alanorth

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# Protect against "HTTPoxy" vulnerability in server-side libraries
# See: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
# See: https://httpoxy.org/
proxy_set_header Proxy "";
proxy_connect_timeout 3600;
proxy_send_timeout 3600;

alanorth

#!/usr/bin/env bash
#
# v2021-04-29
#
# I run it like this (using zsh syntax):
#
#   $ for video (~/Pictures/2021/**/*.mp4(ND.)); do ~/Downloads/av1-tests/convert-av1.sh "$video"; done 
#
# Reference:
#   - https://ffmpeg.org/ffmpeg-codecs.html#libaom_002dav1

alanorth

Arch Linux on LUKS

Mostly follows the Arch Linux install guide, but with tips from these for the encryption setup:

• https://gist.github.com/binaerbaum/535884a7f5b8a8697557
• https://wiki.archlinux.org/index.php/Systemd-boot#Standard_root_installations
• https://gist.github.com/mjkstra/96ce7a5689d753e7a6bdd92cdc169bae
• Uses an unencrypted /efi with Btrfs on LUKS for / and /home

Partitoning

Find the correct disk and clear all existing partitions with sgdisk:

alanorth

#!/usr/bin/env bash
#
# clean-snap-sync-external.sh v1.0.1 (2021-07-09)
#
# Changes
# -------
# 2021-07-09:
#   - adjust logic to keep latest x, instead of delete oldest x
#   - make output cleaner (hide btrfs subvolume delete output)
#

alanorth

alanorth

[Unit]
Description=DSpace Handle Server
# Only run if the DSpace Handle server is configured on this host
ConditionDirectoryNotEmpty=/home/cgspace.cgiar.org/handle-server

[Service]
Type=forking
User=dspace
ExecStart=/home/cgspace.cgiar.org/bin/start-handle-server

alanorth

[Unit]
Description=Run ooniprobe

[Service]
# https://www.ctrl.blog/entry/systemd-service-hardening.html
ProtectHome=read-only
ProtectKernelTunables=true
ProtectSystem=strict
PrivateDevices=true
PrivateTmp=true

alanorth

#!/usr/bin/env bash
#
# pre-process-media.sh v2024-04-28
#
# Prepare a directory of images and videos for long-term archival by normalizing
# their names, optimizing JPEGs with jpeg-archive, and stripping embedded MP4s
# from Android Motion Photos.
#
# SPDX-License-Identifier: GPL-3.0-only

alanorth

[Container]
Image=docker.io/jellyfin/jellyfin:latest
AutoUpdate=registry
PublishPort=8096:8096/tcp
UserNS=keep-id
Environment=TZ=Africa/Nairobi
AddDevice=/dev/dri/:/dev/dri/
Volume=jellyfin-config:/config:Z
Volume=jellyfin-cache:/cache:Z
Volume=/srv/video:/srv/video:ro

alanorth