Mikael Dúi Bolinder mikaeldui

UniFi: DNAT to redirect DNS requests

You have a local DNS server (e.g. your UniFi router) and want all your devices to use it, even though some don't care which server your router specifies in DHCP replies (e.g. IoT devices)? You can use DNAT to redirect all requests ment for external DNS servers to your local (or favourite remote) DNS server.

What's DNAT?

I guess you know what port forwarding is: you have a single public IP address shared by 10s of devices. In order for devices on the internet (e.g. your friends) to be able to access a device on your local network (e.g. your Jellyfin server) you need to tell your router to forward incoming traffic for a port to a local IP

CachyOS Kernel for Fedora with Secure Boot

Did you just install kernel-cachyos and got hit by bad shim signature when booting? Me too. This is how I fixed it.

First, make sure you have Secure Boot with mokutil --sb-state.

Note, there's a second way of doing this by using sbctl, but I didn't want to wipe my Secure Boot keys.

Installing the CachyOS Kernel

Fedora 42 Magnet Links

From the torrents at https://torrent.fedoraproject.org/

magnet:?xt=urn:btih:9eead287a6beae1db259a76d9605aeed9679ba09&dn=Fedora-Budgie-Live-x86_64-42&tr=http%3A%2F%2Ftorrent.fedoraproject.org%3A6969%2Fannounce
magnet:?xt=urn:btih:b8c1c28b31fbe7d830730badc71df596b9f78f34&dn=Fedora-Cinnamon-Live-x86_64-42&tr=http%3A%2F%2Ftorrent.fedoraproject.org%3A6969%2Fannounce
magnet:?xt=urn:btih:477ec60001f6ec8908ca299000c7b71a640c9698&dn=Fedora-COSMIC-Atomic-ostree-aarch64-42&tr=http%3A%2F%2Ftorrent.fedoraproject.org%3A6969%2Fannounce
magnet:?xt=urn:btih:7ebd3a54752fb2fd361dd48504f2b2c2f5c36440&dn=Fedora-COSMIC-Atomic-ostree-x86_64-42&tr=http%3A%2F%2Ftorrent.fedoraproject.org%3A6969%2Fannounce
magnet:?xt=urn:btih:b9ac81def05113ccec99ba6fbdb69f447b0d69d2&dn=Fedora-COSMIC-Live-aarch64-42&tr=http%3A%2F%2Ftorrent.fedoraproject.org%3A6969%2Fannounce
magnet:?xt=urn:btih:754f9eee52377fa544202683a28a0dc2c176dbee&dn=Fedora-COSMIC-Live-x86_64-42&tr=http%3A%2F%2Ftorrent.fedoraproject.org%3A6969%2Fannounc

Convert Fedora Workstation to Fedora Server

So, you installed Fedora Workstation on your server and ended up not using the desktop environment after all and want to convert to Fedora Server without doing a re-installation? It's very easy to do:

Boot to console: systemctl set-default multi-user.target
Change identity: dnf swap fedora-release-identity-workstation.noarch fedora-release-identity-server.noarch

It might take an update of the kernel before the server calls itself "Fedora Server".

While it is possible to completely remove a desktop environment, things could break:

PeerBanHelper as Quadlet

Quadlets are available since Podman 4.4, and offer an easy way to manage container and to keep them updated!

Check podman --version.
Create /etc/containers/systemd/peerbanhelper.container with the content below:

[Unit]
Description=PeerBanHelper Container

Mounting SSHFS (SFTP) using systemd

Why use fstab when there's systemd?

# /etc/systemd/system/media-server1.mount
[Unit]
Description=Mount unit for Server1

[Mount]
What[email protected]:/

Fedora LVM Cache for Intel Optane

Did you know that LVM has built-in support for Intel Optane? Neither did I. It's a manual configuration though and it doesn't seem to be easy to do with BTRFS, so I simply went for EXT4.

Why would you want to enable the Optane cache? It supports super low latency no matter how much you use it while the big NVMe SSD is going to get slower the busier it is.

Note: I'm talking about laptop NVMe SSDs with built-in Optane cache. Mine is a Intel® Optane™ Memory H10 32GB + Intel® QLC 3D NAND SSD 512GB, M.2 80mm PCIe 3.0, which came pre-installed in my HP Spectre x360.

To start:

Enter the UEFI and turn on ACHI for the SSD (I don't know if I did it as I forgot my UEFI password)

Globalping Probe as Quadlet

Quadlets are available since Podman 4.4, and offer an easy way to manage container and to keep them updated!

Check podman --version.
Create /etc/containers/systemd/globalping-probe.container with the content below:

# Equivalent to sudo podman run -d --cap-add=NET_RAW --network host --restart=always \
# --name globalping-probe globalping/globalping-probe
[Unit]

Web Key Directory for Proton Mail using Cloudflare Workers

Web Key Directory is a way for non-Proton users find your keys and encrypt the messages sent to you. Proton doesn't offer this for custom domains out-of-the-box, but you can proxy requests from your domain to Proton.

Create a Cloudflare Worker
Put this code in the Worker:

export default {
 async fetch(request, env, ctx) {

	# /etc/containers/systemd/trilium.container
	[Unit]
	Description=Trilium Container

	[Container]
	ContainerName=trilium
	Image=docker.io/zadam/trilium:latest
	Volume=/home/USERNAME/trilium-data:/home/node/trilium-data:z
	PublishPort=8080:8080
	AutoUpdate=registry