Douglops - notes and banters

visitors from above? what the world's sacred texts actually say about non-human intelligences

2026-09-27T00:00:00+00:00

💡 This was an exercise in AI-assisted research: a team of AI research agents indexed sacred-texts.com and Biblioteca Pleyades, close-read the relevant texts, verified every quotation by script against its source, and compiled the result into a 47-page paper. Take it with the usual caution, and open an issue on GitHub if you find any errors.

Do the world's religions and myths preserve memories of contact with beings from the sky, the stars, other planets or "other dimensions"? I tried to answer that by reading the sources instead of cherry-picking them.

where this started

The question was simple and very old: do the world's religions and myths preserve memories of contact with beings from the sky, the stars, other planets or "other dimensions"? This is the claim behind a whole shelf of popular books, from Chariots of the Gods? to The 12th Planet and The Sirius Mystery. It is usually argued by quoting a few striking passages: Ezekiel's wheels, the Watchers of Enoch, the flying vimānas of the Indian epics, the Dogon star lore.

We wanted to do the opposite of cherry-picking. We would read as much of the primary material as we could, code what it says, check every quotation against its source, and only then ask what explains the pattern.

The starting point was the African section of the Internet Sacred Text Archive (sacred-texts.com/afr). It turned out to be a revealing place to begin. Its 29 books are not "African scriptures". They are one medieval Ethiopian epic (the Kebra Nagast), a set of colonial-era ethnographies and folklore collections made by missionaries and officials between 1868 and 1940, and some diaspora and Rastafarian writing. The famous Dogon "Sirius" material is not there at all. That discovery set the tone for the project: before asking what a tradition says, you have to ask who wrote it down, when, and why.

how the research was organised

1. Indexing. We first mapped the whole sacred-texts site. That meant 77 top-level categories and 261 entries, each rated for relevance and tagged with twelve motif codes: sky descent, culture-bringer, forbidden knowledge, hybrid offspring, celestial vehicles, star-people, time dilation, abduction or otherworld journey, plurality of worlds, hidden peoples or "other dimensions", channelled contact, and war among sky beings. Twenty-two categories (among them Sikhism, the Confucian canon, alchemy and Tarot) had nothing relevant.

2. Gap-filling from Biblioteca Pleyades. Sacred-texts has big holes. It has no Dogon ethnography, no Vaimānika Śāstra, no full Popol Vuh, no Qumran Book of Giants, and nothing Korean. We filled what we could from the aggregator bibliotecapleyades.net, which we indexed separately (166 items). It is overwhelmingly fringe (101 of the 166 items). We used it strictly as an access copy. Whenever a page reproduced a published work, we cite the original publication. We flagged the places where the aggregator's copies are unattributed, mislabelled (Korean myths filed under "China"), altered, or contain editorial insertions.

3. Six regional workstreams. Close reading was split into six areas:

the ancient Near East and Abrahamic traditions;
Africa;
South and East Asia;
Celtic and Northern Europe;
the Americas and the Pacific;
modern esoteric and UFO literature, read as reception rather than as evidence about antiquity.

Each workstream produced a file of passages, an analytic essay, and a bibliography.

4. Verification. Every quotation, 314 in all, was checked by script against the fetched page text. Each passage records the translator and date, the URL and locator, the motif codes, a source type and a strength rating. The source types are primary text, ethnographic record, secondary scholarship, fringe/esoteric, and critical scholarship. Quotations in the paper were inserted mechanically from the verified corpus, so none of them can drift from its source.

5. Five hypotheses, none assumed. For every motif we asked which of five explanations fits best:

H1: literal contact;
H2: cultural diffusion and literary borrowing;
H3: shared cognitive and structural myth-making;
H4: translation and editorial artefacts;
H5: modern reinterpretation.

We were explicit from the start that texts cannot prove or disprove literal contact. What they can show is whether the motifs, as actually attested, require it.

what we found

the motifs are real and often ancient

This needs saying first, because debunking sometimes forgets it. The world's literatures really are full of non-human intelligences who come down from the sky and interact with people:

the Watchers of 1 Enoch, who descend on Mount Hermon, father giants and teach metallurgy and astrology;
the Yoruba gods who climb down a chain from Heaven to make land at Ife;
the tailed sky-race from which a Chaga clan claims descent;
Indra's chariot and Rāvaṇa's Pushpaka;
Ninigi descending from the High Plain of Heaven to found Japan's imperial line;
the Irish síd-folk who take new mothers to nurse their children;
the Iroquoian "man-beings" who live beyond the visible sky.

Sky descent, culture-bringers, divine–human unions, otherworld journeys and hidden peoples turn up in every region we studied.

but the details don't look like spacecraft

When you line the passages up, several patterns stand out.

No traditional text names a planet of origin. "Heaven" is a roof, a court or a layer of the cosmos, not a place in space. Stars are persons (Cherokee, /Xam, Ojibwa), angels (1 Enoch), or humans transformed (Pleiades myths on three continents). The one explicit "from the stars" teacher, the Acjachemen Chinigchinich, was recorded by a Franciscan friar in the 1820s and may belong to an early-contact revival movement. A 1909 Irish informant's idea that the fairies "came from the planets" was, in his own words, "according to my idea".
Every vehicle is divine, magical, visionary or human-made. Examples:
- The Kebra Nagast's wagons are lifted "a cubit" by the Archangel Michael.
- Indian flying cities vanish "like a cloud-constructed city".
- Ezekiel's wheels are explicitly a "likeness".
- The only premodern technical flying machine, King Bhoja's 11th-century mercury-heated wooden bird, is a human automaton.
The celebrated Vaimānika Śāstra was dictated in the 20th century (1918–23, or 1903–18 on a rival account). Engineers at the Indian Institute of Science found its craft unworkable in 1974.
Forbidden knowledge from heaven is one tradition, not a universal. The Watchers' illicit teaching is Mesopotamian sage lore inverted by Second Temple Jewish writers. From there it passed to Ethiopia, Manichaeism and Islam (Hārūt and Mārūt "at Babylon"). Outside that chain, the nearest case, in the Popol Vuh, runs the other way: the gods withdraw knowledge from the first humans.
Time dilation is strong but regional. It is Celtic (Bran becomes "a heap of ashes"; Oisín ages the moment he touches the ground), Indian (King Raivata waits a "moment" in Brahmā's court while ages pass), and later Japanese (Urashima). 2 Enoch's sixty days in heaven equal sixty days on earth.
Channelled contact is modern. The only traditional "contactee" we found is a Cherokee story about a man who fakes messages from star spirits and gets caught.

the "ancient astronaut" reading has a birth date

The most striking result came from the modern workstream. Almost every popular "ancient NHI" reading has a datable first appearance in print, and most of them have a documented chain of borrowing. The clearest chain is the "Venus lineage":

Blavatsky (1888): spiritual "Lords of the Flame" incarnate in early humanity. There are no ships.
Scott-Elliot (1904) and Leadbeater (1912): these beings come from Venus.
Bailey (1922): she dates their descent to "eighteen million years ago". She never actually names Venus.
A Lovecraft revision (written 1935): "the lords of Venus came through space in their ships".
Desmond Leslie (1953), in Flying Saucers Have Landed: he turns the Theosophical descent into "a huge, shining, radiant vessel", citing only Theosophists. The same book introduces Adamski's Venusian contact.

The same pattern holds elsewhere:

Atlantean air-ships first appear in Scott-Elliot in 1896.
Vimāna = aircraft: Leslie, 1953.
Ezekiel as a flying saucer: Williamson, 1953.
The Mahābhārata "nuclear war" verse: manufactured in a 1993 bulletin-board file. The real passage has a curse-born iron bolt.
The spacesuited Kayapó hero Bep Kororoti: von Däniken, 1973. The 1960 field text is a storm myth.

Taken together, the technological reading of ancient beings enters the record between 1896 and 1953. It comes through Theosophy, pulp fiction and the contactees, not through the traditions themselves (see the timeline below, Figure 5 in the paper).

Counting motifs makes this visible. In the traditional primary and ethnographic passages, the commonest motifs are sky descent, hidden peoples and otherworld journeys. In the fringe passages, vehicles and sky descent dominate, and time dilation disappears altogether. The modern reading doesn't just reinterpret the old motifs. It reweights them.

surprising findings along the way

The Dogon "Sirius B" mystery dissolves under restudy. The 1950 article describes the companion star "twinkling", which would make it visible, and Sirius B is not. Walter van Beek's decade of fieldwork found that no Dogon outside Griaule's informant circle knew the doctrine. The article itself never claims contact. That idea is Robert Temple's (1976).
A /Xam control case. Detailed 1870s Sirius lore from southern Africa, in which Sirius should "twinkle like Canopus", has no companion star and no visitors.
Credo Mutwa's reptilian "Chitauri". They appear in no 19th-century Zulu source. Mutwa turned the imbulu of a folktale, which Theal in 1886 described as a tailed shape-shifter "believed in by little folks", into a reptilian alien in an interview arranged through David Icke.
Editors leave fingerprints.
- A 1926 editor footnoted 2 Enoch's solar chariot "Cf. 'Rapid Transit.'"
- The online text of the Kayapó "space hero" story contains an editor's interjection, "(or the future? - Red.)", inside supposedly indigenous speech.
- Mary Kingsley noticed in 1898 that a Kongo spirit was credited with teaching crops that Roman Catholic missionaries had introduced in 1490. This is a perfect demonstration that culture-bringer myths update themselves.
Vallée's quotation may not match his source. Evans-Wentz (1911) wrote that a Barra tale "suggests" fairy women resemble succubi. The online text of Passport to Magonia has "proves conclusively". This needs checking against the 1969 print.

so what's left?

No passage we found requires literal contact. The most "visitor-like" candidate is a white being who "descended from above in a fog" in Callaway's 1868–70 Zulu texts. It has simpler readings, including a mythologised memory of early European contact. But an honest summary shouldn't stop at "debunked". Some things remain genuinely interesting:

The otherworld taking is everywhere:
- the Rwandan Thunder's bride;
- Enoch's summons;
- Raivata's visit to Brahmā;
- Bran and Oisín;
- the fairy-taken nurse;
- the Star Husband's wives.
Diffusion explains local clusters, but not the whole map.
The supernatural lapse of time appears early and far apart: Ireland by the 7th–8th century, India in the first millennium CE, Japan in the 8th century. Nobody has yet done a proper phylogenetic tale-type study of it.
Bullard's puzzle. The folklorist Thomas Bullard found modern abduction reports more uniform than oral folklore ought to be. Whether hypnotic regression and investigator filtering explain that uniformity is an empirical question that could be tested.

limitations

The study is textual and English-language. It rests heavily on Victorian translations and on ethnographies collected under colonial conditions, and it did no fieldwork. Sacred-texts has an Anglo-Celtic and Theosophical skew and is thin on Africa, China and living oral traditions. The aggregator copies of Sitchin, Temple, Leslie and Vallée must be checked against print. Some bibliography entries are flagged "verify", and we have not filled in missing details. The motif counts describe the shape of our sample, not how often motifs occur in whole traditions.

next steps

Check the flagged quotations against print editions: Vallée 1969, Leslie 1953, Dalley, the Genesis Apocryphon, and the Korean texts.
Re-read key passages in modern critical editions: Nickelsburg/VanderKam for 1 Enoch, ETCSL for Sumerian, Tedlock for the Popol Vuh, and a Ge'ez check of the Kebra Nagast's "air (or winds)".
Close the gaps: Chinese primary texts (Shanhaijing, Chuci), Sahagún and the Anales de Cuauhtitlan for Quetzalcoatl, Griaule's Dieu d'eau, and Mutwa's 1964 Indaba, My Children (to see whether "Chitauri" predates 1990).
Run a phylogenetic tale-type analysis of the otherworld time-lapse motif.
Quantitatively compare the variability of fairy legends with abduction reports, to test Bullard's uniformity argument.

You can access the rendered PDF file and the original LaTeX source below:

Read the PDF
Browse the LaTeX source and its bibliography
Download the full research package (zip, 1.3 MB): the paper, LaTeX source, bibliography, figures and evidence corpus

learning industrial controls as an it person

2026-09-26T00:00:00+00:00

Notes on crossing the fence from IT into OT — PLCs, SCADA, MES, and the Purdue model, written down as I learn them.

This started as a plain study outline put together with Claude while figuring out where to even begin. I'm sharing the compiled version because the on-ramp from software into industrial controls is oddly poorly mapped for people coming from where I'm coming from — take the vendor picks as one reasonable path, not the only one, and open an issue if you spot something wrong.

why cross over

Everything I've built professionally lives above an API boundary somewhere. Industrial controls live below one I'd never touched: sensors, relays, motor starters, a PLC scanning inputs in a tight loop, none of it caring what a git blame is. What pulled me in is that the integration problems are the same shape as the ones I already know — moving data correctly and safely between systems that don't trust each other — just wearing different clothes. A PLC talking OPC-UA to a SCADA gateway is not that far, conceptually, from a service talking gRPC to another service. The vocabulary is the barrier, not the concepts.

So this is the guide I wished existed: how the layers fit together, which vendors actually make sense to learn first if you're targeting emerging markets rather than a US/EU plant, and a path that doesn't require owning a factory to get hands-on.

the map: the Purdue model

Before any vendor or protocol, get this hierarchy straight — it's the OSI model of this world, and everything else hangs off it. Low to high:

Level 0 — the physical process itself: sensors, actuators, motors.
Level 1 — basic control: PLCs and DCS controllers reading and writing Level 0 I/O.
Level 2 — supervisory control: local HMIs, area-level SCADA.
Level 3 — site operations: plant-wide SCADA, MES, historians.
Level 3.5 (the DMZ) — the IT/OT security boundary. Most of what gets called "systems integration" happens at or across this line.
Level 4/5 — business systems: ERP, scheduling — the layer most IT people already live in.

Almost all integration work is about moving data safely across these levels, not writing application code the way IT usually means it.

glossary, fast

PLC (Programmable Logic Controller) — a ruggedized industrial computer that scans inputs, runs logic, and writes outputs in a continuous loop. Programmed per IEC 61131-3: Ladder Diagram, Function Block Diagram, Structured Text, others.
SCADA (Supervisory Control and Data Acquisition) — the software layer that visualizes and supervises PLCs/DCS across a site: tag database, HMI screens, alarms, trends, historian.
MES (Manufacturing Execution System) — sits between ERP and the control floor. Tracks work orders, production genealogy, real-time machine status. ISA-95 formally defines this boundary and the data that crosses it.
OEE (Overall Equipment Effectiveness) — Availability × Performance × Quality. The one KPI manufacturing lives and dies by, usually computed from MES or historian data.
Systems Integration — connecting the above. Mostly protocol work and data modeling, closer to writing an adapter than building an application.

the stack, and why

I'm building toward emerging markets — Brazil and South America specifically — which changes the calculus from what a US-centric course would recommend. Licensing cost, import lead time, and local support depth matter as much as feature lists.

control layer: siemens, with a shorter word on weg

Siemens (S7-1200/1500, TIA Portal) is the safe default here: the deepest installed base in the region — automotive plants, food and beverage, oil and gas — the largest integrator and technician pool to learn from or eventually hire, local manufacturing presence that softens import duty and lead-time pain, and a used-equipment market deep enough to make hardware cheap once you're past the learning stage.

Worth a shorter passage: WEG, a Brazilian manufacturer with a dominant domestic position in motors and drives, now building out its own CLP line. It matters when a plant already standardizes on WEG motors and drives — one vendor for the whole motor-to-control chain simplifies commissioning — or when local support and zero import friction outweigh Siemens' bigger ecosystem. The trade-off is smaller name recognition outside Brazil if the skill needs to travel.

SCADA: Ignition

Traditional SCADA licensing (Wonderware, WinCC) charges per tag, which gets expensive fast on a real plant and actively punishes learning by trying things. Ignition (Inductive Automation) licenses per server instead — unlimited tags, unlimited clients — and ships a genuinely modern, web-based client (Perspective) alongside the older desktop-style one (Vision). Inductive University, their free training platform, is the best on-ramp I've found for any of this: structured, free, certificate-backed.

the glue: Modbus + OPC-UA

Modbus TCP is the simplest possible protocol here — a client polls a server for coils and registers, no security model, but nearly every PLC and field device speaks it. Good first protocol precisely because there's nothing to hide behind.

OPC-UA is the one that feels like home coming from IT: an object-oriented, structured address space instead of flat registers, with real certificate-based security built in. It's also the primary path from a Siemens S7-1500 into Ignition. (The S7-1200 needs a bit more care — OPC-UA server support depends on the CPU firmware version, check before assuming it's there.)

Where each fits: Modbus for simple field devices and legacy gear, OPC-UA for structured PLC-to-SCADA/MES data exchange.

how i'm actually learning this

Electrical fundamentals — digital vs. analog I/O, 4-20mA current loops, relays, motor starters, reading a basic circuit.
Siemens ladder logic — TIA Portal plus PLCSIM, its bundled simulator, so no hardware is required to start.
Ignition — the Inductive University track, pointed at PLCSIM over a simulated OPC-UA connection.
A real integration project — a PLC, real or simulated, talking both Modbus TCP and OPC-UA into Ignition, tags flowing end to end.
MES and OEE — the ISA-95 data model, then a simple OEE calculation built on top of simulated machine-state tags inside Ignition.

books and resources

Books

Industrial Automation: Hands On — Frank Lamb. Written for exactly this IT-to-OT switch, start here.
Programmable Logic Controllers — Frank Petruzella. The standard PLC textbook.
Electrical Motor Controls for Integrated Systems — Rockis and Mazur. Electrical fundamentals tied directly to PLC context.
The ISA-95 standard itself (Enterprise-Control System Integration) — dense, but it's the canonical MES/ERP data model, worth owning rather than reading summaries of.
SCADA: Supervisory Control and Data Acquisition — Stuart A. Boyer (ISA).

Free or cheap, online

Inductive University — free Ignition and SCADA training with certificates, the best structured starting point I found.
RealPars — the best general explainer videos for PLCs, instrumentation, and SCADA, free on YouTube with paid tiers beyond that.
PLC Fiddle — a browser-based ladder logic simulator, zero hardware required.
AutomationDirect — free PLC training paired with genuinely cheap hardware.
r/PLC and r/automation — active, and the IT-to-OT switch is a recurring topic, not a novelty there.

Hardware, cheap first

Click PLC (~$100, AutomationDirect) — the cheapest real first PLC worth owning.
A Siemens S7-1200 starter kit — pricier, but matches this stack directly.
A used Allen-Bradley MicroLogix off eBay — only if a Rockwell-standardized client or job actually needs it.
Raspberry Pi running Ignition Edge — a cheap, always-on SCADA sandbox.

project ideas, roughly in order

Simulate a Siemens PLC in PLCSIM, expose it over OPC-UA, connect Ignition to it, build one live HMI screen.
A Click PLC over Modbus TCP, polled by Ignition — the simplest real-hardware integration available.
A simulated machine with run/idle/fault states feeding Ignition tags, turned into a basic OEE dashboard: Availability × Performance × Quality, computed for real instead of quoted as a formula.

still missing (running list)

A step-by-step TIA Portal setup walkthrough.
An Ignition Gateway install and first-project walkthrough.
Common ladder logic patterns: start/stop/seal-in, motor interlocks, timers and counters.
The ISA-95 data model, mapped concretely onto an Ignition or MES data structure.
IT/OT security basics: the Level 3.5 DMZ, network segmentation, what the actual attack surface looks like.

This page will grow as each of those gets filled in.

calisthenics 101

2026-08-22T00:00:00+00:00

where it all started

I've always been curious about strength and body building, and a friend taught me a thing or two about calisthenics in the past. Looking at the growing trend of body building and aesthetics sold as well being in general, something always seemed off to me. Years later I've started to workout on my own just to rediscover the world of calisthenics and strength development.

This developed in me a urge to learn more about how we could leverage our bodies to get healthier and stronger in any ways possible. This work is a living and growing development towards that goal.

building a living calisthenics workbook

40 muscles, 40 skills, two editions, and a pipeline that lied to me four times.

Calisthenics has a measurement problem. A barbell athlete adds five kilos and knows exactly where they are. A bodyweight athlete has one load — themselves — and changes the movement instead. Which is elegant, until you try to answer "can you do a front lever?" and discover the honest answer is a matter of opinion.

So I built the reference I wanted: an anatomy section, forty skills across five levels, programming that turns the catalogue into a week, and a log to write in. Every skill carries a standard — an objective, unambiguous description of what owning it means. Twenty seconds. Chin over the bar. Hips level with the shoulders. Not "getting there."

The muscle figures rotate. That was the part I most wanted and least expected to get for free.

what "living" actually means

Two JSON files are the source of truth: muscles.json and skills.json. Forty muscle entries with origin, insertion, action and a note on what the muscle does in this sport. Forty skills with level, prerequisites, standard, cues, common faults, and 175 ordered progression steps.

Everything else is derived. The muscle reference chapter, the skill catalogue, the coverage matrix showing which muscle groups each skill actually drives, the progression tracker with a line per step, the benchmark sheet — all generated. Edit the JSON, run make, and both editions change together. They cannot drift apart, because there is nowhere for them to drift to.

make            # -> build/workbook.pdf + build/workbook.epub

The imagery is fetched by script too, not curated by hand into a folder. Anatomical renders come from the BodyParts3D/Anatomography dataset via Wikimedia Commons, licensed CC BY-SA. A clean checkout rebuilds the whole thing.

why there are two editions

A PDF cannot contain a GIF. That is a hard format limit, not an oversight.

The print edition embeds each animation as a 16-frame sequence played by LaTeX's animate package. It rotates in Adobe Acrobat and shows a clean still frame in Preview, Chrome and everything else — a designed fallback that loses only the rotation.

The EPUB has no such limit. There the figures are real animated GIFs, and they move in Apple Books, Google Play Books, Calibre and Thorium. Kindle is the exception; its converter flattens them.

Both come from the same data and the same prose. The reference chapters generate straight to XHTML; the hand-written chapters run through pandoc. Nothing is written twice.

the part worth writing down: the bugs all lied

I expected this project to fail loudly. Instead almost every real bug produced output that looked fine.

A seashell engraving labelled "Planche." Matching Commons filenames to skill names seemed obviously correct. It gave me an 18th-century engraving of conches for "Planche", a bowl of bean dip for "Dips", and a Cotswold village for "Row". Scoping the search to fitness categories fixed the homonyms and left subtler ones: an empty dip station, a man leaning on a fence, an acrobat balanced on a partner's ankles for "Handstand". There is no clever fix. Every skill photograph in the book is now on an explicit allow-list, added only after a human looked at it. In a technique manual a wrong photograph is worse than none, so 35 of 40 skills simply show nothing in the shareable build.

A muscle of the foot, captioned "Forearm extensors." My alias for the forearm extensor group was "extensor digitorum" — which matched extensor digitorum brevis, in the foot. The plate rendered beautifully. It showed a pair of feet, under a heading about grip.

A chroma key that dissolved skeletons. Some anatomical renders ship on chroma green. Keying it out seemed trivial. But those particular renders draw a translucent skeleton over the backdrop, so the green is blended into the bone pixels themselves — a tolerance high enough to clear the halo dissolves the skeleton with it. Keying is now scoped to opaque renders only, where it is safe and fixes a plate that read as a black hole in the page.

Photographs that looked badly shot and weren't. Several images came out blown to white and I nearly rejected them as poor sources. They were fine. I was compositing full-range JPEG onto ffmpeg's limited-range white generator, which re-maps the levels and crushes every shadow. The fix is one format=rgba on each branch. The lesson is that I almost deleted good material because my own pipeline defamed it.

Forty empty directories and a book that rebuilt happily. The worst one. Frame extraction computed a canvas that landed on an odd pixel height. The mjpeg encoder cannot 4:2:0-subsample an odd side, and it responds by writing no packets at all rather than by failing. Extraction "succeeded", the book rebuilt without error, and the only symptom was a page count that went to 49 when it should have been 54.

None of these threw an exception. All of them produced a plausible artefact. The habit that caught them was rendering pages and contact sheets and looking — checking output rather than exit codes.

There was one loud failure, and it was the polite kind: Wikimedia returns a flat 429 to a generic user agent. Put a real contact URL in it and the same file downloads instantly. Their policy says exactly this; I just hadn't read it.

licensing, kept honest by the build

The default build is redistributable. Every image is CC-licensed or public domain, with per-file credits generated into an appendix from the same manifest the fetcher writes — so the book cannot credit an image it does not contain.

There is a second, opt-in path that pulls demonstration footage which is not freely licensed, for a personal copy only. It writes to a gitignored directory, and make shareable deletes every such asset and rebuilds. The size difference is the tell: 11 MB and 8 MB for the pair you can share, 26 MB and 18 MB for the one you cannot.

I skipped one suggested source entirely because its licence carries a non-commercial clause, which is incompatible with distributing the book under CC BY-SA. A public-domain Gray's plate covered the same muscle.

where it stands

49 pages shareable, 54 with demonstrations. 40 muscle entries, 37 with a plate and 26 of those animated. 40 skills, 175 progression steps, a coverage matrix, a glossary, and four printable sheets. About 1,500 lines of Python doing the fetching, the image work and the generation; the rest is LaTeX and two JSON files.

The thing I would tell anyone building something similar: put the content in data early, and check what you produced rather than whether the command exited zero. Both of those paid for themselves several times over — mostly by catching output that was confidently, plausibly wrong.

how to get it

For not making it so easy to freely distribute and allow unintended sharing, the entire project lives in a .zip file.

For getting the workbook in the form of a private, non-shareable epub file for personal use only, click here.

The compressed project lives here and for a convenient pdf file, click here.

The workbook provides a logbook, but for easy of use, consider giving CalisthenicsMemory a go.

amateur radio textbook for hackers

2026-07-21T00:00:00+00:00

A Free, Country-Agnostic Textbook for Every Radio Amateur

Ham radio has a strange problem: the physics is universal, but almost every study guide isn't. Ohm's law doesn't care which country issued your callsign, yet most textbooks are written around one nation's exam syllabus, band plan, and licensing bureaucracy — which means the moment you cross a border (or just want to actually understand the material instead of memorizing a question pool), you're stuck.

The Complete Amateur Radio Operator is our attempt to fix that. It grew out of the study materials built for radioescola.pt, a resource originally created to help Portuguese candidates prepare for their national amateur radio exam — the diagrams, worked examples, and topic coverage built up there over time turned out to be too good a foundation to keep locked to one country's syllabus. So I rebuilt it: stripped out everything specific to Portugal's regulator, rewrote and substantially expanded the technical content in English, and turned it into a free, 175-page textbook covering everything underneath every national amateur radio exam in the world.

It runs from electricity and circuit theory through AC and reactance, semiconductors and op-amps, receiver architectures, modulation, antennas, transmission lines, and ionospheric propagation — built up from first principles, with worked examples, exam tips, and end-of-chapter problems throughout. It's organized in five tiers that roughly track the entry-level → intermediate → full-privilege progression used almost everywhere, so you can stop wherever your target license requires, or keep going all the way to advanced RF engineering.

What it deliberately doesn't do is teach any single country's regulations. Instead, it covers the genuinely international layer — the ITU, IARU, CEPT, the Q-code, the NATO phonetic alphabet, standardized emission designators — the stuff that's the same whether you're studying in Lisbon or Lagos or Los Angeles. National band plans and paperwork change; a half-wave dipole doesn't.

A few things we're especially glad made it in: a full appendix of every formula in the book, organized by chapter, for last-minute review, alongside SI prefixes, physical constants, and a resistor color code quick-reference. And a closing bonus chapter, outside the exam material entirely, on aviation, maritime, and military radio monitoring with SDR — ACARS, ADS-B, AIS, NAVTEX, and the rest of the signals now trivially receivable with a $20 USB dongle, framed with a clear-eyed note that monitoring legality varies by country and is worth checking before you start.

It's built in LaTeX, with hand-drawn circuit diagrams and plots rather than screenshots, so it reads like an actual textbook rather than a printed webpage.

Whether you're chasing your first license or just want to finally understand why your antenna tuner does what it does, I hope this is useful to you. 73.

The finished PDF file (check repo for the last updated files) and the tex files can be found below:

llm seven layers stack model - or - why i'm feeling numb?

2026-07-19T00:00:00+00:00

💡 This was an exercise on knowledge compression using inference via Claude to compile an up-to-date textbook, so take it with caution. You can open an issue in Github if you find any errors.

Goal: LLMs are a growing field, with tools changing as fast as the opening and closing of the Strait of Hormuz. For this reason, I began searching for a model similar to the "OSI" to tame the endless complexity of LLM ecosystems and found a layered taxonomy proposed by Rishav Hada, "LLM Application Tech Stack in 2026" published last year (2025) in Future AGI. Focused primarily on technologies, it addresses little of the relationship and technical considerations between each layer, which motivated me to compile a less fragmented and more engineering-oriented body of knowledge.

Some caveats worth noting:

the source is published by Future AGI
which sells into two of the seven layers it describes and ranks itself #1 in one
the taxonomy itself is sound and I kept it intact, but I put the rankings and the unsourced percentages (40–80% routing savings, 15–30% reranker lift) inside "Source-critical note" boxes with the conditions under which they could hold and the measurement procedure to check them on your own traffic
presenting those as facts would have been the weaker choice
the colophon and closing note make the provenance explicit

I asked Claude to consolidate a textbook that would be useful weather or new tooling will appear or fade into oblivion.

The result was a 78 pages, single self-contained .tex, and a companion pdfLaTeX file (no shell-escape, no missing packages, one harmless 0.3pt overfull box). You can take a look by yourself, the goal is to provide a clear foundation for understanding your interactions on each and every layer, and why and when sensible choices makes a difference.

Structure: Part I builds the layer formalism (contract tuple, latency-adds/quality-multiplies algebra, cost decomposition) that later chapters reuse. Part II is one chapter per layer. Part III is the reference architecture, a maturity model, and a critical review of the pitfalls. Appendices hold a vendor-neutral scorecard, a benchmark harness, and notation/glossary.

Beyond: Since the article's source is ~9 minutes of reading, to provide more depth, I added: KV-cache sizing and the bandwidth-bound decode argument (L1); Little's-law capacity formula, speculative-decoding speedup, build-vs-buy crossover (L2); the 𝑝 𝑛 p n reliability table and verifier-corrected 𝑝 eff p eff (L3); index sizing, RRF, IR metrics (L4); LSH dedup, chunking economics, ACL pre-filtering (L5); routing as constrained optimisation with the pointwise Lagrangian solution and cascade break-even (L6); and a heavily statistical L7 — power analysis, paired bootstrap, the multiple-comparisons trap in prompt search, judge validation via 𝜅. Every chapter ends with exercises, also.

References:

Huyen's two books covers the production LLM application stack end to end — evaluation frameworks, prompt design, agent architectures, deployment tradeoffs. It's the nearest published thing to the textbook's scope, and her earlier Designing Machine Learning Systems (2022) is the better book on drift, data pipelines and monitoring even though it predates the LLM era entirely — Chapter 8's PSI and staleness material is downstream of it:

Huyen, C. (2025). AI engineering: Building applications with foundation models. O’Reilly Media.
Huyen, C. (2022). Designing machine learning systems: An iterative process. O’Reilly Media.

A layer-by-layer recommendation:

L1 — Foundation Models. Sebastian Raschka's Build a Large Language Model (From Scratch) if you want the arithmetic in Chapter 2 to become muscle memory; you implement attention, KV caching and sampling in PyTorch. Simon Prince's Understanding Deep Learning (free PDF from the author) is the better theory companion — modern, well-illustrated, and honest about what isn't understood.
L2 — Inference & Serving. No good book exists. The closest useful substitutes are Kirk & Hwu's Programming Massively Parallel Processors for reasoning about memory bandwidth and occupancy, which is what the decode-phase argument actually reduces to, and Kleppmann's Designing Data-Intensive Applications for the queueing and tail-latency intuitions behind Little's law and goodput.
L3 — Orchestration. Kleppmann again for exactly-once semantics and idempotency, plus Michael Nygard's Release It! — circuit breakers, bulkheads, timeouts and the stability antipatterns in it map one-to-one onto what goes wrong in agent loops. Google's Site Reliability Engineering (free online) for the error-budget framing.
L4 — Retrieval. This is the layer where reading old books pays best. Manning, Raghavan & Schütze's Introduction to Information Retrieval (free online) is still the canonical grounding for BM25, index structures and the evaluation metrics in §5.8 — most RAG failures are IR failures that the field solved in 2005. Sebastian Bruch's Foundations of Vector Retrieval (Springer, 2024) is the rigorous treatment of ANN: HNSW, IVF, product quantisation, the theory behind the recall/latency curves. Lin, Nogueira & Yates, Pretrained Transformers for Text Ranking, covers rerankers and dense retrieval properly.
L7 — Evaluation. Kohavi, Tang & Xu, Trustworthy Online Controlled Experiments. The multiple-comparisons trap, sample-size calculation, sequential testing and metric degeneracy in Chapter 8 are all treated at far greater depth there. If you take one book off this list beyond Huyen, take this one — the statistical failures in prompt optimisation are the same failures A/B testing spent twenty years learning to avoid.

A note on security: John Sotiropoulos's Adversarial AI: Attacks, Mitigations and Defense Strategies is the most useful book-length treatment of the prompt-injection and supply-chain material in §7.9, and it's structured against the OWASP LLM Top 10. Pair it with the NIST AI RMF and its Generative AI Profile

You can access the rendered PDF file and the original tex file below:

spot nearby planes with acars when you're bored

2026-05-03T00:00:00+00:00

There was a time when I liked aircraft a lot. Like a really lot. But you know what is even more cool than flying a plane? To me, it is the understanding of aircraft communication systems, avionics and embedded systems and the overall engineering efforts applied to these amazing flying beasts!

The ADS-B detour

My RTL-SDR is an old v2 dongle, and it just doesn't do a good job at 1090 MHz, which is what you need for ADS-B. I didn't feel like buying a v3/v4 just to get that one band, so instead I went down a small rabbit hole with adsb_deku, a Rust ADS-B decoder. The plan was to feed it from dump1090_rs pointed at a SoapySDR remote endpoint instead of the dongle directly:

dump1090_rs --driver "remote, remote=tcp://127.0.0.1:55132, remote:driver=rtlsdr"

Honestly, I never confirmed whether the remote/SoapySDR hop was actually necessary for what I was doing, or just a leftover from an earlier experiment — but I kept the command around, along with the RTL-SDR wiki, in case I revisit it with better hardware.

ACARS: works with (basically) anything

Where the dongle has no trouble at all is VHF, and that's exactly where ACARS lives (airlines still send a lot of short operational messages — gate info, weather, position reports — over VHF datalinks in the 130-137 MHz range). On my MacBook Air, I fed acarsdec live from SoapySDR across the usual set of international ACARS channels, and it picked up traffic right away:

acarsdec --output full:file --soapysdr driver=rtlsdr 131.450 131.525 131.550 131.725 131.825

No fiddling required — it just worked, which was a nice change of pace after the ADS-B detour above.

acars_deku, someday

adsb_deku decodes and renders ADS-B frames so nicely that it left me wanting the same thing for ACARS — something like acars_deku, parsing and rendering the messages acarsdec spits out instead of just logging them to a file. Nothing built yet, just an idea sitting in my someday-maybe pile.

the practice of chinese learning dump

2024-08-01T00:00:00+00:00

My interest in Chinese culture goes way back to my childhood. The symbols (ideograms), martial arts and overall cultural aspects instilled in me a fascination of it's own kind. Now, heading into this journey.

Below some online resources to aid you, if you are interested in getting used to this language:

Dictionaries
- Zhongwen (Google Chrome) One of my most used dictionaries. Definitely give it a try. Check the How-to's here and start leveraging its power today!
- Dict.cn A very handy online dictionary to translate chinese words. I made a common use this way, for example: http://dict.cn/老师 Cool if you are using a sheet for "flashcarding" new learning words. It gets easier to automate a link for lookups doing this.
- Baidu Fanyi (翻译) Complete translation tool from many dialects of mandarin into other languages. More trustworthy than Google Translation in this regard, made for natives of asian speaking languages. Also has a very useful mobile app, check it out!
- Pleco One of the most famous world dictionaries for mobile devices. If you are investing into learning mandarin and don't know where to start, give Pleco a try. With its paid features on, makes it a one-stop-shop for mandarin students.

Grammar
- Chinese Grammar Wiki Tired of being stuck when facing an uncommon phrase variation or symbol used in an unsettling way? Check this complete online grammar that ranges from HSK-1 to HSK-3. Complete references and a very thorough list of sentence patterns.

Vocabulary
- Skritter Skritter is a powerful aid for learning character writing both for Chinese mandarin or Japanese kanji.
- Mandarin Bean Despite all the other resources who will aid you in gaining vocabulary, sometimes you need a compreehensible list. It's made for you! Very handy to print and put at your desk for offline reference. There's also a whole lot of resources like tests etc. Enjoy!
- Chinese HSK Consolidated I've found this in 2021 without even grasping how mandarin worked out or how to tackle its study. Turns out it's very handy for checking words and frequency order for all HSKs levels!

General resources
- Refold Mandarin (also this link) This was a very famous online sheet for hosting cultural resources in chinese mandarin, now turned into a Notion database. Check Refold. You can also check the above mentioned old sheet here.
- Chinese Cinema A fried of mine is addicted to Cinema and made this list of classical Chinese movies, from famous directors! Even if you're not that much in Chinese learning, check it out! Password is: Ch3nKaiRulz. If you want to download it all, get this torrent. Movies included:
Movies:
- Yonggang Wu - 1934 - 神女 (Goddess) | The Goddess
- Weibang Ma-Xu - 1937 - 夜半歌声 (Song at Midnight)
- Fei Mu - 1948 - 小城之春 (Spring in a small town)
- Xie Jin - 1961 - 红色娘子军 (The Red Detachment of Women) -> also on Youtube
- Chen Kaige - 1984 - 黄土地 (Yellow earth), 1993 - 霸王别姬 (Farewell My Concubine), 2021 - 长津湖 (The Battle at Lake Changjin)
- Tian Zhuangzhuang - 1986 - 盗马贼 (Horse thief), 1993 - 蓝风筝 (Blue kite)
- Zhang Yimou - 1988 - 红高粱 (Red Sorghum), 1991 - 大红灯笼高高挂 (Red lanterns hang high), 1994 - 活着 (Tempo de Viver), 1999 - 一个都不能少 (Not one less), 2002 - 英雄 (Hero)
- Jiang Wen - 1994 - 阳光灿烂的日子 (In the Heat of the Sun), 2000 - 鬼子来了 (Devils are coming)
- Jia Zhangke - 2000 - 站台 (Platform), 2006 - 三峡好人 (Em Busca da Vida), 2013 - 天注定 (Destiny), 2015 - 山河故人 (Old friend), 2018 - 江湖儿女 (Rivers and lakes)
- Bi Gan - 2018 - 地球最后的夜晚 (Last night on earth)
- Guan Hu - 2020 - 八佰 (The Eight Hundred)
Animations:
- Wan Laiming - 1941 - 铁扇公主 (Iron Fan Princess), 1961 - 大闹天宫 (The Monkey King: Havoc in Heaven), 1979 - 哪吒闹海 (Nezha Naohai) | Nezha Conquers the Dragon King, 2016 - 大鱼海棠 (Big fish & Begônia) -> (Netflix Only), 2018 - 肆式青春 (Unrestrained youth) -> (Netflix only), 2019 - 罗小黑战记 (Heifei Legend) -> (HBO Max only)
Animated Series:
- 2019 - 领风者 (O Líder) -> YouTube
- Series & Novels:
- 2021 - 觉醒年代 (Age of Awakening) -> YouTube
- 2010 - 三国 (Three Kingdoms) -> Youtube
Chinese Cinema History:
- https://en.wikipedia.org/wiki/Cinema_of_China
- Chinese Television IPTV from China mainland. Lot's of channels for your delight. But it works only by means of a VPN, and after some research, the only feasible (not yet tested or endorsed by me) is earthVPN.
- CN folder on Cloud I hosted for many years a lot of resources for language learning on my cloud disk drive and you can still access it from the link above. It's a couple of Gigabytes in size (~20GB) for the mandarin resources (lang/cn/) and they came from a publicly available torrent at that time (2018) as well as many other languages in there.

Community resources
- My Study Sheet It's my most used resource to study nowadays and I hope it's also beneficial for your study endeavours! There's also a lot of learning resources to master Bopomofo (Zhuyin Fuhao / 注音符號／ㄅㄆㄇㄈ)
- Kaohongshu guide for learning mandarin in 2022 I'm not the most experienced mandarin learner to give advice for newcomers. Check this blog for advice and resources on how to make your mandarin learning journey more effective and joyful
- Discord Chinese Language One of the best learning communities out there I've ever seen. Not because of it's size, but because of its quality both from it's members and guidance in general. There you'll find broader knowledge channels and can practice and level up your mandarin skill set!
- Discord Xefjord's Complete Language (also here) Interested in other asian countries or indian native languages? Say no more! Check Xefjord's amazing resources and join the Discord channel for lots of resources like flashcards and advice!
- Telegram Xiao Mandarim Channel PT-BR If you're coming from Portuguese-speaking countries, this is one of the most effervescent communities for mandarin learning in Brazil. 小老师 also holds a public playlist with +250 videos from 0-to-hero for mastering the mandarin language.

using multiple github accounts locally

2022-11-10T00:00:00+00:00

This guide is just a collection of steps and use case for implementing multi-account authentication on Github in your local machine.

Of course, you can use this, but... why not!?

Context

There was a time when cryptic sysadmins and developers integrated their scripts and codes underneath a pile of skull and rocks (kindly called Revision Control Systems).

Evolved offspring of this so-called jurassic figure filled the earth after this apocalyptical era, and rapidly became popular and known by their own names, like Subversion and TurtoiseSVN, the later its GUI implementation.

Things were gaining traction back then, and the fast-paced rhythm on which software was being developed, spawned a new set of demon capable of spread havoc and anxiety for generations to come. Well known as Git.

Loved and hated, different tastes contributed more or less to what is better known today as SCM - Source Control Management, creating a rich and diverse ecosystem of tools for the occultist craft of software engineering.

In my life I've only used two systems for SCM, SVN and Git. I also have seen people scratching their heads to be more productive on their work machines and keep up with their contributions besides job-related ones.

tip

If you want to dig deeper into Git, there are many resources and also an de facto industry standard book written about what git is and how to better leverage its system's functionality. Check it out!

My main drive for this post is because there's so much information out there about vanilla git configurations, but few ones aimed to configuration and operability for productivity - aside of installing new-shiny-tools.

Signing Commits

Signing posts is the most overlooked component when you are working for a closed doors org if they enforce self-domain usage for contributors in private repos, that is: only users with email user@myorg.com are able to contribute on private repositories and no outside collaborators are allowed.

That works... in parts! Let's suppose you have started small and gaining traction month by month, not only in revenue and corporate growth, but also in collaborators among your team who constantly push changes to production.

Once you start adding complexity in your environment, and aren't inclined to spend large bucks with security software for everyone's laptops - a couple questions arise:

Are my devs skilled enough in security practices while using their machines for off-work related issues?
How can I be assured that the startling new shiny tools integrated in our pipelines, doesn't pose a security risk for the entire supply-chain of our product?
What if a disgruntled employee starts to pose a security risk and plans to act on behalf of other employees to compromise our chain and our users?
More what ifs...

With these concerns at bay, a preliminary solution is to activate signed commits.

As this post from the old is explaining, it poses a question of authenticity and integrity, because:

... the software [in question] is critical to some type of security, an attacker might compromise you by substituting broken software for the software you think you're getting, e.g. something with a backdoor you couldn't easily identify. After all, you want some code, you click "download", and you trust. - Cris from Stackoverflow Apr 26 2017

Sufficiently to say, it also puts another layer of trust in commits inside your org, validating contribution's origin for its members.

So, how do you do that?

I'll summarize the main steps below, but feel free to check this doc from Github and follow it at your own pace.

Install your GPG suite of tools. _ Windows: Gpg4win _ MacOS: GPG Suite integrates automagically in the MacOs keychain. Check be above documentation for nitty-gritty details. * Unix/Linux: Chances are you already have it, but give gpg-agent a try
Verify your main address
Activate commit auto-sign after each commit, this will save time on each commit: git config commit.gpgsign true
Generate your key: gpg --full-generate-key

important

It must be at least 4096 bits (default option) Your email must be the main email address of your Github account

List and export your newly created GPG key: gpg --list-secret-keys --keyid-format=long. Copy the e.g: 3AA5C34371567BD2 part to be used in the next command.

$ gpg --list-secret-keys --keyid-format=long
/Users/hubot/.gnupg/secring.gpg
------------------------------------
sec   4096R/3AA5C34371567BD2 2016-03-10 [expires: 2017-03-10]
uid                          Hubot
ssb   4096R/42B317FD4BA89E7A 2016-03-10

Now, run the below command and copy the exhibited key in your GPG settings on Github:

$ gpg --armor --export 3AA5C34371567BD2
# Prints the GPG key ID, in ASCII armor format

Telling Github you're a winner. Inserting your keys in the config

$ git config user.signingkey 3AA5C34371567BD2

The process above can be used to generate as many keys as you want. It's useful if you plan to manage more than a single account on your machine/session, as we'll cover in the next part.

From now on, you're able to effectively prove yourself and sign every commit you make. Welcome to the age of surveillance capitalism!

Configuring Multiple Accounts

I really appreciate your taste for the above image!

There's a way to have a virtually unlimited number of git accounts configured if you observe some tricks, but often the most sought after feature is to maximize productivity, allowing you to commit to your professional and personal projects.

The above image says that in some cases, you want to use your personal username to work for your org, but using the org domain email, while, for your private projects, preserving the personal username + email address, also. But... is that possible? Yes, my horseshoe crab!

Let's do that now:

Head back to your Github's email settings. In this case, let's create the scenario where you're using your personal account and planning to use this account's username to commit to your org.
Simply add your org's email address and then make it valid.
Your primary address can be either your org or your personal one

After confirming your address, let's go to your ~/.gitconfig settings in your machine.

tip

In this step, you'll not need to configure your SSH keys for each account, as the username will not change. For possible counterpositive needs, you could check this ancient scroll.

We are going to generate and use two additional files for this case, despite the .gitconfig file, and also will specify a static working path dir, to be used with one of the accounts.

~/.git-personal.conf
~/.git-professional.conf

In the .gitconfig file you'll have your path choice set and additional commands:

.gitconfig

include]
        path = ~/.git-personal.conf
[includeIf "gitdir:~/Documents/YourOrgFolder/"]
        path = ~/.git-professional.conf
[init]
        defaultBranch = main

.git-personal

[user]
        signingkey = 3AA5C34371567BD2
        email = your-personal@email.com
        name = your-username
        mergeTool = vimDiff
[commit]
        gpgsign = true

.git-professional

[user]
signingkey = FD668DAFE840A89C
email = your-professional-email@organization.com
name = same-username-as-your-personal-one
mergeTool = vimDiff
[commit]
gpgsign = true

One thing to notice in the above configuration is that you can use more than one signing key, or use the same to signed-commit in both projects - make sure your boss don't work two part-time jobs, if you'll just one key btw.

If you're taking advantage of this pandemic and working more than one all-remote job, you could negotiate to use your same username and enjoy a multi-org config. Just create more .git-professional-<number> files and more [includeIf] entries in your .gitconfig file.

Now, for cloning accordingly (Github example), for other configured accounts not in your first [Include]- which is applicable to any folder besides the configured others - you need to run the clone command this way:

$ git clone git@github.com-<account_username>:<account_username>/<repo_name>.git <repo_name>_<account_username>

$ git clone git@github.com-nullniverse:nullniverse/my_repo.git my_repo_nullniverse

That's it.

not so useful k8s tricks - maybe

2022-11-04T00:00:00+00:00

Nowadays, I barely touch in helm charts in my job. In the past, I was used to writing a little bit of helm charts performing migrations of deployments that were outdated, and migrating our CI/CD pipelines from drone.io to argo workflows.

I tried my best to prioritize maintainability and code flexibility over complexity in helm chart code deployments.

So below you'll find some examples of useful snippets that simplified my day to day tasks, and other k8s useful stuffs - maybe.

⎈ Simplified multi-Ingress

{{- $svcPort := .Values.service.port -}}
{{- if .Values.ingresses.enabled -}}
{{- range .Values.ingresses.ingress }}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .name }}
  namespace: {{ .namespace }}
  labels:
{{ include "app.labels" $ | indent 4 }}
  {{- with .annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
{{- if .tls }}
  tls:
  {{- range .tls }}
    - hosts:
    {{- range .hosts }}
      - {{ . | quote }}
    {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
{{- range .rules }}
    - host: {{ .hosts | quote }}
      http:
      {{- range .http.paths }}
        paths:
          - path: {{ .path | quote }}
            pathType: {{ .pathType | quote }}
            backend:
              service:
                name: {{ .backend.service.name | quote }}
                port:
                  number: {{ .backend.service.port.number | default $svcPort }}
      {{- end }}
{{- end }}
{{- end }}
{{- end }}

It's modular enough so you can attach and remove ingresses as needed without much hurdle.

Here follows the value.yaml example.

It can have a vast number of ingresses each one starting at "name":

ingresses:
enabled: true
ingress:
    - name: ingress-1
    namespace: namespace
    annotations:
    ...
    tls:
        - hosts: my.host.com
        secretName: tls-my-host.com
    rules:
        - hosts: my.host.com
        http:
            paths:
            - path: /
            pathType: Prefix
            backend:
                service:
                name: "service-name"
                port:
                    number: 80
    - name: ingress-2

This works for any object as well - like Services, Secrets etc; -, and could save you face when you need to plan for a modularized model to be used for multiple apps with as single config.

⎈ Pod Recurrent Restarts

Ever wondered how to cycle your deployment/pods the native way? Think no more!

kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: deployment-restart
  namespace: ns-name
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployment-restart
  namespace: ns-name
rules:
  - apiGroups: ["apps", "extensions"]
    resources: ["deployments"]
    resourceNames: ["deployment-name"]
    verbs: ["get", "patch", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployment-restart
  namespace: ns-name
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: deployment-restart
subjects:
  - kind: ServiceAccount
    name: deployment-restart
    namespace: ns-name
EOF

kubectl apply -f - <<EOF
apiVersion: batch/v1
kind: CronJob
metadata:
  name: deployment-restart
  namespace: ns-name
spec:
  schedule: "* */5 * * *"
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 600
      template:
        spec:
          serviceAccountName: deployment-restart
          containers:
            - command:
                - bash
                - -c
                - >-
                  kubectl rollout restart deployment/deployment-name && kubectl rollout status deployment/deployment-name
              image: bitnami/kubectl
              imagePullPolicy: IfNotPresent
              name: kubectl
          restartPolicy: Never
EOF

Adjust the values to meet your current needs.

⎈ Using sealed-secrets the easy way

If your deployment implements the usage of sealed-secrets, chances high that someday you'll need to implement a secret by hand.It is the best way to keep your sensitive data safe in a GitOps workflow.

Here is a breakdown that simplifies this process using kubeseal.

First, ensure you have the following installed and configured:

kubectl: Connected to your target cluster.
kubeseal: The CLI tool for Sealed Secrets.
view-secret: A kubectl kubecrew plugin (or use standard base64 decoding if you don't have it). To install, run kubectl krew install view-secret.

1. Fetch the Public Certificate

To encrypt data without needing direct access to the Sealed Secrets controller, you first need to grab the public certificate from your cluster.

Find the latest key name:

kubectl get secret -n kube-system | grep sealed-secrets-key

Export the certificate:

Replace {{latest-key-name}} with the name you found in the previous step.

kubectl view-secret {{latest-key-name}} -n kube-system tls.crt > tls.crt

Note: This tls.crt file is public. You can safely share it with your team; it can only be used to encrypt data, not decrypt it.

2. Encrypt Your Data

You can now generate the encrypted string (the "Sealed" version) to put into your values.yaml or Kubernetes manifests.

For simple strings:

Use this for passwords, API keys, or tokens.

echo -n 'your-sensitive-data' | kubeseal --raw \
--scope cluster-wide \
--cert tls.crt \
--controller-name {{latest-key-name}} \
--from-file=/dev/stdin

For Service Account JSON files:

If you have a Google Cloud or Azure service account file (SA.json), use this method:

cat SA.json | kubeseal --raw \
--scope cluster-wide \
--cert tls.crt \
--controller-name {{latest-key-name}} \
--from-file=/dev/stdin

💡 Key Parameters Explained

Parameter	Purpose
`--raw`	Outputs only the encrypted string instead of a full YAML object.
`--scope cluster-wide`	Allows the secret to be unsealed in any namespace within the cluster.
`--cert tls.crt`	Uses the certificate you just downloaded to perform the encryption.
`--from-file=/dev/stdin`	Tells the tool to read the data you piped in via `echo` or `cat`.

⚠️ A Quick Pro-Tip

Once you have generated the encrypted string and pasted it into your values.yaml, delete the local tls.crt and any plain-text files (like SA.json) if they are no longer needed. Never commit the plain-text versions to your repository!

⎈ Start a cronjob

Learn how to start a previously deployed cronjob in your cluster:

kubectl create job --from=cronjob/<cronjob-name> <job-name> -n <namespace-name>

⎈ List API versions

This is how to list all your cluster's API versions for any object:

kubectl get <anything> -A -o=custom-columns=NAME:.metadata.name,API-Version:.apiVersion

⎈ Multi-Container pods

Pods can run more than one container (like a main app and a "sidecar"). These commands help you target the right one.

1. List all containers in a Pod

If you aren't sure what the containers inside a Pod are named, use this command to list them:

kubectl get pod <podName> -o jsonpath='{.spec.containers[*].name}'

2. View logs for a specific container

By default, kubectl logs might fail if there is more than one container. Use the -c flag to specify which one you want to see:

kubectl logs pod/<podName> -c <containerName>

3. Access the container's terminal (shell)

If you need to jump inside the container to check file paths, environment variables, or network connectivity:

kubectl exec -it <podName> -c <containerName> -- /bin/bash

What it does: * -it: Interactive and TTY (keeps the session open so you can type).
- -c <containerName>: Ensures you enter the correct container.
- -- /bin/bash: Executes the bash shell (if bash isn't available, try /bin/sh).

💡 Quick Summary Table

Goal	Command Flag	Why use it?
Identify	`-o jsonpath='...'`	When you don't know the container names.
Debug	`logs`	To see error messages or application output.
Inspect	`exec -it`	To run manual commands inside the running environment.

Warning: Be careful with exec in production environments! Changes made manually inside a container are temporary and will disappear if the Pod restarts. Always update your configuration or Dockerfile for permanent changes.

⎈ Identify which images are running in a Kubernetes cluster

kubectl get pods --all-namespaces -o jsonpath="{..image}" |
tr -s '[[:space:]]' 'n' |
sort |
uniq -c

⎈ List all Container images in all namespaces

Easy ti grab a full list of running container images in the cluster, without relying on any extra plugins.

kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec.containers[*].image}" |\
tr -s '[[:space:]]' '\n' |\
sort |\
uniq -c

If you want to list all container images by pod, the command is:

kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\
sort

⎈ List all pulled images in worker nodes

List all images pulled for all nodes:

kubectl get node  -o json | jq -r '.items[].status.images[].names'

For a single worker node:

kubectl get node worker-node -o json | jq -r '.status.images[].names'

⎈ Get and sort cluster events

List all cluster events sorted by the newest first:

kubectl get events --sort-by='.lastTimestamp'

⎈ Real-time node status monitoring

Filter and monitor nodes in real-time:

watch -n1 "kubectl get nodes --sort-by=.metadata.creationTimestamp | grep <node_name_hint>"

💡 Key Parameters Explained

Parameter	Purpose
`-n1`	Runs the following command every 1 second.
`--sort-by=.metadata.creationTimestamp`	It sorts the nodes by their age.

⎈ Database health-check probes

When running databases like MySQL in Kubernetes, you want to know if the database is actually responding to queries.

These configurations use Probes to automate health checks.

Database Health Probes (MySQL)

Probes allow Kubernetes to automatically "heal" your application or stop traffic if the database becomes unresponsive.

1. Liveness Probe: "Is the process alive?"

This probe determines if the container needs a restart.

livenessProbe:
  exec:
    command:
      [
        "bash",
        "-c",
        "mysqladmin --user=$MYSQL_USER --password=$MYSQL_PASSWORD ping",
      ]
  initialDelaySeconds: 30
  timeoutSeconds: 5

The Check: Uses mysqladmin ping to see if the MySQL server process is alive.
Wait Time: It waits 30 seconds (initialDelaySeconds) after starting before checking. This gives the database enough time to finish its internal startup (buffer pools, log recovery, etc.).
Failure: If the command fails or takes longer than 5 seconds, Kubernetes will kill the Pod and start a fresh one.

2. Readiness Probe: "Is the DB ready for traffic?"

This probe determines if the container is ready to accept connections.

readinessProbe:
  exec:
    command:
      [
        "bash",
        "-c",
        "mysql --host=127.0.0.1 --user=$MYSQL_USER --password=$MYSQL_PASSWORD -e 'SELECT 1'",
      ]
  initialDelaySeconds: 5
  periodSeconds: 2

The Check: Runs a real SQL query (SELECT 1). This is more thorough than a "ping" because it confirms the database can actually execute commands.
Frequency: It checks every 2 seconds (periodSeconds).
Traffic Control: If this fails, Kubernetes removes the Pod from the Service endpoint. Your app won't try to send data to a database that isn't ready.

💡 Pro-Tip

Always use a Readiness Probe for databases. If your database is doing a heavy internal migration or recovery, you want the Pod to stay "Running" (so it doesn't get killed by a Liveness probe) but you don't want your application to try and connect to it until the migration is finished.

Douglops - notes and banters

visitors from above? what the world's sacred texts actually say about non-human intelligences

where this started

how the research was organised

what we found

the motifs are real and often ancient

but the details don't look like spacecraft

the "ancient astronaut" reading has a birth date

surprising findings along the way

so what's left?

limitations

next steps

learning industrial controls as an it person

why cross over

the map: the Purdue model

glossary, fast

the stack, and why

control layer: siemens, with a shorter word on weg

SCADA: Ignition

the glue: Modbus + OPC-UA

how i'm actually learning this

books and resources

project ideas, roughly in order

still missing (running list)

calisthenics 101

where it all started

building a living calisthenics workbook

what "living" actually means

why there are two editions

the part worth writing down: the bugs all lied

licensing, kept honest by the build

where it stands

how to get it

amateur radio textbook for hackers

llm seven layers stack model - or - why i'm feeling numb?

spot nearby planes with acars when you're bored

The ADS-B detour

ACARS: works with (basically) anything

acars_deku, someday

Further reading

the practice of chinese learning dump

using multiple github accounts locally

Context

Signing Commits

Configuring Multiple Accounts

not so useful k8s tricks - maybe

⎈ Simplified multi-Ingress

⎈ Pod Recurrent Restarts

⎈ Using sealed-secrets the easy way

1. Fetch the Public Certificate

Find the latest key name:

Export the certificate:

2. Encrypt Your Data

For simple strings:

For Service Account JSON files:

💡 Key Parameters Explained

⚠️ A Quick Pro-Tip

⎈ Start a cronjob

⎈ List API versions

⎈ Multi-Container pods

1. List all containers in a Pod

2. View logs for a specific container

3. Access the container's terminal (shell)

💡 Quick Summary Table

⎈ Identify which images are running in a Kubernetes cluster

⎈ List all Container images in all namespaces

⎈ List all pulled images in worker nodes

⎈ Get and sort cluster events

⎈ Real-time node status monitoring

💡 Key Parameters Explained

⎈ Database health-check probes

Database Health Probes (MySQL)

1. Liveness Probe: "Is the process alive?"

2. Readiness Probe: "Is the DB ready for traffic?"

💡 Pro-Tip