right from the command line.

I installed the brother_ql Python package via pip:

pip install --user brother_ql

I had to do a little manual patch to make it work with the latest versions of the required Pillow dependency, by editing brother_ql/conversion.py and changing Image.ANTIALIAS to Image.LANCZOS.

I also made sure my .bash_profile contains the address and model of my printer:

export BROTHER_QL_PRINTER=tcp://192.168.x.x
export BROTHER_QL_MODEL=QL-820NWB

Then I created two shell scripts, one for printing stamps and one for printing labels.

The first one, porto_print, takes care of printing the stamps. It resizes, trims, adds a new border and then extends to the native width for the selected label size (50mm by default, or 62mm if requested) while keeping a right alignment:

#!/bin/bash

# Usage:
#
#   porto_print <pdf> [50|62]

#!/bin/bash

tmpdir=$(mktemp -d)

cleanup() {
  rm -rf "$tmpdir"
}
trap cleanup EXIT

PDF=$1
LABEL=${2:-50}
PNG=$(basename "${PDF%.*}")

case $LABEL in
  "50")
    WIDTH="554"
    ;;
  "62")
    WIDTH="696"
    ;;
  *)
    echo "Unsupported label size: $LABEL"
    exit -1
    ;;
esac

echo "Converting PDF to individual PNGs..."
pdftoppm "$PDF" "$tmpdir/$PNG" -png -r 600

for file in $(ls $tmpdir/*.png); do
  echo "Printing $file..."
  mogrify -background white -bordercolor white -resize 696x -trim -border 25x25 -gravity east -extent ${WIDTH}x284 "$file"
  brother_ql print -l $LABEL "$file" 
done

The second one, porto_address_print, does basically the same, just with slightly different parameters and left alignment:

#!/bin/bash

# Usage:
#
#   porto_address_print <pdf>

tmpdir=$(mktemp -d)

cleanup() {
  rm -rf "$tmpdir"
}
trap cleanup EXIT

PDF=$1
LABEL=${2:-50}
PNG=$(basename "${PDF%.*}")

case $LABEL in
  "50")
    WIDTH="554"
    ;;
  "62")
    WIDTH="696"
    ;;
  *)
    echo "Unsupported label size: $LABEL"
    exit -1
    ;;
esac

echo "Converting PDF to individual PNGs..."
pdftoppm "$PDF" "$tmpdir/$PNG" -png -r 600

for file in $(ls $tmpdir/*.png); do
  echo "Printing $file..."
  mogrify -bordercolor white -background white -resize 696x -trim -border 25x25 -gravity West -extent ${WIDTH}x839 "$file" 
  brother_ql print -l $LABEL "$file" 
done

Both of these were placed under ~/.local/bin and made executable. I can now call them both from anywhere on the command line, just passing the path to the PDF to print.

The result is one or more nicely printed stamps or address labels, ready to be stuck to an envelope:

Now, this should hopefully make it easier for me to print all those address labels for OctoPrint sticker shipments in the future ;) Next step: Automated QR code labels for the various boxes on my shelves ^^

Once again we are using rclone for syncing.

First I created a new target gphoto by running ~/bin/rclone config again and then following these steps. Quick summary:

1. New remote
2. gphoto
3. Empty application ID and secret
4. Full access
5. No advanced config
6. Use web browser to authenticate

I then created a new album:

rclone mkdir gphoto:album/Steamdeck

and adjusted ~/bin/sync_screenshots to use the new remote and remote path:

REMOTE_NAME='gphoto'
REMOTE_DIR='album/Steamdeck'

That was all.

Obviously the same can be done with any of the other sync targets that rclone supports, of which there are many. For ownCloud or NextCloud it looks like WebDAV is the right option to choose.

Update 2025-03-25: There’s now also a TIL on how to do the same for Immich.

First of all, in your unifi controller you should create a new user that Home Assistant will act as to manage your port forward(s) for you. So, log into the controller, go into Settings > Administrators and add a new Administrator user¹.

Then create your port forward in Settings > Routing & Firewall > Port Forwarding. Take note of the id of the port forward you have created - you can find it by clicking edit on it again, it will be the number at the end of the URL of the edit page. E.g. if the URL looks like this: https://my.unifi.controller/manage/site/default/settings/portforward/edit/1234567890 then this is the id of the port forward: 1234567890.

Next, copy this shell script to /config/scripts/unifi.sh in your Home Assistant. Make sure to adjust https://my.unifi.controller (and, if necessary, the site default) to your own values.

#!/bin/sh

set -e

# based on https://community.home-assistant.io/t/automating-unifi-port-forwarding-based-upon-presence-detection/168185

cookie=$(mktemp)
headers=$(mktemp)
curl_cmd="curl --silent --cookie ${cookie} --cookie-jar ${cookie} -D ${headers} --insecure"

BASEURL="https://my.unifi.controller"
SITE="default"

auth() {
  USERNAME=$1
  PASSWORD=$2

  # authenticate against unifi controller
  ${curl_cmd} --output /dev/null -d "{\"username\":\"$USERNAME\", \"password\":\"$PASSWORD\"}" $BASEURL/api/login

  # grab the `x-csrf-token` and strip the newline (added when upgraded to controller 6.1.26)
  csrf="$(awk -v FS=': ' '/^x-csrf-token/{print $2}' "${headers}" | tr -d '\r')"
  echo $csrf
}

portfwd() {
  USERNAME=$1
  PASSWORD=$2
  FORWARD_ID=$3
  FORWARD_ENABLED=$4

  # authenticate against unifi controller
  csrf=$(auth $USERNAME $PASSWORD)

  # enable/disable firewall rule
  body=$(${curl_cmd} -X GET $BASEURL/api/s/default/rest/portforward/$FORWARD_ID | jq '.data[0] | .enabled='$FORWARD_ENABLED'')
  ${curl_cmd} -X PUT $BASEURL/api/s/default/rest/portforward/$FORWARD_ID -H "Content-Type: application/json" -H "x-csrf-token: ${csrf}" -d @<(echo "$body")
}

isportfwd() {
  USERNAME=$1
  PASSWORD=$2
  FORWARD_ID=$3

  # authenticate against unifi controller
  csrf=$(auth $USERNAME $PASSWORD)

  ${curl_cmd} -X GET $BASEURL/api/s/default/rest/portforward/$FORWARD_ID | jq '.data[0].enabled'
}

"$@"

Now, let’s imagine you want to add a switch for an SFTP port forward that you’ve just created. Then, in your secrets.yaml file, add the following:

unifi_forward_sftp_check: '/bin/bash /config/scripts/unifi.sh isportfwd <user> <password> <forward_id>'
unifi_forward_sftp_enable: '/bin/bash /config/scripts/unifi.sh portfwd <user> <password> <forward_id> true'
unifi_forward_sftp_disable: '/bin/bash /config/scripts/unifi.sh portfwd <user> <password> <forward_id> false'

Replace <user>, <password> and <forward_id> with the login credentials and id of the forward you just created.

Next, add a command line switch definition to your configuration.yaml (or in my case to my packages/network.yaml file):

switch:
  - platform: command_line
    switches: 
      sftp_port_forward:
        friendly_name: "SFTP Port Forward"
        command_state: !secret unifi_forward_sftp_check
        command_on: !secret unifi_forward_sftp_enable
        command_off: !secret unifi_forward_sftp_disable
        value_template: '{{ bool(value, false) }}'

Throw that somewhere on your dashboard, or alternatively tie it into some automation, and you’re good to go!

I came across this gist by pegasd that accomplishes this via rclone, a path monitoring systemd service and some reconfiguration in Steam. However, I had to adjust things slightly for everything to really work - I could imagine that some past Steam update changed things slightly vs when the gist was created:

1. I had to make sure that I selected the option to make Steam create uncompressed screenshots.
2. I had to manually start the path watcher.

Here’s a quick summary of how I managed to make things work on my deck (all credits go to @pegasd, replicating things here mostly so they don’t get lost in the future).

Prerequisites

First of all I switched into Desktop mode.

Since I had not yet done this since upgrading my Deck’s SSD, I set a password for my user account by opening a terminal and running passwd. I also made sure to install Firefox from the package manager.

Setting up the screenshot directory

I opened a terminal and created a dedicated screenshot folder:

mkdir ~/.steam_screenshots

Next I had to tell Steam to use this folder. Still in desktop mode I opened Steam settings and on the “In-Game” tab set the screenshot folder to the one I had just created. I also made sure to check “Save uncompressed copy”, as otherwise Steam won’t use the just configured custom folder.

Installing and configuring rclone

Next, still on the deck, I downloaded rclone (“Intel/AMD - 64 Bit / Linux”). I opened the file browser, opened the archive I had just downloaded and extracted the rclone binary into ~/bin (if that doesn’t exist yet, just create it).

I then went back to the terminal, ran ~/bin/rclone config and configured a new remote gdrive following these steps. Quick summary:

1. New remote
2. gdrive
3. Empty application ID and secret
4. Full access to all files
5. No service account credentials file
6. Use web browser to authenticate
7. Not configured as a shared drive

Automatic sync

I created a file ~/bin/sync_screenshots

#!/usr/bin/env bash

RCLONE_BIN="${HOME}/bin/rclone"
REMOTE_NAME='gdrive'
REMOTE_DIR='Privat/Steamdeck/Screenshots'
SOURCE_DIR="${HOME}/.steam_screenshots"

${RCLONE_BIN} sync "${SOURCE_DIR}" "${REMOTE_NAME}:${REMOTE_DIR}"

and made it executable with chmod +x ~/bin/sync_screenshots.

Then I created a service file for it, ~/.config/systemd/user/sync_screenshots.service:

[Unit]
Description=Sync Steam Screenshots

[Service]
Type=oneshot
ExecStart=%h/bin/sync_screenshots

and another file setting up a path watcher, ~/.config/systemd/user/sync_screenshots.path:

[Unit]
Description=Sync Steam Screenshots

[Path]
PathModified=%h/.steam_screenshots
Unit=sync_screenshots.service

[Install]
WantedBy=default.target

I enabled the automation:

sudo systemctl daemon-reload
systemctl --user enable sync_screenshots.path
systemctl --user start sync_screenshots.path

A quick test

I checked that the path watcher was up and running with systemctl --user status sync_screenshots.path.

Then I created a quick test file in the synced folder

touch ~/.steam_screenshots/test

and verified it showed up in the target folder on my Google Drive.

Next I deleted the file on the deck and verified it got deleted in Google Drive.

Finally I booted back into Game mode, took a screenshot there as well with Steam+R1 and verified this showed up on my Drive.

Success!

Update 2023-02-19: There is now also a TIL on how to do the same for Google Photos. Update 2025-03-25: And now there’s also a TIL on how to do the same for Immich.

The idea is to get the current feed.json prior to publishing the page, and then compare it to the one that was just generated during the build. If there are any differences, we know that there are new posts and can trigger further actions from there.

# Get current feed.json
curl -s https://foosel.net/til/feed.json > feed.current.json

# Get new feed.json
cp public/til/feed.json feed.next.json

# Compare the two, this is where the magic happens
jq --slurpfile current til.current.json --slurpfile next til.next.json -n '$next[0].items - $current[0].items' > til.json

Let’s go through this jq command there:

• --slurpfile <variable> <file> reads in the given files and makes it accessible as an array contained in the given variable. In this case we read in til.current.json and make it accessible as $current, and also read in til.next.json and make it accessible as $next.
• -n doesn’t wait for input on stdin.
• '$next[0].items - $current[0].items' subtracts the items from the new feed from the items in the current feed¹.
• > til.json writes the output to til.json.

til.json will then contain all new items (as long as there weren’t more than the feed’s item size), can be uploaded as an artifact and then used in further jobs².

echo $PREFIX | grep -o "com.termux"

This can also be used to set a variable in a Taskfile:

vars:
  TERMUX: '{{and .PREFIX (contains "com.termux" .PREFIX)}}'

Source

function version_and_build_for_kernelimg() {
    kernelimg=$1

    # uncompressed kernel?
    output=$(strings $kernelimg | grep 'Linux version' || echo)

    if [ -z "$output" ]; then
        # compressed kernel, needs more work, see https://raspberrypi.stackexchange.com/a/108107
        pos=$(LC_ALL=C grep -P -a -b -m 1 --only-matching '\x1f\x8b\x08' $kernelimg | cut -f 1 -d :)
        dd if=$kernelimg of=kernel.gz skip=$pos iflag=skip_bytes
        output=$(gzip --decompress --stdout kernel.gz | strings | grep 'Linux version' || echo)
    fi

    version=$(echo $output | awk '{print $3}' | tr -d '+')
    build=$(echo $output | awk -F"#" '{print $NF}' | awk '{print $1}')

    if [[ -n "$version" && -n "$build" ]]; then
        echo "Version: $kernel"
        echo "Build: $build"
    else
        echo
        echo "Cannot determine kernel version and build number for $kernelimg"
    fi
}

Note that this has only been tested with kernels on RaspberryPi OS images, YMMV.