6. September 2019

Finally! GreenApe Shop goes live!

Together with my partners in crime (Dorit & Micha), we have finally opened our own personal online store.

We have been selling our single origin coffees (1st Single Malt Whisky Coffee, Basic – Single Origin Arabica, Kill me Quick Espresso -Single Origin Robusta), teas (Kräuterschorle – Kräutertee, Feuerkieker – Schwarztee) and rum (Fortune Teller – Double Aged Barbados Rum) using the Amazon Marketplace for the past 2 years.

No more Amazon

GreenApe has been a side project for the past years and I never wanted to deal with the maintenance of our own store. But its time to move on and do our own thing. Amazon has removed so many useful features over the years or added a new fee on top of other fees. Even though Amazon provides access to a large amount of customers, for small companies the fees build up quickly.

Our own

With our own store we can finally do bundles, coupons again and better optimized shipping. It will also allow me to better testdrive some new interesting features for my customers ;) Yeah its kind of my new toy or shopping lab! Its fun being able to work on untested new SEO features, structured data, merchant tools, shopping ads and tracking of all of those.

Locations

We have been selling in Germany for the past 2 years, but that might be changing in the future depending how well the new store shapes up :)

If you live in Germany, love good coffee, tee or rum … say Hi!

GreenApe – Makes Your Life Better
Homepage
Shop
Contact us

6. September 2019

Germann / Gartengestaltung & PlanG

These are 2 OnePagers announcing the upcoming redesign for 2020. The current site runs on GetSimple CMS. Design by GREENTONIC.

I created a separate template for the introduction pages, keeping the rest of the website completely untouched. More to come next year!

Gartengestaltung Germann
Plan Germann

17. August 2019

Keeping Development Credentials Secure

Development today relies on multiple teams, services, and environments all working in unison. A topic that always comes up, when setting up a new development environment: How do we secure important credentials, while not making it too complicated for the rest of the team?

The key when working with version control systems like Git, is to keep any type of credentials out of the versioning system. These can be API keys, database or email passwords.

Even if its a private repository, development environments might change. It can be a simple staging & live website setup you are maintaining.

.env Files for Environment Variables

DB_HOST=localhost
DB_USER=username
DB_PASS=password

DB_HOST=localhost

DB_USER=username

DB_PASS=password

The simplest way in PHP is to use .env files to store your credentials outside of the public accessible directory structure. So outside the public_html, but still within the reach of the executing environment to read it. Variables are accessible through $_ENV['yourVar'] or getenv("yourVar"), once included in your code.

To make it simple you can use the popular package vlucas/phpdotenv, which reads and imports the file automatically.

&lt;?php
require_once __DIR__.'/../vendor/autoload.php';

$dotenv = new Dotenv\Dotenv(__DIR__.'/../');
$dotenv->load();
?>

<?php

require_once __DIR__.'/../vendor/autoload.php';

$dotenv = new Dotenv\Dotenv(__DIR__.'/../');

$dotenv->load();

Don’t fool yourself, if an attacker finds a way into your system, these variables can be easily read. This is just hiding the file from public access and provides some convenience while developing or sharing code.

Encrypted .env files

Some people propose to encrypt / decrypt environment variables using a secret key. But if an attacker can access your data, he can also find the secret key.

There are some nice packages that offer just that. You have to decide if those fit your ammo.

The psecio/secure_dotenv library provides an easy way to handle the encryption and decryption of the information in your .envfile. @Github
johnathanmiller/secure-env-php – Env encryption and decryption library. Prevent committing and exposing vulnerable plain-text environment variables in production environments. The lib provides a nice guided interface to encrypt your .env file. @Github
beyondcode/laravel-credential – Add encrypted credentials to your Laravel production environment. You can edit and encrypt using php artisan credentials:edit. @Github

Apache Pull – setting environment variables

The Apache2 environment variables are set in the /etc/apache2/envvars file. These variables are not the same as the environment variables of your Linux system; they are stored and manipulated in an internal Apache structure.

The /etc/apache2/envvars file holds variable definitions such as APACHE_LOG_DIR (the location of Apache log files), APACHE_PID_FILE (the Apache process ID), APACHE_RUN_USERS (the user that run Apache, by defaultwww-data), etc.

You can open and modify this file in a text editor of your choice. This is nice, but far from simple and requires a server restart. This is something which helps you when hardening security on a live deployed setup.

There are dynamic approaches, but you can do some research for that yourself :) Skipped that rabbit hole for now …

Infrastructure Secret Management

Handling secrets completely detached is another possibility. This is surely an overkill for most cases, but using an Infrastructure Secret Management concept might be worth looking into, if you are working on bigger scale projects that involve multiple development teams and setups. These services also often deal with secret rotation.

HashiCorp Vault – “Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log.”

You can deploy your own vault on your own infrastructure or test out a hosted version, which is free for Open Source projects. HashiCorp Vault

You will find a bunch of Hashicorp related packages that will help you to integrate a vault into your project workflow (scmrus/php-vault-env , poc-webapp-vault).

While this is nice, you will need to cache / store credentials somewhere, as you don’t want to query the vault on every single access.

The Hashicorp Vault is not the only Infrastructure Secret Management solution. There is a nice Github Gist that lists other solutions and a nice feature matrix.

Amazon also provides a solution called AWS Secrets Manager, which makes a lot of sense, when you build and deploy on AWS already :)

What a rabbit hole, once you start researching solutions :)
Have fun …

14. August 2019

GreenApe – Makes Your Life Better – Shop

Together with my partners in crime (Dorit & Micha), we have finally opened our own personal online store.

Amazon is still part of our concept, but we will be phasing it out slowly.

GreenApe Shop

20. July 2019

PROTECT – Mediensucht Selbsttest für Eltern / Jugendliche

I helped integrate a media addiction questionaire for parents and children.

“When children and adolescents use excessive media, parents often experience feelings of helplessness and powerlessness. This is usually accompanied by tendencies towards passivity and withdrawal, which lead to a weakening of the parental presence. Recapturing a strong parental presence can be helpful in breaking out of parental helplessness and working with the child to work out solutions for how to balance the media.”

Elterntest / Jugendliche (Pädagogische Hochschule Heidelberg)

4. June 2019

Cron / Crontab Tips Collection

I will use this article to collect interesting tips and tricks about using the Linux cron. This is not so much about setting up a cron, but about little things I use or discovered!

What is a cron ?

The cron daemon is a long-running process that executes commands at specific dates and times. You can use this to schedule activities, either as one-time events or as recurring tasks.

What is the crontab?

For commands that need to be executed repeatedly (e.g., hourly, daily, or weekly), you can use the crontab command. The crontab command creates a crontab file containing commands and instructions for the cron daemon to execute.

Format is: MIN HOUR DOM MON DOW CMD
Minute field
Hour field
Day of month
Day of week
Command

crontab -l    		# Viewing the cronjobs as currently logged in user 
crontab -e    		# Edit the cronjob for currently logged in user
crontab -l -u $USER 	# View the cronjob for the specified user 
crontab -e -u $USER	$ Edit the cronjob for the specified user

crontab -l # Viewing the cronjobs as currently logged in user

crontab -e # Edit the cronjob for currently logged in user

crontab -l -u $USER # View the cronjob for the specified user

crontab -e -u $USER $ Edit the cronjob for the specified user

Run every 5 minutes

*/5 * * * *  /home/reggaenights/script.sh

1	/5 * * * /home/reggaenights/script.sh

Run yearly, monthly, weekly, daily or on reboot.
@yearly will run at 00:00 on Jan 1st for every year.
@monthly will run at 00:00 on 1st of every month.
@weekly will run at 00:00 on starting of every week.
@daily will run at 00:00 on every day.
@reboot will run after the server has been rebooted

@yearly  	/home/reggaenights/script.sh	
@monthly 	/home/reggaenights/script.sh
@weekly		/home/reggaenights/script.sh
@daily  	/home/reggaenights/script.sh

@yearly /home/reggaenights/script.sh

@monthly /home/reggaenights/script.sh

@weekly /home/reggaenights/script.sh

@daily /home/reggaenights/script.sh

TIPS

1. Send cron output via email

*/30 * * * * /bin/bash /cleanup | /usr/bin/mail -s "Notify me" your@email.org

1	/30 * * * /bin/bash /cleanup \| /usr/bin/mail -s "Notify me" your@email.org

2. Use a real cron for WordPress

A real cron does not rely on website activity and executes independently.

*/30 * * * * /usr/bin/wget -q -O - https://yourwordpress.org/wp-cron.php?doing_wp_cron

1	/30 * * * /usr/bin/wget -q -O - https://yourwordpress.org/wp-cron.php?doing_wp_cron

Do not forget to disable the virtual WordPress Cron in the wp-config.php!

define('DISABLE_WP_CRON', true);

1	define('DISABLE_WP_CRON', true);

3. Prevent Emails being sent, when cron executes > /dev/null 2>&1

*/30 * * * * /usr/bin/wget -q -O - https://yourcrone.org/wp-cron.php?doing_wp_cron >/dev/null 2>&amp;1

1	/30 * * * /usr/bin/wget -q -O - https://yourcrone.org/wp-cron.php?doing_wp_cron >/dev/null 2>&1

4. Set Standard Variables

# Email to send output to
MAILTO="a@b.com,b@b.com"

# Setup your path for reuse
PATH="/usr/bin:/sbin:/bin"

# Tells which directory the cron should execute the crontab commands from
HOME="/path/to/app/root"

#Set the default shell
SHELL="/bin/bash"

# Email to send output to

MAILTO="a@b.com,b@b.com"

# Setup your path for reuse

PATH="/usr/bin:/sbin:/bin"

# Tells which directory the cron should execute the crontab commands from

HOME="/path/to/app/root"

#Set the default shell

SHELL="/bin/bash"

5. Output Redirection

*/15 * * * * /home/reggaenights/script.sh >> /home/collect/cron/output/pipe.log 2>&amp;1

1	/15 * * * /home/reggaenights/script.sh >> /home/collect/cron/output/pipe.log 2>&1

TOOLS

Crontab UI (NodeJS) – Easy way to edit your crontab visually. @Github
Chronis ( >= PHP 7) – Chronis will help you define cron jobs using natural language / YAML and will generate the crontab files for you. @Github
PHP Cron Expression Parser – Standard (V7) compliant crontab expression parser/validator with support for time zones. @Github
PhpGt/Cron (PHP) – Define background jobs in standard crontab format and the Cron Runner will execute them when they are due. Jobs can be either normal scripts, or calls to static functions with automatic autoloading taken care of. @Github
Cronicle (NodeJS) – A simple, distributed task scheduler and runner with a web based UI. @GitHub / Website

30. May 2019

Have you heard of GatsbyJS?

Gatsby is a free and open source framework based on React that helps developers build blazing fast websites and apps.

What they have to say …

Go Beyond Static Websites. Get all the benefits of static websites with none of the limitations. Gatsby sites are fully functional React apps so you can create high-quality, dynamic web apps, from blogs to e-commerce sites to user dashboards.
Use a Modern Stack for Every Site. No matter where the data comes from, Gatsby sites are built using React and GraphQL. Build a uniform workflow for you and your team, regardless of whether the data is coming from the same backend.
Load Data From Anywhere. Gatsby pulls in data from any data source, whether it’s Markdown files, a headless CMS like Contentful or WordPress, or a REST or GraphQL API. Use source plugins to load your data, then develop using Gatsby’s uniform GraphQL interface.
Performance Is Baked In. Ace your performance audits by default. Gatsby automates code splitting, image optimization, inlining critical styles, lazy-loading, and prefetching resources, and more to ensure your site is fast — no manual tuning required.
Host at Scale for Pennies. Gatsby sites don’t require servers so you can host your entire site on a CDN for a fraction of the cost of a server-rendered site. Many Gatsby sites can be hosted entirely free on services like GitHub Pages and Netlify.

What I have to say …

While researching some popular static site generation tools, GatsbyJS comes up often. I have played with NuxtJS and Hugo in the past, but what I REALLY like about GatsbyJS is the plugin / modular system. You can build your website with plain-old React and CSS styles, but make your development more efficient by adding node_modules.

Also being able to import any data source with ease, using GraphQL, is amazing. And when it comes to content management, you can easily hook a headless WordPress or Drupal setup into the mix and consume their REST APIs :)

I am not switching my own website to GatsbyJS anytime soon, but its another tool in my toolbox for future project consideration !

There are many tutorials on Youtube about getting started, maybe something to consider for the next freetime testdrive ;) Enjoy …

GatsbyJS @ Github

20. May 2019

PsySH – PHP Debug Console

A runtime developer console, interactive debugger and REPL for PHP.

PsySH can be used as an interactive debugger, much like JavaScript’s debugger statement, saving you from endless var_dump() and die() iterations. Just drop this line in where you’d like to have a breakpoint: eval(\Psy\sh());
PsySH has tab completion for variable names, functions, classes, methods, properties, and even files! Just start typing, then hit [tab]. But you probably already guessed that.
Most PHP shells are terrible at namespaces. PsySH does just what you’d expect.
Have a question about a core PHP function? Try doc array_map. Want to read the documentation for an object property? Run doc $response->statusTexts.
The list command knows all about your code — and everyone else’s. Easily list and search all variables, constants, classes, interfaces, traits, functions, methods and properties.
Easily show the source code for any userland object, class, interface, trait, constant, method or property.
No worries, PsySH has your back. We caught it for you, and made it available via the wtf command.
Show, search, save and replay your shell history.
and much more :)

Integrations

CakePHP: cake console
CiviCRM: cv cli
CodeIgniter: craftsman console
Drupal: drush php, drupal shell
Emacs: psysh.el
eZ Publish: ezsh
Grav: bin/plugin psysh shell
Jupyter: Jupyter-PHP
Laravel/Lumen: artisan tinker
Magento: magerun console
MediaWiki: php maintenance/shell.php
Pantheon CLI: terminus cli console
Phalcon: phalcon console
SilverStripe: sliver
Symfony: sf1-psysh-bootstrap
Symfony2: PsyshBundle, symfony-repl
WordPress: wp-cli shell
Yii 2: yii shell
Zend Framework 1: zf1-psysh
Zend Framework 2: PsyshModule

Github
Website

18. May 2019

Screenshot Service with Node.js

Manet is a REST API server which allows capturing screenshots of websites using various parameters.

The Node.js server can use SlimerJS or PhantomJS as headless browser engines.

I have build similar with CasperJS, but this is far better for those that want a simple straight solution.

@GitHub

17. May 2019

CSS3 Animations with Special Effects.

A nice set of CSS3 Animations that can be easily used to spice up your design.

The animations can be triggered through Javascript, jQuery and the timings can be tweaked through pure CSS. The package also provides gulp, so that you can tweak every aspect easily.

Demo
Github