| From ead6a4c11602b2a78523dfe6c364b2e8eb59665c Mon Sep 17 00:00:00 2001 | |
| From: daemonhorn <daemonhorn@nullcore.com> | |
| Date: Sat, 25 Jul 2026 12:08:08 -0400 | |
| Subject: [PATCH qemu-server] fix #4219: cfg2cmd: use tpm-tis-device for TPM on | |
| non-x86_64 archs | |
| QEMU's aarch64 'virt' machine has no ISA bus and only exposes the TPM | |
| TIS interface as the sysbus device 'tpm-tis-device'. add_tpm_device() | |
| always emitted the x86 ISA device 'tpm-tis', so any VM with 'arch: | |
| aarch64' and a tpmstate0 configured failed to start with: |
| #!/bin/sh | |
| # Universal TPM 2.0 Secure Setup Script | |
| # Features: Single Master PIN, Auto/Manual execution, Multi-User safe | |
| # OS Support: Debian, RHEL (Rocky/Alma/CentOS), FreeBSD | |
| set -e | |
| printf "%s\n" "=== Phase 1: OS Detection & Prerequisites ===" | |
| OS_NAME=$(uname -s) |
The Linux kernel key retention service (keyrings) lets you store secrets in kernel memory — never on disk, automatically discarded when your session ends. This makes it a solid backing store for the encryption key used to protect a dotfile like .app.conf.
The kernel exposes a hierarchy of keyrings tied to different lifetimes:
| Keyring | Lifetime | Typical use |
|---|
This guide walks through creating a System V init script on Debian stable that launches a set of shell scripts in individual named tmux sessions, running as a non-privileged local user.
Configuration — including which user to run as — lives in /etc/default/tmux-sessions, the standard Debian location for externalizing init script settings. The init script itself contains no hardcoded usernames or paths.
| import os | |
| import sqlite3 | |
| from datetime import datetime, date | |
| from typing import Tuple, Dict, List | |
| import getpass | |
| from mattermostdriver import Driver | |
| import pathlib | |
| import json |
nagios4 instead of building from source, thus requires a few tweaks to enable nginx as the webserver.apt install nginx nagios4 php-fpm fcgiwrap -y
usermod -a -G nagios www-data
# Make a folder and symlink the native apache cgi into nginx
###################################
# Prerequisites
# Update the list of packages
Auto-Update for Ubuntu/Debian using Unattended-Upgrades package
Unattended-upgrades is installed by:
sudo apt install unattended-upgrades
sudo systemctl enable --now unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
The default config is reasonable, but should be inspected.
The default instructions on the PivKey documentation site: https://pivkey.zendesk.com/hc/en-us do not provide any examples for configuring a self-signed certificate in any of the 25 slots. These instructions were tested with the PivKey C910 version, but likely most Taglio variants will work the same way.
There is support in powershell 5.1+ on currently supported Windows OS (Server 2012+/Windows 10+) configurations for generating self-signed certificates with a wide variety of configuration parameters, including support for the Microsoft Smart Card Key Storage Provider to generate keys on a smartcard.
Application Policies OID configuration in in the initi