bnhf

Just thought I'd put together some detail on deploying Tailscale using Docker and Portainer. These bits-and-pieces are available elsewhere, but not together, so hopefully this will save someone a bit of time if you'd like to add Tailscale to an existing Docker install:

Here's my annotated recommended docker-compose, to use with Portainer-Stacks. Note that I'm not using a pre-made Auth Key. I started that way, but realized it was very easy to simply check the Portainer log for the tailscaled container once the stack is running. In that log you'll see the standard Auth link that you can use to authorize the container. This way you don't need to create a key in advance, or create a reusable key that introduces a security risk:

version: '3.9'
services:
  tailscale:
    image: tailscale/tailscale
    container_name: tailscaled

jesselawson

#!/usr/bin/env bash

ipset -q flush ipsum

ipset -q create ipsum hash:net

for ip in $(curl --compressed https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt 2>/dev/null | grep -v "#" | grep -v -E "\s[1-2]$" | cut -f 1); do ipset add ipsum $ip; done

# Add any IPs here that may not be in the block list yet:
ipset add ipsum 110.169.9.43

shawngmc

[default]
aws_access_key_id=XXXXXXXXXXXXXXXXXXXX
aws_secret_access_key=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
aws_region=us-east-1

berkant

## template: jinja
#cloud-config

{% if v1.distro_release == 'focal' %}

users:
    - name: berkant
      shell: /usr/bin/bash
      ssh_import_id: gh:berkant
      sudo: ALL=(ALL:ALL) NOPASSWD:ALL

eusonlito

Protect your server with a strong iptables rules and ipset lists.

1. Install ipset to manage ipstables lists

apt install ipset

2. Install iptables-persistent to preserve iptables rules on reboot

kaichao

1. switch nginx image to openresty/openresty

2. add the following to server/location (/etc/nginx/conf.d/default.conf)

   set $req_header "";
   set $resp_header "";
   header_filter_by_lua_block{ 
      local h = ngx.req.get_headers();
      for k, v in pairs(h) do
         ngx.var.req_header = ngx.var.req_header .. k.."="..v.." ";

dustyfresh

# Security enhancements and custom Nginx server header
#
# Requirements:
# $ apt install nginx vim
# $ apt install libnginx-mod-http-headers-more-filter
# $ vim /etc/nginx/sites-enabled/default
#
# Further reading http://docs.hardentheworld.org/Applications/Nginx/
#
server {

reitermarkus

set -euo pipefail

# Reduce backup IO.
sed -i -E 's/^\s*#?\s*(ionice:).*/\1 7/' /etc/vzdump.conf
sed -i -E 's/^\s*#?\s*(bwlimit:).*/\1 32768/' /etc/vzdump.conf

tee /etc/cron.hourly/xfs_fsr <<EOF
#!/bin/sh

xfs_fsr -t 600

henrik242

Disable Device Enrollment Program (DEP) notification on macOS Ventura.md

Ventura docs for M2 Macs in this comment: https://gist.github.com/henrik242/65d26a7deca30bdb9828e183809690bd?permalink_comment_id=4555340#gistcomment-4555340

Old Monterey docs in this old revision: https://gist.github.com/henrik242/65d26a7deca30bdb9828e183809690bd/32c410e3a1de73539c76fa13ea5486569c4e0c5d

Solution for Sonoma: https://gist.github.com/sghiassy/a3927405cf4ffe81242f4ecb01c382ac

qzm

### Basic ###
# The directory to store the downloaded file.
dir=${HOME}/Downloads
# Downloads the URIs listed in FILE.
input-file=${HOME}/.aria2/aria2.session
# Save error/unfinished downloads to FILE on exit.
save-session=${HOME}/.aria2/aria2.session
# Save error/unfinished downloads to a file specified by --save-session option every SEC seconds. If 0 is given, file will be saved only when aria2 exits. Default: 0
save-session-interval=60
# Set the maximum number of parallel downloads for every queue item. See also the --split option. Default: 5