Simplify neverssl FAQ entry - #328
Conversation
Simplify neverssl FAQ guidance
shunkakinoki
added
the
codex
ChatGPT Codex Connector
📝 WalkthroughSummary by CodeRabbitRelease Notes
WalkthroughAdds documentation and a new Home Manager service module for keeping captive portal sessions alive. The module provides a systemd user service and timer that periodically pings neverssl.com to prevent session expiration on private networks. Changes
Sequence DiagramsequenceDiagram
participant Timer as systemd Timer<br/>(neverssl-keepalive)
participant Service as systemd Service<br/>(neverssl-keepalive)
participant Script as Shell Script<br/>(neverssl-keepalive)
participant Remote as neverssl.com
Timer->>Timer: OnBootSec 3s
Timer->>Service: Trigger neverssl-keepalive.service
Service->>Script: ExecStart
Script->>Remote: curl http://neverssl.com
alt Request succeeds
Remote-->>Script: HTTP response
Script-->>Service: Exit 0
else Request fails
Script-->>Service: Exit 0 (intentional)
end
Service-->>Timer: Service complete
Timer->>Timer: OnUnitActiveSec 3s (reschedule)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new feature to help users maintain active captive portal sessions by periodically pinging Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRSimplified the neverssl FAQ entry by condensing it to focus on essential automation options. What changed?The neverssl captive portal FAQ entry was condensed to highlight essential automation options. (File summaries were not provided for detailed changes.) Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a helpful feature to keep captive portal sessions alive using neverssl.com, including a new FAQ entry and a home-manager service. The implementation is solid. I've offered a couple of suggestions to enhance the clarity of the documentation and simplify the keepalive script for better readability and consistency.
|
|
||
| For more details, see [nix-darwin issue #789](https://github.com/LnL7/nix-darwin/issues/789). | ||
|
|
||
| ## Auto renew neverssl on private wifi |
There was a problem hiding this comment.
The title "Auto renew neverssl on private wifi" could be misleading. Captive portals are most common on public Wi-Fi networks (e.g., airports, hotels), not private ones. Using a more general title would better reflect the feature's purpose.
| ## Auto renew neverssl on private wifi | |
| ## Keep captive portal sessions alive using neverssl |
| set -euo pipefail | ||
| if ! curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1; then | ||
| exit 0 | ||
| fi |
There was a problem hiding this comment.
The shell script logic can be simplified. The current if statement to handle the curl exit code is a bit verbose. You can achieve the same result more concisely by using || true, which also aligns with the command suggested in FAQ.md for cron.
set -uo pipefail
curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1 || true
There was a problem hiding this comment.
Pull Request Overview
This PR adds a neverssl-keepalive service to automatically maintain captive portal sessions by periodically sending HTTP requests to neverssl.com. The implementation uses systemd user services and timers for Linux environments.
- Implements a systemd user service that pings neverssl.com every 3 seconds
- Integrates the new service into the home-manager services module
- Adds FAQ documentation with setup instructions for various platforms
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| home-manager/services/neverssl-keepalive/default.nix | Defines systemd service and timer for captive portal keepalive |
| home-manager/services/default.nix | Imports and exports the new neverssl-keepalive service |
| FAQ.md | Documents usage and configuration for the neverssl keepalive feature |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| OnBootSec = "3s"; | ||
| OnUnitActiveSec = "3s"; |
There was a problem hiding this comment.
The 3-second interval is extremely aggressive and will generate ~28,800 HTTP requests per day. This could unnecessarily consume network bandwidth and battery on mobile devices. Consider increasing the interval to at least 30-60 seconds, which is typically sufficient for captive portal keepalive while being much more resource-friendly (reducing requests to ~2,880 per day at 30s intervals).
| OnBootSec = "3s"; | |
| OnUnitActiveSec = "3s"; | |
| OnBootSec = "30s"; | |
| OnUnitActiveSec = "30s"; |
| { pkgs }: | ||
| let | ||
| keepaliveScript = pkgs.writeShellApplication { |
There was a problem hiding this comment.
The service uses systemd which is Linux-specific, but unlike other services in this codebase (code-syncer, ollama), there's no platform check using pkgs.lib.mkIf pkgs.stdenv.isLinux. This will cause issues on macOS systems. Consider wrapping the entire configuration with a platform check or updating the return value structure to handle both platforms.
| OnBootSec = "3s"; | ||
| OnUnitActiveSec = "3s"; | ||
| AccuracySec = "1s"; | ||
| Unit = "neverssl-keepalive.service"; |
There was a problem hiding this comment.
The Timer.Unit field is redundant in systemd timers. By default, a timer automatically activates a service with the same name (minus the .timer suffix). This line can be safely removed as neverssl-keepalive.timer will automatically trigger neverssl-keepalive.service.
| Unit = "neverssl-keepalive.service"; |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
home-manager/services/neverssl-keepalive/default.nix (2)
3-12: Consider adding a comment explaining the failure handling.The
exit 0on curl failure is intentional (preventing systemd from marking the service as failed when the network is unavailable), but this logic may confuse future maintainers.Apply this diff to add clarity:
text = '' set -euo pipefail + # Exit successfully even on curl failure to avoid systemd errors during network issues if ! curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1; then exit 0 fi
32-33: Consider a less aggressive interval.A 3-second interval generates ~28,800 requests per day. Most captive portals maintain sessions for minutes, so 30-60 second intervals would typically suffice while reducing network traffic and power consumption.
If you want to keep the 3-second default, consider this diff:
Timer = { - OnBootSec = "3s"; - OnUnitActiveSec = "3s"; + OnBootSec = "30s"; + OnUnitActiveSec = "30s"; AccuracySec = "1s";
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
FAQ.md(1 hunks)home-manager/services/default.nix(1 hunks)home-manager/services/neverssl-keepalive/default.nix(1 hunks)
🧰 Additional context used
📓 Path-based instructions (6)
**/*.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Format all Nix files with nixfmt
**/*.nix: Nix: Use 2 spaces for indentation
Nix: Keep line length under 100 characters
Nix: Sort attribute sets alphabetically
Nix: Use consistent spacing around operators
Nix: Format lists and sets consistentlyFollow the Nix expression language style guide
Files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
**/default.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Use default.nix files for module exports
Files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
home-manager/**
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Keep home-manager configurations under home-manager/
Files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
home-manager/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Use proper indentation and formatting in Nix files
Files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
home-manager/services/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/nix.mdc)
home-manager/services/**/*.nix: Service configurations in home-manager/services should follow systemd service conventions
Service configurations should include proper service dependencies
Service configurations should provide clear documentation for service parameters
Files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
home-manager/services/*/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
home-manager/services/*/default.nix: Service configurations must be located in home-manager/services// with configuration in default.nix
Service configurations should include proper service definitions
Service configurations must handle dependencies correctly
Service configurations must document service parameters
Files:
home-manager/services/neverssl-keepalive/default.nix
🧠 Learnings (7)
📚 Learning: 2025-09-28T16:27:24.275Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-09-28T16:27:24.275Z
Learning: Applies to home-manager/services/*/default.nix : Service configurations should include proper service definitions
Applied to files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
📚 Learning: 2025-09-28T16:27:59.822Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-09-28T16:27:59.822Z
Learning: Applies to home-manager/services/**/*.nix : Service configurations should include proper service dependencies
Applied to files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
📚 Learning: 2025-09-28T16:27:24.275Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-09-28T16:27:24.275Z
Learning: Applies to home-manager/services/*/default.nix : Service configurations must handle dependencies correctly
Applied to files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
📚 Learning: 2025-09-28T16:27:24.275Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-09-28T16:27:24.275Z
Learning: Applies to home-manager/services/*/default.nix : Service configurations must document service parameters
Applied to files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
📚 Learning: 2025-09-28T16:27:59.822Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-09-28T16:27:59.822Z
Learning: Applies to home-manager/services/**/*.nix : Service configurations in home-manager/services should follow systemd service conventions
Applied to files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
📚 Learning: 2025-09-28T16:27:24.275Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-09-28T16:27:24.275Z
Learning: Applies to home-manager/services/*/default.nix : Service configurations must be located in home-manager/services/<name>/ with configuration in default.nix
Applied to files:
home-manager/services/default.nix
📚 Learning: 2025-09-28T16:27:59.822Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-09-28T16:27:59.822Z
Learning: Applies to home-manager/services/**/*.nix : Service configurations should provide clear documentation for service parameters
Applied to files:
home-manager/services/default.nixhome-manager/services/neverssl-keepalive/default.nix
🪛 LanguageTool
FAQ.md
[grammar] ~16-~16: Use a hyphen to join words.
Context: ...om/nix-darwin/nix-darwin/issues/789). ## Auto renew neverssl on private wifi Send a l...
(QB_NEW_EN_HYPHEN)
[grammar] ~16-~16: Ensure spelling is correct
Context: .../nix-darwin/issues/789). ## Auto renew neverssl on private wifi Send a lightweight HTT...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Mesa
- GitHub Check: nix-nixos
- GitHub Check: nix-linux
- GitHub Check: nix-darwin
- GitHub Check: docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)
- GitHub Check: docker-build-push (linux/amd64, amd64, ubuntu-latest)
- GitHub Check: e2e-run (MacOS, macos-latest)
- GitHub Check: e2e-run (NixOS, ubuntu-latest)
- GitHub Check: e2e-run (Ubuntu, ubuntu-latest)
🔇 Additional comments (3)
FAQ.md (1)
16-26: LGTM! Clear and concise FAQ entry.The new FAQ section provides practical guidance for keeping captive portal sessions alive across multiple platforms. The static analysis warnings about "neverssl" are false positives—it's the legitimate domain name neverssl.com used for captive portal detection.
home-manager/services/default.nix (1)
5-5: LGTM! Follows existing patterns.The new service module is properly integrated following the established pattern, with correct alphabetical ordering and consistent formatting.
Also applies to: 11-11
home-manager/services/neverssl-keepalive/default.nix (1)
15-25: LGTM! Proper systemd service definition.The service follows systemd conventions with appropriate network dependencies and oneshot type for timer-triggered execution.
| { pkgs }: | ||
| let | ||
| keepaliveScript = pkgs.writeShellApplication { | ||
| name = "neverssl-keepalive"; | ||
| runtimeInputs = [ pkgs.curl ]; | ||
| text = '' | ||
| set -euo pipefail | ||
| if ! curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1; then | ||
| exit 0 | ||
| fi | ||
| ''; | ||
| }; | ||
| in | ||
| { | ||
| systemd.user.services.neverssl-keepalive = { | ||
| Unit = { | ||
| Description = "Keep captive portal alive via neverssl.com"; | ||
| Wants = [ "network-online.target" ]; | ||
| After = [ "network-online.target" ]; | ||
| }; | ||
| Service = { | ||
| Type = "oneshot"; | ||
| ExecStart = "${keepaliveScript}/bin/neverssl-keepalive"; | ||
| }; | ||
| }; | ||
|
|
||
| systemd.user.timers.neverssl-keepalive = { | ||
| Unit = { | ||
| Description = "Timer for neverssl captive portal keepalive"; | ||
| }; | ||
| Timer = { | ||
| OnBootSec = "3s"; | ||
| OnUnitActiveSec = "3s"; | ||
| AccuracySec = "1s"; | ||
| Unit = "neverssl-keepalive.service"; | ||
| }; | ||
| Install = { | ||
| WantedBy = [ "timers.target" ]; | ||
| }; | ||
| }; | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion | 🟠 Major
Expose configuration options for the service.
The module hardcodes the interval (3s) and URL without exposing any configuration parameters. This violates the coding guidelines requirement that service configurations must document service parameters.
Consider restructuring the module to expose options:
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.neverssl-keepalive;
keepaliveScript = pkgs.writeShellApplication {
name = "neverssl-keepalive";
runtimeInputs = [ pkgs.curl ];
text = ''
set -euo pipefail
if ! curl -fsS --max-time 10 ${cfg.url} > /dev/null 2>&1; then
exit 0
fi
'';
};
in
{
options.services.neverssl-keepalive = {
enable = mkEnableOption "neverssl captive portal keepalive";
interval = mkOption {
type = types.str;
default = "30s";
description = "Interval between keepalive requests";
};
url = mkOption {
type = types.str;
default = "http://neverssl.com";
description = "URL to request for keepalive";
};
};
config = mkIf cfg.enable {
systemd.user.services.neverssl-keepalive = {
Unit = {
Description = "Keep captive portal alive via neverssl.com";
Wants = [ "network-online.target" ];
After = [ "network-online.target" ];
};
Service = {
Type = "oneshot";
ExecStart = "${keepaliveScript}/bin/neverssl-keepalive";
};
};
systemd.user.timers.neverssl-keepalive = {
Unit = {
Description = "Timer for neverssl captive portal keepalive";
};
Timer = {
OnBootSec = cfg.interval;
OnUnitActiveSec = cfg.interval;
AccuracySec = "1s";
Unit = "neverssl-keepalive.service";
};
Install = {
WantedBy = [ "timers.target" ];
};
};
};
}This would require updating home-manager/services/default.nix to pass config and lib parameters.
Based on coding guidelines.
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of af4d988...95e3707
Analysis
-
Platform Incompatibility: The service lacks platform guards for Linux-only functionality (using
systemd.user.*), which will break on macOS/Darwin systems. Other services in this repo use proper platform guards. -
Excessive Request Frequency: The 3-second timer interval is extremely aggressive, generating ~28,800 requests per day. This creates unnecessary network load when typical captive portals have timeouts of 5-30 minutes.
-
No Opt-in Mechanism: The service is automatically enabled for all Linux users with no configuration options. For a use-case specific service like this, an opt-in approach would be more appropriate.
-
Inverted Error Handling Logic: The script exits with success (0) when curl fails, making failures appear as successes in logs and complicating debugging.
-
Missing Network Robustness: There's no handling for network disconnections, retry logic, or conditions to only run on WiFi networks despite the stated purpose being for "private WiFi".
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
3 files reviewed | 3 comments | Edit Agent Settings • Read Docs
| @@ -0,0 +1,41 @@ | |||
| { pkgs }: | |||
There was a problem hiding this comment.
Missing platform guard. This service uses systemd.user.* which is Linux-only, but there's no lib.mkIf pkgs.stdenv.isLinux wrapper. This will break the configuration on macOS/Darwin systems. Other platform-specific services in this repo (ollama, code-syncer) use this pattern. Consider:
{ pkgs }:
let
inherit (pkgs) lib;
in
lib.mkIf pkgs.stdenv.isLinux {
# ... rest of service definition
}Agent: 🏛 Architecture •
| runtimeInputs = [ pkgs.curl ]; | ||
| text = '' | ||
| set -euo pipefail | ||
| if ! curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1; then |
There was a problem hiding this comment.
The error handling logic appears inverted. With set -euo pipefail, the script will exit on the curl success path (when the if ! condition is false). The explicit exit 0 in the failure branch makes it the only successful path, which means systemd cannot track actual failures. Consider either:
- Remove the negation and handle properly:
curl ... || exit 0 - Or let curl's exit code propagate and use systemd's
Restart=on-failurewithRestartSec=30sto handle transient network issues
Agent: 🏛 Architecture •
| Description = "Timer for neverssl captive portal keepalive"; | ||
| }; | ||
| Timer = { | ||
| OnBootSec = "3s"; |
There was a problem hiding this comment.
A 3-second interval is extremely aggressive for a captive portal keepalive, generating ~28,800 requests per day. This creates unnecessary load on neverssl.com infrastructure, wastes network bandwidth and battery, and is much shorter than typical captive portal timeouts (5-30 minutes). Consider using a 5-10 minute interval instead:
OnBootSec = "5min";
OnUnitActiveSec = "5min";Or make it configurable via a module option if users have different timeout needs.
Agent: 🏛 Architecture •
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Summary
Testing
Codex Task
Summary by cubic
Simplified the neverssl captive portal FAQ and added a Home Manager service to auto-renew sessions with a 3-second systemd user timer.
Written for commit 95e3707. Summary will update automatically on new commits.