Mark Vainomaa mikroskeem

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict

Simple automated GIT Deployment using GIT Hooks

Here are the simple steps needed to create a deployment from your lokal GIT repository to a server based on this in-depth tutorial.

How it works

You are developing in a working-copy on your local machine, lets say on the master branch. Most of the time, people would push code to a remote server like github.com or gitlab.com and pull or export it to a production server. Or you use a service like my Deepl.io to act upon a Web-Hook that's triggered that service.

Arch Linux btrfs install

NOTE: Last update to this gist was on Jun 2, 2018. Most of the things here are out of date (e.g consider using zstd for transparent compression instead of lzo), so do your own research as well. Take care!

0. Prerequisites

Plenty of storage - snapshots will take (sort of) a lot of space
Latest Arch Linux install iso because those have newer kernels and more bugfixes in btrfs.
Have previous experience with installing Arch (like you can install arch with a blind fold).
Read everything through

	package com.vex.random;

	import java.util.HashMap;
	import java.util.Map;
	import java.util.TreeMap;

	import org.bukkit.ChatColor;

	public class ColorUtil {
	private static Map<ChatColor, ColorSet> colorMap = new HashMap<>();

	func getFlags(desiredHeap int64) string {
	asKb := desiredHeap / units.KiB

	// the following is specific to OpenJ9 and is based on Aikar's flags:
	// https://aikar.co/2018/07/02/tuning-the-jvm-g1gc-garbage-collector-flags-for-minecraft/

	// The equivalent of -XX:G1NewSizePercent/-XX:G1MaxNewSizePercent in OpenJ9's gencon policy is -Xmns/-Xmnx.
	// We have to manually compute these values ourselves. By default, the gencon policy assumes 25% of Xms, which is
	// simply not sufficient for Minecraft (and Aikar can tell you).
	xmns := asKb / 2

	import co.aikar.commands.BaseCommand
	import co.aikar.commands.JDACommandEvent
	import co.aikar.commands.annotation.CommandAlias
	import co.aikar.commands.annotation.Dependency
	import net.dv8tion.jda.core.JDA
	import net.dv8tion.jda.core.entities.Guild


	class BaseCommands : BaseCommand() {
	@Dependency

	/*
	* Copyright (c) 2017. Starlis LLC / dba Empire Minecraft
	*
	* This source code is proprietary software and must not be redistributed without Starlis LLC's approval
	*
	*/

	package com.empireminecraft.systems.tasks;

	import com.empireminecraft.util.Log;

	#!/bin/sh

	##
	## Note: this generates profile which works with Android OpenVPN Connect
	## Usage: ./ovpn-writer.sh SERVER CA_CERT CLIENT_CERT CLIENT_KEY SHARED_SECRET > client.ovpn
	##

	server=${1?"The server address is required"}
	cacert=${2?"The path to the ca certificate file is required"}
	client_cert=${3?"The path to the client certificate file is required"}