There are a ton of old Teslas out there running Autopilot v1 (AP1), and they fall further behind in assisted-driving capability every year. AP1 felt ultra futuristic in its day, but it’s starting to become outclassed even by the lane assist shipping in everday non-Tesla cars.
One of the biggest reasons I opted to seek an upgrade was the ability to remove the notorious “Tesla NAG”. While I get checking if the driver is paying attention is critical for safety, the way Tesla did it in AP1 was less than ideal by having to apply torque to the steering wheel, even if you are alert and watching the road ahead of you. In addition, the driving capabilities of AP1 on unmarked roads, aggressive curves, phantom braking, etc. make for a significantly less confident driving experience in AP1 and feel dated compared to newer vehicles today.
openpilot – make driving chill
Revive your car with the open source software openpilot, maintained by the company Comma AI! comma.ai — make driving chill
While Comma AI does not officially support old Tesla vehicles there are several forks for older Tesla’s to use openpilot and while Comma AI doesn’t provide an official wiring harness for older Tesla cars, they do provide a developer harness where you can make your own.
You can grab a harness for the vehicle from a developer in the openpilot community, who has helped try to maintain a fork of openpilot (which we’ll talk about later on). This makes installing the Comma 4 significantly easier by bringing peace of mind it’s correct and kick back support to the maintainer for their contributions to the fork for the older Tesla vehicles.
That being said, I went down the road of trying to DIY this myself for two reasons: 1) I wanted to learn 2) cost
When starting the project, cost wasn’t originally my concern, but I was lucky and was able to pick up their official development harness for $50 on a sale and with sourcing the parts and ultimately was able to make it for under $80. The prebuilt harness was > $250 and my understanding at the time is it would have shipped from Europe, so it would have likely gone over $300 with tariffs with that assumption (although they have some stock in the USA I found out later on).
While a cheaper harness sounds great, one big note is if you go down the DIY route, don’t expect the Comma community to help. The folks that really understand this kind of stuff in the unsupported Tesla community really laid it on thick that I should give up and just buy the harness.
IMO, if you have the time and patience it was an interesting project and I learned a lot on the electrical side and comma side debugging the pin configuration.
Nonetheless, if you do this DIY, don’t expect much help. If you just want your car to work, buy the harness, it’s worth it. If you have some background in software development and electrical engineering, then here’s my learnings if you want to take a similar venture; but proceed at your own risk. I’m not responsible if you short out any components of your car.
Acquiring the parts for the harness if you DIY this
Pulling it altogether, you get this as the secret sauce to build the harness:
From the mirror connector to the 18pin comma connector: Pin 1 – GND -> Comma -> Pin 1 Pin 2 – Radar CAN + -> Comma -> Pin 8 Pin 3 – Radar CAN – -> Comma -> Pin 7 Pin 4 – Camera CAN + -> Comma -> Pin 4 Pin 5 – Camera CAN – -> Comma -> Pin 6 Pin 6 DefogHSD_OUT -> Floating Pin 7 DefogPWR_in -> Floating Pin 8 12v -> Comma -> Pin 10
From the 18pin comma connector to the original car port: Comma Pin 17 -> GND – Car Pin 1 Comma Pin 9 -> Car Pin 2 Radar CAN + Comma Pin 11 -> Car Pin 3 Radar CAN – Comma Pin 16 -> Car Pin 4 Camera CAN + Comma Pin 18 -> Car Pin 5 Camera CAN – Floating Car Pin 6 Floating Car Pin 7 Comma Pin 12 -> 12v Car Pin 8
Pin 3 and 5 are looped on the comma connector (this is standard to the dev harness as-is)
One note about this, be very very very careful you do not mix up the 12v pins with another position when building your harness. If you send 12v down your CAN buses, that will not be good. Use a multimeter to triple check. I was ultra surprised to find that Tesla had a red wire on their harness and it didn’t carry 12v; rather the “blue” wire is what actually carried 12v. Going simply by the color codes would have given me a bad day, so DO NOT make any assumptions.
When building my harness, I terminated both the “to car” and “to camera” cables with the MQS 8P plugs. Connecting the cable from the car to the comma, I placed both MQS HDR 8P ASSY back-to-back on the protoboard and soldered the pins together. This allowed me a secure connection between the car and comma harness. Unfortunately, TE Connectivity doesn’t have the receiving connector without it being mounted to a PCB board, so double connector it was. Given vibration and force from accelerating / braking, I’d recommend locking connectors over the screw down blocks to prevent wires from coming lose.
Mount the Comma 4 Bracket
Before you pull apart your mirror, I would recommend mounting the Comma 4 bracket. Sit how you would normally in your seat, then hold the device up. The camera can be partially blocked by the mirror, but not fully. I saw a guide that said use 3 fingers down and you should be good. I did more like 4-5, since 3 had the entire device completely blocked by the mirror. Once your Comma 4 is mounted, remove the Comma 4 itself from the device, leaving just the mount on your windshield. One thing to make sure is to make sure the yaw (left and right balance) of the unit is as close as level as possible; you have roughly 4 degrees of skew and it’s nearly impossible to adjust once you stick the device, so have someone take a look on the outside of the windshield to gauge if it looks aligned properly.
Install the harness
To install the harness you will need to remove the front mirror assembly. Official instructions can be found on Tesla’s website here:
If you prefer a YouTube video, this video was helpful on understanding how to remove the mirror (don’t go past moving the mirror):
Mount the Comma 4 and Connect the harness
Next, connect the cable from the car to the harness, and then the harness to the car.
Then mount your Comma 4 on the mount and run the USB-C cable to the dev harness. I routed mine around the mirror bracket and back into the headliner.
Install the xnor fork for the Comma 4
Stock openpilot won’t do anything for you here as it doesn’t support older Tesla vehicles with AP1. The fork that keeps AP1 alive is xnor, maintained by xnor-tech (Lukas Loetkolben on GitHub). Docs on how to get started can be found here: https://wiki.xnor.shop/docs/general/installing_a_fork/
Power on the Comma 4 and wait for the setup screen.
Connect to WiFi
When you get to the software prompt, choose Custom Software (Advanced) instead of the default openpilot build
Unrelated, but whoever at Comma was responsible for the onboard keyboard on the Comma 4 should get a gold star. The second I saw the keyboard I got anxiety that it would be miserable to type the URL in, but the keyboard honestly functions incredibly well for such a small screen. Kudos!
Tap Install — it took about 5-10 mins; was really quick.
The `xnor` branch is the precompiled one and it covers comma four + comma 3X for Tesla Model S/3/X/Y across HW1 through HW4 — HW1 being what we care about for AP1.
There’s also `xnor-dev` at `https://installer.comma.ai/xnor-tech/xnor-dev` which builds from source on the device. It takes considerably longer to install. Unless you have a reason to be on dev, take the precompiled branch.
Setup Comma 4
At this point, I ran through setup and calibration of the Comma 4.
Ideally, you mounted the Comma 4 so you can run through the driver detection mode and pass it on first try. After driver monitoring, you’ll be prompted to run through device calibration, where you drive the car > 15 mph for a little bit of time.
Unlike me, I mounted the Comma 4 blindly after tearing the mirror apart and one thing that later got me is the yaw of the device has to be within ±3.96°. Lucky me, I was off by 0.07 degrees at −4.03° and had to remount the whole thing. As far as I can tell Comma doesn’t seem to have a mounting mode so you kinda have best guess whether or not it’s level on the windshield, but if it’s off, you’ll see a “Unable to calibrate” messages, with no details on what went wrong.
Unrelated, if you have to tear the Comma 4 mounting bracket off, I used a large wide razor blade that you use when scraping items or cleaning windows. Strongly recommend that, trying to pull it off with your fingers is pretty much impossible
At this point, everything should be working. If it is, go ahead and repeat the mirror disassembly steps in reverse to reassemble it.
This is a really brief guide and slightly scattered, but thought I’d post it as I couldn’t find what the mirror pins did and was curious if the original dev harness from Comma could be used as-is (which it looks like it can be! : )
Disclaimer: I am not affiliated with, sponsored, or have any investment in comma ai or openpilot. I’m just some random person that wants to make my car feel like a car of the future again.
Building My Own GPS Stratum-1 Time Server on a Raspberry Pi
Time silently hums away in the background, affecting everything we do today. Wake up, go to work, go to an appointment; all happen at specific times. Computers are no different, constantly logging time in logs, showing time in applications, and used for scheduling. In general, no one really cares about time because it’s typically “accurate enough” for most tasks. Most computers just automatically have the correct time and are accurate down to a second or so, with most people perfectly content that it’s technically approximately right. That being said, I’m neurotic and want nuclear-science-lab accuracy, knowing precisely what time it is.
While pool.ntp.org is a fantastic source of time, why settle when you can have sub-microsecond precision? No one is going to have a good time when you’re technically having a bad time.
For this project, I wanted to see how precise time can be in my house, owning it end to end — no leaning on someone else’s server out on the internet. In the industry, precision time is provided by what are called stratum-1 time servers and can sometimes be thousands of dollars. Given I’m cheap and don’t have a money tree, I decided to build my own stratum-1 time server in a relatively affordable way: a Raspberry Pi that pulls time straight off the GPS satellites overhead and serves it to everything on my LAN, no internet required.
Along the way the project grew a second half, which is to visualize the satellite tracking and time sync. Once I had gpsd and chrony working, I wrote a small daemon that enables a live view of the calculated time, full gpsd + chrony stats, a satellite sky view, and an interactive 3D globe showing the GNSS constellation in space.
chrony instead of ntpd. chrony has native PPS support and a clean socket backend, so you skip the from-source NTP compile entirely.
Current Raspberry Pi OS paths. On Bookworm (and Trixie) the boot config lives at /boot/firmware/config.txt, not the old /boot/config.txt (which is now just a placeholder).
How it all fits together
Before wiring anything up, here’s a quick overview :
The timekeeping path — gpsd reads NMEA + PPS and feeds chrony; chrony disciplines the kernel clock and serves NTP to my network. This is what makes it a stratum-1 server. If you stop reading after Part 6, you’ve got a fully working time server.
The telemetry path — a small daemon written in Rust that reads the same gpsd data plus chrony’s stats and streams them to the dashboard over Server-Sent Events. It’s strictly read-only and has zero effect on timekeeping accuracy.
What you’ll need
Here’s the parts list I used:
Part
Notes
Raspberry Pi 3 or 4
Both work identically here. The Pi 4 has dedicated Gigabit Ethernet; on the Pi 3, Ethernet shares the USB bus, so keep other USB devices off it. The Pi 5 needs different UART steps and isn’t covered.
GPS HAT with PPS
I used the Uputronics Raspberry Pi GPS/RTC Expansion Board, and it’s what this guide is written against. PPS is mandatory for stratum-1; NMEA alone is only good to a few hundred milliseconds.
GPS antenna (active, timing-grade)
Amphenol PCTEL 3978D-HR-DH-W — the exact antenna I used: a weatherproof (IP67) GPS L1 dome antenna with a built-in LNA + filter (~40 dB gain) and a TNC-female connector. A real step up from a puck. Needs a clear-ish view of the sky.
Antenna mounting bracket
Amphenol PCTEL MMK1925 — the stainless-steel L-bracket for the WS397x-series dome (fits the 3978D). This and the antenna above are what I actually mounted.
Antenna coax
A run with the right ends for your antenna and HAT (see the note below). I didn’t spring for timing-grade coax — I used a cheap SMA extension cable like this one and it’s been perfectly fine.
All in all, the project cost ~$240 (inc. shipping, tax, etc). I didn’t include the cost of a raspberry pi since I had one unused from a prior project, but assuming you bought a new Pi; you are ~$360.
Notes before we get started
Check your HAT’s PPS pin. This guide assumes GPIO18 (the Uputronics default). Some HATs (e.g. Adafruit) use GPIO4. Adjust the gpiopin= value accordingly. Guess wrong and PPS will simply never show up.
Antenna connector & bias (if you’re using the dome antenna above). The 3978D outputs TNC female, while most GPS HATs (Uputronics included) use SMA — so plan a coax run with the right ends (TNC-male at the antenna, SMA-male at the HAT) or grab an adapter. It’s an active antenna (built-in LNA), so the HAT has to supply DC bias voltage on the coax; the Uputronics HATs do this, but confirm yours does. Being IP67 and bracket-mounted, it’s meant to live outdoors on a mast with a clear sky view.
You don’t have to mount it outdoors. The 3978D is a weatherproof, IP67, mast-mount dome. It’s built to bolt onto a roof and shrug off the weather. I didn’t put it on a roof. I bolted it to its MMK1925 bracket, set the whole thing up in my attic under asphalt shingles and 5/8″ OSB, and ran it back to the HAT with a cheap SMA extension cable instead of proper timing-grade coax. On paper that’s leaving signal on the table three different ways. In practice it’s been tracking ~16-20 satellites and holding a sub-microsecond lock the entire time. So: buy the better antenna over fancy cable if you are on a limited budget and don’t let “needs a clear view of the sky” scare you into a rooftop install (especially if you are HOA bound and limited to what you can mount outside). An attic on the sky-facing side of the house is likely going to do it for you.
Part 1 — The base OS
Flash Raspberry Pi OS Lite (64-bit) with Raspberry Pi Imager. In the Imager’s advanced settings (the gear icon), enable SSH and set the hostname (I’ll use timeserver for this guide) and locale before writing. Note: this Pi runs headless, which means you don’t have a monitor connected to it, so you want to be able to reach it on first boot.
A word on Bookworm vs Trixie. As of mid-2026 there are active reports of a Trixie serial regression where the GPIO UART stops receiving GPS data on hardware that worked fine on Bookworm (a suspected kernel/PL011 driver issue). For a device whose entire job is reliable time, Bookworm might be the safer choice today; but so far things have worked fine for me. The config paths and overlays are identical — but if NMEA never appears despite correct wiring, jump to the Trixie diagnostic in Troubleshooting. There’s also a Debian 12 vs 13 appendix at the bottom.
Here’s the first “gotcha” the Pi throws at you. The Pi 3/4 wire the good UART (PL011) to the onboard Bluetooth by default. We need that UART for the GPS, and we also need to stop Linux from using the serial port as a login console.
2a. Disable the serial login shell (but keep the hardware port)
sudo raspi-config
Under Interface Options → Serial Port:
login shell accessible over serial? → No
serial port hardware enabled? → Yes
Choose Finish but don’t reboot yet, we’ve got more config to add, and I’d rather reboot once.
2b. Disable Bluetooth to reclaim the UART
sudo vi /boot/firmware/config.txt
New to vi? Here’s the reader’s digest: press i to start typing (insert mode), make your edits, then hit Esc and type :wq followed by Enter to write and quit. If you fat-finger something and want to bail without saving, Esc then :q! throws your changes away. That’s genuinely 90% of what you need to survive vi.
Add this at the end (we’ll drop the PPS line in here too in Part 3, so it’s a single reboot):
# Reclaim the PL011 UART for GPS by disabling onboard Bluetooth
enable_uart=1
dtoverlay=disable-bt
Older guides use dtoverlay=pi3-disable-bt; the current canonical name is just disable-bt. raspi-config may have already added an enable_uart=1 line — a duplicate is harmless, but you can keep just one if it bugs you.
Then stop the Bluetooth-UART service:
sudo systemctl disable hciuart
On a Lite image (and commonly on Trixie) this may report Unit hciuart.service does not exist — and that’s totally fine. It ships with the pi-bluetooth package, which isn’t always installed, and disable-bt already turns Bluetooth off at the device-tree level. The overlay is what actually matters here; this step is just belt-and-suspenders.
Part 3 — Enabling PPS
PPS (pulse-per-second) is the secret sauce. NMEA sentences tell you what second it is; the PPS pulse tells you exactly when that second begins, down to the nanosecond. No PPS, no real stratum-1.
3a. Load the PPS-over-GPIO overlay
Still in /boot/firmware/config.txt, add (adjust gpiopin for your HAT):
# Pulse-Per-Second input on GPIO18
dtoverlay=pps-gpio,gpiopin=18
Then load the kernel module at boot and reboot so both the UART and PPS changes take effect:
echo 'pps-gpio' | sudo tee -a /etc/modules
sudo reboot
3b. Verify raw GPS and PPS
First confirm the UART is on the GPIO header, then read raw NMEA:
Always use /dev/serial0 — it’s a symlink that always points to whichever UART is on the GPIO header, so you don’t have to care whether it’s ttyAMA0 or ttyS0 today. Ctrl-C to stop.
If you see garbled characters instead of clean $GNRMC/$GNGGA lines, don’t panic, that’s a baud-rate mismatch, not a fault. Bytes are flowing; the port’s just reading them at the wrong speed. Set the rate explicitly and re-read until it’s clean:
sudo stty -F /dev/serial0 9600 raw && sudo cat /dev/serial0 # common u-blox default
sudo stty -F /dev/serial0 38400 raw && sudo cat /dev/serial0
sudo stty -F /dev/serial0 115200 raw && sudo cat /dev/serial0 # mine with the Uputronics unit
Write down the rate that produces readable NMEA, you’ll need it for gpsd in Part 4. It’s a property of your GPS module, not the OS. Many u-blox modules use 9600, but others (including some Uputronics units) run at 115200. Mine was 115200.
Now confirm the pulse itself. This needs a satellite fix; most HATs blink a timepulse LED once they’ve locked:
No output usually just means no fix yet, wait a couple mins or try moving the antenna to a different location. If you are running the antenna in a faraday cage, expect no results since it won’t find a satellite.
Part 4 — gpsd
sudo apt install -y gpsd gpsd-clients
sudo vi /etc/default/gpsd
Point it at your HAT (using the baud rate you found in Part 3b):
-n polls the GPS immediately at boot; -s 115200 pins the serial speed so gpsd doesn’t autobaud its way into garbage. Enable and check:
sudo systemctl enable --now gpsd
sudo systemctl restart gpsd # ensure it picks up the new config
gpsmon # or: cgps -s
gpsmon shows the raw feed (fast-scrolling UBX packets are normal and healthy); cgps -s gives a calmer table. You want a 3D fix, satellites with good SNR, low DOP values, and a PPS line with a near-zero offset. That PPS line is the confirmation I was chasing.
Tip: gpsd takes exclusive control of the port. If you want to cat /dev/serial0 again for debugging, stop gpsd first: sudo systemctl stop gpsd gpsd.socket.
Part 5 — chrony with the socket backend
sudo apt install -y chrony
Here’s the key design point, and the reason chrony is such an upgrade over the old ntpd dance: gpsd hands the precise PPS timestamp to chrony through a Unix socket (chrony’s SOCK refclock). gpsd automatically writes to /run/chrony.<device>.sock once chrony has created it — neatly sidestepping the classic headache where chrony drops privileges and can no longer read /dev/pps0 directly.
sudo vi /etc/chrony/chrony.conf
Add this at the end:
# --- GPS + PPS reference clocks -------------------------------------------
# Coarse absolute time from gpsd (NMEA) via shared memory.
# 'noselect' = never sets the clock, only gives the PPS pulse a whole-second
# label. Tune 'offset' after calibration (Part 7d) if PPS won't lock.
refclock SHM 0 refid GPS precision 1e-1 offset 0.0 delay 0.2 noselect
# Precise PPS via gpsd's socket. gpsd writes here automatically.
# 'lock GPS' anchors each pulse to the GPS second above.
refclock SOCK /run/chrony.pps0.sock refid PPS lock GPS prefer
# Serve time to your LAN (adjust to your subnet) and keep serving during
# brief GPS dropouts.
allow 192.168.0.0/24
local stratum 1
# Optional internet fallback if the antenna fails. Remove for air-gapped use.
pool 2.debian.pool.ntp.org iburst
Restart both, in order — chrony first, so its socket exists by the time gpsd starts:
Confirm the socket exists (it should be owned by root and actually be a socket — note the leading s in the permissions):
ls -l /run/chrony.*.sock # expect /run/chrony.pps0.sock
Part 6 — Confirming you’ve actually got a stratum-1 server
Give it 5 minutes to settle, then watch the sources roll in:
watch -n 2 chronyc sources -v
You’re looking for #* next to PPS. The asterisk means it’s the selected source disciplining the clock. It starts at #? (not enough samples yet), climbs its reachability register (0 → 1 → 3 → 7 → 17 → 37 → 77 → 377), then finally promotes to #*. The internet servers drop to ^- (background sanity checks) once PPS takes over. Watching that register tick up is weirdly satisfying:
Look for Stratum : 1, Reference ID … (PPS), and a System time offset down in the sub-microsecond range. That, right there, is a working stratum-1 time server. I may have taken a screenshot.
Reading the numbers:System time / Last offset are your current accuracy (nanoseconds-to-microseconds once locked). RMS offset looks alarming at first (hundreds of µs) because it’s a rolling average still dominated by the noisy warm-up; it falls steadily the longer it runs, so don’t judge it too early. Root delay near zero and Reference ID = PPS confirm a direct hardware lock.
The falseticker trap. chrony will reject PPS if the GPS (NMEA) label is more than ±200 ms off the true second. If PPS stays stuck at #?, that’s almost always the culprit, calibrate the offset (Part 7d).
At this point the time server itself is done. Below is the fun part of visualizing the setup. If you just wanted accurate time, congratulations, you can stop here.
Part 7 — The telemetry daemon
Now to create a live dashboard to visualize everything. The daemon does four things:
Connects to gpsd’s JSON socket on 127.0.0.1:2947 — the same protocol libgps speaks, so I get identical data without any C FFI.
Polls chrony once a second with chronyc -c tracking (the -c flag hands back machine-readable CSV from chrony’s command socket).
Merges both, streams them to the browser over SSE at /data, and serves the dashboard.
(Optional, off by default) fetches and caches the NAVCEN GPS almanac and serves it at /satinfo for satellite-health enrichment (more in Part 8).
sudo apt install -y git
git clone https://github.com/JackStromberg/gps-timeserver-daemon.git
cd gps-timeserver-daemon
ls -al
You should end up with:
gps-timeserver-daemon/
├── Cargo.toml
├── src/main.rs
└── static/index.html # already set to live mode (USE_SIMULATION = false)
7a. Install Rust and build
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh # press Enter for defaults
source "$HOME/.cargo/env"
cargo --version # should print a version
sudo apt install -y build-essential # C linker (Lite images lack it)
cd gps-timeserver-daemon
cargo build --release
cargo: command not found right after installing? The installer can’t modify an already-running shell’s PATH. Run source "$HOME/.cargo/env" (or just open a new terminal). If ls ~/.cargo/bin/cargo doesn’t exist, the install didn’t finish — re-run the curl … | sh line.
error: linker 'cc' not found? Install build-essential (above) and rebuild.
Fair warning: the first build on a Pi is slow. It compiles tokio, axum, reqwest, and the whole rustls TLS stack from scratch (several minutes), and it may look completely frozen at the final link step. That’s normal. Subsequent builds are incremental and quick.
7b. Run it
./target/release/gps-timeserver-daemon
It prints its listen address and stays running (it’s serving, so it won’t hand you back a prompt). Open http://<pi-ip>:8080 from a browser on your LAN and you should see the dashboard light up.
The port is configurable — see Part 8. If 8080 is already taken (a Docker service, say), you’ll get AddrInUse; set a different PORT rather than editing code.
7c. The /data contract
The daemon emits one JSON object per second in this shape (the dashboard reads exactly these field names):
Telemetry::to_json() in src/main.rs is the single source of truth for this contract — if you want to add a field, that’s the one place to touch.
7d. Calibrating the GPS offset (optional)
If PPS refuses to lock, let it run ~15 minutes, then read the measured GPS offset:
chronyc sourcestats
Take the GPS source’s Offset (say +512ms), convert to seconds, and set it as offset on the SHM 0 line in chrony.conf (e.g. offset 0.512). Restart chrony. This nudges the NMEA label back inside the ±200 ms window so PPS gets accepted — the fix for that falseticker trap I mentioned above.
Part 8 — Configuration via environment variables
I wanted to be able to change behavior without recompiling, so the daemon reads a handful of environment variables at startup. Set them when running manually, or via Environment= lines in the systemd unit (Part 9).
Variable
Default
Purpose
PORT
8080
Port to bind (binds 0.0.0.0:PORT).
LISTEN_ADDR
(unset)
Full host:port; overrides PORT. Use 127.0.0.1:8088 to serve only locally, 0.0.0.0:8088 for the LAN.
SATINFO_ENABLED
(off)
1/true/yes/on enables the optional NAVCEN satellite-info fetcher. Off means the daemon makes zero outbound network calls — safe for air-gapped setups.
SATINFO_INTERVAL_HOURS
168 (weekly)
How often to refresh the NAVCEN data. The constellation changes only a few times a year, so weekly (or 720 ≈ monthly) is plenty.
SATINFO_URL
NAVCEN YUMA almanac
Override the source if needed.
The optional satellite-info fetcher
When SATINFO_ENABLED=1, a background task fetches the NAVCEN GPS almanac (US Coast Guard, public-domain US-government data), caches it in memory, and serves it at /satinfo. The dashboard uses it to add live health status to each GPS satellite’s hover tooltip. On failure it retries in an hour; on success it waits the full interval. Left disabled (the default), /satinfo returns {"enabled": false} and the dashboard silently falls back to its built-in reference table — so nothing breaks either way.
Quick checks once you’ve enabled it:
journalctl -u timeserver-dashboard -n 20 --no-pager # look for: satinfo: fetched N satellites
curl -s localhost:8080/satinfo | head -c 300 # expect "enabled":true and a satellites object
On data sources & licensing (not legal advice): NAVCEN is public-domain US-government data — no account, redistribution-safe. The dashboard’s built-in reference table is assembled from public GPS records. If you instead point live mode at CelesTrak, respect their access etiquette (cache; don’t poll more than roughly every 2 hours) and cite them. There’s a fuller Licensing appendix at the bottom.
Part 9 — Running it at boot
I want this thing to just come back on its own after a power blip, so let’s give it a systemd unit:
sudo vi /etc/systemd/system/timeserver-dashboard.service
[Unit]
Description=GPS Timeserver Dashboard
After=network-online.target gpsd.service chrony.service
Wants=network-online.target
[Service]
# Adjust User and paths to where you put the project.
User=pi
WorkingDirectory=/home/pi/gps-timeserver-daemon
ExecStart=/home/pi/gps-timeserver-daemon/target/release/gps-timeserver-daemon
Restart=on-failure
RestartSec=3
# Optional configuration (see Part 8):
Environment=PORT=8088
# Environment=SATINFO_ENABLED=1# Environment=SATINFO_INTERVAL_HOURS=168
[Install]
WantedBy=multi-user.target
WorkingDirectory matters more than it looks. The daemon serves static/index.html relative to where it runs, and systemd does not inherit your shell’s current directory. Point this at the wrong place and you’ll get a 404 for the dashboard.
Enable and verify:
sudo systemctl daemon-reload
sudo systemctl enable --now timeserver-dashboard
systemctl status timeserver-dashboard # expect: active (running)
journalctl -u timeserver-dashboard -n 5 --no-pager # confirm the listen address
Whenever you edit the unit file (say, to change an Environment= line), run sudo systemctl daemon-reloadand thensudo systemctl restart timeserver-dashboard. Skipping the reload is the classic “my change didn’t take” gotcha. systemctl show timeserver-dashboard -p Environment prints what systemd is actually passing, which is handy when you’re sure you fixed it but it disagrees.
One nice quality-of-life note: editing only static/index.html (HTML/CSS/JS) needs no rebuild and no restart — the daemon serves it from disk at request time. Just hard-refresh the browser (Ctrl-Shift-R). Only changes to src/main.rs or Cargo.toml require cargo build --release.
Part 10 — Serving time to the rest of the network
Everything so far only disciplines the Pi’s own clock. To let other machines sync from it, chrony has to answer NTP requests — and it refuses by default, which is a good safety default but not what we want here.
10a. Match the allow line to your LAN
hostname -I # your Pi's IP, e.g. 192.168.1.50
If the Pi is 192.168.1.50, your subnet is likely 192.168.1.0/24. Edit chrony.conf so the allow line matches — a whole subnet (allow 192.168.1.0/24), a single host (allow 192.168.1.100), or allow all only if you deliberately mean to serve the public — then restart:
sudo systemctl restart chrony
10b. Confirm it’s serving
sudo ss -ulnp 'sport = :123' # something should be bound to UDP 123
chronyc clients # machines that have requested time (empty until clients connect)
If you run a firewall on the same Raspberry Pi (ufw, nftables, or Docker-managed iptables), open NTP: sudo ufw allow 123/udp. A plain Lite install has no firewall and needs nothing.
10c. Point your clients at the Pi
Your Pi is stratum 1, so anything syncing to it becomes stratum 2 — perfect for a LAN. Here’s how I pointed a few common clients at it:
Router: set its NTP server to the Pi’s IP — this pushes time locally to every device automatically, using it as an ntp source.
Linux: add server <pi-ip> iburst to /etc/chrony/chrony.conf, restart chrony.
Windows:w32tm /config /manualpeerlist:"<pi-ip>" /syncfromflags:manual /update then w32tm /resync.
macOS: System Settings → General → Date & Time, or sudo sntp -sS <pi-ip>.
Verify from a client with chronyc -h <pi-ip> tracking, sntp <pi-ip>, or ntpdate -q <pi-ip>. Back on the Pi, chronyc clients will list everyone pulling time from you.
Part 11 — Actually using the dashboard
Open http://<pi-ip>:<port> (default 8080, or 8088 in my examples above). Everything updates once per second from the live feed.
Time header. A large clock with millisecond precision, plus GPS time, system time, and the chrony offset. The UTC / Local toggle under the clock switches every time on the page between UTC and your browser’s local zone, and it remembers your choice across reloads.
Orbital globe (the hero panel, and my favorite). A holographic Earth with each GNSS satellite placed in true 3D from its azimuth/elevation, color-coded by constellation, with beams running from the satellites in use down to a marker at your location.
Drag to rotate (mouse or touch): horizontal spins around the poles, vertical tilts.
Home button (top-right) or double-click the globe to glide back to the default view.
Hover a satellite for its details: PRN, constellation, elevation, azimuth, SNR, and whether it’s in the solution — plus, for GPS, catalog facts (block, manufacturer, clock type, launch year, name, SVN) and, if /satinfo is enabled, live health.
Hover a legend entry (GPS/GLONASS/Galileo/BeiDou/SBAS) for a one-line explanation of that constellation.
Status panels. GPS Status, Chrony Status, Position & Navigation, and System Info. Hover any metric label (they’ve got a dotted underline) for an explanation of what it means and what a good value looks like — HDOP, TDOP, EPX/EPY/EPV, the chrony offsets, and so on. I added these mostly so I’d stop having to look them up myself.
Sky view + satellite table. Polar az/el plot, plus a detailed per-satellite table.
Satellite-info modes (dashboard side)
Near the top of the <script> in static/index.html:
SATINFO_MODE — 'daemon' (default; asks this server’s /satinfo, no CORS, falls back to the built-in table if the server has fetching disabled), 'offline' (built-in table only, never fetches), 'celestrak' (fetch CelesTrak directly from the browser; may hit CORS), or 'off'.
The built-in table always supplies block/manufacturer/clock/name/launch; /satinfo adds live health on top.
Previewing with simulated data
static/index.html ships with const USE_SIMULATION = false; (live). To preview the UI without any hardware — say you’re building this on your laptop before the HAT arrives — open a copy with it set to true. It generates fake data (a fixed location, invented satellites, a locked stratum-1 state) so every visual works offline.
Heads up: the globe and all hover tooltips are mouse-based, so the hover interactions won’t appear on touchscreens (dragging the globe still works via touch).
Part 12 — Optional: running the dashboard in Docker
You can containerize the dashboard daemon — but keep gpsd + chrony on the host. The kernel clock is a single host-wide resource; putting chrony in a container means granting it SYS_TIME and steering the host clock across the container boundary — extra layers wrapped around your most timing-sensitive component. The daemon, on the other hand, is a read-only consumer and containerizes cleanly with zero precision impact.
Here’s an example multi-stage Dockerfile:
# Build
FROM rust:1-bookworm AS build
WORKDIR /app
COPY Cargo.toml Cargo.lock* ./
COPY src ./src
RUN cargo build --release
# Runtime
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
chrony ca-certificates && rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=build /app/target/release/gps-timeserver-daemon /usr/local/bin/
COPY static ./static
CMD ["gps-timeserver-daemon"]
Note that chrony is installed here only for its chronyc client (the daemon shells out to it) — the container does not run a chrony daemon. Run it sharing the host network and chrony’s command socket:
--network host lets the daemon reach host gpsd at 127.0.0.1:2947 and keeps PORT/LISTEN_ADDR working normally.
Mounting /run/chrony gives the container’s chronyc access to chrony’s command socket.
You do not need --device=/dev/serial0 or /dev/pps0 here — the daemon never touches the hardware directly; it reads gpsd and chronyc. (Those devices only matter if you were containerizing gpsd/chrony too, which, again, I’d steer you away from.)
Troubleshooting
Here’s a running list of things I’ve stumbled across:
Symptom
Likely cause / fix
cat /dev/serial0 shows nothing
UART not freed. Confirm dtoverlay=disable-bt is in /boot/firmware/config.txt (not /boot/), hciuart disabled, rebooted. Check ls -l /dev/serial0 points to ttyAMA0.
cat /dev/serial0 shows garbled text
Baud-rate mismatch (not a fault). Set the rate with stty -F /dev/serial0 <rate> raw and re-read; use the working rate in gpsd’s -s.
Silent serial on Trixie only, same HW worked on Bookworm
Suspected Trixie UART/PL011 regression. Diagnose: pinctrl poll 14-15 &, then trigger GPS data — if GPIO15 (RX) never changes level, no bytes are reaching the pin (a kernel issue, not your config). Try linux-modules-extra-raspi, pin an older kernel, or fall back to Bookworm.
ppstest prints nothing
No fix yet, or wrong PPS pin. Give it sky view; verify gpiopin= (4 vs 18).
chrony PPS stuck at #?
GPS/NMEA offset > 200 ms → falseticker. Calibrate the SHM 0 offset (Part 7d); make sure /dev/pps0 is in gpsd DEVICES and /run/chrony.pps0.sock exists.
Dashboard “Waiting for data…”
Daemon can’t reach gpsd. Check systemctl status timeserver-dashboard and that gpsd is up on :2947.
Dashboard returns 404
WorkingDirectory in the unit doesn’t point at the project root, so static/index.html isn’t found. Fix the path, daemon-reload, restart.
Daemon exits with AddrInUse
The port’s taken (e.g. Docker on 8080). Set Environment=PORT=8088 (or another free port); sudo ss -ltnp 'sport = :8080' shows the culprit.
/satinfo shows enabled:false
SATINFO_ENABLED not set/true, or daemon-reload skipped after editing the unit. systemctl show … -p Environment to verify.
/satinfoenabled:true but count:0
NAVCEN fetch/parse failed (check the error field and the journal). Network blip → it retries within an hour; persistent → check outbound HTTPS.
cargo: command not found
PATH not loaded: source "$HOME/.cargo/env". If ~/.cargo/bin/cargo is missing, re-run the rustup installer.
cargo build → linker 'cc' not found
sudo apt install -y build-essential, then rebuild.
Clients can’t sync
The allow subnet in chrony.conf has to match your LAN; open UDP/123 if you run a firewall.
Satellites look frozen on the globe
Expected! GPS is MEO (~2 orbits/day) and moves only gradually in az/el; the receiver also updates angles slowly. Check back in 20–30 min and the pattern will have shifted.
What you end up with
So where does all this leave you? Two things:
A stratum-1 NTP server disciplined by GPS + PPS, accurate to the microsecond or better, serving your whole LAN with no internet dependency. Every device on my network now sets its clock from a little box in my attic pulling time straight out of the sky, and I find that quietly delightful.
A live dashboard showing the calculated time, full gpsd + chrony stats with hover explanations, an interactive 3D constellation globe with per-satellite detail, and a sky view — all fed by the same hardware over SSE, with a clean JSON contract you can extend however you like.
If you want to keep tinkering, there are really just two files worth revisiting: src/main.rs (where Telemetry::to_json() defines the data contract) and static/index.html (METRIC_HELP, GPS_SAT_DB, and the render functions). Everything I’d want to customize lives in one of those two places.
If you made it this far, congrats on your new clock! Your clock is now more accurate than it has any reason to be!
Appendix A — Debian 12 (Bookworm) vs Debian 13 (Trixie)
Both work; most steps are identical. I verified everything on Debian 12 & 13 exactly as written above.
Topic
Debian 12 / Bookworm
Debian 13 / Trixie
Boot config path
/boot/firmware/config.txt
Same
disable-bt / pps-gpio overlays
Same
Same
Serial device
/dev/serial0 → ttyAMA0 (always prefer serial0)
Same
systemctl disable hciuart
Usually succeeds
Often Unit … does not exist — harmless
GPIO UART receiving GPS
Reliable
Regression risk (mid-2026): no RX bytes despite correct config. Diagnose with pinctrl poll 14-15; may need linux-modules-extra-raspi, an older kernel, or Bookworm
gpsd / chrony
Stock; config as written
Newer; same config syntax, chronyc -c tracking CSV unchanged
Recommendation
Preferred for a time server
Works, but verify the serial link early
Remember: serial baud rate is a property of your GPS module, not the OS — it’s handled identically on both.
Appendix B — Environment variables (quick reference)
Daemon (systemd Environment= or shell):
Variable
Default
Notes
PORT
8080
Bind port.
LISTEN_ADDR
(unset)
Full host:port; overrides PORT.
SATINFO_ENABLED
off
1/true/yes/on to enable NAVCEN fetch. Off = no outbound calls.
SATINFO_INTERVAL_HOURS
168
Refresh cadence (weekly).
SATINFO_URL
NAVCEN YUMA
Source override.
Dashboard (static/index.html constants):
Constant
Default
Notes
USE_SIMULATION
false
true = fake data for previewing.
SATINFO_MODE
'daemon'
daemon / offline / celestrak / off.
Appendix C — Licensing & data sources
Not legal advice. For personal, non-commercial use you’re clear on all of the below.
GPS orbital/almanac data is US-government, public-domain. NAVCEN (US Coast Guard) serves it with no account and is redistribution-safe — the recommended live source here.
CelesTrak (an alternative live source) redistributes the same government data and adds convenient PRN/block labeling. Respect their access etiquette: cache results and don’t poll more than roughly once every two hours; cite CelesTrak; note that it isn’t an official source. Commercial redistribution is a “contact them first” situation.
The dashboard’s built-in reference table is factual data (which PRN, block, launch year, manufacturer) assembled from public records; facts aren’t copyrightable.
For anything commercial or internet-facing at scale using, review each source’s current terms directly.
I’m in the process on repurposing a few Raspberry Pis and noticed Debian 13 has officially been released (at time of writing), but Raspberry Pi OS is still on Debian 12.
If you’re looking to create a custom Raspberry Pi OS image tailored for headless deployment, this guide walks you through using the official pi-gen tool to build your own image — based on Debian Trixie (Debian 13).
While I’ve tried to write this document in the context of a how-to, it’s more of a reflection on what I did vs something formal.
⚠️ Disclaimer: Since this image is not built or maintained by the Raspberry Pi Foundation, you may encounter compatibility issues, hardware quirks, or missing Raspberry Pi-specific features. Official support for this setup is limited, and it’s best suited for experimentation or advanced use cases. I don’t work for the Raspberry Pi project, so follow at your own risk.
That all being said, here’s what following this page would yield:
Uses the same tool the Raspberry Pi Foundation uses to generate official images
Builds a minimal system similar to Raspberry Pi OS Lite
Builds an Arm64 image (not 32-bit)
Has SSH enabled
Supports customization of locale, timezone, and user credentials
✅ Why Build Your Own Image?
You may want a custom image when:
You need headless deployment out of the box (no keyboard/mouse/monitor)
You want SSH access enabled by default
You want to preconfigure locales or packages for embedded or production use
🔧 Prerequisites
To follow this guide, it assumes usage of a few linux utilities / command. It assumes you are using and have available:
A macOS (Apple Silicon) or Linux machine
git, docker, and optionally qemu-user-static (only needed for x86)
~10–20GB of free disk space
🧰 Step 1: Clone pi-gen
git clone --branch arm64 https://github.com/RPi-Distro/pi-gen.git
cd pi-gen
From the docs at time of this article:
Note: 32 bit images should be built from the master branch. 64 bit images should be built from the arm64 branch.
Tip: They have different branches based on debian OS version you want to target.
🧾 Step 2: Create the config File
You can define a file to customize that tells the image how to be customized out of box. Since we are a headless setup, we don’t want to have to connect a monitor, keyboard, mouse, etc; so this file will define how the operating system should be customized on first startup.
Inside the pi-gen directory, create a file named config:
touch config
Then edit it with your preferred editor (nano, vim, VSCode, etc.):
Example config File
# Debian release to build (note, you should target the applicable branch when changing releases)
RELEASE=trixie
# Name of the image
IMG_NAME="raspios-trixie-arm64"
# Build 64-bit image
ARCH=arm64
# Enable SSH by default
ENABLE_SSH=1
# Set default username and password
FIRST_USER_NAME="pi"
FIRST_USER_PASS="raspberry"
# Don't compress the image – output raw .img file
DEPLOY_COMPRESSION=none
# Set timezone to UTC+0
TIMEZONE_DEFAULT="Etc/UTC"
# Don't use QEMU (set to 1 if not on Arm based architecture)
USE_QEMU=0
🌍 Locales, Keyboard, and Timezone
To change the system locale or timezone, you can add these optional variables:
Run through the build stages (stage0 to stage2 (assuming you created the skips))
Output a raw .img file(s) in the deploy/ folder
Example output without skip
copying log from container pigen_work to deploy/
total 35235816
drwxr-xr-x 10 jack staff 320B Sep 6 11:58 .
drwxr-xr-x 23 jack staff 736B Sep 6 11:57 ..
-rw-r--r-- 1 jack staff 8.3G Sep 6 11:57 2025-09-06-raspios-trixie-arm64-full.img
-rw-r--r-- 1 jack staff 245K Sep 6 11:57 2025-09-06-raspios-trixie-arm64-full.info
-rw-r--r-- 1 jack staff 2.6G Sep 6 11:56 2025-09-06-raspios-trixie-arm64-lite.img
-rw-r--r-- 1 jack staff 76K Sep 6 11:56 2025-09-06-raspios-trixie-arm64-lite.info
-rw-r--r-- 1 jack staff 5.8G Sep 6 11:56 2025-09-06-raspios-trixie-arm64.img
-rw-r--r-- 1 jack staff 213K Sep 6 11:56 2025-09-06-raspios-trixie-arm64.info
-rw-r--r-- 1 jack staff 1.0M Sep 6 11:58 build-docker.log
-rw-r--r-- 1 jack staff 10K Sep 6 11:57 build.log
Example output with the skip files
copying results from deploy/
copying log from container pigen_work to deploy/
total 5525296
drwxr-xr-x 6 jack staff 192B Sep 6 12:03 .
drwxr-xr-x 23 jack staff 736B Sep 6 12:03 ..
-rw-r--r-- 1 jack staff 2.6G Sep 6 12:03 2025-09-06-raspios-trixie-arm64-lite.img
-rw-r--r-- 1 jack staff 76K Sep 6 12:03 2025-09-06-raspios-trixie-arm64-lite.info
-rw-r--r-- 1 jack staff 308K Sep 6 12:03 build-docker.log
-rw-r--r-- 1 jack staff 5.8K Sep 6 12:03 build.log
💾 Step 4: Flash the Image to SD Card
After the build completes, write the image to an SD card. You can do this via command line or via the official Raspberry Pi Imager.
WARNING: make absolutely sure if you use the commands below you do not target the wrong disk. These commands can result in data loss. You do not hold me liable for data loss if using this approach!
⚠️ Replace /dev/rdisk5 with the correct device for your SD card.
🔌 Step 5: Boot the Pi
Insert the SD card into your Pi
Connect an Ethernet cable
Power on the Pi
You should:
See the Pi boot
Get a login prompt (no GUI)
Be able to SSH in using the IP address assigned via DHCP
🧩 Optional: Add SSH Key or Preseed Files
You can also preconfigure:
Your SSH public key
A custom hostname
Static IP
Additional packages
Let me know if you want a follow-up post for those.
✅ Recap
Feature
Configured?
Debian Version
✅ Trixie (Debian 13)
SSH Enabled
✅ Yes
GUI/Desktop
❌ No
Output Format
✅ Raw .img
Build Host
✅ Apple Silicon (no QEMU)
Locale / Timezone
✅ UTC (editable)
🧭 Conclusion
By using pi-gen, you’re following the official image-building process used by the Raspberry Pi Foundation — but with full control over your system. This process can also be used for embedded projects, production environments, or anyone who needs a tightly configured headless system.
I recently purchased a ratgdo device to replace MyQ’s kit for a local non-cloud dependent solution. ratgdo offers homekit, mqtt, and Control4, Nice/Elan, or Crestron integration. For this tutorial, I’m going to cover ratgdo and MQTT integration.
If you run Home Assistant as-is or are using their hardware, you can easily setup an MQTT broker by navigating to Add-Ons and installing the MQTT Broker, however in the past I have written articles on Home Assistant and Z-Wave JS as separate containers, so I wanted to follow the same concept by running the MQTT broker as a container as well.
Across the board, the consensus seems to be that most people are running Mosquitto as an MQTT broker, so here is how you can get that setup as a container.
Download the docker image for Mosquitto
docker pull eclipse-mosquitto
2. Create directories for Mosquitto’s config and data files. If desired, you can create one for logs as well, but I’m ok not persisting that.
3. Create a configuration file for mosquitto. This file will configure what ports MQTT data should be listed on as well as its corresponding port for receiving data via WebSocket. In addition, we will define where data should be stored, and require authentication to be able to connect. For now, leave the password file, which contains the username/password combo for who can authenticate.
vi /home/docker/mosquitto/config/mosquitto.conf
Press i to enter insert mode and paste the following:
6. Use the mosquitto_passwd utility to generate an encrypted username and password. An ask for the password will prompt once you run the command. Type exit to return back to your local terminal.
One thing that is a bummer is Exchange online does not support setting an autoreply / out of office message for a distribution list. Usually if you want such functionality, you’d convert the distribution list to a shared mailbox and configure the autoreply or use a 3rd party utility, or potentially come up with some complex transform rule.
Solution
One workaround you can apply is to enable out of office / autoreply messages from recipients in the distribution list. By default, Exchange Online will suppress autoreply messages when going to a distribution list, but you can quickly configure the behavior to allow the messages per distribution list.
Steps
Install Exchange Online PowerShell module
Open PowerShell as an administrator and execute the following command: Install-Module exchangeonlinemanagement
Configure the distribution list to allow the out of office / autoreply messages to be returned to the sender / originator. Set-DistributionGroup -identity [email protected] -SendOofMessageToOriginatorEnabled $true
Result
Now when someone emails the distribution list, they will receive an out of office / autoreply if configured by an individual member. Note, if multiple members have the autoreply configured, the sender/originator will receive multiple replies.
You can generate large files for testing on both Linux and Windows machines without having to leverage a 3rd party utility.
Windows
In Windows, you can use the fsutil utility to create a new file with a defined number of bytes. In this case, the following command will generate a 1 GB file. The contents of the file will consist of spaces.
In Linux, you can use the dd utility. In this case, this command will create a 1 GB file filled with 0s. The bs parameter is the block size and count is the number of blocks to create.
Fighting spam can be tricky. In addition to SPF records, DKIM is nearly mandatory to help prevent sent emails from being classified as spam. Beginning February of 2024, both Google and Yahoo will require DMARC, which require either SPF or DKIM; and in some cases for a high volume of emails (5,000+), both.
In this tutorial, we will look at signed outbound messages with DKIM via use of the open source project OpenDKIM. If you followed my previous tutorial on Postfix + Dovecot + Mysql/MaraiDB, you may have multiple domain names, so this guide will assume you will want to configure separate DKIM keys for each domain name you are hosting.
Step 1: Install OpenDKIM
First, update packages for your distribution.
sudo apt-get update && sudo apt-get upgrade
Install OpenDKIM and OpenDKIM tools. OpenDKIM-tools has a utility to generate the keys we will use.
sudo apt-get install opendkim opendkim-tools
Step 2: Created trusted hosts configuration file for OpenDKIM
First, create a file that OpenDKIM will use that defines the trusted hosts that can send messages.
sudo mkdir /etc/opendkim
sudo vi /etc/opendkim/TrustedHosts
Add the IP addresses and fqdn of the server sending messages by typing i to change into insert mode in vi.
127.0.0.1
localhost
192.168.1.2
mail.mydomain.com
Type :wq to commit the changes in vi.
Step 3: Modify OpenDKIM configuration file
Modify the opendkim.conf configuration file
sudo vi /etc/opendkim.conf
Search for #Canonicalization simple and uncomment the line by removing the # symbol.
Search for #Mode and remove the # symbol to uncomment the line. Ensure the line is configured with s for signing outbound emails or sv for verifying dkim keys on sent and received emails.
If you have subdomains, search for #SubDomains and remove the # and change to yes. For example:
SubDomains yes
Search for Socket local:/var/run/opendkim/opendkim.sock and comment the line by adding a # in front of the line.
Search for #Socket inet:8891t@localhost and uncomment the line. If the line does not exist in your document, then add the following at the end of your document.
Socket inet:8891@localhost
Next, add the following lines to reference our DKIM configurations for each domain:
Run the following command to create a new folder and change directory to it for where we will generate our key used to sign the outgoing emails.
sudo mkdir -p /etc/opendkim/keys/mydomain.com
cd /etc/opendkim/keys/mydomain.com
Execute the following command to generate the key:
sudo opendkim-genkey -r -d mydomain.com
Delegate access to the opendkim user and group to access the key (note, if you modified the user in your opendkim.conf file, you will want to use that instead)
sudo chown opendkim:opendkim default.private
Step 7: Reference the key via OpenDKIM KeyTable
Modify the Keytable with vi
sudo vi /etc/opendkim/KeyTable
Add the following line to the file to define your selector. In this example, we will call the selector default, but if your domain requires multiple DKIM keys, ensure you make this unique. You can modify the file by pressing i to enter insert mode in vi:
Create a new TXT record within your nameservers and specify the value between the quotes (don’t include the quotes). I.e.:
v=DKIM1; h=sha256; k=rsa; s=email; p=ABCDEFG.....
Note: I choose to update DNS last as once you update DNS, any servers that would receive mail before you apply the previous configuration may discard your emails. Then again, you didn’t have DKIM before, so you were probably going to junk mail anyways ;^)
This is going to be a quick tutorial, but here’s a quick way to generate a root certificate, server certificate, and bundle them together via pfx file. This can be useful to validate scenarios where a certificate chain is required. For this tutorial, we’ll be using the openssl utility, which can be freely downloaded here: Win32/Win64 OpenSSL Installer for Windows – Shining Light Productions (slproweb.com)
Generate the Root Certificate
Execute the following command to generate a key for the root certificate:
Execute the following command to generate a certificate signing request. Note: During this step, you will be prompted to specify several certificate attributes; for the common name, you can specify the name you’d like as the issuer (i.e. MyCorp)
Execute the following to generate the public certificate. During this step, you’ll specify the validity of the root certificate (you may want this to be longer than 365 days as the root).
Execute the following command to generate a certificate signing request. Note: During this step, you will be prompted to specify several certificate attributes; for the common name, specify the FQDN to your server. You do not need to start the value of the common name with CN=
Execute the following command to generate the public certificate for the server certificate. During this step, you’ll specify the validity of the server certificate. Generally speaking, the validity of this certificate would be much shorter than your root.
Optionally, you can verify the issuer or expiry dates of the server certificate is correct via the following command:
openssl x509 -in server-cert.crt -text -noout
Generate PFX from Root and Server certificate
Execute the following command to generate a PFX file containing the public and private keys of the server certificate as well as public key of the root certificate. Note, you will be prompted for a password for the PFX file, which can increase security when needing to move these sensitive files around.
One of the side projects I have is rebroadcasting local ATC (Air Traffic Control) audio from my local airport to LiveATC.net. I previously had an RTL-SDR dongle connected to a RaspberryPi 1 Model B, which then rebroadcasted to LiveATC via IceCast. While I’ve had success the past few years broadcasting, overhead plans were really the only thing that was clear; being distant from the airport, receiving broadcasts from the tower were a slim to none at best.
In doing a bit of research I settled on purchasing a SDRplay RSPduo and Raspberry Pi 4, which seems to help with noise. Pairing the SDRplay with the newest version of RTLSDR-Airplay, I was able to achieve much clearer audio/hear things I couldn’t before. While I’m using the SDRplay RSPduo, this guide can be used for their other devices such as the Rsp1a and RSPdx as well (likely others as this guide ages). Here’s a reflection on how I got things setup.
Update Raspbian packages
First, update your Linux packages to latest version. I’m running the latest version of Raspbian / Debian.
sudo apt-get update && sudo apt-get upgrade
Disable WiFi/Bluetooth
This is optional, but I figured I’d disable the radios on the RaspberryPi to further mitigate as much possible noise as possible. First, you can disable both radios by editing /boot/config.txt via the vi text editor (this can actually be configured by placing this file on your SD-Card you attach to your Raspberry Pi during first-time boot). Official details on the boot overlays can be found here.
sudo vi /boot/config.txt
Once in vi, press i to insert the following lines:
dtoverlay=disable-bt
dtoverlay=disable-wifi
Press the escape key and then type :wq to write the changes to the file and exit vi.
Lastly, execute the following command to disable the UART bluetooth service.
sudo systemctl disable hciuart
Download & Install RSP Control Library + Driver
First, you will want to grab the latest SDRplay Drivers and Libraries. You can do this by navigating to SDRplay’s website and selecting RSPduo and ARM Raspberry Pi OS for the download. Then click the API button. Now this is kinda difficult if you are SSHed into the Pi, so I’d find the latest version from their website and then use the following commands below to remotely download the software (substituting in the version number to grab the latest download) and install it and reboot after install (rebooting after installation is strongly recommended).
Execute the following commands:
# Navigate to home directory
cd ~
# Download latest API Library + Driver
wget https://www.sdrplay.com/software/SDRplay_RSP_API-Linux-3.15.2.run
# Provide execution rights to install the software
chmod a+x SDRplay_RSP_API-Linux-3.15.2.run
# Run the installer
sudo ./SDRplay_RSP_API-Linux-3.15.2.run
# Reboot the machine
sudo reboot now
Build and install SoapySDR from source
In this section, we need to install SoapySDR which is a vendor and platform neutral SDR support library. Essentially this means that instead of needing a bunch of developers to write integrations into all the different SDRs, other software can leverage these interfaces to skip worrying about device compatibility and focus on what the application needs to do. As we’ll see later, RTLSDR-Airband does exactly this to provide support for tons of different SDRs. Kudos to the PothosWare team for enabling developers all over the world to build all sorts of SDR projects!
So, to get this installed, we need to clone the source code from their GitHub repo and compile the project. Official documentation on this process can be found on their wiki, but I’m going to try and simplify everything here.
Since Raspberry Pi doesn’t come with Git, I am going to use wget and unzip to do this, but if you don’t mind installing Git, that’d be the easier way to “clone” down the latest source code from GitHub (make sure you replace versions where appropriate, at time of writing this, 0.8.1 is the latest version).
# Install dependencies needed to build this project
sudo apt-get install cmake g++ libpython-dev python-numpy swig
# Make sure we are back in our home directory
cd ~
# Grab latest tarball from GitHub
wget -O soapy-sdr-0.8.1.tar.gz https://github.com/pothosware/SoapySDR/archive/soapy-sdr-0.8.1.tar.gz
# Extract the tarball (this is like unzipping a .zip on Windows)
tar xvfz soapy-sdr-0.8.1.tar.gz
# Change directories into the new SoapSDR folder
cd SoapySDR-soapy-sdr-0.8.1
# Make a new folder called build
mkdir build
# Change directories into the build folder
cd build
# Execute cmake build automation
cmake ..
# Make installer (-j4 parameter increases build threads to make compilation quicker)
make -j4
# Make the installer copy files to right locations
sudo make install
sudo ldconfig #needed on debian systems
# Navigate back to home directory
cd ~
# Delete the SoapySDR folder since we are done with it
sudo rm -R SoapySDR-soapy-sdr-0.8.1
At this point, you should be able to execute the SoapySDRUtil command and see the version you installed.
SoapySDRUtil --info
You should get something like this (note: you will likely see a missing module; that’s ok for right now!):
Build and install SoapySDR Play module from source
Now that we have SoapySDR installed, we need to install the module to allow it to control the SDRplay device. Similiar to SoapySDR install, we’ll pull down the latest files from the SoapySDR Play Module GitHub repo, build the installer, execute it, and verify that all went well. Official instructions can be found on their wiki as well.
# Make sure we are back in our home directory
cd ~
# Grab latest tarball from GitHub
wget -O SoapySDRPlay.zip https://github.com/pothosware/SoapySDRPlay3/archive/refs/heads/master.zip
# Unzip the archive
unzip SoapySDRPlay.zip
# Change directories into the new SoapSDR folder
cd SoapySDRPlay3-master
# Make a new folder called build
mkdir build
# Change directories into the build folder
cd build
# Execute cmake build automation
cmake ..
# Make installer
make
# Make the installer copy files to right locations
sudo make install
sudo ldconfig #needed on debian systems
# Navigate back to home directory
cd ~
# Delete the SoapySDR folder since we are done with it
rm -R SoapySDRPlay3-master
Plug in SDRplay RSPduo device and verify we see it
If you haven’t already, go ahead and plug in your SDRplay RSPduo. Next, let’s verify we see it using the SopaySDRUtil command.
SoapySDRUtil --probe="driver=sdrplay"
You should see something like this and you should see your device and hardware version (note the hardware hardware= value as you may need that later). In addition, one thing that is neat about the RSPduo is there are multiple tuners/antennas. You will be able to see these values in the probe output. Once you enable RTLSDR-Airplay, you’ll notice active antennas are removed from the list of available devices.
RTLSDR-Airband is an open source project that allows you to receive analog radio voice channels and produce audio streams which can be routed to various outputs, such as online streaming via Icecast server, PulseAudio server, Audio file, or Raw I/Q file. In our case, we are going to stream to an Icecast server in this example.
Similar to our previous section in SoapySDR, we need to download the latest source code, build and install RTLSDR, and then modify the configuration file. Official documentation can be found on the RTLSDR-Airplay GitHub Wiki.
# Install RTLSDR-Airplay dependencies
sudo apt-get install build-essential cmake pkg-config libmp3lame-dev libshout3-dev 'libconfig++-dev' libraspberrypi-dev libfftw3-dev
# Navigate back to our home directory
cd ~
# Download the latest source from GitHub
wget -O v5.1.1.tar.gz https://github.com/rtl-airband/RTLSDR-Airband/archive/refs/tags/v5.1.1.tar.gz
# Extract the tarball
tar xvfzv5.1.1.tar.gz
# Change directory into the RTLSDR-Airband folder
cd RTLSDR-Airband-5.1.1
mkdir build
cd build
cmake ../
make
# Install the program
sudo make install
Configure RTLSDR-Airband
For my particular setup, I want to stream to an external icecast server. To do that, I recommend creating a backup of the default configuration file (as a backup).
# Rename the original config file as a backup
sudo mv /usr/local/etc/rtl_airband.conf /usr/local/etc/rtl_airband.conf.bak
Next, we can create a new configuration file with the proper configuration. Execute the following command to open vi.
sudo vi /usr/local/etc/rtl_airband.conf
Press i to go into insert mode and paste the following (replacing the values applicable to your environment; you may want to change the name of the stream, authentication parameters, and gain”). Also, note that we are using the first Antenna and specifying the hardware version of RSPduo from the previous step where we probed the SDRplay device (if you have a different SDRplay device, substitute that value accordingly).
From their wiki: you will see simple text waterfalls, one per each configured channel. This is an example for three devices running in multichannel mode. The meaning of the fields is as follows:
The number at the top of each waterfall is the channel frequency. When running in scan mode, this will be the first one from the list of frequencies to scan.
The number before the forward slash is the current signal level
The number after the forward slash is the current noise level estimate.
If there is an asterisk * after the second number, it means the squelch is currently open.
If there is a > or < character after the second number, it means AFC has been configured and is currently correcting the frequency in the respective direction.
Execute the following command to start running in foreground mode:
# Test in foreground mode
/usr/local/bin/rtl_airband -f
Press Cntrl+C to break out of the stream once you are satisfied with your testing.
Enable RTLSDR-Airband to autostart
To enable RTLSDR-Airband to automatically start up each time your Raspberry Pi is rebooted, you can execute the following commands from within the RTLSDR-Airband directory.
TLDR: I wanted to control the light on Big Ass Fans’ Haiku fan via physical wall switch, so this tutorial is going to go over how to pair a smart switch with Home Assistant software to provide a traditional light switch experience. Skip down to Setting up the wall switch to start if you want to skip my ramblings.
Here’s a YouTube video if you don’t like to read:
Longer story
In the background of many commercial buildings, silently lurking and judging us from above, lies what looks like possibly a recycled helicopter blade. Don’t be fooled, these blades are no helicopter blade, they are years of engineered excellence in the makings. The company prides themselves on solid engineering and building a solid product for their customers. They are called Big Ass Fans.
For quite some time I’ve been eyeing their Haiku fan, which is their residential ceiling fan. Their fans look incredibly modern, operate almost completely silent, have a “SenseMe” feature that figures out when people are in the room to automatically do stuff, and they have an API that you can integrate into locally on the fan via WiFi (lose internet, no problem, you can still control your fan!). One of my biggest “beefs” with today’s companies is they try to make things really proprietary and crappy, so seeing the company that takes pride in their product and allowing others to integrate into it remotely without internet is super “cool” 😉
You spin me right round
The fan itself is smart… too smart
One thing that’s really interesting, is when you hook up the fan, to me, it’s designed more like their commercial units where it needs to be constantly powered on; from there you remotely control the fan either by remote or their smart phone application. Both the remote and even the mobile app, work incredibly well and are extremely responsive, but the only tricky thing about the fan is in a residential setting, many folks have light/fan combos in their bedrooms, offices, and living rooms and if a guest walks into the room and flips the light switch, they are flipping power to the whole fan/light.
So….?
In many commercial settings, fans you typically set once and let em’ rip, but with the residential play, you have grandparents, guests, friends, etc. that may come over. Since the remote is there, they go, how do I turn the lights on to this room? Unfortunately, there isn’t a good answer here other than to put a plate on the wall and force your guests to check out the remote.
I personally find the remote a hassle since I have a small little corridor into one room, so when it’s darker in the evenings, you grab the remote on the wall, walk through this dark area, and then aim the remote somewhere at the ceiling to turn it on (this is if you don’t forget the remote in the room from before).
So…?
I am a “big fan” of having a smart home, but I want it to be super intuitive to the end user. I design everything to be used as if my grandparent is over and they have no idea what the heck is going on. In this case, I leveraged an open source project called Home Assistant and a Leviton Z-Wave switch to do the magic of controlling the fan like any other fan you’d buy at a big box store. More specifically, I really just needed to control the light on the fan, so this tutorial is going to go over how to control the light from the fan via the switch.
Setting up the wall switch
The first thing you’ll need is a smart switch. It can be WiFi, Z-Wave, ZigBee, etc; it doesn’t matter specifically what brand (odds are, it’ll be compatible (here’s the official list)), but you’ll need a switch that allows you to control it via the computer or your phone. I used a dimmer switch specifically as the light on the Haiku allows several different levels of brightness.
Once you have the switch, what you’ll want to do is wire up the fan so it constantly has power and also give power the switch. This does two things: 1) it allows the fan to be powered on regardless if your guest turns the light switch on/off 2) it allows the light switch to stay powered on so you use that to talk to your fan. Here’s an example of how I wired my Leviton Z-Wave switch.
Here you can see I don’t have anything connected to the red pin, or load. Typically, you’d have this connect back to the fans lights to turn them on/off, but the Haiku fan isn’t wired like that.
On this side, you can see we only have the negative wire connected. It’s hard to see, but in the box, I have all my neutral and negative wires capped together, which offers power to the fan 100% of the time, regardless of what this switch is doing.
Once you have the switch wired up and ready to go, it should literally do nothing when you turn it on/off, but your fan should stay on all the time.
Setting up Home Assistant Automation
This guide won’t go into installing / setting up Home Assistant, rather more so around the automation scripts needed to get this all working. If you are interested in learning more about Home Assistant, you can check out their website here and I have a blog post on how to deploy Home Assistant on a Raspberry Pi here.
To get this working, you will need a couple of things:
Add your smart switch to Home Assistant
Install HACS
Install Haiku SenseMe Integration
Add two automation scripts
One to control light on/off events
One to control light brightness events
Add your smart switch
I won’t go into details here too much since every switch will have a separate way to install (Z-Wave vs WiFi vs Zigbee for example), but here is a nice YouTube video on how to get things going (https://youtu.be/FtWFSuMdiSQ?t=353).
HACS
If you have used Home Assistant, it comes with many different native integrations out of the box. Unfortunately, many integrations are developed so quickly the HA (Home Assistant) team doesn’t have time to vet them all, so they end up being maintained by the community. HACS helps install these integrations, so I’d recommend installing this.
Step-by-Step documentation on installation can be found here: Prerequisites | HACS
Haiku Integration
A few much smarter folks wrote up an integration for the Haiku fan called SenseME, which we need to install. Once HACS is installed, you can search for the integration via HACS and install the integration. Copied from their integration, here is how to install the integration:
Go to Configuration -> Integrations.
Click on the + ADD INTEGRATION button in the bottom right corner.
Search for and select the SenseME integration.
If any devices are discovered you will see the dialog below. Select a discovered device and click Submit and you are done. If you would prefer to add a device by IP address select that option, click Submit, and you will be presented with the dialog in step 5.
If no devices were discovered or you selected the IP Address option the dialog below is presented. Here you can type in an IP address of undiscoverable devices.
Repeat these steps for each device you wish to add.
Once configuration is completed, you should see an entity for your fan listed that looks something like this.
On/Off Automation
This automation will first control On/Off behavior from your light switch.
Go to Configuration -> Automations.
Click on the + ADD Automation button in the bottom right corner.
Click the START WITH AN EMPTY AUTOMATION button
Click on the three dots in the top right corner and click Edit in YAML
5. Paste the following code; make sure you edit the names of each of your light switch entities (one for your fan light and one for the light switch on the wall): light.your_light (the light for your wall) and light.fan_light (the light on the Haiku fan).
alias: Turn On/Off Haiku Fan/Wall Switch
description: ''
trigger:
- platform: state
entity_id: light.your_light, light.fan_light
from: 'off'
to: 'on'
- platform: state
from: 'on'
to: 'off'
entity_id: light.your_light, light.fan_light
condition: []
action:
- service: light.turn_{{ trigger.to_state.state }}
data:
entity_id: |-
{% if trigger.entity_id == 'light.your_light' %}
light.fan_light
{% elif trigger.entity_id == 'light.fan_light' %}
light.your_light
{% endif %}
mode: single
6. Click the SAVE button
Brightness Automation
This automation will first control On/Off behavior from your light switch.
Go to Configuration -> Automations.
Click on the + ADD Automation button in the bottom right corner.
Click the START WITH AN EMPTY AUTOMATION button
Click on the three dots in the top right corner and click Edit in YAML
Paste the following code; make sure you edit the names of each of your light switch entities (one for your fan light and one for the light switch on the wall): light.your_light (the light for your wall) and light.fan_light (the light on the Haiku fan).
At this point, whether you use your remote or the light switch, your lights should be in sync! Use the remote or the wall switch to the turn on/off the lights. Try using the switch to dim and it should adjust the brightness of the light (note: there may be a tiny delay after you make changes to the dimmer value as there’s a 2second delay in the automation, which prevents the lights from going wonky).
Conclusion
Through the use of Home Assistant + any smart switch, we can easily control the Haiku fan with physical nobs and dials. While this tutorial only covers controlling the fan’s light via a switch, the same principals can be used to add a second switch to control the fan speed.
For those that like physical knobs and dials to control your devices, hope this was helpful!