Doa

Consolidating My Small-to-Medium Web Apps on SvelteKit + Bun + SQLite

Fri, 04 Sep 2026 00:00:00 GMT

It’s been a while since I wrote about something web-related.
For about the past year, every web app I’ve built on my own has used SvelteKit + Bun + SQLite, so I figured I’d write down how I ended up there.

Overview#

Here’s what I currently have running.

	What it does	Public
worklog	Builds timesheets from Slack and GitHub logs	Service only
𝕏ool	Automatically posts a “report card” of your day on 𝕏	Source
mogiri	QR-based admission, pre-ordering and self-checkout	Source
denpa	TV program guide, scheduling, recording, and streaming	Source
tamasagashi	Browser for a vehicle master database (model code → common name and specs) built from public data	Service only

All five have nearly identical package.json files: SvelteKit 2 + Svelte 5, adapter-node, Blades (the successor to Pico CSS), bun:sqlite, TypeScript 7, and they all start with bun build/index.js.
I didn’t set out to standardize them. Honestly, I rewrote one, it was pleasant, and everything after that just followed suit.

How the rewrite came about#

mogiri (formerly Smart QR Payment) was originally built around 2024 as two separate pieces: a Django REST Framework backend and a Nuxt (Vuetify) frontend.
I didn’t touch it for a while after that, but Renovate PRs keep coming whether you touch a project or not. Looking at the history for July 2026, it went something like this, with commits in between that did nothing but bump dependencies and then carry them through to a working state.

1
2026-07-28  Update dependency Django to v3.2.25
2
2026-07-28  Update dependency @nuxt/eslint-config to ^0.7.0
3
2026-07-29  Carry the dependency bumps through to a working app

Two languages, two runtimes, two containers. Keeping up with updates for each of them didn’t feel worth it for an app this size.
Splitting out the backend is overkill for a small application, and a single container seemed like the better call, so in August 2026 I rewrote the whole thing. The API and the UI are merged into one SvelteKit app: one container, and on k3s a single Pod with one PVC.

Why Svelte#

Since the original was Vue, the obvious choices would have been React or just staying on Nuxt, but I went with Svelte.

The reason is simple: you write less code, and the generated code is easier to read. State handling with Svelte 5 runes is straightforward, and, as I’ll get to later, since I have AI write a lot of the implementation, whether I can read and fix the code it produces matters quite a bit.
With React, the React Compiler means you no longer have to think about managing useMemo in tsx, but I don’t think it has become as easy to write as Svelte. On top of that, I personally have no desire to keep up with the speed and weight of the React ecosystem. Next.js has a lot of Vercel-specific features, and those get in the way when you deploy to your own k3s.

I dropped Nuxt because it has a lot of breaking changes, and it didn’t offer much of the benefits I listed above.

With SvelteKit, the API and the UI become one. You can do that with Next too, but SvelteKit is more straightforward to put together, and since adapter-node outputs a plain Node server, it runs anywhere.

On SQLite#

bun:sqlite ships with Bun and is fast; there’s no driver or separate process to run, and the database is a single file. On k3s it’s self-contained with one PVC, and a backup is just a file copy.

I use it knowing its limits. Writes go through a single writer, and you can’t scale horizontally. In denpa, both the scheduler and the program guide fetcher write to one SQLite database, so it runs a single replica with strategy: Recreate.
I still chose SQLite because, for a small app, the extra overhead of running PostgreSQL outweighs the benefits. SQLite is increasingly being adopted even for medium-sized apps, and services built for production use, like Cloudflare’s D1, have appeared, so I judged that it holds up fine in production. It’s a choice I made having already decided to move to PostgreSQL if things get bigger.

This is all I set at startup.

1
export const db = new Database(url, { create: true });
2
db.exec('PRAGMA journal_mode = WAL;');
3
db.exec('PRAGMA foreign_keys = ON;');
4
ensureSchema(db);

On indexes#

tamasagashi is an example of how search is plenty fast with SQLite as long as you index properly. Public data such as the MLIT (Ministry of Land, Infrastructure, Transport and Tourism, 国交省) fuel economy listings, type designations published in the Official Gazette (kanpō), and recall notifications are converted to JSONL, imported into SQLite at build time, and baked into the image; at runtime the database is opened read-only. Since there are no writes, the single-writer limitation never comes into play in the first place.
For the model codes and common names used as search keys, I want to ignore differences between hiragana and katakana, full-width and half-width characters, spaces, and hyphens. Doing that on the query side every time would defeat the indexes, so at import time I store separate normalized columns, code_norm and name_norm, index those, and look them up with LIKE. The key is running the same normalization function at import time and at search time, so all the handling of spelling variations is finished at the import stage.
Beyond that, things like making tables that are only looked up by a composite primary key WITHOUT ROWID, and loading data with PRAGMA synchronous = OFF during import, then compacting it with wal_checkpoint(TRUNCATE) and VACUUM before shipping, are all handled with standard SQLite features. At this scale, I have yet to feel that something is “slow because it’s SQLite.”

On ORMs#

The first version of the rewrite used Drizzle ORM, but at this scale there weren’t really any differences for the ORM to smooth over, and writing SQL directly is easier to read and fix, so I removed it the same day. Now there’s just a thin layer: the schema in ddl.ts and raw SQL in repo.ts.

NOTE
As a very SQLite-style trick, denpa makes a recording’s state a generated column. SQLite rejects any attempt to write to it, so the facts and the state can’t drift apart. Back when I stored it separately as a string, that drift was a breeding ground for bugs.

On Bun#

Two things: bun:sqlite and Bun.password (argon2id) are bundled, so the database and password hashing are covered without any native dependencies; and it runs TypeScript as-is and starts up fast.

As a side effect, node_modules disappeared from production. adapter-node bundles devDependencies into the server build and leaves only dependencies external, so if you move everything actually needed at runtime into devDependencies, dependencies ends up empty and the app runs with just Bun and the build output. The install step vanished from the final stage of the Dockerfile.

Where Bun tripped me up#

There’s no point in only writing about the good parts, so here are the places I actually got stuck.

It can’t start on Node
The moment you use bun:sqlite, the app only runs on Bun. You end up writing “Always start this with Bun” in the README. I’ve closed off my own escape route for switching away.
Things break when the local Bun and the container’s Bun are different versions
After getting bitten by this once, I moved all development into the container. If you run bun install at the repository root, the preinstall below stops it (the message reads “Don’t install locally”).
```
1
"preinstall": "test \"$PWD\" = /usr/src/app || { echo 'ローカルで install しないでください'; exit 1; }"
```
To run Vite on Bun you have to write bunx --bun vite
Plain vite starts up on Node.
Getting TypeScript 7 and svelte-check to coexist
To run svelte-check with the native TypeScript 7 (tsgo), you need both typescript@~6 and an alias for @typescript/native installed. It does get faster, but the dependency list looks a bit off.
Biome only looks at the <script> in .svelte files
It flags variables used in the template as unused, so I’ve turned off the unused-variable checks for .svelte files.
adapter-node closes its listener the moment it receives SIGTERM
This is less about Bun and more about running SvelteKit on k3s as a long-running process. denpa is designed so that if a deploy comes in mid-recording, it sticks around until the recording finishes, but adapter-node’s default cleanup ran first, leaving the process alive with only its port closed. I had to catch the stop signal myself and remove that cleanup, and because of the timing of when it’s registered, I had to do it twice. The details are in denpa’s architecture.md.

On Biome and CSS#

I chose Biome largely because I’m a neat freak and dislike having libraries scattered around. The fewer libraries the better. Right after the mogiri rewrite I was using ESLint + Prettier, but I didn’t like keeping separate libraries and config files for linting and formatting, and on top of that having to check how well they play together, so I consolidated on a single biome.json and a single command, biome check --write. It’s written in Rust and fast, so putting it alongside type checking in the check script doesn’t bother me.
The downside, as I mentioned earlier, is that it only looks at the <script> in .svelte files and flags variables used in the template as unused, so I use it with just that rule turned off.

For a long time my CSS was Tailwind + daisyUI. At the start of a project it’s easy to build a UI with fixed choices, and when you want to customize something, Tailwind makes it easy to tweak directly. I’d start with class="btn btn-primary" and only add utilities where I didn’t like something, as in class="btn btn-primary rounded-full px-8".

But when I looked back after finishing a pass over all the apps, the components that actually showed up were basically just tables, forms, notices, and tags. For that little, I was loading 3,000 lines of component CSS, and the markup had become strings of ten classes like class="card bg-base-100 border-base-300 flex flex-col gap-3 p-4 shadow-sm" that I couldn’t make sense of six months later. Utility classes are fast to write, but when you read them, you have to mentally convert every class name back into CSS.

So at one point I moved everything over to Pico CSS. It’s a classless CSS framework that styles plain <button> and <table> elements as-is.

NOTE
Update (October 2026): I’ve since dropped Pico CSS itself and switched all the apps to Blades (@anyblades/blades), which carries on Pico’s maintenance. It’s distributed as plain CSS, so I no longer need Sass and could remove sass-embedded and the related Vite config. What follows describes the setup after moving to Blades.

1
@import "@anyblades/blades/pico" layer(pico);

Blades is loaded into a layer (@layer) named pico. My own rules, which aren’t in a layer, always win over rules inside the layer regardless of specificity, so there’s no need to get into a tug-of-war of rewriting selectors to match Pico’s strong ones.

On top of that, I put only the things shared across apps into app.css, about ten names like .panel (a white box), .note (a notice), .tag (a tag), and .field (label + input), and confined screen-specific tweaks to Svelte’s <style> (scoped). As a result, the markup from earlier became just two words, class="panel body", and each screen’s particulars live only inside that screen’s file.

For colors, I mostly stick with Blades’ defaults. If my own tokens just pull from Pico’s --pico-* variables, light/dark switching follows Blades automatically, so the apps no longer have to take care of a dark theme themselves.

I’ve only added Bits UI for components like dropdowns and dialogs, where keyboard interaction and focus need to be taken care of. It’s headless with no styling of its own, so it doesn’t clash with my approach of writing the CSS myself.

What I don’t do in SvelteKit#

I don’t do everything with this stack. When I need heavy computation, or processing that holds a queue and keeps running for a long time, I use .NET.
denpa’s tuner agent is one of those. It’s a component that just grabs the signal and streams the raw TS, and I originally wrote it in bun, but after measuring it on real hardware I rewrote it in .NET (it’s Native AOT, so it’s a single executable with no dependencies).
As for what went wrong with bun: first, when something fails, say the tuner gets taken away, you have to tear down the whole connection so the receiving side doesn’t see it as a normal end, but the bun version couldn’t do that, so truncated recordings counted as “recorded.” Second, the kernel’s dvr ring buffer is 1.8 MB by default, which at terrestrial broadcasting’s 18 Mbit/s is only 0.9 seconds’ worth, so it overflows if the reader stalls even briefly, say for GC. I tuned this on real hardware while counting the overflows, but in the end only the .NET version could call ioctl directly, so that’s where I landed. The numbers I measured are written up as-is in agent.md if you’re interested.
UI and API in SvelteKit; things close to the hardware, things that need to be real-time, and heavy computation in .NET. That rough split hasn’t caused me any trouble so far.

On AI#

To be honest, Claude wrote most of the mogiri rewrite. The task was to read the Django + Nuxt code and rebuild the same screen flows in SvelteKit. What the human did was make the decisions described above, and poke at and fix what came out.

The choice of one language, one process, and readable generated code pays off precisely because of that premise. Having tons of code I can’t read generated for me wouldn’t help, so choosing Svelte, with less code to write and a straightforward structure, was also a decision to widen the range of what I can hand off to AI.
I wrote about how this feels in practice in the second half of my Slack post.

Summary#

For small-to-medium apps, don’t split out the backend. One SvelteKit app, one container
I picked Svelte for how little you write and how readable it is. I have no intention of keeping up with the React ecosystem
Use SQLite knowing its limits. It’s self-contained with one PVC, and if it gets bigger, PostgreSQL
I picked Bun for how much it bundles. In exchange, the escape route to Node is closed
Carve out heavy computation and anything that needs a queue into .NET

I built five and they all settled into the same shape, so the next time I build something I’ll probably start with this setup too. If you’re struggling with this stack, or think something here should be done differently, I’d appreciate a comment.

You Can't Distribute a Slack App That Fetches All of Your Own Messages

Fri, 31 Jul 2026 00:00:00 GMT

I set out to build a Slack app that pulls every message I’ve posted across a workspace, and found out it can’t be listed on the Slack Marketplace. The scope it needs, search:read, is called out by name in the guidelines as a rejected scope.
Every workaround turned out to be closed off too, and in the end the only option left was to have users create an internal app themselves. I’m writing this down with quotes and sources so that the next person looking into the same thing doesn’t burn a whole day on it.

What I wanted to do#

The idea was to auto-generate a timesheet (a list of working hours) from the timestamps of my Slack messages.
All I need are the timestamps, not the message bodies. If I know who posted when, I can infer the start, end, and breaks of a workday from clusters of activity.

The API for this is search.messages. With a query like from:<@USER_ID> after:2026-06-01 before:2026-07-01 you can pull just your own messages for a given period. The only scope it needs is search:read.
If anything, I’d say that’s on the small side as permissions go. It doesn’t read whole channel histories; it only returns your own messages.

How search:read is treated#

The guidelines spell it out directly.

legacy/restricted scopes or methods, scopes that provide extensive access to workspace data without a clear use case that requires them, or coded workflow scopes (e.g. admin.*, identity.*, search:read, workflow.steps:execute, triggers:*) Source: Slack Marketplace app guidelines and requirements

The scope reference also marks it as legacy.

This is a legacy scope Source: search:read scope

IMPORTANT
It hasn’t been deprecated. With a user token, search.messages still works just fine. You just can’t list it on the Marketplace. Mix these two up and you’ll wrongly conclude “it doesn’t work anymore,” so be careful.

Working around it with *:history#

If search is off the table, the obvious next thought is to just read channel history instead. But the same page lists that as something you must not do.

Request user token *:history and files:read scopes for the collection of message and file data

On top of that, the rate limits changed in May 2025, and this route is effectively dead.

The conversations.history API method rate limit for commercially distributed apps created after May 29, 2025 … will be limited to 1 request per minute … These methods will have a new rate limit of 15 messages per request. Source: Rate limit changes for non-Marketplace apps

One request per minute, 15 messages per request. For going back a month and aggregating, that’s a non-starter.
And fetching history means reading every message from everyone in the channel in the first place. I only want my own messages, yet I’d be asking for permissions far broader than search. You’d be trading friction for something more invasive, which is a bad deal.

The Real-time Search API#

In February 2026 Slack released the Real-time Search API as a replacement for search:read. It consists of assistant.search.context and finer-grained scopes like search:read.public / .private / .im.

Source: Announcing the Slack MCP server and Real-time Search API

This one can be listed. But it comes with four conditions of use, and depending on your use case, every one of them can bite.

Condition	Details
No data storage	”You must not store or copy any of the data retrieved from this API.”
No guest access	”Workspace guests are not permitted to access apps using platform AI features”
Plan restrictions	Semantic search requires Business+ / Enterprise+
AI features only	”exclusively in your app using AI features”

Source: Using the Real-time Search API

For my use case the second one was fatal. People working on-site at a client or as contractors often join the client’s workspace as guests, so this condition excludes exactly the users I was targeting.
There are also caps of up to 20 results per request and 10 requests per minute per user.

Workspace app approval settings#

This was the biggest takeaway. I’d assumed an internal app would just get blocked by an admin anyway, but when I looked into it, it was the other way around.

By default, members can install apps without approval from a Workspace Owner. Source: Manage app approval for your workspace

By default, no approval is needed. Here’s how things behave when the settings are tightened.

Workspace setting	Marketplace-listed app	Self-built internal app
No restrictions (default)	Allowed	Allowed
Only allow apps from the Marketplace	Allowed	Allowed
Approval required for all apps	Pending approval	Pending approval

Slack states the second row explicitly.

Workspace Owners can set a permission to “Only allow apps from the Slack Marketplace” … This will not prevent members from creating and installing internal apps. Source: Add apps to your Slack workspace

In other words, the “Marketplace only” setting doesn’t stop internal apps. That’s the opposite of what the name suggests.
And with the third row, “approval required for all apps,” Marketplace-listed apps end up pending approval too, so there’s no setting that puts internal apps at a disadvantage.

On top of that, the rate limit change I mentioned earlier says this:

Internal customer-built apps will not notice any changes.

Internal apps are exempt from the tightened limits.
So the internal-app approach isn’t a second-best option you settle for because you can’t get listed; for this use case it was the only option that actually works properly.

How I actually distribute it#

I went with having users create the app themselves. To cut down the effort, I hand them an App Manifest embedded in a URL.

1
https://api.slack.com/apps?new_app=1&manifest_yaml=<URL エンコードした manifest>

(The placeholder reads “URL-encoded manifest”.)

Source: Configuring apps with app manifests

This way they start with the app name, description, and scopes already filled in. The only scope requested is search:read, so the consent screen is light too.
Reading the docs, it looks like it’s done in “click the link → Create → Install → copy the token,” but when you actually do it there are two traps.

The red error on creation#

In Step 2, when you press Create and Install, a white popup flashes open and closes, and then you see this:

1
Installation was not completed. Click Create and Install to try again.

The app itself has been created. Reload the list and it shows up.
The cause is probably that this app has no bot scopes at all. It’s a flow that creates and installs in one go, but there’s no bot to install, so it misfires. Adding a bot scope would probably make it go away, but increasing the requested permissions just for that would defeat the purpose, so I’ve left it as is.
A red error on the very first step of onboarding is a guaranteed drop-off without an explanation, so all I could do was write “this is normal” in the instructions.

Token rotation#

At the top of the OAuth & Permissions page there’s an option labeled like this:

Recommended for developers building on or for security-minded organizations

When something says Recommended you want to turn it on, but if you do, tokens start expiring after a short time, and any app without a refresh mechanism can no longer connect.
The generated manifest sets token_rotation_enabled: false, but it can still be turned on later from the UI, so the instructions also say plainly “please don’t enable this.”

About AI#

To be upfront: I had AI (Claude Code) write almost all of the code. What I did as the human was decide what to build and what not to build.
That was not easy work. AI will build something that works if you tell it to, but if your instructions are wrong, you get the wrong thing, built to a high standard.

For a concrete example, I initially designed the free plan’s cutoff as “Slack integration is free, other services are paid.” Since Slack is the main data source, it seemed like a plausible line. The implementation, the pricing page, and the decision records were all written on that premise, and the tests passed.
I only noticed the mistake when I used it myself. Someone who has only connected GitHub couldn’t generate anything on the free plan; they’d sign up, connect, look at an empty timesheet, and leave. The whole point of the free plan was to show the full value for free, and I’d drawn a line that broke that very goal.
I changed the line to “one integration, regardless of which service.” Around the same time, real data showed that building a timesheet from commit times alone came out to only 9 hours of actual work for a month, which led to tuning the inference model.

My current feeling is that you can hand the building to AI, but you can’t hand off making sure you’re building the right thing. Tests tell you whether it works, but not whether it’s right.

Summary#

For anyone wanting to distribute an app that uses search.messages, here’s the rundown.

It can’t be listed on the Marketplace. search:read is named outright as a rejected scope
The *:history workaround is closed off too. It’s prohibited by the guidelines, and the rate limit is 1 req/min with 15 messages
The Real-time Search API can be listed, but it comes with no data storage, no guest access, and plan restrictions
The internal-app approach is alive and well. Even the workspace’s “Marketplace only” setting doesn’t stop it, and it’s exempt from the tightened rate limits

Here’s what I built. It infers each day’s start, end, breaks, and actual working time from your Slack and GitHub activity logs and produces a draft timesheet. It works even in environments where you can’t install a monitoring agent at the client site, and it can generate timesheets retroactively for past months.

https://w.doany.io

Rebuilding This Site with Astro + k3s

Wed, 29 Jul 2026 00:00:00 GMT

This site was originally built with HUGO and later ran on Next.js (tailwind-nextjs-starter-blog), but I’ve now fully migrated it to Fuwari, an Astro-based theme.
While I’m at it, I’ll write up the current setup from start to finish.

saicaca

fuwari

✨A static blog template built with Astro.

The big picture#

1
Posts (Markdown)
2
  ↓ pnpm build
3
Astro → dist/ + Pagefind search index
4
  ↓ docker build (multi-stage)
5
Build on node:24-slim → put only dist/ on caddy:2-alpine
6
  ↓ GitHub Actions
7
Push to ghcr.io → automatically rewrite the k3s manifest and commit it
8
  ↓ ArgoCD watches Git and syncs
9
k3s + Traefik (Let's Encrypt / DNS-01) → Cloudflare → readers

No server-side application runs at all; everything served is purely static files.

NOTE
Update (October 2026): I’ve since switched the package manager from pnpm to Bun, so the build is now bun run build and the build image is oven/bun instead of node:24-slim. I also replaced Swup with Astro’s built-in ClientRouter for page transitions. The rest of the flow is unchanged. See the repository for the latest setup.

Build#

Since it’s Astro, the output is static HTML. Page transitions are handled by Swup, so pages switch without a full reload.

For full-text search I use Pagefind. It scans dist/ at build time to create the index, so no search server is needed. Japanese text gets matched properly too.

NOTE
Pagefind doesn’t support stemming for Japanese, so it won’t match across inflected forms, but I think it’s perfectly practical for searching a personal blog.

Serving with Caddy#

The image has a two-stage setup: node:24-slim for the build and caddy:2-alpine for serving. The final image contains only dist/ and the Caddyfile.

There’s a reason I chose Caddy over nginx.
Astro uses trailingSlash: "always", so every request to /posts/foo gets redirected to /posts/foo/. nginx builds that redirect URL from $scheme, so if TLS is terminated at a proxy in front, it 301s to http://, which is a classic trap. You can avoid it by writing absolute_redirect off;, but if you don’t know about it, you’re guaranteed to fall in.
Caddy returns relative redirects, so this problem simply doesn’t exist. Here’s what it actually looks like.

1
$ curl -sI https://doany.io/posts/truck | grep -i location
2
location: https://doany.io/posts/truck/

On top of that, a single line, encode zstd gzip, gets you zstd compression. Using zstd with nginx requires building a module, so this convenience is a big deal. The top page goes from 97,465 bytes down to 16,264 bytes.

I also consolidated redirects from old URLs into Caddy.

1
@blogPost path_regexp blogPost ^/blog/(.+?)/?$
2
redir @blogPost /posts/{re.blogPost.1}/ permanent

/blog/*, /tags/*, /projects, /feed.xml and the like are URLs from the old setup, so they all get 301’d to their new locations.

Deploying with GitOps#

This is my personal favorite part: I never run kubectl apply from my machine.

When I push to main, GitHub Actions first builds the image and pushes it to ghcr.io. Then the same job rewrites the image tag in deploy/deployment.yaml to the commit SHA and commits it back to the repository.

1
- name: Update deployment image tag
2
  run: |
3
    sed -i "s#image: ${REGISTRY}/${IMAGE_NAME}:.*#image: ${REGISTRY}/${IMAGE_NAME}:${GITHUB_SHA}#" deploy/deployment.yaml

On the k3s side, ArgoCD runs permanently and watches this repository. When it detects a change to the manifest, it syncs automatically and the Pods are swapped out for ones running the new image.
In other words, Git is the state of the cluster, and you can tell what’s running just by looking at the repository. If I want to roll back, I just git revert.

ArgoCD itself is also declared as a manifest using k3s’s HelmChart CRD, so even if I rebuild the cluster, I can bring it back with the same steps. Login goes through Entra ID via OIDC, and the local admin account is disabled.
Traefik obtains certificates from Let’s Encrypt using the DNS-01 challenge. Cloudflare sits in front.

Handling secrets#

Secrets like the comment system’s signing key and the OIDC client secret aren’t kept in Git. They live in a self-hosted Infisical instance, and its official operator on the k3s side reads them and turns them into Secrets. The manifest only says which Infisical folder to look at.

1
secretsScope:
2
  projectSlug: doa
3
  envSlug: prod
4
  secretsPath: /yosegaki/yosegaki-secrets

I used to commit secrets encrypted with Sealed Secrets, but re-sealing them every time I changed a value was a pain, so I moved to the current setup, where editing a value in Infisical’s UI swaps out the Pods within seconds. It breaks the “everything is in Git” property, but the references are still in Git, so I can track what lives where.

I wrote my own comment system#

This went back and forth a few times, so I’ll write up the whole story. In the end I’m running something I wrote myself.

On giscus#

Right after the migration I had giscus (the one that uses GitHub Discussions), but requiring a GitHub account to comment just kept bothering me.

On remark42#

So I switched to remark42. It’s a single Go binary and its storage is a BoltDB file, so no separate database is needed. Setting AUTH_ANON=true lets people post without an account.

Readers can stay anonymous, but someone still needs to be able to delete things when trolls show up. So I set it up so that only the admin logs in, via Entra ID. It reuses the same app registration as ArgoCD and my other internal services.
I got stuck here for a bit. If the app registration is single-tenant, you can’t use the default /common endpoint.

1
AADSTS50194: Application is not configured as a multi-tenant application.
2
Usage of the /common endpoint is not supported for such applications.

You need an option to specify the tenant explicitly, and that was only available in remark42 v1.16 and later. Making the app registration multi-tenant would have gotten it working, but that registration is shared with other services, so I wanted to avoid widening its authentication scope. In the end, I solved it by upgrading remark42.

After using it for a while, what bothered me was the look. The site is built with Tailwind, yet the comment section alone clearly looked like something else.
When I tried to fix it, I found out that remark42 is embedded in an iframe. The host page’s CSS can’t reach inside, so there’s no room to tweak it from outside, and the only exposed knob is theme: light | dark. In other words, if you don’t like the look, your only option is to switch.

Comparing the candidates#

I lined up the options that support anonymous comments and whose look I could actually control.

	Implementation / DB	Rendering	Styling	Admin auth
Artalk	Single Go binary / SQLite	Host DOM	CSS variables, dark mode	Password
Isso	Python / SQLite	Host DOM	Completely free	Password
Comentario	Go / SQLite	Web Component	Can be fully disabled and replaced	OIDC supported
Waline	Node.js / various	Host DOM	CSS variables	Password
remark42	Single Go binary / BoltDB	iframe	light/dark only	OIDC supported

I ruled out Cusdis because it’s archived, Commento because it’s been abandoned since 2022 (Comentario is its successor), and utterances and giscus because they require a GitHub account.

I had written Isso off as old, but that was a mistake. With data-isso-css="false" you can drop its default stylesheet entirely; it’s designed with the assumption that you’ll write your own CSS. Its default look is just plain, and you can make it match your site as closely as you like.

I looked at the numbers too. Isso has the most stars at 5,293, but that’s accumulated over 14 years. In Docker pulls, which are closer to real-world usage, Artalk had 639K, while Isso was spread across unofficial images for a total of around 360K. Comentario was in the three digits; good features, but almost no track record.

On Artalk#

The deciding factor was that Artalk runs the same way remark42 does. It’s a single Go binary with SQLite, so I could reuse the one-PVC, single-Pod setup as-is. The manifest only needed the hostname and image swapped.
Since it renders into the host page’s DOM rather than an iframe, there’s still a way to apply CSS, and by wiring its CSS variables to the site’s color scheme I got it to blend in reasonably well.

It came at a cost. Artalk doesn’t have OIDC, so I lost the Entra ID admin login I’d set up. The admin panel uses a single shared password. Since I’m the only admin and all I do is delete spam, I accepted that.

As I used it more, other things started to bother me. Some parts of the Japanese translation were questionable, and the notification center gets separate CSS inside an iframe, so font settings meant for Chinese show up as-is. I sent PRs upstream, but the fact remained that the fonts and wording were decided somewhere out of my reach.
As for styling, I matched what I could with variables, but small overrides kept piling up, like re-inserting stylesheets that disappeared on page transitions and closing gaps in the sort menu. I wanted the site to decide how the comment section looks, but the comment system had its own CSS and the two kept fighting.

On yosegaki#

At that point I figured it would be faster to write my own, and that’s how yosegaki came about. It’s SvelteKit + Bun + SQLite, my usual stack as described in another post.

DAnything

yosegaki

寄せ書き。SvelteKit + Bun + SQLite のコメントサーバ。管理画面なし、どのコメント欄からでもサイト全体の新着と自分宛ての返信が見える

AGPL-3.0

TypeScript

Here are the principles behind it.

No styling of its own. The bundled CSS doesn’t pick colors; it just fades the host page’s text color for borders and backgrounds, so it follows light and dark automatically. You can also throw it out entirely with data-css="false" and write your own
No admin panel. Administration happens inside the comment section itself. The notification panel shows new comments and ones awaiting approval across the whole site, and you can approve, delete, and search across everything right there. Readers never see this entry point; the login button only appears when you open a post’s URL with #yosegaki-admin appended
Admin authentication is OIDC only. Maintaining password authentication yourself is a pain to keep up with, so I never built it. It reuses the same Entra ID app registration as ArgoCD and only lets in people in the admins group. What I set up with remark42 and lost with Artalk came back here
Comments are published immediately without approval. Bots are stopped with Cloudflare Turnstile and a honeypot. Turnstile only appears when needed, so normally you don’t see anything

The API returns only JSON, and the embed script is just one of its consumers. Even if I want to rebuild the UI, the API stays usable as-is.

1
<div id="yosegaki"></div>
2
<script src="https://yk.doany.io/embed.js"></script>

It’s deployed as a Helm chart: CI pushes it to ghcr.io as an OCI artifact, and this blog’s deploy/ references it as a HelmChart. It just keeps one SQLite file on a PVC, so operationally nothing has changed since Artalk.
For the record, when I decided to switch, there were zero comments. Honestly, part of why I could take the plunge so many times is that migration cost was effectively zero.

Subscriptions and support#

These are the things in the sidebar.

The official Ko-fi widget loads an external script, so I implemented it as a plain link. It doesn’t affect page speed and follows the theme’s light/dark mode as-is.

For the newsletter I use Buttondown. I originally planned to use its feature that watches an RSS feed and sends emails automatically, but that turned out to be a $9/month add-on. A bit much for a blog where I write only a few posts a year.
On the other hand, the API is available even on the free plan. All I want is to create an email when a new post is added, so I can write that myself. So I added a workflow that runs when I push a post.

1
- name: Collect newly added posts
2
  run: |
3
    # Only added (A) files. Edits to existing posts don't trigger a send.
4
    FILES=$(git diff --name-only --diff-filter=A "$BEFORE" "$SHA" \
5
      -- 'src/content/posts/**.md' | tr '\n' ' ')

The key is narrowing it down to newly added files with --diff-filter=A. Without it, subscribers would get an email every time I fix a typo.
It only goes as far as creating a draft; I review the content in Buttondown and hit send manually. I plan to switch to automatic sending once I’m used to it, but emails can’t be unsent, so I’ll leave it like this for now.

Keeping up with upstream#

I’m using Fuwari as a theme, so I want to pull in updates from upstream. That said, checking manually every time isn’t sustainable.
So I added a workflow that automatically checks upstream once a month and opens a PR. If the merge goes through without conflicts it opens a PR; if there’s a conflict, it doesn’t create a PR and instead notifies me with an Issue.

To make this work, I also massaged the Git history. This repository and Fuwari originally had no common ancestor at all, so as-is, git merge upstream/main would be rejected with “refusing to merge unrelated histories.” So during the migration, I rebuilt the history so that my changes sit as a single commit on top of all of Fuwari’s commits (the top commit below reads “feat: migrate the Next.js blog’s content onto Fuwari”).

1
$ git log --oneline -3
2
xxxxxxx feat: Next.js 版ブログの内容を Fuwari の上に移行
3
6d39b0d chore(deps): bump the patch-updates group ... (#681)
4
415fb97 chore(deps): bump the patch-updates group ... (#648)

It doesn’t show up as a fork on GitHub, but this achieves what I wanted a fork for (tracking upstream).

Summary#

Since it’s a static site, there’s almost nothing that can go down, and posts go live just by writing them and pushing. Comments are the one thing I now have to look after myself, but in exchange readers can post without an account.
All the source code is public on GitHub. If you have any questions about the setup, I’d appreciate a comment.

DAnything

blog

doany.io のソース — Fuwari ベースの Astro 製静的ブログ

MIT

Astro

I Registered My Station Wagon as a Cargo Vehicle to Cut My Taxes

Wed, 06 Aug 2025 00:00:00 GMT

It’s been a while since my last post. Lately, instead of web stuff, I’ve been completely absorbed in cars.
On that note, I recently had my Subaru Legacy (a “3-number” passenger car) registered as a cargo vehicle (a “1-number” vehicle), so I’m going to write up how I did it.

NOTE
Update (September 2026): I got tired of retracing the steps in this article myself every time, so I built a ledger that turns everything from buying the car to selling it into a series of stages. It’s called Todoroku. I also put the weight distribution Excel sheet I used to work out the maximum payload on the web, so you can use it via the weight distribution calculator mentioned later.

What is cargo registration?#

First, what is cargo registration? The vehicle inspection certificate (shakensho) has a field called “use”. The idea is to change it from passenger to cargo, which changes the tax bracket that applies to the car.
I’ll skip the details of the tax system here, but for the vehicle I registered as cargo this time, the taxes changed as follows. (As of October 3, 2026. For the old weight tax and compulsory liability insurance, I’ve divided the 24-month amounts by 2. The insurance figures are the base rates for policies starting on or after November 1, 2026.)

	Before	After
Automobile tax	51,750	8,800
Weight tax	22,800	8,200
Compulsory liability insurance (jibaiseki)	9,280	17,930
Total	83,830	34,930
Difference	0	-48,900

As you can see, it gets quite a bit cheaper, but there are a few downsides.
The big one is that your ETC (electronic toll collection) toll class goes from standard to mid-size, so tolls go up. Let’s work out how much driving it takes before the savings are wiped out, using the Shin-Tomei Expressway (standard section). NEXCO tolls are (terminal charge of 150 yen + 24.6 yen × distance) × vehicle class ratio × 1.1 (consumption tax), where mid-size is 1.2 times standard, and the portion beyond 100 km gets cheaper through the long-distance discount. Dividing the 48,900 yen difference above by the difference per km gives the yearly expressway mileage at which the savings are wiped out.

Distance per trip	Standard	Mid-size	Difference	Difference per km	Yearly distance where savings are wiped out
50 km	1,518 yen	1,822 yen	304 yen	about 6.1 yen	about 8,100 km
100 km	2,871 yen	3,445 yen	574 yen	about 5.7 yen	about 8,500 km
200 km	4,900 yen	5,881 yen	980 yen	about 4.9 yen	about 10,000 km
300 km	6,795 yen	8,154 yen	1,359 yen	about 4.5 yen	about 10,800 km

The longer each trip, the more the discount helps and the smaller the gap gets. Unless you drive 8,000 km or more a year on expressways, it’s not a problem.
That said, the holiday discount (30% off) applies only to standard cars and kei cars, not mid-size, so if you mostly drive on weekends and holidays, the gap widens. (The late-night discount does apply to mid-size.)

Distance per trip	Standard (holiday discount)	Mid-size	Difference	Difference per km	Yearly distance where savings are wiped out
50 km	1,063 yen	1,822 yen	759 yen	about 15.2 yen	about 3,200 km
100 km	2,010 yen	3,445 yen	1,436 yen	about 14.4 yen	about 3,400 km
200 km	3,430 yen	5,881 yen	2,450 yen	about 12.3 yen	about 4,000 km
300 km	4,756 yen	8,154 yen	3,397 yen	about 11.3 yen	about 4,300 km

The other one is that the vehicle inspection (shaken) becomes yearly. That adds an inspection fee once a year, but it’s only around 2,600 yen (the fee for bringing a standard-size car in for inspection yourself, after the April 2026 revision). Some of you probably leave your shaken to a dealer or a shop, but if it’s a Japanese car, it’ll pass the inspection with hardly any maintenance. If you’re reading this article, you presumably want to save on running costs, so if you want to keep them down, buy your own tools and at least google the bare-minimum maintenance needed to keep a car going. If you can’t do that, just do what the dealer says and pay up. That’s what the service fee is for.

The cargo registration process#

Getting a parking space certificate#

This isn’t actually related to cargo registration, but you need it to transfer the vehicle into your name.
In my case, I submitted the documents below to the police station with jurisdiction over the parking lot I rent. Each prefectural police force publishes which station covers which area on its website. If yours doesn’t, just call and ask.

Application for a parking space certificate (2 copies (1 copy if there’s no revenue stamp, e.g. when paying cashless))
Location map and layout diagram of the parking space

I filled in both of the above by editing the XLSX files on the page below on my computer. They don’t need to be handwritten.
Parking space certificate application procedures (Japanese)

Certificate of consent to use the parking space

For this one, if it meets the requirements (lessor, lessee, contract date, contract end date, etc.), you may be able to use something like your parking lot lease instead.
I always apply with a copy of my parking lot lease. It’s a good idea to ask the police station whether your own lease will be accepted.

Reference: Parking space requirements and documents proving the right to use it (Japanese)

Getting a temporary license plate#

The car I put through this time had already been temporarily deregistered (ichiji massho) when I bought it, so I went to borrow a temporary license plate (kari number). Without one, you can’t drive the car to the inspection or to get it serviced for inspection.
To borrow a temporary plate you need compulsory liability insurance, but the car I’d bought had already let its policy lapse, so I took out a 5-day policy under a “commercial vehicle” contract.
It used to be possible to get a one-month compulsory liability policy for a deregistered vehicle, but apparently the rules on compulsory liability insurance were tightened, and now, when the purpose is borrowing a temporary plate, you can only get a 5-day contract as a commercial vehicle.
Also, some compulsory liability insurance agents don’t handle commercial vehicle contracts. You can reliably get one at the administrative scrivener (gyoseishoshi) offices on or near the grounds of the regional transport bureau (rikuunkyoku) office, or at an insurance company’s branch office. The car accessory stores I tried didn’t offer it.
Once you have the insurance, go to your nearest city hall or a branch office that lends temporary plates and apply to borrow one. The maximum loan period is 5 days, so I recommend going to borrow it only after the parking space certificate above has been issued and the pre-screening described later is done. I got the order wrong myself once and nearly ran out of my 5 days, so the stages in Todoroku include this order, what to bring to each counter, and where you need cash.

Modifications for cargo registration#

Criteria for being classified as cargo#

First, how are the inspection criteria for each type of use set for cars? They’re determined by government ordinances from the Ministry of Land, Infrastructure, Transport and Tourism (MLIT).
Some of you might be thinking, “Isn’t that set out in the Road Transport Vehicle Act?”, but the Act only covers things in broad strokes, and how to interpret it is laid down separately in ordinances.
The official line is that automotive technology changes so fast that it has to be done this way, but I think it’s really a system for keeping everyone involved happy.
The criteria for passing inspection as a cargo vehicle are roughly as follows. I’ve pulled these from the ordinance and rewritten them in plain language.

The floor area of the cargo space must be at least 1 m2
The floor area of the cargo space must be larger than the floor area of the passenger seating
The load weight must exceed the occupant weight of the passenger seating
The opening for loading and unloading goods must be at least 800mm*800mm (height and width), with a projected area of at least 0.64 m2
There must be a protective partition between the occupants and the cargo space

NOTE
“Passenger seating” means the second row and beyond. It doesn’t include the first row, where the driver’s seat is.

Reference: On the Classification of Vehicle Uses, etc. (Directive) (Japanese)

On top of what’s written in the ordinance, NALTEC (the National Agency for Automobile and Land Transport Technology, which carries out vehicle inspections) has its own Examination Procedures Regulations (shinsa jimu kitei), which spell out how to handle points the ordinance doesn’t cover.
You might wonder whether a body that isn’t even the national government gets to interpret laws and ordinances however it likes, but swallow that for the sake of saving money.
Below are the provisions that add extra conditions for cargo registration. I’ve cut the irrelevant parts.

Chapter 4: How examinations related to vehicle inspections, etc. are conducted
4-17 Examination of cargo vehicles
4-17-1 Determination of use
(2) For designated vehicles, etc. with four or more wheels certified as passenger vehicles (limited to those whose body type is box, hood or station wagon), and for parallel-imported vehicles classified as “related to designated vehicles, etc.” with respect to such vehicles, the space for carrying the occupants’ belongings shall not be deemed a goods loading facility under the use classification directive.
However, limited to vehicles whose body type is station wagon (including vehicles other than station wagons that can be classified as station wagons when 6.2.7. of Attachment 3, “Guidelines for Examination of Parallel-Imported Vehicles”, is applied mutatis mutandis, and hood-type vehicles whose hood behind the seats extends to near the rear end of the vehicle), where the rear seats, etc. are removed (including vehicles certified with multiple seating capacity settings that were certified in a state equivalent to having the rear seats, etc. removed) or stowed and fixed to the floor, the resulting floor surface and the space for carrying the occupants’ belongings that is continuous with that floor surface shall be deemed a goods loading facility. Source: Chapter 4: How examinations related to vehicle inspections, etc. are conducted (Japanese)

In short, it comes down to this:

The luggage space that box-type, hood-type and station wagon bodies come with from the factory is not counted as a goods loading facility under the use classification directive.
For station wagons, or vehicles that can be classified as station wagons by applying 6.2.7. of the Guidelines for Examination of Parallel-Imported Vehicles, the space created by removing or stowing seats plus the original luggage space together count as the goods loading facility.

What I actually modified#

Here are the modifications I made to meet the requirements above.

The opening for loading and unloading goods must be at least 800mm*800mm (height and width), with a projected area of at least 0.64 m2

For this one, measure with a tape measure; if it’s 800mm or more, you’re basically fine. Note that it’s the height of the opening that matters, not the height of the cargo area.

The floor area of the cargo space must be at least 1 m2
The floor area of the cargo space must be larger than the floor area of the passenger seating
The load weight must exceed the occupant weight of the passenger seating

This time I decided to fold down the right side of the second-row seat and fix it in that position (the NALTEC procedures say “stowed and fixed”, so it has to be fixed) to increase the cargo area.
As for how to fix it, I put a bolt through the headrest hole, attached a chain to it, and connected the chain to the striker under the seat that holds the seat cushion in place. It’s easy to remove, but I think most people would still call that fixed.
Also, some inspectors will tell you the floor has to be flat, but under the law and the ordinances it doesn’t have to be.
Note 2(2) of the 自動車の用途等の区分について（依命通達） (“On the Classification of Vehicle Uses, etc. (Directive)”) I listed in the references earlier says: タイヤえぐり、蓄電池箱等の占める面積は、物品の積載に支障がない限り物品積載設備の床面積に含めるものとする。 (“The area occupied by wheel wells, battery boxes, etc. shall be included in the floor area of the goods loading facility as long as it does not interfere with loading goods.”)
Reading this, it says that even areas with curved parts such as wheel wells count as loading area as long as they don’t get in the way of loading goods. “Goods” isn’t defined here and could include things like gravel, so I think it’s reasonable to read it as not requiring a flat floor.

There must be a protective partition between the occupants and the cargo space

I bought one of those wire mesh panels used for shelving at a 100-yen shop, bent it 90 degrees and slid it under the folded seat.
During the inspection, the inspector pointed out that it wasn’t fixed with bolts. I replied, “Even if it were bolted in, you could take it out by turning the bolts, so there’s no meaningful structural difference, right?” The inspector wandered off somewhere muttering to himself, and the inspection passed without a hitch.
Besides, nothing specifies what kind of fixing a protective partition actually needs, so something like the tension rods you see in ordinary vans should be fine too.
As you can see, the safety standards compliance inspection that NALTEC carries out involves a lot of arbitrary judgment by inspectors, so on inspection day it’s best to have a solid understanding of the actual ordinances and the reasoning behind them, enough to win the argument with the inspector.
In the first place, as the Road Transport Vehicle Act states, NALTEC staff are required to report the results of their standards compliance examination in writing to MLIT. In other words, if they write something in the examination results that contradicts the Road Transport Vehicle Act or the procedures drawn up in line with MLIT ordinances, it could constitute the crime of making a false official document bearing a seal. In fact, there has been a case in the past where someone was charged, though prosecution was ultimately suspended.
If even that doesn’t get you anywhere, an inspection decision is, I believe, a form of administrative action, so filing a request for administrative review (shinsa seikyu) is another option.

About the maximum payload#

For cargo registration there’s a provision like the one below. Earlier, you’ll also remember the requirement the load weight must exceed the occupant weight of the passenger seating.
On top of that, the ordinance defines passenger seating as everything except the front seats, and NALTEC’s rules say the payload is calculated in 50 kg increments.
Putting it all together, the payload has to be at least 100 kg and must not push the car past the maximum gross vehicle weight within the same classification.
In my case, I only stowed and fixed the seat, so the car could end up exceeding the maximum gross vehicle weight within the same classification (you can find this out by asking the manufacturer or NALTEC).
That means you’ll need to remove things like the spare tire. If that’s still not enough, try removing the onboard tools, the luggage board, the car navigation system and other interior parts.

(e) For designated vehicles, etc. whose permissible limits for gross vehicle weight and axle load are not clear, it shall be specified within a range not exceeding the maximum gross vehicle weight within the classification of the same model. (f) For vehicles other than those specified in (a) through (e), it shall be specified within a range not exceeding the weight obtained by multiplying the number of occupants for the removed passenger seating by 55 kg. Source: 7-124, 8-124 Maximum payload (Japanese)

Now take a look at the provision below. Based on the wording 産出される物品の積載量のうち最大のものとする (“shall be the largest of the calculated payloads”), NALTEC will tell you to take the largest payload possible within the gross weight.
The problem here is that taking the maximum payload can push the gross vehicle weight over 2 tonnes. Over 2 tonnes, the weight tax goes up, so I think it’s better to keep it as light as you can.
To make it easier to follow, take a car with a spec maximum gross vehicle weight of 2,040 kg, and compare a measured vehicle weight of 1,895 kg + 100 kg = 1,995 kg with 1,890 kg + 150 kg = 2,040 kg.
In that case, making it too light actually increases your weight tax, so it takes some fine-tuning. Usually you can adjust it by leaving in or taking out the luggage board and interior parts.
For these calculations, I’ve put the Excel sheet I made for myself on the web, so use the weight distribution calculator. Enter the front and rear axle weights, the wheelbase, the position of the seats you’re keeping, the payload and the tires’ load index, and it gives you the gross vehicle weight and the maximum payload you can get from the classification (in 50 kg increments). It also checks the front axle load ratio when loaded (it won’t pass below 20%) and the tire load ratio. You can see the verdict without logging in.
I haven’t verified whether it actually works yet, but for cars like one with a maximum gross vehicle weight of 2,090 kg, which ends up over 2 tonnes no matter what you do, I think you could register it once at over 2 tonnes and then get the gross weight to 2 tonnes or less by fully removing the seats and taking out interior parts to lighten it.

(1) The maximum payload of a vehicle shall be the largest of the payloads of goods calculated based on the standards in (2) through (11), as the amount that can be loaded within a range that complies with the provisions of this chapter, ensures safe operation, and prevents pollution.

Pre-screening#

As of April 2025, the rules were revised to make it clear that pre-screening is not required for some structural modifications.
Even under the previous rules, depending on how you read them, pre-screening didn’t seem to be required for things like station wagon -> van, but interpretations probably differed between regional NALTEC offices, and I suspect the revision was meant to keep that from becoming a problem.
So this section is no longer needed, but there’s always a chance that document screening will be required again in the future, so I’m leaving it here.
Partial revision of the Examination Procedures Regulations (63rd revision) (Japanese)

Since October 28, 2024, you can submit the documents online. However, some documents have to be prepared on your end and then uploaded, so you’ll apply once you have the full set ready.
It takes up to 15 days from submission to get a response. So if you’ve already had your parking space certificate issued, submit early. (A parking space certificate is valid for about a month.) In my case, when I mentioned upfront that my parking space certificate was close to expiring, they processed it quickly.

How to submit#

Create an account on this site. You can do it via Log in -> Register account
Once you’ve created an account and logged in, click New Inspection Notification
Click Create Notification
Select and fill in the following, then click Next
1. Notification method: 個別届出 (“Individual notification”)
2. Supplementary provision: 技術基準等の審査を要する自動車、自動車予備検査証の交付を受けた自動車又は使用の過程にある自動車若しくは特定の大型特殊自動車 (“Vehicles requiring examination against technical standards, etc., vehicles issued a preliminary vehicle inspection certificate, vehicles in use, or certain large special vehicles”)
3. Category: 3.2.（1）技術基準等の審査を要する自動車 (“3.2.(1) Vehicles requiring examination against technical standards, etc.”)
4. Submit to: select the inspection office where you’ll take the inspection
5. Make, model and chassis number: fill in exactly as on the vehicle inspection certificate
Fill in the New Inspection Notification Form (Form No. 1) (Part 1) as follows
1. Classification number or vehicle specification code: select 類別区分番号 (“Classification number”) and enter the classification number shown on the vehicle inspection certificate in the input field
2. Structures and equipment changed relative to the designated vehicle of that model and classification number
  1. Structure/equipment changed: select 有 (“Yes”)
  2. Option: select （記入欄のとおり） (“(As described in the entry field)”)
  3. Entry field: enter the following (adjust to match your car’s current specs)
```
1
乗車定員の変更（5人→3人）2列目右側座席固定
2
用途変更（乗用→貨物）
3
車体形状の変更（ステーションワゴン→バン）
```
  (“Change of seating capacity (5 → 3), right-hand second-row seat fixed / Change of use (passenger → cargo) / Change of body type (station wagon → van)”)
  1. Changes to structures/equipment related to the noise prevention device: 無 (“No”)
  2. Over-revolution prevention device related to the noise prevention device: 無 (“No”)
The documents to upload for the New Inspection Notification Form (Form No. 1) (Part 2) can be created with a Windows application that NALTEC distributes. Download the zip file from the link below and run InitPreEntry.exe in the bin folder to launch it.
- New Inspection Notification Form No. 1, Part 2
- You can fill in the values by actually measuring the car or by asking the manufacturer for its spec sheet.
- For the parts that need calculations, some NALTEC offices may give you something called a weight distribution calculation sheet, but this seems to vary from office to office. Just copy over the numbers from the weight distribution calculator mentioned earlier.
For the document identifying the vehicle, upload a scan of the Registration Identification Information Notice (toroku shikibetsu joho-to tsuchisho)
For the spec sheet or vehicle specification table, upload the specs you got from the manufacturer and the four-view exterior drawing
For the document certifying compliance with technical standards, upload the “Document on Compliance with the Technical Requirements of Each Provision of the Safety Standards”. Fill it in with calculations that fit your own car.
- ※ Update (October 2026): I’ve stopped publishing the Word file with sample inputs that I used to distribute here. Now, on the structural modification screen in Todoroku, you can generate this document and the four-view exterior drawing from the vehicle values you’ve entered in the ledger.
Under other documents, upload the following
- A side-view photo annotated with the overall length
- A front-view photo annotated with the overall width
- A rear-view photo annotated with the overall height, the cargo area height and the opening height
- Photos showing the fixed seat cushion and the partition between the seats and the cargo area

Registering for cashless payment#

Since January 2023, you can pay the fees for inspection and registration cashless.
You can register your payment details below.
Vehicle ownership procedures: payment information registration service (Japanese)

When registering your payment details, set the procedure type to used-vehicle new registration (chuko shinki). Otherwise, you can’t change the procedure type later, and you’ll end up paying in cash when the vehicle inspection certificate is issued.
If the car still has inspection time left and you’re not getting a tax refund via temporary deregistration or the like, choose structural modification.
Compulsory liability insurance is handled separately, so you’ll need cash just for that. Car accessory stores let you buy compulsory liability insurance by card, so getting it there is another option.
Also, the license plate fee at the plate center and the hole-punching fee for keeping your old plates as a souvenir are cash only.

Inspection day#

Before inspection day, you need to book through the site below. When booking, the inspection type is 構造等変更検査 (“structural modification inspection”) even if the car has already been temporarily deregistered.
That said, at some locations it can be very hard to get a booking.
That’s because some businesses grab booking slots for multiple cars and cancel only the ones for cars that don’t show up on the day. There’s no particular penalty for doing this, so slots can fill up.
On the other hand, businesses that operate like this often cancel bookings on the day, so slots sometimes open up the same day. It’s worth checking early in the morning or during the first round of inspections.
Vehicle inspection online booking system (Japanese)

Here’s roughly how the day goes. The finer details probably differ between transport bureaus, so I’ll leave them out.
Also, if you didn’t register for cashless payment, you’ll have two or three extra forms to fill in on the day, so I recommend doing the procedures cashless if you can. The steps below leave out the cash-payment procedures.

There’s a PC for printing inspection reception documents near the inspection reception counter at the registration office; scan the QR code on the vehicle inspection certificate and print the reception documents
Go through the inspection in the regular periodic inspection lane
Pick up the screening documents at the inspection booth where you submitted them ※not needed if you didn’t do pre-screening
Have the vehicle weight and so on measured in the new-inspection lane
Take out compulsory liability insurance as a standard cargo vehicle
Whether it’s a used-vehicle new registration or a structural modification, fill in Form No. 1 and submit it at the registration counter
Fill in the tax declaration form, go to the tax declaration counter and submit it
Get your license plates at the plate counter (if the car still has its old plates, remove them first)
Put the plates on and have them sealed

Wrap-up#

I’m not a pro at administrative procedures, politics or law, so there may be mistakes in this post or in my thinking. If you spot any, I’d really appreciate your comments. As I mentioned at the top, I’ve turned the flow in this article, plus buying the car beforehand and selling it afterwards, into an 8-stage ledger in Todoroku. If you’re the next person to go through this, starting from the ledger keeps what to bring, where you need cash and what you spent all in one place, which should make things easier. I did cargo registration this time to save on taxes, but I’m left with some questions: isn’t the current tax system barely based on the beneficiary-pays principle in the first place? And aren’t these regulations driven mostly by the agendas of NALTEC and the police, rather than actually contributing to safer roads? What do you all think?

Notes on Unlocking the ATA Lock on a Mercedes NTG

Sat, 25 May 2024 00:00:00 GMT

There’s a well-known method using xboxhdm, described in the thread below, but xboxhdm v1.9 doesn’t support SATA connections, so it can’t be used on NTG 4.5 and later, which use SATA.
NTG4.5 / 4.7 HDD imaging project
That thread also covers approaches like using fujtool, but I wanted to know whether a SMART editing tool for Windows could unlock the drive in the first place.
smartctl is a SMART tool that runs on Windows and supports USB, SATA and so on, and the latest xboxhdm, v2.3, actually uses smartctl for its unlockhd command.

So my guess is that, combined with the password generation steps described in the forum thread above, commands like the following should be able to unlock the drive.

1
./smartctl.exe -s security-unlock,"longUserPasswordFromMelcoCalculator" /dev/sdb
2
./smartctl.exe -s security-disable,"longUserPasswordFromMelcoCalculator" /dev/sdb

Registering a Vehicle Ownership Transfer Online with OSS

Mon, 01 Jan 2024 00:00:00 GMT

Another car post, following on from last time.

NOTE
Update (September 2026): After writing this post I started a used car dealership, and I still use OSS for transfer registrations where I’m the applicant. I built Todoroku, which turns the paperwork from purchase to sale into a ledger. Two things in it are relevant to this post: scanning the QR code on a vehicle inspection certificate with your phone lets you export the vehicle inspection certificate import file mentioned below, and when you apply for a parking space certificate at the same time, you can draw the location map and layout diagram on top of a map. I’ve added notes at the relevant spots. I also reviewed the steps as of September 2026 and added notes on what has changed (the abolition of the parking space sticker, the supported environment, and link targets).

What is OSS?#

OSS (ワンストップサービス, “One Stop Service”) is a service from the Ministry of Land, Infrastructure, Transport and Tourism that lets you handle vehicle registration procedures, such as a transfer of ownership registration (iten toroku), over the internet.

How it differs from the regular procedure#

These days car dealerships and the like adopt it to streamline their paperwork. It differs from the regular procedure in the ways below, but for personal use there aren’t many benefits.

You can apply for the parking space certificate (shako shomei, proof that you have somewhere to park the car) at the same time, so you make fewer trips to the police station
Fees can be paid via Pay-easy, credit card, and so on, so even if the regional transport bureau (rikuunkyoku) with jurisdiction doesn’t accept cashless payments, you can pay without cash.
If you apply with an electronic certificate, you don’t need your own seal registration certificate (inkan shomei), so you save the cost of getting one
You don’t have to fill in paper forms (except the transfer certificate and power of attorney)
You can use the electronic vehicle inspection certificate (shakensho) to cut down the time spent entering vehicle details

The actual process#

If you bought the car from a dealer that uses OSS, the transfer certificate (joto shomeisho) and other documents may already be registered electronically, but that’s rare, so here I’ll go through the case where you received a paper power of attorney (ininjo) and a paper transfer certificate.

Advance preparation#

OSS browser add-on#

You need to install a browser add-on to use OSS.
Install the add-on and the Chrome extension from the links below.
In my case I used Microsoft Edge, and it works the same in Edge.
OSS browser add-on (Japanese)
Chrome extension

NOTE
Update (September 2026): Officially supported environments are now only Edge or Chrome on Windows 11 (24H2 and 25H2). Windows 10 is not supported. Supported environments (Japanese)

My Number–related setup#

Some applications require the digital signature function of your My Number Card (Japan’s national ID card). If you’ll read the card with a card reader connected to your PC, install 利用者クライアントソフト (“User Client Software”); if you’ll read it with your smartphone, install マイナポータルアプリ (“Mynaportal app”).
Here I’ll go with the PC route.

You can install the User Client Software from the link below. Download it from 利用者クライアントソフトのダウンロード (“Download the User Client Software”). You don’t need to install the browser version.
Public Certification Service for Individuals (JPKI) portal site (Japanese)

The Mynaportal app is available here.
android
iOS

Cashless payment registration#

If you want to use cashless payment such as a credit card, you need to register via the link below.
Payment information registration service (Japanese)

Reading the electronic vehicle inspection certificate#

You can use the electronic vehicle inspection certificate to skip some of the data entry.
Vehicle inspection certificate viewer app

NOTE
Update (September 2026): iPhone and Android versions are now out too, so you can export the vehicle inspection certificate import file from your phone as well. About the viewer app (Japanese)

Update (September 2026): The vehicle inspection certificate import file that the viewer app exports can also be exported from Todoroku. Scan the QR code on the vehicle inspection certificate with your phone to register a car, and you can download JSON in the same format from the vehicle details screen. You can create it even after you’ve put the certificate back in the car.

Creating the attorney information file#

You’ll be creating an electronic power of attorney, but before that you need to create a file with your own details called the attorney information file (受任者情報ファイル).

Create attorney information file (Japanese)
Click “Start application” on the page above
Select IC card
Select “Use a card reader”
Enter your digital signature password and read your My Number Card
For the item 自動車の車台番号をご存知ですか。 (“Do you know the vehicle’s chassis number?”), select No (selecting No here lets you use the file for applications with no restriction on which vehicle you’re applying for)
Save the attorney information file

Creating the power of attorney#

You’ve probably received a paper power of attorney, but you also need to create one electronically.
You can create it from the link below.
Create power of attorney (Japanese)

I didn’t know the other party’s phone number, so I entered my own, and that was fine.
For the attorney information file field, specify the file you created earlier.
Here you need to enter the chassis number.
For 所有者・使用者の別 (“Owner or user”), select the previous owner. (If you don’t select this correctly, you can’t submit the application.)

Transfer of ownership registration#

Apply for the transfer of ownership registration from the link below.
Transfer of ownership registration (Japanese) (*Update (September 2026): The page had moved, so I fixed the link)

For the type of transfer certificate, select paper.
If you select No for すでに取得済みの保管場所証明書を利用した申請ですか。 (“Are you applying with a parking space certificate you’ve already obtained?”), you can apply for the parking space certificate at the same time.
- *Update (September 2026): A simultaneous application requires attaching images of the location map and layout diagram. You can scan hand-drawn ones, but with Todoroku you can pull up an aerial photo from the address, draw the parking space and road width, and download an image that meets OSS’s requirements (JPEG, up to 1024×768, around 100KB). I’ve summarized what the reviewers check (within 2km of the vehicle’s base of use, whether the car fits in the space) in How to apply for a parking space certificate yourself (Japanese).
For the power of attorney, select the one you created earlier.

Submitting the documents#

Even though you apply electronically, you still have to submit the paper originals of the power of attorney and the transfer certificate.
After completing the application on OSS, you need to go to the regional transport bureau and submit them.
It probably varies by bureau, but at Narashino, where I went, there was a dedicated OSS reception window, and I submitted them there.

Paying the fees#

You get an email every time the status is updated. Check it as soon as one arrives.
After you submit the documents, the application status updates to “awaiting payment of the parking space certification fee.” You can log in to the application screen from the URL in the email, so log in with the password you set when applying and pay via Pay-easy or a supported financial institution.
After payment a police internal management number is issued, and apparently you can phone that number in to the police station with jurisdiction and ask them to mail you the parking space sticker (hokan basho hyosho).

Then after 2 or 3 days the status changes to “awaiting payment of the parking space sticker fee,” so pay that the same way.
The day after paying, it changes to “awaiting payment of the inspection and registration fee.” Pay this one the same way too, but because the payee is different, the supported financial institutions are different. Pay-easy works for this one as well.

NOTE
Update (September 2026): The parking space sticker (the garage sticker) was abolished on April 1, 2025, so there’s no longer a sticker fee to pay. Now it’s the parking space certification fee, then the inspection and registration fee, then automobile tax if applicable, in that order. The parking space certification fee varies by prefecture.

Picking up the parking space sticker and vehicle inspection certificate#

By the time you’ve paid the inspection and registration fee, the parking space sticker has been issued, so go pick it up at the police station with jurisdiction.

NOTE
Update (September 2026): Since the sticker was abolished, the step of going to the police station to pick it up is gone. The parking space certificate result is passed to the District Transport Bureau (unyu shikyoku) within OSS, so the only place you need to go is the regional transport bureau.

After that, go to the regional transport bureau to pick up the vehicle inspection certificate. If the transfer of ownership changes which regional transport bureau has jurisdiction, you’ll need new license plates, so bring the car with you.
The order above doesn’t matter; it’s fine to go pick up the vehicle inspection certificate first.

Summary#

That’s the general flow. Since the paper documents have to be submitted to the regional transport bureau, there isn’t much benefit to doing it over the internet. On top of that, the choices on the application screens are convoluted, so I think it’s hard to use unless you’re reasonably familiar with the procedures. I suspect it’s like this because they digitized the existing process as is, but personally I wish they’d stop doing that.

NOTE
Update (September 2026): Things are different when you’re on the selling side as a dealership. Under the amended Administrative Scriveners Act (Gyoseishoshi-ho) that took effect in January 2026, a dealer preparing the buyer’s application documents is now a violation regardless of what it’s called. The same goes for proxy applications through OSS. I’ve written about how much a dealer can do in What used car dealers can and can’t do under the amended Administrative Scriveners Act (Japanese).

Audi Coding Notes

Wed, 08 Jul 2020 00:00:00 GMT

CAUTION
I accept no responsibility whatsoever if following the steps below damages your vehicle or causes it to fail its vehicle inspection (shaken).
Do this entirely at your own risk.

I used VCDS to customize how the electrical systems on my Audi behave (apparently this is commonly called “coding”), so here are the steps and the things you can customize.

1. Getting a VCDS cable#

Search for “VCDS” on Yahoo! Auctions, Rakuten or similar and you’ll find cables; just buy one of those and you’re fine.

The listings mention version numbers and such, but the product detail page lists the supported models and model years. Generally, buying a fairly recent one will do.

2. Setting up the PC#

Most cables come with a disc, so read what’s on it and set things up accordingly.

Once you can launch the VCDS application, first grab the map data via Auto-Scan and save it. You can use it for restoring later.

3. Settings list#

To customize anything, plug the cable into the car’s OBD2 port and the PC, then click Select under Select Control Module. The numbers below are the ones in that menu. Depending on the model, some items may not exist; in that case they may be under a different item, or the car may not support them.
These are for the A5 (B8).

1
- Rebooting the MMI
2
Pre-facelift: press SETUP + the center of the joystick + the top-right button at the same time
3
Facelift: press MENU + the center of the joystick + the top-right button at the same time
4
No need to hold them; if the simultaneous press registers properly, it reboots the moment you let go.
5
- Enabling the green menu
11 collapsed lines
6
For MMI 2G
7
[07-Bed.Paneel/Display]
8
[Aanpassen-10]
9
[Kanaal 08]  enter '1'
10
Pre-facelift: press SETUP + CAR at the same time
11
Facelift: press CAR + MENU at the same time
12
For MMI 3G
13
[5F-Informatie Electr.]
14
[Aanpassen-10]
15
[Kanaal 06]  enter '1'
16
The menu is opened the same way
17
- Showing the cruise control distance setting screen
4 collapsed lines
18
[13-Afstandsregeling]
19
[Aanpassen-10]
20
[Kanaal 07]  set the value to '1'
21
It should appear in the MMI under CAR -> ACC.
22
- Setting the speed at which parking assist turns off
4 collapsed lines
23
[10-Parkeerhulp]
24
[Aanpassen-10]
25
Pre-facelift  [Kanaal 23]  max 20 km/h
26
Facelift  [Kanaal 233]  max 20 km/h
27
- Recirculation while parked (not an add-on unit, but apparently it's called parking air conditioning)
5 collapsed lines
28
[08-Airco/Verwarming]
29
[Hercoderen-07] longcoding
30
[Byte 01]  [Bit 4]  enable
31
Show the green menu -> 'Car' -> 'cardevicelist' -> 'Auxillary heating' enable
32
Show the green menu -> 'Car' -> 'carmenuoperations' -> 'Auxillary heating' set this item to 5
33
- Enabling key answer-back & showing the settings in the MMI (only on cars with an anti-theft system)
6 collapsed lines
34
[46-Comfortsysteem]
35
[Hercoderen-07] longcoding
36
[Byte 01]  [Bit 2]  enable
37
[46-Comfortsysteem]
38
[Aanpassen-10]
39
[Kanaal 63]  default 40; 44 to enable
40
- Enabling the alarm with interior monitoring (not standard on Japanese-market cars, but if you've retrofitted it)
8 collapsed lines
41
[46-Comfortsysteem]
42
[Hercoderen-07] longcoding
43
[Byte 01]  [Bit 1]  enable anti-theft system
44
[Byte 01]  [Bit 2]  enable horn alarm
45
[Byte 01]  [Bit 3]  enable tilt sensor
46
[Byte 01]  [Bit 4]  enable interior monitoring
47
[Byte 01]  [Bit 5]  enable rear window sensor
48
[Byte 01]  [Bit 6]  enable anti-rod monitoring wireless contact
49
- Enabling Autobahn lights
6 collapsed lines
50
Turns on at 130 km/h; not confirmed whether it passes vehicle inspection (shaken) in Japan
51
[09-Boordnet]
52
[Hercoderen-07] longcoding
53
From the dropdown at the top, pick the one that looks like this
54
'2 -- xxx -- RLS' (Rain and Light Sensor)
55
[Byte 00]  [Bit 0]  enable

Saving Periodic RDS Dumps to S3 with ECS

Thu, 31 Oct 2019 00:00:00 GMT

Overview#

I wanted to take periodic dumps of RDS on AWS, so I set things up to grab dumps on a schedule using ECS’s cron-like feature.
I also automated the management of the container image and task that ECS runs on a schedule.
This post targets postgres; for mysql and the like, adjust the Dockerfile as needed.

Prerequisites#

An AWS account
An RDS instance already set up
A bitbucket account

Preparation#

Creating an IAM user#

Here we’ll create a user for deploying from bitbucket pipeline and for uploading the dump data to S3.
Normally you’d want separate users for deployment and S3, but to keep management overhead down I’m creating just one.

Open IAM, go to Users in the left menu, then open Add user, and you’ll get a screen like the one below.
Enter a user name as you like, and limit the access type to programmatic access.

Select AmazonECS_FullAccess, AmazonEC2ContainerRegistryFullAccess, and AmazonS3FullAccess (I wanted to use the same user from the CLI, so the permissions are broad. If you know what you’re doing, narrow them down as appropriate.)

There’s nothing else in particular to configure after that, so proceed through to creating the user.
At the end you’ll see a screen like this; make a note of the access key ID and secret access key. You can issue additional secret access keys, but this one can never be displayed again, so be absolutely sure to write it down.

Creating an IAM role#

This is the role used to run tasks. It normally gets created automatically, but if you’ve never used ECS at all it won’t exist yet, so create it manually.
(If you already have a role ending in ecsTaskExecutionRole, make a note of its ARN.)
Open IAM, go to Roles in the left menu, then open Create role, and you’ll get a screen like the one below.
Select Elastic Container Service, then select Elastic Container Service Task, and click Next.

Select AmazonECSTaskExecutionRolePolicy; there’s nothing else in particular to configure after that, so proceed through to creating the role.

Once it’s created you’ll be taken back to the original screen, so open the role you just created and make a note of the ロール ARN (“Role ARN”) shown on the screen below.

Creating a bucket#

There’s nothing special to configure. Create it with whatever settings suit you.
Make a note of the name you give it.

Creating an ECR repository#

Again there’s nothing special to configure, but since the pipeline overwrites tags, make sure tag immutability is disabled (it’s disabled by default).
After creating it, make a note of the URL-like value in the URI column.

Creating a repository on bitbucket#

Create a repository as you normally would.
Locally, create the following files.

1
~/
2
 ├ .pgpass
3
 ├ bitbucket-pipelines.yml
4
 ├ Dockerfile
5
 └ docker-entrypoint.sh

.pgpass is a password file that lets you access postgres without typing a password. Write it as follows.

1
hostname:port:database:username:password

bitbucket-pipelines.yml is the file that defines the bitbucket pipeline. Write it as follows.
Fill in the ロール ARN (Role ARN) you noted earlier for execution-role-arn.

1
# enable Docker for your repository
2
options:
3
  docker: true
4

5
pipelines:
6
  default:
7
    - step:
8
        name: build-push
9
        image: atlassian/pipelines-awscli:latest
10
        deployment: test
11
        caches:
12
          - docker
13
        script:
14
          # aws login
15
          - aws ecr get-login-password --region ${AWS_DEFAULT_REGION} | docker login --username AWS --password-stdin ${AWS_REGISTRY_URL%%/*}
16
          # docker
17
          - export BUILD_ID=$BITBUCKET_BRANCH_$BITBUCKET_COMMIT_$BITBUCKET_BUILD_NUMBER
18
          - docker build -t ${AWS_REGISTRY_URL}:$BUILD_ID -t ${AWS_REGISTRY_URL}:development .
19
          - docker push ${AWS_REGISTRY_URL}
20

21
    - step:
22
        name: deploy
23
        image: atlassian/pipelines-awscli:latest
24
        deployment: production
25
        script:
9 collapsed lines
26
          - export BUILD_ID=$BITBUCKET_BRANCH_$BITBUCKET_COMMIT_$BITBUCKET_BUILD_NUMBER
27
          - export IMAGE_NAME="${AWS_REGISTRY_URL}:$BUILD_ID"
28
          # ECS variables
29
          - export ECS_CLUSTER_NAME="${BITBUCKET_REPO_OWNER}"
30
          - export ECS_SERVICE_NAME="${BITBUCKET_REPO_SLUG}"
31
          - export ECS_TASK_NAME="${BITBUCKET_REPO_SLUG}"
32
          # Create ECS cluster, task, service
33
          - aws ecs list-clusters | grep "${ECS_CLUSTER_NAME}" || aws ecs create-cluster --cluster-name "${ECS_CLUSTER_NAME}"
34
          # Updating the existing cluster, task, service
35
          - export TASK_VERSION=$(aws ecs register-task-definition
36
            --family "${ECS_TASK_NAME}"
37
            --execution-role-arn ""
7 collapsed lines
38
            --network-mode "awsvpc"
39
            --requires-compatibilities "FARGATE"
40
            --cpu "256"
41
            --memory "512"
42
            --container-definitions "[{\"name\":\"${ECS_TASK_NAME}\",\"image\":\"${IMAGE_NAME}\",\"logConfiguration\":{\"logDriver\":\"awslogs\",\"options\":{\"awslogs-group\":\"/ecs\",\"awslogs-region\":\"${AWS_DEFAULT_REGION}\",\"awslogs-stream-prefix\":\"${ECS_TASK_NAME}\"}}}]"
43
            | jq --raw-output '.taskDefinition.revision')
44
          - echo "Registered ECS Task Definition:" "${TASK_VERSION}"

NOTE
Update (October 2026): aws ecr get-login, which I’d been using to log in, was removed in AWS CLI v2, so I rewrote it to pipe aws ecr get-login-password into docker login (this also works on v1 from 1.17.10 onward). Changes in AWS CLI v2
Also, the atlassian/pipelines-awscli image has been deprecated, and you’re directed to migrate to amazon/aws-cli. Docker Hub

The Dockerfile is the container definition that gets deployed to ECS. Write it as follows.
Fill in the placeholders with the values you noted earlier ({アクセスキーID} is the access key ID and {シークレットアクセスキー} is the secret access key).

1
FROM alpine
2

3
RUN apk --no-cache add postgresql-client aws-cli
4
ENV AWS_DEFAULT_REGION ap-northeast-1
5
ENV AWS_ACCESS_KEY_ID {アクセスキーID}
6
ENV AWS_SECRET_ACCESS_KEY {シークレットアクセスキー}
7
RUN mkdir dump
8
WORKDIR /root/dump
9
ADD .pgpass /root/.pgpass
10
RUN chmod 0600 /root/.pgpass
11
ADD docker-entrypoint.sh /root/docker-entrypoint.sh
12
RUN chmod +x /root/docker-entrypoint.sh
13

14
CMD ["/root/docker-entrypoint.sh"]

NOTE
Update (October 2026): On recent Alpine you can’t install packages into the system Python with pip3 install (it stops with externally-managed-environment), so I changed it to install the AWS CLI from Alpine’s package (aws-cli).

docker-entrypoint.sh is the set of commands run when the container starts; in other words, it’s the body of the cron job.
Fill in the placeholders with the values you noted earlier ({DB名} is the DB name, {DBのホスト} the DB host, {ユーザー} the user, and {S3のバケット} the S3 bucket).
As for the storage layout, the first prefix is the deletion cycle, then the DB name, and finally the file name prefix, which here holds the dump cycle.

1
#!/bin/sh
2

3
mkdir -p yearly/{DB名}
4
pg_dump -Fc -h {DBのホスト} -U {ユーザー} {DB名} > yearly/{DB名}/weekly-`date "+%Y%m%d_%H%M%S"`.custom
5
aws s3 sync . s3://{S3のバケット}

Once everything is ready, push to the repository you created earlier as usual.

Setting up the pipeline on bitbucket#

Open the repository you just pushed on bitbucket.
Go to Settings -> PIPELINES -> Settings and turn on Enable Pipelines.

Next, open Repository variables.
Set them as shown below using the values you noted earlier.

Deploying and setting up cron#

Running the deployment#

Still on the bitbucket screen, open Pipelines from the menu again, then click Run pipeline, select the options as shown below, and click Run.

When that’s done you’ll see something like the screen below; wait for the pipeline to finish.

From then on it runs automatically every time the branch changes.

Creating a schedule on AWS#

On AWS ECS, a cluster has been created with the repository owner’s name, so open that cluster (click where the cluster name is shown to open it).

Open the Scheduled Tasks tab and click Create.

NOTE
Update (October 2026): The screens are different in the current ECS console. For scheduled runs, the recommended approach now is to create a schedule in Amazon EventBridge Scheduler and choose ECS RunTask as the target. The cron expression is EventBridge Scheduler’s as well. Using Amazon EventBridge Scheduler to schedule Amazon ECS tasks

Set the run interval and so on. For the target, since we created the task for FARGATE this time, choose FARGATE as the launch type; for the task definition family there’s a task with the same name as the repository, so select that. Configure the VPC and security group as appropriate.

NOTE
I got stuck when choosing a cron expression; it seems to differ from the cron expressions of busybox cron and the like. I used the following as a reference.
Wildcards in AWS cron expressions (Japanese)

No Network on Ubuntu After Installing a GUI

Fri, 11 Jan 2019 00:00:00 GMT

If you’ve set a static IP with netplan on Ubuntu (or another Linux) and then install a GUI such as ubuntu-desktop or network-manager, the interface can end up outside NetworkManager’s control, so the network won’t connect or you can’t configure it from the GUI. When that happens, create a YAML file in /etc/netplan/ and add a setting so that netplan uses NetworkManager. Something like the following should get it working.

1
network:
2
  version: 2
3
  renderer: NetworkManager

Tripping Up on Level Switching in hls.js

Tue, 18 Dec 2018 00:00:00 GMT

Overview#

The reason is pretty embarrassing, but I got stuck implementing level switching (switching between m3u8 files) with hls.js.

Where I got stuck#

hls.js provides an API called hls.currentLevel, and you switch levels by changing its value. I tried to build it so that when the select changed, the option’s value would be assigned to it, but whenever I passed -1, playback stopped.

1
$('.res>select').on('change', function() {
2
    hls.currentLevel = $(this).val();
3
});

Fix#

Casting the option’s value with Number fixes it.

1
$('.res>select').on('change', function() {
2
    hls.currentLevel = Number($(this).val());
3
});

Cause#

The value you get from val() implicitly ends up as either a string or a number. With the minus sign it became a string, and since hls.js doesn’t validate the value internally, there was no error at all — playback just stopped working.

Wrap-up#

This was pretty basic stuff, but maybe my skill level is just low, because it took me quite a while to solve. It’d be great if there were more information like this out there in Japanese.

Testing Magnetic Stripes

Sun, 26 Aug 2018 00:00:00 GMT

What is a magnetic stripe card?#

According to Wikipedia, “A magnetic stripe card is a type of card capable of storing data by modifying the magnetism of tiny iron-based magnetic particles on a band of magnetic material on the card.” Put simply, it’s any card with a magnetic strip on it, like the point cards and credit cards everyone carries around.

Overview#

In this post I’ll explain the basic specs of magnetic stripes and share some simple tests I ran to pin down how they work.

Specs#

Data on the magnetic stripe#

First, the data on the magnetic stripe. I read the data using an MSR705 and its bundled software, and put it together with information I found online. For the online information, I referred to this page.

The above is the data I read. As a sample I used an Osaifu Ponta card that hadn’t been activated. Credit cards have Track1, Track2, and Track3, arranged one above the other. (*Most credit cards issued in Japan don’t have Track3.) Using the above as an example, here’s a quick breakdown of the numbers on the magnetic stripe.
Track1
B (start sentinel) 3574001005472095 (card number) ^ (field separator) MEMBER/OSAIFUPONTA (name)
^ (field separator) 2110 (expiration date) 121 (service code) 679 (CVC1)

Track2
3574001005472095 (card number) = (field separator) 2110 (expiration date) 121 (service code) 679 (CVC1)

About the service code#

Next, the service code from the magnetic stripe data above. The service code determines what behavior can be required of the payment terminal, and each digit has the following meanings.
First digit
1: International brand
2: International brand & IC chip
5: Domestic brand
6: Domestic brand & IC chip
7: Private use
9: Test use

Second digit
0: Decided by the payment terminal
2: Contact the issuer
4: Contact the issuer, except under bilateral agreements

Third digit 0: No restrictions & PIN required
1: No restrictions
2: Goods and services only
3: ATM only & PIN required
4: Cash advance only
5: Goods and services only & PIN required
6: No restrictions & PIN required where possible
7: Goods and services only & PIN required where possible

Testing#

I tested whether cards can be cloned and whether cloned cards can be used.

Cloning a card#

To give the conclusion first: cloning is possible. However, even if you know the card number, expiration date, and CVC2, you can’t clone a card, because the CVC1 I explained earlier is unknown. The code usually printed on the back of a credit card is actually the CVC2, which is used for online payments, while the one on the magnetic stripe is the CVC1, used for in-store payments. The CVC1 is random and can’t be guessed, so you can’t forge a card from that information alone. So how can a card be cloned? The well-known method is a skimming device attached to a payment terminal, and a cloned card can also be made if a malicious merchant steals the magnetic stripe data directly. A magnetic stripe has no unique, non-rewritable data, so once someone gets hold of the data on the stripe, it’s game over.
As for countermeasures, ones that have been spreading in Japan in recent years too: having customers operate the payment themselves, and visually checking the payment terminal.

Using a cloned card#

Again, to give the conclusion first: it can be used. But it’s also true that it has become harder in recent years with the move to IC. The reason is the service code I explained earlier: if its first digit is 2 or 6, the IC chip is required (though some terminals don’t require it), so the payment can’t go through. I also tried rewriting the service code, and under the current credit card infrastructure, a payment fails if even a single number differs from what the issuer has, so the payment couldn’t be made. As an aside, here’s something I found out during this test: with no data on Track1 (with the magnetic data wiped), the payment couldn’t be made, but with any card information at all on Track1, it went through. And no matter what card information I put on Track1, the payment was processed using the card information on Track2. The service code, too, was taken from Track2.
The countermeasures are putting IC chips in cards and making payment terminals IC-capable.

Summary#

As shown above, it turned out that fraudulent use is fairly easy. Given the state of payments in Japan in particular, I think this needs to be addressed quite urgently.

NOTE
Update (October 2026): Just before this post, on June 1, 2018, the amended Installment Sales Act (kappu hanbai hō) came into effect, requiring merchants that accept credit cards to install terminals that can process IC card payments. Terminals that only swipe the magnetic stripe are subject to replacement. Notice on the amendment to the Installment Sales Act | JCB (Japanese)

Validating Credit Card Numbers

Fri, 27 Jul 2018 00:00:00 GMT

Introduction#

Credit card numbers are something we see all the time, but there are all sorts of rules and security measures behind them too. In this post I’ll go over those.

Overview of the number#

First, how a credit card number is structured: credit card numbers are defined in ISO/IEC 7812, and consist of a 6-digit BIN (Bank Identification Number) or IIN (Issuer Identification Number) plus the remaining digits, which are decided by the issuer.

NOTE
Update (October 2026): The ISO/IEC 7812-1:2017 revision extended the IIN to 8 digits, and since April 2022 the card networks only assign new BINs as 8 digits (existing 6-digit BINs remain in use). The discussion below assumes 6 digits, so keep in mind that if you can pin down an 8-digit BIN, there are two fewer unknown digits. ISO/IEC 7812

About BIN and IIN#

The BIN/IIN is itself made up of multiple parts. The first digit is called the MII (Major Industry Identifier) and indicates the industry the card is used in; the mapping is as follows.

MII value	Industry
0	Reserved by ISO
1	Airlines
2	Airlines / other future industry assignments
3	Travel & entertainment / banking & financial
4	Banking & financial
5	Banking & financial
6	Merchandising / banking & financial
7	Petroleum / other future industry assignments
8	Healthcare / medical / telecommunications / other future industry assignments
9	Assignable by national standards bodies

And below is a list of major BINs, past and present.

Card type	Prefix	Length	Validation
American Express	34, 37	15	Luhn algorithm
China UnionPay	622126-622925, 624-626, 6282-6288	16	None
Diners Club International	300-303574, 3095, 36, 38-39	14	Luhn algorithm
Discover Card	60110, 60112-60114, 601174-601179, 601186-601199, 644-649, 65	16	Luhn algorithm
JCB	3528-3589	16	Luhn algorithm
MasterCard	510000 - 559999, 222100 - 272099	16	Luhn algorithm
UATP	1	15	Unknown
Visa	4	13, 16	Luhn algorithm

About the check digit#

Credit card numbers use the Luhn algorithm. My guess is that its main purposes are to avoid issuing numbers sequentially and to prevent someone else’s card from being charged because of a typo. However, since it can be calculated, it isn’t meant to stop malicious payments.

Validation from a security perspective#

Based on the rules above, here’s what I tested.

Overview of the test#

These days services like Apple Pay display the last 4 digits of the card number for reference, and in Apple Pay’s case you can identify the issuer to some extent from the card design, so I tested whether the card number could be guessed from that.

Identifying the BIN/IIN#

First, I tried identifying the BIN from the card design. BINs aren’t officially published, but you can look them up on sites like the one below. Some card companies have an enormous number of registered BINs, so at this point the issuers whose card numbers could be pinned down are already limited, but from here on I’ll assume the BIN has been identified. BIN search

Identifying the card number#

I’ll proceed assuming the BIN has been identified. At this point you know the 6-digit BIN plus the last 4 digits. I then computed every number that satisfies the Luhn algorithm (for 16 digits this time). I checked it on the site below, and there were well over 100 candidates, so identifying the number was impossible. credit card number generator

Summary#

As shown above, the result is that identifying a card number from screenshots, receipt photos, and the like is practically impossible. On top of that, mandatory security codes and the rollout of 3D Secure have been progressing in recent years, so even if a number were cracked, realistically there’d be no merchant where you could actually make a payment with it.

NOTE
Update (October 2026): The Credit Card Security Guidelines [version 5.0] (Japan) require, in principle, all e-commerce merchants to adopt EMV 3-D Secure by the end of March 2025. Introduction of the authentication service for card payments (EMV 3-D Secure) | JCB (Japanese)