Forem: Dmitry Gordin

The minimal setup for OpenVino iGPU

Dmitry Gordin — Mon, 03 Nov 2025 14:03:22 +0000

Python script to print available execution providers and devices:

import onnxruntime as ort

# pip install onnxruntime-openvino

def log_onnx_info() -> None:
    providers: list[str] = ort.get_available_providers()
    print(f"Onnx providers: {providers}")
    if "OpenVINOExecutionProvider" not in providers:
        return
    try:
        from onnxruntime.capi.onnxruntime_pybind11_state import (
            get_available_openvino_device_ids,
        )

        available_devices: list[str] = get_available_openvino_device_ids()
        print(f"OpenVINO devices: {available_devices}")
    except ImportError:
        print("OpenVINOExecutionProvider is available but get_available_openvino_device_ids not found")


if __name__ == "__main__":
    log_onnx_info()

To access iGPU on host machine:

sudo apt install clinfo intel-opencl-icd intel-gpu-tools
sudo usermod -a -G render $LOGNAME

re-login and you're good to start using igpu for inference from both openvino or through onnxruntime-openvino.

For docker:

requirements.txt should contain onnxruntime-openvino

FROM python:3.12-slim-bookworm

# intel-opencl-icd is required
# htop, clinfo and intel-gpu-tools are optional
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && \
    apt-get install -y htop clinfo intel-opencl-icd intel-gpu-tools && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["python", "main.py"]

services:
  app:
    build: 
      context: .
      dockerfile: Dockerfile
    devices:
      - /dev/dri:/dev/dri
    group_add:
      - video

Self-hosting nowadays is easier than never before

Dmitry Gordin — Thu, 19 Jun 2025 12:12:12 +0000

Cloudflare tunnel allows you to host from any machine without a white static IP address or any port-forwarding settings. E.g., you can tether Wi-Fi from your phone to a "server" PC and happily host anything to the public internet.

We'll focus on managing multiple services from different docker-compose files for convenience.

1. Cloudflare Setup

First, you need a domain name managed by Cloudflare. Let you figure out this yourself.

Then go to admin console → Zero Trust → Network → Tunnels → Create tunnel.
No need to install anything — we'll use Docker. Just take the token and save it to a .env file.

In "Public hostnames" you have two possibilities:

a specific domain name,
use * star to move managing subdomains to the Caddyfile.

Then specify where on local machine to forward requests: we'll use http://proxy:80 as destination - because this is our Caddy's container name in docker compose file.

When you first create a rule — it'll update DNS settings for you, but later if you manually change something — pay attention if corresponding changes are done in DNS.

2. Docker Network

To the technical part: we need to create a network that will be available between multiple docker-compose files:

sudo docker network create tunnel-proxy

3. Base docker-compose.yml (cloudflared + caddy)

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    command: tunnel --no-autoupdate run --token ${TUNNEL_TOKEN}
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
    networks:
      - tunnel-proxy

  proxy:
    image: caddy:latest
    # tunnel is configured to forward requests to http://proxy:80
    container_name: proxy
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - cloudflared
    networks:
      - tunnel-proxy

volumes:
  caddy_data:
  caddy_config:

# this network is created manually beforehand:
# sudo docker network create tunnel-proxy
networks:
  tunnel-proxy:
    external: true

4. Caddyfile example

{
    admin off
    auto_https off
}

# inside tunnel everything is http on port 80
# https is done later by Cloudflare

http://hello.example.net:80 {
    # can serve content right away
    # refer to Caddy documentation for details
    respond "Hello, world!" 200
}

http://container-name.example.net:80 {
    # or reverse proxy to container from another docker-compose.yml
    reverse_proxy container-name:80
}

Save your token from Cloudflare to .env file: TUNNEL_TOKEN=abcdefg

5. Another docker-compose.yml for your service

services:
  anything:
    # must match name in www/Caddyfile
    container_name: container-name
    # here's your service you want to host
    # caddy is just an example
    image: caddy:latest
    restart: unless-stopped
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - tunnel-proxy

volumes:
  caddy_data:
  caddy_config:

networks:
  tunnel-proxy:
    external: true

NVIDIA Drivers with Secure Boot on Ubuntu

Dmitry Gordin — Wed, 15 Jan 2025 10:54:22 +0000

After enabling Secure Boot in BIOS settings on my PC with Kubuntu, I noticed laggy animations. When checking nvidia-smi, I got this error:

NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver. Make sure that the latest NVIDIA driver is installed and running.

Updating apt packages and drivers didn't help. After a day of troubleshooting, here's what worked for me:

# Install necessary tools
sudo apt update && sudo apt install -y openssl mokutil

# Create directory for keys
sudo mkdir -p /var/lib/shim-signed/mok/

# Generate the key that will be used to sign drivers
sudo openssl req -new -x509 -newkey rsa:2048 -keyout /var/lib/shim-signed/mok/MOK.priv -outform DER -out /var/lib/shim-signed/mok/MOK.der -days 36500 -subj "/CN=MyKey4Nvidia/" -nodes

# Import generated key
sudo mokutil --import /var/lib/shim-signed/mok/MOK.der

Now you will be prompted to enter a new password, this can be any string (not necessary your user's password). Remember it! You'll need to enter it after reboot.

# Reinstall NVIDIA drivers
sudo apt purge 'nvidia*'
sudo apt autoremove
sudo ubuntu-drivers autoinstall

Reboot your system. At the beginning of the boot process, you'll see a countdown for 10 seconds to enter the MOK management menu.
Select "Enroll MOK", press continue, and enter the password you created earlier. After enrollment, select the reboot option.

That's it! After booting up, you should have working NVIDIA drivers. Verify this with the nvidia-smi command.

Disable Dualsence touchpad on Ubuntu

Dmitry Gordin — Mon, 27 May 2024 11:59:01 +0000

Valve's efforts in making the Steam Deck (which runs a Debian-based distro) have enabled hassle-free gaming on Linux machines. I finished Witcher 3 with Sony's DualSense controller and am now playing Helldivers 2. Surprisingly, HD2 even supports haptic feedback and adaptive triggers. I didn't think I would be able to try these features without a PS5.

However, one little annoying thing was preventing me from fully enjoying the game and spreading managed democracy — the touchpad of the DualSense was interpreted as a mouse. Anytime I wanted to open the in-game map, it acted as a mouse and changed the control to the keyboard.

Solution

sudo nano /etc/X11/xorg.conf.d/30--dualsense-touchpad.conf

Section "InputClass"
    Identifier "Sony Interactive Entertainment Wireless Controller Touchpad"
    Driver "libinput"
    MatchIsTouchpad "on"
    Option "Ignore" "true"
EndSection

Then, log out from user or just reboot pc.
Now the DualSense acts exactly the same way as if it were attached to a PS5.

Credits archlinux forum

Hikvision camera configuration via ISAPI

Dmitry Gordin — Mon, 07 Aug 2023 11:02:08 +0000

Hikvision company makes good cameras and terrible documentation for their software.
If you've ended up here, chances are you've tried digging through their "isapi.pdf" file and didn't find much help there.

First, I'd suggest you get your camera set up via the web interface. Next, grab a reference template of the settings in XML format. Do it by opening in you browser:

http://192.168.1.64/ISAPI/Streaming/channels/1 - for streaming options (resolution, fps, bitrate),
http://192.168.1.64/ISAPI/Image/channels/1 - for image settings (white balance, WDR, lightning, etc). You will be asked for camera's login and pass.

In case you have different models of cameras, probably you need to get this templates from all of them, compare, and find common basis.

To deploy this config to camera simply PUT this xml text to camera by the same url!

Sample python code:

import requests
from requests.auth import HTTPDigestAuth

username, password = ('admin', 'camera_password')
stream_xml = """
<StreamingChannel version="2.0" xmlns="http://www.hikvision.com/ver20/XMLSchema">
    <id>1</id>
blah blah blah
"""
url = "http://192.168.1.64/ISAPI/Streaming/channels/1"
response = requests.put(url, data=stream_xml, auth=HTTPDigestAuth(username, password))
print(response.text)
assert response.status_code == 200

image_xml = """
<ImageChannel xmlns="http://www.hikvision.com/ver20/XMLSchema" version="2.0">
    <id>1</id>
    <enabled>true</enabled>
    <videoInputID>1</videoInputID>
"""
url = "http://192.168.1.64/ISAPI/Image/channels/1"
response = requests.put(url, data=image_xml, auth=HTTPDigestAuth(username, password))
print(response.text)
assert response.status_code == 200

You should get response like:

<?xml version="1.0" encoding="UTF-8"?>
<ResponseStatus version="2.0" xmlns="http://www.hikvision.com/ver20/XMLSchema">
<requestURL></requestURL>
<statusCode>1</statusCode>
<statusString>OK</statusString>
<subStatusCode>ok</subStatusCode>
</ResponseStatus>

In more complex case, when you need different configs for each camera model, use: http://192.168.1.64/ISAPI/System/deviceInfo to find out camera model.