Skip to content

Simplify neverssl FAQ entry #328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Nov 9, 2025
Merged

Simplify neverssl FAQ entry #328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions FAQ.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,15 @@ killall Dock
After running these commands, you may need to re-add your desired applications to the Dock. Subsequent reboots should then persist your Dock configuration.

For more details, see [nix-darwin issue #789](https://github.com/LnL7/nix-darwin/issues/789).

## Auto renew neverssl on private wifi

@gemini-code-assist gemini-code-assist Bot Nov 9, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The title "Auto renew neverssl on private wifi" could be misleading. Captive portals are most common on public Wi-Fi networks (e.g., airports, hotels), not private ones. Using a more general title would better reflect the feature's purpose.

Suggested change
## Auto renew neverssl on private wifi
## Keep captive portal sessions alive using neverssl


Send a lightweight HTTP GET to `http://neverssl.com` on a short cadence to keep the captive portal session alive.

**Systemd (Linux):** define a `neverssl-keepalive.service` oneshot that runs curl, then pair it with a timer using `OnBootSec=3s` and `OnUnitActiveSec=3s`, finally `systemctl enable --now neverssl-keepalive.timer`.

**Cron or launchd:** schedule the same curl command (`curl -fsS --max-time 10 http://neverssl.com >/dev/null 2>&1 || true`) at your preferred interval.

**NixOS/Home Manager:** use the bundled `home-manager/services/neverssl-keepalive` module to install a 3-second systemd user timer.

If the network still expires sessions, the captive portal may require additional headers, JavaScript heartbeats, or manual sign-ins.
2 changes: 2 additions & 0 deletions home-manager/services/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,12 @@
let
codeSyncer = import ./code-syncer { inherit pkgs; };
dotfilesUpdater = import ./dotfiles-updater { inherit pkgs; };
neversslKeepalive = import ./neverssl-keepalive { inherit pkgs; };
ollama = import ./ollama { inherit pkgs; };
in
[
codeSyncer
dotfilesUpdater
neversslKeepalive
ollama
]
41 changes: 41 additions & 0 deletions home-manager/services/neverssl-keepalive/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
{ pkgs }:

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High

Missing platform guard. This service uses systemd.user.* which is Linux-only, but there's no lib.mkIf pkgs.stdenv.isLinux wrapper. This will break the configuration on macOS/Darwin systems. Other platform-specific services in this repo (ollama, code-syncer) use this pattern. Consider:

{ pkgs }:
let
  inherit (pkgs) lib;
in
lib.mkIf pkgs.stdenv.isLinux {
  # ... rest of service definition
}

Agent: 🏛 Architecture • Fix in Cursor

let
keepaliveScript = pkgs.writeShellApplication {
Comment on lines +1 to +3

Copilot AI Nov 9, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The service uses systemd which is Linux-specific, but unlike other services in this codebase (code-syncer, ollama), there's no platform check using pkgs.lib.mkIf pkgs.stdenv.isLinux. This will cause issues on macOS systems. Consider wrapping the entire configuration with a platform check or updating the return value structure to handle both platforms.

Copilot uses AI. Check for mistakes.
name = "neverssl-keepalive";
runtimeInputs = [ pkgs.curl ];
text = ''
set -euo pipefail
if ! curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1; then

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

The error handling logic appears inverted. With set -euo pipefail, the script will exit on the curl success path (when the if ! condition is false). The explicit exit 0 in the failure branch makes it the only successful path, which means systemd cannot track actual failures. Consider either:

  1. Remove the negation and handle properly: curl ... || exit 0
  2. Or let curl's exit code propagate and use systemd's Restart=on-failure with RestartSec=30s to handle transient network issues

Agent: 🏛 Architecture • Fix in Cursor

exit 0
fi
Comment on lines +7 to +10

@gemini-code-assist gemini-code-assist Bot Nov 9, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The shell script logic can be simplified. The current if statement to handle the curl exit code is a bit verbose. You can achieve the same result more concisely by using || true, which also aligns with the command suggested in FAQ.md for cron.

      set -uo pipefail
      curl -fsS --max-time 10 http://neverssl.com > /dev/null 2>&1 || true

'';
};
in
{
systemd.user.services.neverssl-keepalive = {
Unit = {
Description = "Keep captive portal alive via neverssl.com";
Wants = [ "network-online.target" ];
After = [ "network-online.target" ];
};
Service = {
Type = "oneshot";
ExecStart = "${keepaliveScript}/bin/neverssl-keepalive";
};
};

systemd.user.timers.neverssl-keepalive = {
Unit = {
Description = "Timer for neverssl captive portal keepalive";
};
Timer = {
OnBootSec = "3s";

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

A 3-second interval is extremely aggressive for a captive portal keepalive, generating ~28,800 requests per day. This creates unnecessary load on neverssl.com infrastructure, wastes network bandwidth and battery, and is much shorter than typical captive portal timeouts (5-30 minutes). Consider using a 5-10 minute interval instead:

OnBootSec = "5min";
OnUnitActiveSec = "5min";

Or make it configurable via a module option if users have different timeout needs.

Agent: 🏛 Architecture • Fix in Cursor

OnUnitActiveSec = "3s";
Comment on lines +32 to +33

Copilot AI Nov 9, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 3-second interval is extremely aggressive and will generate ~28,800 HTTP requests per day. This could unnecessarily consume network bandwidth and battery on mobile devices. Consider increasing the interval to at least 30-60 seconds, which is typically sufficient for captive portal keepalive while being much more resource-friendly (reducing requests to ~2,880 per day at 30s intervals).

Suggested change
OnBootSec = "3s";
OnUnitActiveSec = "3s";
OnBootSec = "30s";
OnUnitActiveSec = "30s";

Copilot uses AI. Check for mistakes.
AccuracySec = "1s";
Unit = "neverssl-keepalive.service";

Copilot AI Nov 9, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Timer.Unit field is redundant in systemd timers. By default, a timer automatically activates a service with the same name (minus the .timer suffix). This line can be safely removed as neverssl-keepalive.timer will automatically trigger neverssl-keepalive.service.

Suggested change
Unit = "neverssl-keepalive.service";

Copilot uses AI. Check for mistakes.
};
Install = {
WantedBy = [ "timers.target" ];
};
};
}
Comment on lines +1 to +41

@coderabbitai coderabbitai Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Expose configuration options for the service.

The module hardcodes the interval (3s) and URL without exposing any configuration parameters. This violates the coding guidelines requirement that service configurations must document service parameters.

Consider restructuring the module to expose options:

{ config, lib, pkgs, ... }:
with lib;
let
  cfg = config.services.neverssl-keepalive;
  
  keepaliveScript = pkgs.writeShellApplication {
    name = "neverssl-keepalive";
    runtimeInputs = [ pkgs.curl ];
    text = ''
      set -euo pipefail
      if ! curl -fsS --max-time 10 ${cfg.url} > /dev/null 2>&1; then
        exit 0
      fi
    '';
  };
in
{
  options.services.neverssl-keepalive = {
    enable = mkEnableOption "neverssl captive portal keepalive";
    
    interval = mkOption {
      type = types.str;
      default = "30s";
      description = "Interval between keepalive requests";
    };
    
    url = mkOption {
      type = types.str;
      default = "http://neverssl.com";
      description = "URL to request for keepalive";
    };
  };

  config = mkIf cfg.enable {
    systemd.user.services.neverssl-keepalive = {
      Unit = {
        Description = "Keep captive portal alive via neverssl.com";
        Wants = [ "network-online.target" ];
        After = [ "network-online.target" ];
      };
      Service = {
        Type = "oneshot";
        ExecStart = "${keepaliveScript}/bin/neverssl-keepalive";
      };
    };

    systemd.user.timers.neverssl-keepalive = {
      Unit = {
        Description = "Timer for neverssl captive portal keepalive";
      };
      Timer = {
        OnBootSec = cfg.interval;
        OnUnitActiveSec = cfg.interval;
        AccuracySec = "1s";
        Unit = "neverssl-keepalive.service";
      };
      Install = {
        WantedBy = [ "timers.target" ];
      };
    };
  };
}

This would require updating home-manager/services/default.nix to pass config and lib parameters.

Based on coding guidelines.

Loading