HOWTO add headers to the Django test client

To mess with the HTTP headers used by the Django web test client, make your request with your custom headers in a dict. From inside a django test method it looks like this:

self.client.get('/some/path/', **{'HTTP_USER_AGENT':'silly-human', 'REMOTE_ADDR':'127.0.0.1'})

Import multiple vcf files into gmail

You can import contacts into gmail - it currently accepts csv files or vcf files. Unfortunately you can only upload one file at a time. If you are trying to import a full phone backup of hundreds of vcf files, that isn't useful. It turns out vcf's have their own internal structure and you can just combine them all into one giant file (using cat on linux):

cat *.vcf > ../allinone.vcf

HOWTO: Convert a darcs repository to mercurial

It seems the "easiest" way to convert a darcs repo to a mercurial repo is via git =( This uses darcs-fast-export, git-fast-import and hg convert. Other solutions such as tailor and "darcs2hg.py" exist but seem hard(er) to setup or have errors.

1. Get darcs fast-export from bzr-fast-import:
   

   git clone git://vmiklos.hu/bzr-fastimport
   

2. The only thing you care about in the entire bzr-fast-import repo is "darcs-fast-export" (a python script) in bzr-fastimport/exporters/darcs.
3. Checkout the darcs project
   

   mkdir project; cd project; darcs get codebox:/code/project project.darcs; cd .. 
   

4. Convert darcs to git (in Ubuntu karmic git-fast-import isn't in PATH)
   

   mkdir project/project.git; cd project/project.git; git init
   ../../darcs-fast-export.py ../project.darcs | /usr/lib/git-core/git-fast-import; cd .. 
   

5. Convert git to hg
   

   hg convert project.git project.hg; cd project.hg; hg update
   

Generate SSL certificates for openvpn with easy-rsa

Easy-rsa is distributed with openvpn (on Ubuntu anyway), and makes generating SSL certs a lot easier.

Here is typical usage:

cd /usr/share/doc/openvpn/examples/easy-rsa/2.0
[edit vars with your site-specific info]
source ./vars
./clean-all
./build-dh     -> takes a long time, consider backgrounding
./pkitool --initca
./pkitool --server myserver
./pkitool client1

Keys and certs are written to the "keys" directory.

HOWTO rotate large numbers of images in Ubuntu

I needed a way for my wife to rotate a whole bunch of JPEG images.  It had to be simple to use (i.e. GUI not command line).

I stumbled across a blog that suggested the nautilus-image-converter plugin, which worked perfectly. It has a simple right-click interface that allows you to rotate images in place or use a renaming scheme. It can also do resizing.

Brilliant.

Apache and client side SSL certificate verification

To require client SSL certificate verification, add this to your apache config:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCipherSuite HIGH:MEDIUM
SSLCACertificateFile /etc/ssl/ca_that_signed_client_certs.pem

And to log what is going on with the SSL client cert verification, use something like this:

ErrorLog /var/log/apache2/error.log
LogLevel info

CustomLog /var/log/apache2/access.log combined

CustomLog /var/log/apache2/ssl.log "%t %h %{SSL_PROTOCOL}x verify:%{SSL_CLIENT_VERIFY}x %{SSL_CLIENT_S_DN}x \"%r\" %b"

Commercial SSL certificate untrusted - what did I pay for?

I recently bought a commercial SSL certificate, and was slightly mystified as to why the browser was calling it untrusted. How could they possibly be selling certs that Firefox doesn't trust? After some head scratching I realised the answer was that I needed to install the intermediate certificates (provided by the CA) on the server side, to complete the chain of trust.

During the SSL certificate exchange the web server (in this case Apache) can provide the client with additional certificates to enable it to establish a chain of trust.  Use the SSLCertificateChainFile directive in your site config, something like:

    SSLCertificateChainFile /etc/apache2/ssl/ExternalCARoot1.crt
    SSLCertificateChainFile /etc/apache2/ssl/CACompanySecureServerCA.crt

According to the apache help, you can cat these two together and just specify one file.  Say the browser trusts RootCA1, it can check that RootCA1 signed ExternalCARoot1.crt, which signed CACompanySecureServerCA.crt, which signed my certificate. Without those intermediate certificates, the browser cannot establish trust.