The deployment script is available on GitHub as capistrano-cake.

Installation

I use rvm to manage ruby on OS X, but it doesn’t really matter how you do it as long as you can install ruby gems.

1
2

gem install capistrano
gem install railsless-deploy

The railsless-deploy gem removes most of the railsisms that come with capistrano.

The Setup

I usually use a shared CakePHP core on my production servers, so deployment from development consists of transferring my app files and dependencies (plugins, etc.). Managing dependencies with Composer is well worth the effort, and allows you to easily add packages from Packagist or from your own private repositories.

My app to deploy is structured like this:

Capfile
composer.json
Config/
Console/
Controller/
Lib/
Locale/
Model/
Plugin/
Test/
Vendor/
View/
compass/
tmp/
webroot/

I’m splitting up my deploy script into two files, app.rb and deploy.rb. This lets me reuse deploy.rb for every CakePHP deployment, while only changing a few variables in app.rb. Both of these files are put in my app’s Config directory. The Capfile in the root of my app simply loads things:

1
2
3
4

require 'rubygems'
require 'railsless-deploy'
load  'Config/app'
load    'Config/deploy'

In Config/app.rb, I set the required variables for deployment:

1
2
3
4
5

set :application, "testapp.chronon.us"
set :repository,  "ssh://git.chronon.us/home/repos/testapp"
set :deploy_to, "/var/www/#{application}"
set :branch, "master"
role :web, "server.chronon.us"

The deploy strategy here is that I’m developing the site locally, pushing changes to a private git repository (git.chronon.us), and have the production server (server.chronon.us) pull changes from the git repository.

Deploying

With my app.rb configured, I can set things up on the remote server:

1

cap deploy:setup

This creates two directories on the remove server, releases and shared. In shared, the following directories are created by the CakePHP deploy.rb specifically for a CakePHP app and permissions are set correctly for the tmp directory.

tmp/
Config/
Plugin/
Vendor/

The config files core.php, bootstrap.php, and database.php are uploaded to shared/Config. Before deploying, make the necessary changes to these to match your production server environment.

To deploy an app for the first time:

1

cap deploy -S composer=install

The -S composer=install part passes the install command to the composer task in the deploy script. By default, composer runs the update command, so future deployments will require only cap deploy.

Upon deployment, a few special things happen:

• The tmp, Plugin, and Vendor directories in the app directory on the server are removed, and symlinked to the corresponding directories in the shared directory capistrano made.

• The files core.php, bootstrap.php, and database.php in the Config directory are removed, and symlinked to corresponding names in the shared/Config directory.

• The CakePHP tmp directory structure (cache, sessions, tests, logs) is created in shared/tmp.

• If a composer.json project file exists, composer runs install, putting plugins into shared/Plugins and vendor files into shared/Vendor.

• If a compass project exists and set :compile_css, true has been set in app.rb, the command compass compile compass is run locally. The compiled css files are then transferred to the remote server, eliminating the need to compile assets on a production server.

• If javascript compilation and minification has been configured with jammit and set :compile_js, true has been set in app.rb, the command jammit -c compass/assets.yml -o webroot/js/ runs locally. The compiled js files are then transferred to the remote server.

Options

A few other variables can be set in app.rb, all are optional:

1
2
3
4
5
6

set :cake_config_files, %w{core.php database.php bootstrap.php} # these are the defaults if not set
set :cake_shared_dirs, %w{tmp Vendor Plugin} # these are the defaults if not set
set :upload_dirs, %w{img/contents img/options files/downloads}
set :compile_css, true
set :compile_js, true
set :files_to_remove, %w{webroot/css/cake*.css webroot/img/cake.* webroot/img/test-*.png webroot/test.php}

• cake_config_files: the config files to symlink and upload during initial setup.
• cake_shared_dirs: the directories to symlink from app to shared.
• upload_dirs: sets the listed directories to be created in the shared directory and symlinked, just like Plugin and Vendor.
• compile_css: runs compass compile, requires compass to be set up in your app’s compass directory.
• compile_js: runs jammit, requires an assets.yml file in your app’s compass directory.
• files_to_remove: array of files to delete at the end of deployment.

Conclusion

Obviously this setup is pretty specific to how I have things set up for development. Hopefully all or at least parts of the workflow and script can helpful in deploying CakePHP sites with capistrano.

CakePHP’s built-in CakeRequest object can easily determine if a request is from a mobile device:

$this->request->is('mobile');

However, sometimes an application needs finer control over what to serve certain devices, such as a mobile layout to smartphones and a desktop layout to tablets. The MobileDetect project is a “lightweight PHP class for detecting mobile devices”. This component, packaged as a plugin, makes MobileDetect available in a CakePHP controller.

Compatibility:

Tested with CakePHP 2.3.x, but should work fine with any CakePHP 2.x version.

Installation:

Using Composer/Packagist:

In your project composer.json file:

1
2
3
4
5
6
7
8

{
  "require": {
      "chronon/mobile_detect": "*"
  },
  "config": {
        "vendor-dir": "Vendor"
    }
}

This will install the plugin into Plugin/MobileDetect, and install the Mobile_Detect lib (from Packagist) into your Vendor directory.

In your app’s Config/bootstrap.php, import composer’s autoload file:

1
2

<?php
App::import('Vendor', array('file' => 'autoload'));

Using git:

You will need the component (packaged as a plugin), and the MobileDetect PHP library (not included). The MobileDetect library needs to be in this plugin’s Vendor directory and must be named ‘MobileDetect’. Using git, something like this:

1
2

git clone git@github.com:chronon/CakePHP-MobileDetectComponent-Plugin.git APP/Plugin/MobileDetect
git clone git@github.com:serbanghita/Mobile-Detect.git APP/Plugin/MobileDetect/Vendor/MobileDetect

The MobileDetect library could also be added as a git submodule…

Usage:

The component has only one method, named detect. It accepts two arguments: the method to pass to the MobileDetect library, and any arguments for the passed method.

Example: check if a request is from a tablet:

$result = $this->MobileDetect->detect('isTablet');

Example: check if a request is from an iOS device :

$result = $this->MobileDetect->detect('isiOS');

Example: get version number of an Android device:

$result = $this->MobileDetect->detect('version', 'Android');

See the demo at mobiledetect.net for a list of all available methods.

Example:

Let’s say we want to serve a mobile layout to smartphones and a desktop layout to tablets. Instead of loading the component on every request (by adding it to your controller’s $components array), we’ll load the component on the fly when needed. This example sets a session variable tablet if the request is from a tablet, calling the component only once.

In Controller/AppController.php:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

<?php
public function beforeFilter() {
  // check if the request is 'mobile', includes phones, tablets, etc.
  if ($this->request->is('mobile')) {
      if (!$this->_isTablet()) {
          // if the request is mobile, but not a tablet, activate the mobile layout
          $this->_setMobile();
      }
  }
}

protected function _setMobile() {
  $this->theme = 'Mobile';
  // etc...
}

protected function _isTablet() {
  if ($this->Session->check('tablet')) {
      if ($this->Session->read('tablet') == true) {
          return true;
      }
      return false;
  }
  // load the component
  $this->MobileDetect = $this->Components->load('MobileDetect.MobileDetect');
  // pass the component the 'isTablet' method
  $result = $this->MobileDetect->detect('isTablet');
  $this->Session->write('tablet', $result);
  return $result;
}

CakePHP YMLP Component

YMLP, or Your Mailing List Provider, is a email newsletter and marketing service with free and paid accounts, and a well written API.

This component interfaces a CakePHP app with YMLP’s API.

You will need a free or paid account at YMLP, along with your username and API key (found at ymlp.com under “Configuration”, “API”). Make sure to enable API access on YMLP’s API page!

Compatibility:

Tested with CakePHP 2.3.x. Requires PHP 5 with cURL support.

Installation:

Using Composer/Packagist:

In your project composer.json file:

1
2
3
4
5

{
  "require": {
      "chronon/ymlp": "*"
  }
}

Using git:

1

git clone git@github.com:chronon/CakePHP-YmlpComponent-Plugin.git APP/Plugin/Ymlp

Configuration:

All configuration is in APP/Config/bootstrap.php.

Required: Load the plugin:

1

CakePlugin::load('Ymlp');

or

1

CakePlugin::loadAll();

Required: Set your YMLP API key and username.

1
2
3
4
5

<?php
Configure::write('Ymlp.settings', array(
  'Key' => '1234567890ABCDEFG',
  'Username' => 'yourusername',
));

Required: Set your YMLP field mapping, which is your local field => YMLPField.

1
2
3
4

<?php
Configure::write('Ymlp.fieldMap', array(
  'email' => 'Email',
));

Usage:

Add the component to your controller:

1
2

<?php
public $components = array('Ymlp.Ymlp');

Example: if you have a subscriber form with a field named email, $this->request->data would look something like this:

1
2
3

['Subscriber'] => array(
  'email' => 'some@email.com'
)

To add this email address to YMLP using the component:

1
2

<?php
$result = $this->Ymlp->command('Contacts.Add', $this->request->data['Subscriber']);

The $result would be the response from YMLP’s Contacts.Add() method. See the YMLP docs for all available API commands.

The available methods of this component are:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

utility($method, $data = array())

/**
 * A utility method to send anything to the YMLP API
 *
 * @param string $method The YMLP API method call
 * @param array  $data Data to pass to the YMLP method
 * @return string
 * @access public
 */
 
command($method, $data)

/**
 * The primary method to format data, post it to the YMLP API, and then format
 * the returned result.
 *
 * @param string $method The YMLP API method call
 * @param array  $data Data to pass to the YMLP method
 * @return string
 * @access public
 */

Example usage of the utility method to view a list of configured YMLP fields. If you created a form at YMLP to collect name, email address, and mailing address, you need to match your app’s fields with YMLP fields. The YMLP API Fields.GetList() method can give you what you need.

Create a temporary method in your controller and use the component’s utility method:

1
2
3
4
5
6

<?php
public function utility() {
  $result = $this->Ymlp->utility('Fields.GetList');
  debug($result);
  exit;
}

Visit /utility and you should see a list of YMLP configured fields with field id, which you can use to map to your app fields with the Ymlp.fieldMap configuration array.

1
2
3
4
5
6
7
8
9
10

<?php
Configure::write('Ymlp.fieldMap', array(
  'email' => 'Email',
  'first_name' => 1,
  'last_name' => 2,
  'address' => 3,
  'city' => 4,
  'state' => 5,
  'zip' => 6,
));

As we made it down the mountain and passed near the neighborhood, we tried every spur trail only to be met with multiple fences and private property. A ninja mission to a promising looking gate set off some alarms, so we quickly retreated back to the trail.

By now we had walked around 4.5 miles and it was getting late in the afternoon, so we decided our best option was to just follow the trail to it’s end. Eventually we made it to Oak Canyon park, which was 2.8 miles away from our car on main roads. My maps app didn’t show any connecting trail or road between Oak Canyon park and were we were parked, so we started walking on the road. Eventually we made it back to the car, and arrived home as it was getting dark.

A few days later, I investigated our hike in Google Maps on my computer, and clearly saw a distinct line connecting Oak Canyon park with the neighborhood our car was parked in. Zooming in, it became clear it was a bike path. The 2.8 miles we walked would have been .7 on the bike path…if we only knew it was there! Of course I should have checked the satellite imagery, or at least checked the web version of Google Maps from my phone…but instead I trusted the Apple Maps data without question.

A PHP Markdown helper packaged as a plugin, includes php-markdown.php.

Installation:

Using Composer/Packagist:

If you are using composer, require chronon/markdown:

1
2
3
4
5
6
7
8

{
    "require": {
        "chronon/markdown": "*"
    },
  "config": {
        "vendor-dir": "Vendor"
    }
}

This will install the plugin into Plugin/Markdown, and install Markdown lib (from Packagist) into your Vendor directory.

In Config/bootstrap.php, import composer’s autoload file:

1
2

<?php
App::import('Vendor', array('file' => 'autoload'));

Using git:

If you are not using composer, clone the repository:

1

git clone git@github.com:chronon/CakePHP-Markdown-Plugin.git APP/Plugin/Markdown

Usage:

In your controller:

1
2

<?php
public $helpers = array('Markdown.Markdown');

In your view:

1
2

<?php
echo $this->Markdown->md(markdown_to_be_converted_to_html);

Description:

This plugin adds Flickr photos to the Octopress sidebar, with a few configurable options. It does not require Flickr API access as it uses their badge script.

Files:

Place flickr.html in source/_includes/custom/asides/. Optionally copy the contents of
_styles.scss to sass/custom for some basic styling (centered photos with 20px top margin).

Configuration:

Add custom/asides/flickr.html to default_asides: in your _config.yml. If you want photos at the top of the sidebar, add it to the beginning of the list.

Add the Flickr sidebar configuration options to your _config.yml at the bottom of “3rd Party Settings”. You’ll need your Flickr user id, which is different from your username. An easy way to find your user id is idgettr.com.

1
2
3
4
5
6
7

# Flickr Badge
flickr_user:            # user id (not username)
flickr_count:           # number of photos to show (example: 3)
flickr_display:         # random or latest
flickr_size:            # t (thumbnail), s (small square), m (medium)
flickr_source:          # user, user_tag, all, all_tag
flickr_tag:             # tagname - set if flickr_source is set to user_tag or all_tag

The flickr_source: setting can be:

• user (all user’s public photos)
• user_tag (user’s tagged photos),
• all (everyone’s public photos)
• all_tag (all public photos tagged with tag)

Example/Demo

See the bottom of the sidebar at technokracy.net, or the source on Github.

Description

For simple deployments and updates to a website, rysnc is a wonderful tool. zrsync is a simple rsync wrapper I wrote because I got tired of typing commands like this:

1
2
3

rsync -auv -e ssh --delete-after --stats --exclude=.svn --exclude=.git*
--exclude-from=sync.exclude /Users/chronon/www/chronon.com/public/
chronon.com:/home/chronon/www/chronon.com/public

Following a few required conventions and using zrsync, the above command becomes:

1

zrsync

A little easier to remember!

Installation

Put the script in your $PATH. Obviously SSH access to the remote host is required, preferably using key pair authentication.

Configuration

Optional: Set an environment variable for your most commonly used remote host. In .bashrc for example:

1

export ZRSYNC_REMOTE="chronon.com"

Optional: Set an environment variable to convert Mac OS X directory /Users to /home when figuring out the remote path. See the conventions section below for details. In .bashrc for example:

1

export ZRSYNC_OSXUSER=1

Conventions

This script is based on (my) conventions, which if followed make using it very simple.

• Use the same directory structure on your local development machine as you do on your server. Since OS X puts users in /Users and servers rooted in UNIX put users in /home, set the above mentioned environment variable ZRSYNC_OSXUSER to 1.

• To exlcude files or directories, create a file in the root of your project named sync.exclude and list stuff there. Example sync.exclude contents:

1
2
3

Tests/
tmp/
webroot/test.php

• Both .svn and .git files/directories are automatically excluded.

Usage

If the above conventions are followed, to perform an rsync deployment or update of a project is as simple as cd to project root, and typing zrsync.

All command line options can be seen by typing zrsync -h. A pretend/dry-run mode is available by using the -p option.

This is a simple component that interfaces a CakePHP app with Stripe’s PHP API library. Pass the component an array containing at least an amount and a Stripe token id, it will attempt the charge and return an array of the fields you want.

Compatibility:

Tested with CakePHP 2.2.x, though should work with any 2.x version. The required Stripe PHP API library requires PHP 5 with cURL support.

Installation:

Using Composer/Packagist:

In your project composer.json file:

1
2
3
4
5
6
7
8

{
  "require": {
      "chronon/stripe": "*"
  },
  "config": {
        "vendor-dir": "Vendor"
    }
}

This will install the plugin into Plugin/MobileDetect, and install the Stripe library (from Packagist) into your Vendor directory.

In your app’s Config/bootstrap.php, import composer’s autoload file:

1
2

<?php
App::import('Vendor', array('file' => 'autoload'));

Using git:

You will need the component (packaged as a plugin), and Stripe’s PHP library (not included). The Stripe library needs to be in this plugin’s Vendor directory and must be named ‘Stripe’. Using git, something like this:

1
2

git clone git@github.com:chronon/CakePHP-StripeComponent-Plugin.git APP/Plugin/Stripe
git clone git://github.com/stripe/stripe-php.git APP/Plugin/Stripe/Vendor/Stripe

Configuration:

All configuration is in APP/Config/bootstrap.php.

Required: Load the plugin:

1
2

<?php  
CakePlugin::load('Stripe', array('bootstrap' => false, 'routes' => false));

Required: Set your Stripe secret API keys (both testing and live):

1
2
3

<?php  
Configure::write('Stripe.TestSecret', 'yourStripeTestingAPIKeyHere');
Configure::write('Stripe.LiveSecret', 'yourStripeLiveAPIKeyHere');

Optional: Set Stripe mode, either ‘Live’ or ‘Test’. Defaults to Test if not set.

1
2

<?php
Configure::write('Stripe.mode', 'Test');

Optional: Set the currency. Defaults to ‘usd’. Currently Stripe supports usd only.

1
2

<?php
Configure::write('Stripe.currency', 'usd');

Optional: fields for the component to return mapped to => Stripe charge object response fields. Defaults to 'stripe_id' => 'id'. See the Stripe API docs for Stripe_Charge::create() for available fields. For example:

1
2
3
4
5
6
7
8

<?php
Configure::write('Stripe.fields', array(
  'stripe_id' => 'id',
  'stripe_last4' => array('card' => 'last4'),
  'stripe_address_zip_check' => array('card' => 'address_zip_check'),
  'stripe_cvc_check' => array('card' => 'cvc_check'),
  'stripe_amount' => 'amount'
));

See Usage below if Stripe.fields is confusing.

Optional: add a logging config:

1
2
3
4
5
6
7

<?php
CakeLog::config('stripe', array(
  'engine' => 'FileLog',
  'types' => array('info', 'error'),
  'scopes' => array('stripe'),
  'file' => 'stripe',
));

Usage:

Make a payment form however you want, see the Stripe docs for sample code. Add the component to your controller:

1
2
3
4

<?php
public $components = array(
  'Stripe.Stripe'
);

Format your form data so you can send the component an array containing at least:

1
2
3
4
5

<?php
$data = array(
  'amount' => '7.59',
  'stripeToken' => 'tok_0NAEASV7h0m7ny'
);

Optionally you can include a description field as well, which according to Stripe docs is:

An arbitrary string which you can attach to a charge object. It is displayed when in the web interface alongside the charge. It’s often a good idea to use an email address as a description for tracking later.

For example:

1
2
3
4
5
6

<?php
$data = array(
  'amount' => '7.59',
  'stripeToken' => 'tok_0NAEASV7h0m7ny',
  'description' => 'Casi Robot - casi@robot.com'
);

Attempt a charge: $result = $this->Stripe->charge($data);

If the charge was successful, $result will be an array as described by the configuration value of Stripe.fields. If Stripe.fields is not set:

1
2
3
4

<?php
$result = array(
  'stripe_id' => 'ch_0NXLLCydWzSIeE'
);

If Stripe.fields is set, using the example described above in the Configuration section would give you:

1
2
3
4
5
6
7
8

<?php
$result = array(
  'stripe_id' => 'ch_0NXLLCydWzSIeE',
  'stripe_last4' => '4242',
  'stripe_address_zip_check' => 'pass',
  'stripe_cvc_check' => 'pass',
  'stripe_amount' => 769
);

If the charge was not successful, $result will be a string containing an error message, and log the error.

Get a free certificate:

1. Find a free certificate provider, such as InstantSSL/Comodo. A list of others is available here.
2. Complete the form, recieve email confirmation.
3. Open the link in the email with Firefox, you should see an alert about certificate installed.

Export certificate to a file:

1. In Firefox, go to Preferences -> Advanced -> Encryption and push View Certificates.
2. Click Your Certificates, click on the certificate (line with a serial number).
3. Click Backup, select Desktop, and enter a password.

Import certificate to your keychain:

1. On your desktop, you should have something like comodo.p12, double click it.
2. Enter the password you just set and import the certificate.
3. Save your exported certifcate somewhere for backup, remember your password.

Using your certificate:

1. Quit Mail.app if it’s running, open Mail.app.
2. Compose a new message, notice two new buttons (a lock and a check).
3. When the check box is checked, your public certificate will be sent to the recipient.
4. Once your recipient has your public certificate, you can sign and encrypt (lock button) messages.
5. Any time you sign a message (check button checked), you are sending your public certificate.

Using your certificate with iOS devices:

1. Check out this very good blog post.

So…through some git experimentation trying to erase the history of a file, I committed and pushed to a local repository, which turned out not to be my intention. Instead of figuring out how to fix it the git way, I thought I’d just copy yesterday’s Time Machine backup of the repository. Instead of using Time Machine app, I mounted the backup disk, and cp -R‘d the directory. A ls-l told me permissions and user:group ownership were correct…though I did notice an @ tacked onto the end drwxr-xr-x@…

Insufficient Permission?

Returning to the project a few days later, git pushing a new tag to the local repository didn’t work, with a permission error:

insufficient permission for adding an object to repository database etc.

WTF, permissions and ownership are right. Google, Google, git, permissions, etc. and no luck. Then, brilliant insight - don’t ignore the information presented to me. What exactly does the @ on the end of drwxr-xr-x@ mean anyway?

OS X Extended Attributes

Copying directly from the Time Machine backup also copied extended attributes and ACLs, which I definitely didn’t want. The command

1

xattr my_repository.git

told me things like com.apple.metadata:_kTimeMachineOldestSnapshot and com.apple.metadata:_kTimeMachineNewestSnapshot were attached to the directory and it’s files. To remove:

1
2

sudo xattr -d -r 'com.apple.metadata:_kTimeMachineOldestSnapshot' my_repository.git
sudo xattr -d -r 'com.apple.metadata:_kTimeMachineNewestSnapshot' my_repository.git

To learn more about xattr:

1

xattr -h

OS X ACLs

Now ls -l gave me drwxr-xr-x+, with the + meaning the directory has ACL (access control lists) attached to it. Needless to say, I still couldn’t push to the repository, even though the standard user:group permissions said I could. To remove the ACL restrictions:

1

sudo chmod -R -a# 0 my_repository

Finally, ls -l returns plain old drwxr-xr-x, and I could push to my repository. What a wonderful waste of time!

• 2013-06-18 Adding change rbackup user’s login shell section.
• 2013-06-14 A few steps updated, thanks in part to contributors. Notably, the rbackup user doesn’t necessarily need to be created on the backup server (uno) as described originally.
• 2011-01-07 Initial post.

Introduction

The Mission:

To rsync and/or rsnapshot both normal and protected/restricted files from one server to another over ssh without enabling remote root access to either server while maintaining original file attributes and permissions. Whew.

Cast of Characters

• uno: the server which will store the backups, run rsync or rsnapshot.
• zero: the server to be backed up, with root readable files (/etc for example).

Prerequisites

• root on both uno and zero, hopefully via sudo and not by remote root ssh access!

Configuration

The command examples here are specific to Debian and Ubuntu, so adjust to your distribution accordingly (though little if any adjustment should be necessary).

Server: uno (backup server)

Become root, create an ssh key pair:

1

root# ssh-keygen -t rsa

When naming the key, don’t accept the default. Instead, enter

1

/root/.ssh/id-rbackup_rsa

We’re naming the key pair with ‘rbackup’ in it to keep track of what the keys are for.

As root, create a ssh config file:

1

root# vim .ssh/config

In root’s .ssh/config file:

1
2
3
4
5

Host zero-rsync
  Port 456 # only required if zero is running sshd on a non-standard port
  Hostname zero
  User rbackup
  IdentityFile /root/.ssh/id-rbackup_rsa

Save the file, set permissions:

1

root# chmod 600 config

While still root, copy the public key id-rbackup_rsa.pub somewhere publicly accessible, such as your regular user’s home directory.

As your regular user (which already has ssh access to zero), send this public key from uno to zero:

1

$ scp ~/id-rbackup_rsa.pub zero:~/

Server: zero (server to be backed up)

Create new backup user, lets call it rbackup:

1

$ sudo adduser rbackup

Make uno’s public key id-rbackup_rsa.pub available to user rbackup.

Login as rbackup, create a .ssh directory, set permissions, create an authorized_keys file:

1
2
3
4
5
6
7

$ su rbackup
$ cd
$ mkdir .ssh
$ chmod 700 .ssh
$ cd .ssh
$ cat /home/regularuser/id-rbackup_rsa.pub > authorized_keys
$ chmod 600 authorized_keys

Now we want to limit the use of this authorized key by allowing connections only from uno, and allowing one command only. Edit the key, and add something like this to the beginning of the key:

1
2

from="192.168.100.123",command="/home/rbackup/validate_rsync.sh" ssh-rsa AX
...remainder of key...rbackup@uno

While still user rbackup, create a script named validate_rsync.sh in your home directory:

1
2

$ cd
$ vim validate_rsync.sh

Contents of validate_rsync.sh:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#!/bin/sh
case "$SSH_ORIGINAL_COMMAND" in
  *\&*)
    echo "Connection closed"
    ;;
  *\;*)
    echo "Connection closed"
    ;;
    rsync*)
    $SSH_ORIGINAL_COMMAND
    ;;
  *true*)
    echo $SSH_ORIGINAL_COMMAND
    ;;
  *)
    echo "Connection closed."
    ;;
esac

Make sure that validate_rsync.sh is executable by user (and group) rbackup:

1

$ chmod 754 validate_rsync.sh

As your regular user (which can sudo):

1

$ sudo visudo

Add this line to the bottom:

1

rbackup    ALL=NOPASSWD:/usr/bin/rsync

For a little added security, set the rbackup user’s login shell to the validate_rsync.sh script:

1

$ sudo chsh rbackup

When prompted to choose the login shell, enter /home/rbackup/validate_rsync.sh.

If you have the AllowUsers directive set for sshd in /etc/ssh/sshd_config, make sure to add the user rbackup to the list, and restart sshd.

As root or with sudo, create a simple rsync wrapper, named rsync_wrapper.sh at /usr/local/bin, containing:

1
2

#!/bin/sh
/usr/bin/sudo /usr/bin/rsync "$@";

Testing

Test 1

Become user rbackup on uno, attempt ssh to zero:

1

$ ssh zero

Expected response:

1
2

Connection closed.
Connection to zero closed.

The “Connection closed.” with the period at the end tells us the validate_rsync.sh worked as expected (echoing the last Connection closed).

Test 2

Become root on uno, attempt to ssh to zero-rsync (the alias set in root’s .ssh/config):

1

root# ssh zero-rsync

Expected response:

1
2

Connection closed.
Connection to zero closed.

Test 3

Become root on uno, attempt to rsync something on zero that is restricted:

1
2

root# rsync -ae ssh --rsync-path='rsync_wrapper.sh' zero-rsync:/etc
/home/regularuser/tmp/

Expected response: you should have a copy of zero’s /etc directory in regular users tmp directory (or wherever). Important things to note in the above command - the –rsync-path switch and using zero-rsync as the host instead of just zero.

Using rsnapshot

If the above tests all work, setting up rsnapshot is easy. Check any other guide for general setup info, the relevant stuff for us to use in our rsnapshot.conf is:

1
2

rsync_long_args --rsync-path=rsync_wrapper.sh --delete --numeric-ids --relative --delete-excluded
backup rbackup@zero-rsync:/etc zero/

Remember the rsnapshot.conf file needs tabs. The rsync_long_args setting is rsnapshot’s default rsync arguments, with our --rsync-path=rsync_wrapper.sh added. The backup command has our backup user (rbackup) and the host alias set in root@uno’s .ssh/config.

References

This was pieced together from various notes, blogs, and articles. Some script source and extra-helpful information was found at:

• alien.slackbook.org/dokuwiki/doku.php?id=linux:rsnapshot
• troy.jdmz.net/rsnapshot/
• www.cyberciti.biz/faq/linux-rsnapshot-backup-howto/
• serverfault.com/questions/136549/rsync-over-ssh-with-root-access-on-both-sides

The source code for these demos is freely available, so it should be very easy to add these (or other) types of photo galleries to your own app.

Available demos:

• Raw
• Colorbox
• Galleriffic
• Photostack

When viewing the controller code for each demo, the $params array is merged with some defaults I’ve set in /app/bootstrap.php. Setting defaults for this Flickr plugin is totally optional, but makes for less code in your controller. The defaults I’ve set for all of these demos is:

1
2
3
4
5
6
7
8

<?php
'Flickr.defaults', array(
    'api_key' => '111122223333aaaabbbbccccdddd',
    'user_id' => '1234567@N66',
    'method' => 'flickr.photos.search',
    'format' => 'php_serial',
    'extras' => 'description, date_taken'
)

All defaults can be overridden/replaced in your controller. See the docs for my Flickr plugin and the Flickr API for additional information. For more information on how to use and customize any of the demo galleries you see here, check the developer websites below (and thank them for their excellent work!):

• Colorbox
• Galleriffic
• Photostack

Requirements:

• CakePHP 1.3 (might work with 1.2, not tested)
• PHP 5 (tested with PHP 5.3.2/Apache 2 OS X and Debian Linux)
• allow_url_fopen set to on in your php.ini (this uses PHP streams and not cURL)
• A Flickr account and a Flickr API key

Configuration:

Global configuration is optional, but useful. You can put default values in app/config/bootstrap.php or app/config/core.php like this:

1
2
3
4
5
6
7
8
9
10
11

<?php
Configure::write('Flickr.posting_url', 'http://api.flickr.com/services/rest/');
Configure::write(
    'Flickr.defaults', array(
        'api_key' => '111122223333aaaabbbbccccdddd',
        'user_id' => '1234567@N66',
        'method' => 'flickr.photos.search',
        'format' => 'php_serial',
        'extras' => 'description, date_taken'
    )
);

Pretty much any option available by the Flickr API can go here. All defaults can be overridden/replaced in your controller as needed.

Usage:

First, you might want to take a look at this plugin’s demo project code, demo site or blog entry.

Controller:

Add the plugin’s component and helper to your controller:

1
2
3

<?php
public $components = array('Flickr.Flickr');
public $helpers = array('Flickr.Flickr');

Using the defaults above (replacing the api_key and user_id values with your own), this would get 20 photos from user_id’s account with the tag “Public”:

1
2
3
4
5
6
7
8
9

<?php
public function somephotos() {
    $params = array(
        'tags' => 'Public',
        'per_page' => 20,
    );
    $photos = $this->Flickr->flickrRequest($params);
    $this->set('photos', $photos);
}

The $photos variable would be an array, which you or the included Flickr helper can do something with. Again, check the Flickr API for all of the available options.

This example gets all of the Flickr sets for user_id, including everything needed to display the set thumbnail, title, and description:

1
2
3
4
5
6

<?php
public function somesets() {
    $params = array('method' => 'flickr.photosets.getList');
    $sets = $this->Flickr->flickrRequest($params);
    $this->set('sets', $sets);
}

Helper:

Output the 20 photos tagged “Public” you set in the above somephotos() method:

1
2
3
4
5
6

<?php
echo $this->Flickr->getPhotos(
    $photos,
    array('type' => 'div'),
    array('rel' => 'example1', 'title' => 'flickr_title')
);

The resulting HTML would be:

1
2
3
4
5

<div>
    <a href="http://farm5.static.flickr.com/4079/4750870838_52fc9c7167.jpg" rel="example1" title="Doi Mae Salong">
        <img src="http://farm5.static.flickr.com/4079/4750870838_52fc9c7167_s.jpg" alt="" />
    </a>
</div>

The helper parameters are:

• @param array $photos required The response from Flickr as an array (what this plugin’s component returns)

• @param array $formatAttribs optional Special key: type. This is what each thumbnail is wrapped in. The default is nothing. You could use things like ‘type’ => ‘div’ or ‘type’ => ‘li’ or ‘type’ => ‘p’, etc. You can also add additional HTML attributes, such as ‘class’ => ‘thumb’, ‘id’ => ’flickr_id’, etc. See the info on the special flickr_ values below.

• @param array $linkAttribs optional Attributes for the <a> wrapping the thumbnail. Examples (from above ‘rel’ => ‘example1’, ‘title’ => ‘flickr_title’.

• @param array $thumbAttribs optional Attributes for the containing the thumbnail. Example: ‘class’ => ‘little’, ‘alt’ => ’flickr_title’. There is also a special key named ‘size’, which determines the thumbnail size. Default is Flickr’s size ‘s’, which is 75x75. See Flickr’s size codes for the list. For a 500px photo, do this: ‘size’ => ‘n’, for 240px: ‘size’ => ‘m’. You can also use numbers (but they must be valid Flickr sizes): ‘size’ => 100.

• @param array $imgAttribs optional Size for the large image. Default: ‘size’ => ‘n’. The only parameter you can set for the linked image is ‘size’. See Flickr’s size codes for the list.

• @param array $captionAttribs optional The special keys for caption are ‘type’, ‘location’, and ‘caption’. The ‘type’ key should be things like div, p, li, etc. Example: ‘type’ => ‘div’. The ‘location’ key can only have the values ‘before’ or ‘after’, which determines the placement of the caption in relation to the linked thumbnail image. The ‘caption’ key sets the contents of the caption. Examples: ‘caption’ => ’flickr_description’, ‘caption’ => ’flickr_datetaken’.

The special flickr_ values

These values act as variables and use the corresponding values returned from Flickr. If you use one for an ‘id’ anywhere, such as ‘id’ => 'flickr_id', in the $linkAttribs array, it will append type of a attribute to the id to make valid XHTML - so the above would produce something like: id="link1234567" in the HTML output. The special variables are:

• ‘flickr_id’,
• ‘flickr_secret’,
• ‘flickr_title’,
• ‘flickr_datetaken’,
• ‘flickr_description’

Once configured, all you have to do is feed the component an array of order data (fields used are up to you) and it will map the fields, build the XML string, submit the string, read the response from the gateway, and convert the response back into an array.

Installation

git clone or submodule add to your your app/plugins directory

Requirements

• PHP5 with curl support
• CakePHP - tested on 1.3 only but should work fine with 1.2

Example usage in your controller

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

<?php
// attempt the charge (array $data, boolean $testing)
$response = $this->Ggapi->ggProcess($data, true);

// update the order table with the response
if ($response) {
    if ($response['r_approved'] == 'APPROVED') {
        // merge the response data with the order data
        $this->data['Order'] = array_merge($this->data['Order'], $response);
    } else {
        // card was DECLINED
        $error = explode(':', $response['r_error']);
        $this->Session->setFlash(
            'Your credit card was declined. The message was: '.$error[1],
            'modal',
            array('class' => 'modal error')
        );
        $this->redirect(array('controller' => 'orders', 'action' => 'checkout'));
    }
} else {
    // no response from the gateway
    $this->Session->setFlash(
        'There was a problem connecting to our payment gateway, please try again.',
        'modal',
        array('class' => 'modal error')
    );
    $this->redirect(array('controller' => 'orders', 'action' => 'checkout'));
}

The Bakery Article

Right here

1
2
3
4
5
6
7
8
9
10

Undefined symbols: " res 9 dn expand", referenced from:
zif   dns get mx in dns.o " res 9 search", referenced from:
zif   dns get mx in dns.o
zif   dns check   record in dns.o " res 9 dn skipname", referenced from:
zif   dns get mx in dns.o
zif   dns get mx in dns.o
ld: symbol(s) not found
collect2: ld returned 1 exit status
make: *** [libs/libphp5.bundle] Error 1
Error: Status 1 encountered during processing.

Some searching found MacPorts users were seeing the same problem, and the culprit was lresolv.

Simply adding a configure environment variable before the actual configure command created a Makefile which worked:

1

LIBS=-lresolv ./configure --with-apxs2 --with-gd (etc.)

1

$ sudo port -v install apache2 mysql5-server

After everything was built and installed, I then installed the dependencies I needed for PHP 5.3 from MacPorts (openssl, mcrypt, libxml, etc.). My full configure command is:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

./configure \
--prefix=/usr/local \
--with-apxs2=/opt/local/apache2/bin/apxs \
--with-config-file-path=/usr/local/etc/php5 \
--disable-cgi \
--enable-bcmath \
--with-gd \
--with-curl \
--enable-exif \
--enable-calendar \
--enable-mbstring \
--with-mysql=/usr/local/mysql \
--with-mysqli \
--with-pdo-mysql=/usr/local/mysql \
--with-zlib-dir=/opt/local \
--with-openssl=/opt/local \
--with-mcrypt=/opt/local \
--with-mhash=/opt/local \
--with-freetype-dir=/opt/local \
--with-jpeg-dir=/opt/local \
--with-png-dir=/opt/local \
--with-libxml-dir=/opt/local \
--with-xsl=/opt/local \
--with-gettext=/opt/local \
--with-bz2 \
--with-iconv=/opt/local

Notice –with-mysql=/usr/local/mysql? No matter how many paths I tried I could not get PHP to con- figure with MySQL. Apparently the MacPort changes the layout for some reason. My solution (inspired by a 2007 discussion on the MacPorts mailing list) involved making a few symlinks:

1
2
3
4
5
6
7

$ sudo mkdir -p /usr/local/mysql
$ cd /usr/local/mysql
$ sudo ln -s /opt/local/include/mysql5 include
$ sudo ln -s /opt/local/lib/mysql5 lib
$ sudo mkdir bin
$ cd bin
$ sudo ln -s /opt/local/bin/mysql_config5 mysql_config

Once the symlinks were in place, PHP configured without error.

I am no longer going to be making or updating these packages. Compiling nginx from source is very easy, and is still the recommened way to run the current version. Clear and simple instructions are available for many Linux distributions.

Why Did I Make These?

I want to use newer versions than what the Ubuntu universe repository offers. The feisty package is 0.4.13 (and gutsy will be 0.5.26). Simply compiling these from source works OK, but involves finding an init script, setting paths in the configure line, etc. I like the “debianized” features the official packages offer, so I used the latest debian unstable package (0.5.30) as a base and made updated packages.

Debian Note:

I’ve had a report (thanks Cliff) that my package does not work on Debian/stable due to a dependency on a later libc6. An option is to use the Debian source packages backported to Debian/stable instead. Details on how to do this are available…

Changes from the official package:

• commented out the first section of the prerm script because it messed things up when removing or upgrading.
• changed default port from 80 to 8000 because I use nginx with apache.

Of course use at your own risk. I’ve done a fair amount of testing and things work fine for me. I use the amd64.debs on my slice at Slicehost, and the i386.debs at home for testing.

Instructions:

INSTALL: sudo dpkg -i nginx_xxxxxx.deb
REMOVE: sudo aptitude remove nginx

Resources:

• Official nginx homepage
• Very useful English nginx wiki

Thanks:

• Igor Sysoev - nginx developer
• Jose Parrella - official Debian package maintainer
• Cliff Wells - nginx wiki maintainer

The product is manufactures by the excellent craft, design essence. Jan is ingenious, filters presses the net design to be possible to cause you regardless of. Flushes adjusts the coffee or makes tea all may with ease filter. Falls the sediment, the use is extremely convenient. Dismantable. Designs easy to clean, the modeling is unique, artistic. Practical.

Use Method:

Turns on the cover for a jar, in the pot puts in the right amount tea. The mesh pot assumes 45 slanting to put, approximately 95 hot water slowly will break in, cover the pot, will settle 3-5 minute. Will soak the good tea to pour into the cup then.

Possibly M-Audio is discontinuing or replacing their Black Box “guitar performance recording system” as it is no longer findable on their website. No Mac 10.5 Leopard drivers are available, and my guess is they will never be. Just for fun, I installed the 10.4.10 Tiger drivers, rebooted, and found upon (every) reboot BootstrapDaemonPerUser crashed. I ran the driver uninstall app (included with the driver) only to find BootstrapDaemonPerUser was still crashing upon reboot, and the driver was not actually uninstalled.

Manually uninstalling the driver was easy enough, looking at the uninstall.ss shell script inside the uninstallation app:

1
2
3
4
5
6
7
8

$ rm -rf /System/Library/Extensions/M-AudioBlackBoxBoot.kext
$ rm -rf /System/Library/Extensions/M-AudioBlackBoxJag.kext
$ rm -rf /Library/StartupItems/com.m-audio.startupitem.blackbox
$ rm -f /etc/mach_init_per_user.d/com.m-audio.blackbox.helper.plist
$ rm -rf /Library/Audio/MIDI Devices/M-Audio
$ rm -rf /Library/PreferencePanes/M-AudioBlackBox.prefPane
$ rm -rf /Library/Receipts/M-Audio\ Black\ Box.pkg
$ rm -f ~/Library/Preferences/com.m-audio.prefpane.blackbox.plist

Upon rebooting, all traces of the driver were gone. Guess it was not the best idea to install it.

The Black Box seems to work fine with no driver installed, though Logic 8 only sees two inputs (there should be four).

On a sort of related traffic fun note, today on the way to play tennis a motorbike (little one) flew past us going around 90 km/h. The driver had one hand on the throttle and the other hand on top his head holding his helmet on…because he did not fasten the chinstrap!