Karri Niemelä kakoni

I hereby claim:

To claim this, I am signing this object:

	DEFAULT_FORWARD_POLICY="ACCEPT"

	# before.rules

	# NAT table rules
	*nat
	:POSTROUTING ACCEPT [0:0]
	# Allow traffic from OpenVPN client to eth0
	-A POSTROUTING -s 10.8.0.0/8 -o eth0 -j MASQUERADE
	COMMIT

	https://blog.ruanbekker.com/blog/2018/02/11/setup-a-site-to-site-ipsec-vpn-with-strongswan-and-preshared-key-authentication/
	https://www.greyhat.dk/usg-ubiquiti-strongswan/

	https://community.ubnt.com/t5/UniFi-Routing-Switching/Site-2-Site-VPN-between-USG-and-Linux-box-StrongSWAN/td-p/2386372
	https://community.ubnt.com/t5/UniFi-Routing-Switching/IPsec-site-to-site-USG-gt-Cisco/m-p/2094765#M60671

	### ex61-nvme, ubuntu 18.04 minimal, no raid. apt-get update, apt-get install postgresql
	/usr/lib/postgresql/10/bin/pg_test_fsync
	5 seconds per test
	O_DIRECT supported on this platform for open_datasync and open_sync.

	Compare file sync methods using one 8kB write:
	(in wal_sync_method preference order, except fdatasync is Linux's default)
	open_datasync 974.559 ops/sec 1026 usecs/op
	fdatasync 957.327 ops/sec 1045 usecs/op
	fsync 366.054 ops/sec 2732 usecs/op

	iptables -A INPUT -p ALL -m mac --mac-source xx:xx:xx:xx:xx:xx -j blocked_access
	iptables -N blocked_access #Create new chain
	iptables -A blocked_access --protocol ALL #Rule all protocols
	iptables -A blocked_access -m mac --mac-source xx:xx:xx:xx:xx:xx #limit by mac
	iptables -A blocked_access -m time --timestart 23:00 --timestop 6:00 --days Mon,Tue,Wed,Thu,Fri,Sat,Sun #limit by time
	iptables -A blocked_access -j DROP #if match, drop

	https://www.digitalocean.com/community/tutorials/how-to-list-and-delete-iptables-firewall-

	#thinking also limit per time

	# Using keytool

	keytool -genkey -keyalg RSA -alias logstash -keystore keystore.jks -storepass 123pass -ext SAN=ip:1.2.3.4,ip:1.2.3.4.5 -validity 360 -keysize 2048

	SAN ips are your server ips.

	Also set first and lastname to ip address well. This is known as commanname and according to Internet
	"here may be compatibility issues with certificates for IP addresses unless the IP address is in both the commonName and subjectAltName fields"

	https://marinehowto.com/lifepo4-batteries-on-boats/
	http://nordkyndesign.com
	https://shop.pkys.com/Technical-Pages_ep_41.html

	Daikin Ururu Sarara R35, Daikin CALDO XR40
	Kolla
	https://kvi.se/kvi-test-luftvarmepumpar/?selectAll=on&pump%5B%5D=4009&pump%5B%5D=3976&pump%5B%5D=3953&pump%5B%5D=3951&pump%5B%5D=3949&pump%5B%5D=3924&pump%5B%5D=3920

	http://debezium.io/blog/2018/05/24/querying-debezium-change-data-eEvents-with-ksql/
	http://sqlstream.com/5-reasons-why-spark-streamings-batch-processing-of-data-streams-is-not-stream-processing/

	# Roles
	https://github.com/Squarespace/pgbedrock