duretti

Overview

Here, you might lay out the reasons behind writing this code. You can link to specs, issues, or bugs in order to give someone a better idea of how a decision was made. This is your chance to give context to your reviewer. Ego depletion - the idea that willpower is used up over time - can be easily applied to your reviewer. We are human, after all. You'll likely get one shot at a quality review, so help your reviewer help you. Flush out this section.

Testing

How did you test this code? Did you write a unit test, or test it manually? Can you provide an animated gif or a screenshot to demonstrate your code does what it purports to do? What about test output or a useful snippet from a logfile? Help show that your code works.

🚨🚨🚨 (Risks)

Is there some part of the code that you know probably doesn't work as it should? Call out potential weak spots, and get help addressing them.

xkr47

# input: fullchain.pem and privkey.pem as generated by the "letsencrypt-auto" script when run with
# the "auth" aka "certonly" subcommand

# convert certificate chain + private key to the PKCS#12 file format
openssl pkcs12 -export -out keystore.pkcs12 -in fullchain.pem -inkey privkey.pem

# convert PKCS#12 file into Java keystore format
keytool -importkeystore -srckeystore keystore.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks

# don't need the PKCS#12 file anymore

xelwarto

global
  chroot  /var/lib/haproxy
  crt-base  /etc/pki/tls/certs
  daemon  
  group  haproxy
  log  127.0.0.1 local0
  maxconn  2000
  pidfile  /var/run/haproxy.pid
  stats  socket /var/lib/haproxy/stats
  tune.ssl.default-dh-param  2048

martijnvermaat

SSH agent forwarding and screen

When connecting to a remote server via SSH it is often convenient to use SSH agent forwarding so that you don't need a separate keypair on that server for connecting to further servers.

This is enabled by adding the

ForwardAgent yes

option to any of your Host entries in ~/.ssh/config (or alternatively with the -A option). Don't set this option in a wildcard Host * section since any user on the remote server that can bypass file permissions can now als use keys loaded in your SSH agent. So only use this with hosts you trust.