Constantin Kraft gruentee

Requirements

A self-managed VPS or dedicated server with Ubuntu 24.04 running Apache 2.4.xx.
A registered domain name with working HTTPS (TLS/SSL). HTTP/2 and HTTP/3 only works alongside HTTPS because most browsers, including Firefox and Chrome, don’t support HTTP/2 or HTTP/3 in cleartext (non-TLS) mode.

Architecture

After multiple tries with apche2 recompiling with a different modules to support quic and http3, I simply run nginx container that will overtake only UDP traffic and forward it to the apache2 as http2 via TCP. So, no, it is not real "http3 apache2 support", but works pretty well and you do not need to change anything on your Apache2 sever.

Upgrade LineageOS with Magisk

WARNING: tested only on my setup (LineageOS 18.1 on instantnoodle), other setups may break and brick the device!

Step-by-step instructions (for reinstalling patched boot.img for Magisk):

upgrade LineageOS to the latest by the standard way in Android GUI (download + install + reboot)
if using not the latest Magisk: wipe old (possibly hidden) Magisk app then install the up-to-date one from the official Magisk github repo
~~install (git clone) payload_dumper from GitHub (in Termux or in an SSH session on the Android device) for the 1st time, or update (git pull) later~~
~~the Android terminal session: wget the same LineageOS nightly image installed in step 1 from https://download.lineageos.org/~~

Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)

Errors, typos, something to say ?

If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources

Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List

Fully automated setup of Ubuntu 20.04 on ZFS as root file system, optionally with LUKS and/or ZFS native encryption via single master password/keyfile and SSH unlock.

Please read the content for more information.

Feature request for adding this to the docs on requarks.canny.io

Keycloak

Keycloak is an Open Source Identity and Access Management solution for modern Applications and Services.

Relevant information

Setting up NixOs with LUKS encrypted root

Here are my working notes on getting a system up and running.

WARNING: You can run into a hidden problem that will prevent a correct partition setup and /etc/nixos/configuration.nix from working: if you are setting up a UEFI system, then you need to make sure you boot into the NixOS installation from the UEFI partition of the bootable media. You may have to enter your BIOS boot selection menu to verify this. For example, if you setup a NixOS installer image on a flash drive, your BIOS menu may display several boot options from that flash drive: choose the one explicitly labeled with “UEFI”.

References

I used these resources:

	#!/bin/bash

	sudo apt install fontconfig
	cd ~
	wget https://github.com/ryanoasis/nerd-fonts/releases/download/v2.1.0/Meslo.zip
	mkdir -p .local/share/fonts
	unzip Meslo.zip -d .local/share/fonts
	cd .local/share/fonts
	rm Windows
	cd ~

	# Maintainer: Daniel M. Capella <[email protected]>
	# Contributor: ZaZam <zazaamm ät gmail döt com>
	# Contributor: Yegorius <[email protected]>

	pkgname=pulseaudio-dlna
	pkgver=0.6.1
	pkgrel=1
	pkgdesc='Small DLNA server which brings DLNA/UPnP support to PulseAudio'
	arch=('x86_64')
	url=https://github.com/Cygn/pulseaudio-dlna/

	# Use systemd for managing NVIDIA driver suspend in drivers ====>>> PRIOR to version 470 <<<=====
	# https://download.nvidia.com/XFree86/Linux-x86_64/450.66/README/powermanagement.html
	# https://forums.developer.nvidia.com/t/unable-to-set-nvidia-kernel-module-parameters/161306
	# Please note: In Fedora Linux you may need to just install the xorg-x11-drv-nvidia-power pakage
	# as sugested by @goombah88 in the comments below.

	TMP_PATH=/var/tmp
	TMPL_PATH=/usr/share/doc/nvidia-driver-460/

	echo "options nvidia NVreg_PreserveVideoMemoryAllocations=1 NVreg_TemporaryFilePath=${TMP_PATH}" \| sudo tee /etc/modprobe.d/nvidia-power-management.conf

	#!/bin/bash
	###
	# Pre-commit hook that verifies if all files containing 'vault' in the name # are encrypted.
	# If not, commit will fail with an error message
	#
	# Original author: @ralovely
	# https://www.reinteractive.net/posts/167-ansible-real-life-good-practices
	#
	# File should be .git/hooks/pre-commit and executable
	###