Constantine K looselyrigorous

Deprecated

The method described in this gist has been deprecated/superceeded by kiler129/early-vfio-pci-isolate tool.
It is more robust, configurable, and doesn't hack around scripts that are sometimes overwritten by system updates. The tool uses similar methods to the ones described below, but extends the capabilities by e.g. easy NVMe passthrough by S/N.

The description below has been preserved for historical context. At the time of writing, the tool above has been tested for ~6 months across multiple systems.

Ubiquiti EdgeRouter X: custom dynamic DNS

ssh ubnt@<your-ip>
configure

Obtain your public IP address behind a NAT: using ipinfo.io

With heightening concern regarding the state of internet privacy (fuelled in part by the passing of the Investigatory Powers Act in the UK), I have set up a VPN server on the virtual server I have hosted with Mythic Beasts. This uses strongSwan and certificate-based IKEv2 authentication.

Assumptions:

Debian Jessie server already set up and accessible via debian.example.com, a public IPv4 of 203.0.113.1 and a public IPv6 of 2001:db8::1
Client username of me
Clients are running the latest versions of macOS and iOS (Sierra and 10 respectively at the time of writing)
No need to support any other operating systems (although the setup is easily translated)

For automated deployment of a similar setup, albeit Ubuntu-based and using ansible for deployment, I recommend you take a look at Algo VPN. I used that project as a basis for my configuration.

	-- Based off IETF draft, https://datatracker.ietf.org/doc/draft-peabody-dispatch-new-uuid-format/

	create or replace function uuid_generate_v7()
	returns uuid
	as $$
	begin
	-- use random v4 uuid as starting point (which has the same variant we need)
	-- then overlay timestamp
	-- then set version 7 by flipping the 2 and 1 bit in the version 4 string
	return encode(

	#!/bin/sh

	FLASH_TIME=$(opkg info busybox \| grep '^Installed-Time: ')

	for i in $(opkg list-installed \| cut -d' ' -f1)
	do
	if [ "$(opkg info $i \| grep '^Installed-Time: ')" != "$FLASH_TIME" ]
	then
	echo $i
	fi

	<?xml version='1.0'?>
	<!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>

	<fontconfig>

	<match target="font">
	<test name="family">
	<string>Inconsolatazi4</string>
	</test>
	<edit name="pixelsize" mode="assign">

	// Just before switching jobs:
	// Add one of these.
	// Preferably into the same commit where you do a large merge.
	//
	// This started as a tweet with a joke of "C++ pro-tip: #define private public",
	// and then it quickly escalated into more and more evil suggestions.
	// I've tried to capture interesting suggestions here.
	//
	// Contributors: @r2d2rigo, @joeldevahl, @msinilo, @_Humus_,
	// @YuriyODonnell, @rygorous, @cmuratori, @mike_acton, @grumpygiant,

	#!/usr/bin/env python3
	# encoding: utf-8
	# By Joonas Kuorilehto 2011, MIT license
	#
	# The script combines .ssh/known_hosts so that each fingerprint is only
	# listed once.

	import re
	import sys
	import os

	# to generate your dhparam.pem file, run in the terminal
	openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048