Kit Roed

Home Server Setup Notes

Sat, 22 Nov 2025 00:00:00 +0000

Key preparations
Disable IP forwarding
Configure interfaces separately
Firewall with iptables
- Install and configure iptables
- Disable nftables
Set up Nginx Proxy Manager:
- Create directories for NPM
- Create NPM docker-compose.yml
Default Landing Page
- Create landing page directory
- Create index.html
- Create robots.txt (deny crawlers)
- Create default-page docker-compose.yml
- Start the service
- Configure NPM proxy hosts
Dynamic DNS with Namecheap
- Enable Dynamic DNS in Namecheap
- Configure DDNS with ddclient
WireGuard VPN with wg-easy
- Create WireGuard directory
- Create WireGuard docker-compose.yml
- Start WireGuard
- Access Web UI
- Add and download client configurations
- Connect clients
- Check connected peers
- Expose WireGuard Web UI via NPM (Optional)
External USB Drive as Samba Share Storage
- Identify and format the drive
- Mount the drive
- Install and configure Samba
- Create Samba user
- Configure firewall
Plex Media Server
- Create Plex directory structure
- Create docker-compose.yml for Plex
- Start Plex
- Allow Plex through firewall
- Access Plex
- Enable Remote Access
  - Method 1: Direct Connection (Recommended for streaming)
  - Method 2: Reverse Proxy via NPM
ntfy - Push Notification Service
- Create ntfy directory
- Create ntfy docker-compose.yml
- Start ntfy
- Access ntfy
- Send a test notification
- Mobile apps
- Expose ntfy via NPM
Nextcloud with Dedicated Drive
- Format and mount the drive
- Give your user read access
- Create Nextcloud directory
- Create Nextcloud docker-compose.yml
- Start Nextcloud
- Access Nextcloud
- Expose Nextcloud via NPM
- Configure trusted domains
- Add Samba share for direct file access
- Access the share
- Sync changes to Nextcloud
Wallabag - Read It Later Service
- Create Wallabag directory
- Create Wallabag docker-compose.yml
- Start Wallabag
- Allow Wallabag through firewall
- Expose Wallabag via NPM
- Access Wallabag
RustDesk - Self-Hosted Remote Desktop
- Create RustDesk directory
- Create RustDesk docker-compose.yml
- Start RustDesk
- Get the public key
- Configure RustDesk clients
- Usage
Immich - Self-Hosted Photo & Video Backup
- Create Immich directory
- Download configuration files
- Configure environment
- Start Immich
- Expose Immich via NPM
- Access Immich
- Mobile Apps
- Troubleshooting: System Freeze (optional, I didn’t do this)
Calibre-Web - Ebook Library Access
- Create library directory
- Deploy Calibre-Web
- Access Calibre-Web
- Sync from desktop Calibre
- Optional sync script
- LAN firewall rule
- Optional reverse proxy via NPM
Copyparty - Easy File Browsing & Sharing
- Create Copyparty directory
- Create the sandbox share directory
- Create Copyparty docker-compose.yml
- Create configuration file
- Start Copyparty
- Access Copyparty
- LAN firewall rule
- Optional: Expose via NPM
OpenSpeedTest - Network Speed Testing
- Create OpenSpeedTest directory
- Create OpenSpeedTest docker-compose.yml
- Start OpenSpeedTest
- Access OpenSpeedTest
- LAN firewall rule
- Optional: Expose via NPM
Netdata - Real-time Performance Monitoring
- Create Netdata directory
- Create Netdata docker-compose.yml
- Start Netdata
- LAN firewall rule
- Access Netdata
- Optional: Expose via NPM (Securely)
Watchtower - Container Update Monitoring
- Create Watchtower directory
- Create Watchtower docker-compose.yml
- Start Watchtower
- Triggering a Manual Check
- Subscribe to notifications
- Optional: Enable auto-update for specific containers
- Manual update workflow
Final Firewall Configuration
Moving Docker Data to /srv
- 1. Stop Docker
- 2. Create new directory
- 3. Configure Docker to use new path
- 4. Move existing data
- 5. Start Docker
- 6. Verify and clean up
Verifying System Health
- Check Docker Containers
- Monitor Resource Usage
- Check System Logs
- Verify Network & Firewall

Key preparations

internal network is enp2s0
external network is eno1

I want to have the external network set up for internet access only, and the internal network for LAN access only. The server should not route traffic between the two networks. Effectively, the server acts as a client on both networks, but does not forward traffic between them, a reverse proxy appliance, and VPN endpoint.

Disable IP forwarding

check that IP forwarding isn’t enabled:

sudo sysctl net.ipv4.ip_forward

it returned

net.ipv4.ip_forward = 1

created a new file

sudo nano /etc/sysctl.d/99-network-hardening.conf

and added

# Disable IPv4 packet forwarding (no gateway duties)
net.ipv4.ip_forward = 0

# Disable IPv6 forwarding unless explicitly needed
net.ipv6.conf.all.forwarding = 0

# Ignore ICMP broadcast requests (mitigate smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore bogus ICMP error responses
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Do not accept source-routed packets
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# Do not accept ICMP redirects (prevent malicious route injection)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Do not send ICMP redirects (stay quiet as a router)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable SYN cookies (protect against SYN flood DoS)
net.ipv4.tcp_syncookies = 1

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Reverse path filtering (helps prevent IP spoofing)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

reload

sudo sysctl --system

Configure interfaces separately

using systemd networkd

sudo vim /etc/systemd/network/20-enp2s0-lan.network

[Match]
Name=enp2s0

[Network]
DHCP=yes

[DHCPv4]
RouteMetric=2000

sudo vim /etc/systemd/network/10-eno1-external.network

[Match]
Name=eno1

[Network]
DHCP=yes
DNS=1.1.1.1 8.8.8.8   # optional: override ISP DNS with public resolvers

[DHCPv4]
RouteMetric=10       # Low metric = high priority - ensures eno1's default route wins
UseRoutes=yes

enable and start:

sudo systemctl enable --now systemd-networkd
sudo systemctl restart systemd-networkd

NOTE: If systemctl restart systemd-networkd hangs and doesn’t return, you may need to reboot the server. This can happen when changing DHCP settings. To avoid SSH lockout in the future:

# Check config syntax before applying
sudo networkctl reload
# Or test with a timeout that auto-reverts
sudo systemctl restart systemd-networkd & sleep 10 && ip route show

After reboot, verify the routes:

ip route show
# Should only see default via public IP address (eno1), NOT via 192.168.0.1

works!

Firewall with iptables

Since Docker doesn’t work properly with nftables, use iptables-legacy instead.

Install and configure iptables

Install iptables-legacy:

sudo apt update
sudo apt install iptables iptables-persistent

Switch to iptables-legacy:

Debian provides two “flavors” of iptables binaries: iptables-nft and iptables-legacy. You can select which one is active:

sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
sudo update-alternatives --set arptables /usr/sbin/arptables-legacy
sudo update-alternatives --set ebtables /usr/sbin/ebtables-legacy

Disable nftables

IMPORTANT: If nftables is installed, it must be completely disabled:

# Stop and disable nftables service
sudo systemctl stop nftables
sudo systemctl disable nftables

# Clear any active nftables rules
sudo nft flush ruleset

You can optionally delete /etc/nftables.conf or rename it to .bak for reference. Since the service is disabled, the file won’t be loaded on boot anyway.

This makes it so that:

Docker manages firewall rules via iptables-legacy
eno1: Docker/NPM handles 80/443 from internet
enp2s0: LAN access to NPM admin UI (port 81) works
No forwarding: box won’t act as a router
Minimal attack surface

Set up Nginx Proxy Manager:

(install Docker and Docker Compose)

Create directories for NPM

sudo mkdir -p /opt/npm/data /opt/npm/letsencrypt
sudo chown -R $USER:$USER /opt/npm
cd /opt/npm

Create NPM docker-compose.yml

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped

    ports:
      - '80:80'              # Public HTTP Port
      - '443:443'            # Public HTTPS Port
      - '192.168.0.101:81:81'  # Admin Web Port (LAN only)

    # Use host's DNS for proper LAN service resolution
    dns:
      - 192.168.0.2          # LAN DNS
      - 1.1.1.1              # Cloudflare fallback

    environment:
      DISABLE_IPV6: 'true'
      TZ: 'America/Chicago'

    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

The dns configuration is critical - it allows NPM to resolve and reach internal LAN services properly while still accessing the internet.

Default Landing Page

Set up a simple default page for yourdomain.com and catch-all subdomains.

Create landing page directory

sudo mkdir -p /opt/default-page
sudo chown -R $USER:$USER /opt/default-page
cd /opt/default-page

Create index.html

vim index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>yourdomain.com</title>
    <style>
        * {
            margin: 0;
            padding: 0;
            box-sizing: border-box;
        }
        body {
            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            color: white;
            display: flex;
            justify-content: center;
            align-items: center;
            min-height: 100vh;
            padding: 20px;
        }
        .container {
            text-align: center;
            max-width: 600px;
        }
        h1 {
            font-size: 4rem;
            margin-bottom: 1rem;
            text-shadow: 2px 2px 4px rgba(0,0,0,0.3);
        }
        p {
            font-size: 1.5rem;
            opacity: 0.9;
            line-height: 1.6;
        }
        .subdomain {
            margin-top: 2rem;
            padding: 1rem;
            background: rgba(255,255,255,0.1);
            border-radius: 8px;
            font-size: 1rem;
            opacity: 0.7;
        }
    </style>
</head>
<body>
    <div class="container">
        <h1>👋</h1>
        <p>Nothing to see here.</p>
        <div class="subdomain">yourdomain.com</div>
    </div>
</body>
</html>

Create robots.txt (deny crawlers)

vim robots.txt

User-agent: *
Disallow: /

Create default-page docker-compose.yml

vim docker-compose.yml

services:
  default-page:
    image: nginx:alpine
    container_name: default-page
    volumes:
      - ./index.html:/usr/share/nginx/html/index.html:ro
      - ./robots.txt:/usr/share/nginx/html/robots.txt:ro
    ports:
      - "192.168.0.101:8090:80"
    restart: unless-stopped

Start the service

docker compose up -d

# Check logs
docker logs -f default-page

Configure NPM proxy hosts

Open NPM at http://192.168.0.101:81
Add two proxy hosts:

For root domain:

Domain Names: yourdomain.com
Scheme: http
Forward Hostname/IP: 192.168.0.101
Forward Port: 8090
SSL: Request new certificate, Force SSL

For catch-all subdomains:

Domain Names: *.yourdomain.com (type the literal *. prefix, then press Enter to commit the entry)
Scheme: http
Forward Hostname/IP: 192.168.0.101
Forward Port: 8090
SSL: None (see “Wildcard SSL” note below)

Now any undefined subdomain will show the default page over HTTP. Confirm with:

http://anything.yourdomain.com   # → default page
https://anything.yourdomain.com  # → cert error (expected, see below)

This is fine for a generic “nothing here” landing page that exposes no data. Your defined subdomains (plex.yourdomain.com, nextcloud.yourdomain.com, etc.) still get individual Let’s Encrypt certs via the standard HTTP-01 challenge — only the wildcard catch-all needs special handling.

Optional: Wildcard SSL via DNS-01

A wildcard Let’s Encrypt certificate (*.yourdomain.com) can only be issued via the DNS-01 challenge — NPM’s default HTTP-01 challenge will fail because it can’t prove ownership of a name that doesn’t resolve to anything specific. On the catch-all proxy host’s SSL tab, switch to “Use a DNS Challenge” and select Namecheap from the provider list, then:

In Namecheap, go to Profile → Tools → Namecheap API Access and enable API access. Eligibility requires 20+ domains on the account, $50 spent in the past two years, or $50 in account balance.
Whitelist your server’s public IP in Namecheap’s API settings (the form is on the same page).
Back in NPM, paste your Namecheap API username (same as your account username) and API key into the credentials form.

Once provisioned, NPM renews the wildcard via DNS-01 automatically. To verify the cert is actually a wildcard:

echo | openssl s_client -connect anything.yourdomain.com:443 -servername anything.yourdomain.com 2>/dev/null \
  | openssl x509 -noout -text \
  | grep -A1 "Subject Alternative Name"
# Look for: DNS:*.yourdomain.com

Dynamic DNS with Namecheap

To keep your domain pointing to your external IP address, set up dynamic DNS updates.

Enable Dynamic DNS in Namecheap

Log in to Namecheap
Go to Domain List → Manage → Advanced DNS
Enable “Dynamic DNS” toggle
Note the Dynamic DNS Password (you’ll need this)

Configure DDNS with ddclient

Install ddclient:

sudo apt update
sudo apt install ddclient

During installation, you can skip the configuration prompts or configure for Namecheap directly.

Edit the configuration:

sudo vim /etc/ddclient.conf

Replace contents with:

# Configuration for Namecheap
daemon=600                   # Check every 10 minutes
syslog=yes                   # Log via syslog
pid=/var/run/ddclient.pid    # PID file location
ssl=yes                      # Use SSL

# Get IP from interface
use=if, if=eno1

# Namecheap settings
protocol=namecheap
server=dynamicdns.park-your-domain.com
login=yourdomain.com
password='your-dynamic-dns-password'
@,*

Note:

Replace your-dynamic-dns-password with the password from Namecheap’s Dynamic DNS settings
The @,* syntax updates both the root domain (yourdomain.com — @ is the zone-file shorthand for the bare apex, not a literal subdomain) and the wildcard (*.yourdomain.com)
Make sure both the @ and * A-records are enabled for Dynamic DNS in Namecheap’s Advanced DNS panel

Restart and enable:

sudo systemctl restart ddclient
sudo systemctl enable ddclient
sudo systemctl status ddclient

# Check the logs
sudo journalctl -u ddclient -f

Test the update:

sudo ddclient -daemon=0 -debug -verbose -noquiet

WireGuard VPN with wg-easy

Set up WireGuard VPN with a web UI for easy client management.

Create WireGuard directory

sudo mkdir -p /opt/wireguard
sudo chown -R $USER:$USER /opt/wireguard
cd /opt/wireguard

Create WireGuard docker-compose.yml

First, generate a password hash:

docker run -it ghcr.io/wg-easy/wg-easy wgpw 'YourSecurePasswordHere'

This will output a bcrypt hash. Copy it for the next step.

vim docker-compose.yml

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    environment:
      - LANG=en
      - WG_HOST=yourdomain.com          # Your dynamic DNS domain
      - PASSWORD_HASH=$$2a$$12$$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  # Paste your hash here (escape $ with $$)
      - PORT=51821                   # Web UI port
      - WG_PORT=51820                # WireGuard VPN port
      - WG_DEFAULT_ADDRESS=10.13.13.x
      - WG_DEFAULT_DNS=192.168.0.2   # Your LAN DNS
      - WG_ALLOWED_IPS=192.168.0.0/24, 10.13.13.0/24  # LAN + VPN subnet
      - WG_PERSISTENT_KEEPALIVE=25
      - WG_MTU=1420
    volumes:
      - /opt/wireguard:/etc/wireguard
    ports:
      - "51820:51820/udp"            # WireGuard port
      - "192.168.0.101:51821:51821/tcp"  # Web UI (LAN only)
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    restart: unless-stopped

Important: In docker-compose.yml, escape each $ in the hash by doubling it ($$).

Start WireGuard

docker compose up -d

# Check logs
docker logs -f wg-easy

Docker will automatically handle the necessary iptables rules for WireGuard.

Access Web UI

Open http://192.168.0.101:51821 from your LAN and log in with the password you set.

From the web interface you can:

Add/remove clients
Generate QR codes
Download config files
See connected clients
Enable/disable clients

Add and download client configurations

Unlike linuxserver/wireguard, wg-easy does not generate per-peer files on disk — clients are created and managed entirely through the web UI:

Open http://192.168.0.101:51821 and log in
Click “New Client”, give it a name, and save
For each client, use the icons on its row to:
- Show the QR code (scan from a phone)
- Download the .conf file (for desktop clients)
- Enable/disable or delete the client

The underlying state is kept in /opt/wireguard/wg0.conf (live interface config) and /opt/wireguard/wg0.json (wg-easy’s metadata). You generally shouldn’t edit these by hand.

Connect clients

Mobile (iOS/Android):

Install the WireGuard app
In the wg-easy web UI, click the QR-code icon next to the client and scan it

Desktop:

Install the WireGuard client
In the wg-easy web UI, click the download icon next to the client to grab its .conf
Import that file into the WireGuard client

Once connected, you’ll have access to your entire LAN (192.168.0.0/24) through the VPN.

Check connected peers

docker exec wg-easy wg show

Expose WireGuard Web UI via NPM (Optional)

For remote management of WireGuard clients, expose the web UI through NPM:

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: wireguard.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 51821
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Now you can manage WireGuard clients remotely at https://wireguard.yourdomain.com using your password.

Security note: The web UI is already protected with bcrypt password hashing. Make sure you used a strong password when generating the hash.

Mount an external USB drive at /srv/share for Samba shares and Plex library.

Identify and format the drive

Plug in the USB drive and identify it:

lsblk
# Should show sdb as 14T (with or without an existing sdb1 partition)

If lsblk only shows sdb (no sdb1 underneath), the drive has no partition table yet — create one first:

sudo parted /dev/sdb -- mklabel gpt mkpart primary ext4 1MiB 100%

Then format the partition with ext4:

sudo mkfs.ext4 /dev/sdb1

Mount the drive

Create mount point and get UUID:

sudo mkdir -p /srv/share
sudo blkid /dev/sdb1

Add to /etc/fstab for automatic mounting:

The Recommended Change: x-systemd.automount

Instead of a “static” mount that stays active forever, you should use systemd automount. This tells Linux: “Don’t worry about this drive right now, but the second any program (like Plex) tries to look inside /srv/share, mount it immediately.”

UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx /srv/share ext4 defaults,nofail,x-systemd.automount,x-systemd.idle-timeout=300 0 2

Mount and set permissions:

sudo mount -a
sudo chown -R $USER:$USER /srv/share

Verify it’s mounted:

df -h | grep /srv/share

Install and configure Samba

Install Samba to share /srv/share:

sudo apt install samba

Edit Samba config:

sudo vim /etc/samba/smb.conf

Add the following share definition at the end of the file:

[share]
   path = /srv/share
   browseable = yes
   writable = yes
   guest ok = no

Create Samba user

Create Samba user:

sudo smbpasswd -a $USER

Configure firewall

Adjust firewall to allow Samba:

# Allow Samba on LAN
sudo iptables -A INPUT -i enp2s0 -p udp -m multiport --dports 137,138 -j ACCEPT
sudo iptables -A INPUT -i enp2s0 -p tcp -m multiport --dports 139,445 -j ACCEPT

# Block Samba externally
sudo iptables -A INPUT -i eno1 -p udp -m multiport --dports 137,138 -j DROP
sudo iptables -A INPUT -i eno1 -p tcp -m multiport --dports 139,445 -j DROP

Make it persistent across reboots:

sudo netfilter-persistent save

Plex Media Server

Restore Plex Media Server with your existing library at /srv/share/Library.

Create Plex directory structure

sudo mkdir -p /opt/plex/config
sudo chown -R $USER:$USER /opt/plex
cd /opt/plex

Create docker-compose.yml for Plex

vim docker-compose.yml

services:
  plex:
    image: plexinc/pms-docker:latest
    container_name: plex
    network_mode: host
    environment:
      - TZ=America/Chicago
      - PLEX_UID=1000
      - PLEX_GID=1000
    volumes:
      - /opt/plex/config:/config
      # :rslave ensures the container follows the host's mount/unmount events
      - /srv/share/Library:/data:rslave
    devices:
      - /dev/dri:/dev/dri  # Intel QuickSync hardware transcoding (i5-8500T)
    restart: unless-stopped

Note:

The :rslave option on the data volume is included because /srv/share is an external mount point. This ensures that if the drive is remounted on the host, the change propagates to the container.
Using network_mode: host allows Plex to properly discover clients on your LAN and makes DLNA work correctly
The /dev/dri device passthrough enables Intel QuickSync hardware transcoding on the i5-8500T’s UHD Graphics 630
After starting Plex, enable hardware acceleration in Settings → Transcoder

Start Plex

docker compose up -d

# Check logs
docker logs -f plex

Allow Plex through firewall

Since Plex uses host networking mode, Docker doesn’t automatically manage firewall rules. Add an iptables rule to allow access from the LAN:

sudo iptables -I INPUT -i enp2s0 -p tcp --dport 32400 -j ACCEPT

Make it persistent across reboots (iptables-persistent was already installed in the Firewall with iptables section above):

sudo netfilter-persistent save

Access Plex

Open http://192.168.0.101:32400/web from your LAN to set up Plex.

During setup:

Sign in with your Plex account
Name your server
Add library pointing to /data (which maps to /srv/share/Library)
Plex should recognize your existing library structure

Enable Remote Access

Plex supports two methods for remote access: direct connection (better performance) and reverse proxy (uses existing SSL setup).

Method 1: Direct Connection (Recommended for streaming)

Allow Plex through the external interface:

sudo iptables -I INPUT -i eno1 -p tcp --dport 32400 -j ACCEPT
sudo netfilter-persistent save

Since eno1 has a public IP, no router port forwarding is needed — the iptables rule above is sufficient.

In Plex Settings:

Go to Settings → Remote Access
Click “Enable Remote Access”
Manually specify port: 32400

Method 2: Reverse Proxy via NPM

Add Plex to Nginx Proxy Manager for SSL access:

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: plex.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 32400
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

In Plex Settings → Network:

Add https://plex.yourdomain.com:443 to “Custom server access URLs”

Note: Both methods can be used simultaneously. Direct connection will be preferred for local network and external streaming, while the reverse proxy provides additional SSL access.

ntfy - Push Notification Service

Set up ntfy for simple push notifications to your devices.

Create ntfy directory

sudo mkdir -p /opt/ntfy
sudo chown -R $USER:$USER /opt/ntfy
cd /opt/ntfy

Create ntfy docker-compose.yml

vim docker-compose.yml

services:
  ntfy:
    image: binwiederhier/ntfy:latest
    container_name: ntfy
    command:
      - serve
    environment:
      - TZ=America/Chicago
    volumes:
      - /opt/ntfy/cache:/var/cache/ntfy
      - /opt/ntfy/etc:/etc/ntfy
    ports:
      - "192.168.0.101:8080:80"  # Web UI and API (LAN only)
    restart: unless-stopped

Start ntfy

docker compose up -d

# Check logs
docker logs -f ntfy

Access ntfy

Open http://192.168.0.101:8080 from your LAN.

Send a test notification

curl -d "Hello from ntfy!" http://192.168.0.101:8080/test

Then subscribe to the test topic in the web UI or mobile app to see the notification.

Mobile apps

Android: Install from Play Store or F-Droid
iOS: Install from App Store

In the app, add your server: http://192.168.0.101:8080

Expose ntfy via NPM

For external access, add ntfy to Nginx Proxy Manager:

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: ntfy.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 8080
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Then you can send notifications from anywhere:

curl -d "External notification" https://ntfy.yourdomain.com/alerts

Update your mobile apps to use https://ntfy.yourdomain.com instead of the local IP.

Nextcloud with Dedicated Drive

Set up Nextcloud with a dedicated 1.9TB drive for data storage.

Format and mount the drive

First, identify the drive:

lsblk
# Should show sda as 1.9T

Format the drive with ext4. Here we format the whole disk (/dev/sda) directly, no partition table — simpler when the drive is dedicated to a single purpose and won’t be moved between systems. If you’d prefer the partitioned approach used for the Samba drive above, run sudo parted /dev/sda -- mklabel gpt mkpart primary ext4 1MiB 100% first and then mkfs.ext4 /dev/sda1 (and use /dev/sda1 everywhere /dev/sda appears below).

sudo mkfs.ext4 /dev/sda

Create mount point and get UUID:

sudo mkdir -p /srv/nextcloud
sudo blkid /dev/sda
# Note the UUID value

Add to /etc/fstab for automatic mounting:

sudo vim /etc/fstab

Add this line (replace YOUR-UUID with the actual UUID):

UUID=YOUR-UUID  /srv/nextcloud  ext4  defaults,nofail  0  2

Why eager mount instead of x-systemd.automount (which we used for /srv/share): the Nextcloud Docker container bind-mounts /srv/nextcloud into /var/www/html/data without :rslave propagation (unlike Plex’s /srv/share/Library mount). With automount, the drive only appears on first access — if Nextcloud’s container starts before any process touches /srv/nextcloud, the bind-mount sees the empty mount-point directory instead of the real data, and Nextcloud silently writes to the system disk. Eager-mounting at boot avoids that race entirely. If you’d rather mirror the Samba drive’s x-systemd.automount setup, also add :rslave to the data volume in Nextcloud’s docker-compose.yml:

- /srv/nextcloud:/var/www/html/data:rslave

Mount and set permissions:

sudo mount -a
sudo systemctl daemon-reload  # Reload systemd if you see the fstab modified hint
sudo chown -R 33:33 /srv/nextcloud  # www-data user for Nextcloud

Verify it’s mounted:

df -h | grep nextcloud

Give your user read access

Add your user to the www-data group to access the Nextcloud drive:

sudo usermod -a -G www-data $USER

Then log out and back in, or run:

newgrp www-data

This allows you to read files on the Nextcloud drive. The force user/group settings in the Samba configuration ensure any files created via SMB are properly owned by www-data for Nextcloud to use.

Create Nextcloud directory

sudo mkdir -p /opt/nextcloud
sudo chown -R $USER:$USER /opt/nextcloud
cd /opt/nextcloud

Create Nextcloud docker-compose.yml

vim docker-compose.yml

services:
  db:
    image: mariadb:latest
    container_name: nextcloud-db
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
    restart: unless-stopped
    volumes:
      - /opt/nextcloud/db:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=CHANGEME_ROOT_PASSWORD
      - MYSQL_PASSWORD=CHANGEME_NEXTCLOUD_PASSWORD
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - TZ=America/Chicago

  app:
    image: nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    ports:
      - "192.168.0.101:8081:80"  # Web interface (LAN only)
    links:
      - db
    volumes:
      - /opt/nextcloud/html:/var/www/html
      - /srv/nextcloud:/var/www/html/data
    environment:
      - MYSQL_PASSWORD=CHANGEME_NEXTCLOUD_PASSWORD   # must match the db service's MYSQL_PASSWORD above
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
      - MYSQL_HOST=db
      - TZ=America/Chicago
    depends_on:
      - db

Important: Change the passwords to secure values before starting.

(Optionally, run openssl rand -base64 32 twice to generate two secure passwords — one for MYSQL_ROOT_PASSWORD and one shared between the db service’s MYSQL_PASSWORD and the app service’s MYSQL_PASSWORD.)

Start Nextcloud

docker compose up -d

# Watch the initialization (takes a few minutes)
docker logs -f nextcloud

Access Nextcloud

Open http://192.168.0.101:8081 from your LAN.

During first setup:

Create admin account
Data folder should already be set to /var/www/html/data (the 1.9TB drive)
Database settings are already configured via environment variables
Click “Install”

Expose Nextcloud via NPM

Add Nextcloud to Nginx Proxy Manager for external access:

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: nextcloud.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 8081
- Enable “Websockets Support”
- Scroll down to Advanced section
- In “Custom Nginx Configuration” box, add:
```
client_max_body_size 10G;
proxy_request_buffering off;
```
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Configure trusted domains

After setting up the reverse proxy, add the domain to Nextcloud’s trusted domains.

Edit the config file on the host:

sudo vim /opt/nextcloud/html/config/config.php

Find the trusted_domains array and add your domain, plus the overwriteprotocol setting:

'trusted_domains' =>
array (
  0 => '192.168.0.101:8081',
  1 => 'nextcloud.yourdomain.com',
),
'overwriteprotocol' => 'https',

The overwriteprotocol setting tells Nextcloud to generate HTTPS URLs even though NPM forwards to it via HTTP internally.

Restart Nextcloud:

cd /opt/nextcloud
docker restart nextcloud

Now you can access Nextcloud at https://nextcloud.yourdomain.com with all your data stored on the 1.9TB drive.

For native file system access to Nextcloud data, add another share to the existing Samba configuration.

Edit the Samba config:

sudo vim /etc/samba/smb.conf

Add the Nextcloud share definition at the end of the file:

[nextcloud]
path = /srv/nextcloud
browseable = yes
writable = yes
guest ok = no
valid users = nextcloud
force user = www-data
force group = www-data
create mask = 0664
directory mask = 0775

Create a system user and Samba user for Nextcloud access:

# Create a system user (no login, no home directory)
sudo useradd -r -s /usr/sbin/nologin -M nextcloud

# Create Samba password for the nextcloud user
sudo smbpasswd -a nextcloud

Important: Set a secure password when prompted.

Restart Samba to apply changes:

sudo systemctl restart smbd

Windows:

Open File Explorer
Type in address bar: \\192.168.0.101\nextcloud
Username: nextcloud
Password: (the one you set)

Mac:

Finder → Go → Connect to Server
Server: smb://192.168.0.101/nextcloud
Username: nextcloud
Password: (the one you set)

Linux:

sudo apt install cifs-utils
sudo mount -t cifs //192.168.0.101/nextcloud /mnt/share -o username=nextcloud,uid=1000,gid=1000

Sync changes to Nextcloud

After making changes via SMB, tell Nextcloud to rescan for new files:

docker exec -u www-data nextcloud php occ files:scan --all

Or for a specific user:

docker exec -u www-data nextcloud php occ files:scan username

Note: Files added/modified via SMB won’t immediately appear in Nextcloud web interface until a scan is run. Consider setting up a cron job for periodic scans if you frequently use SMB.

Wallabag - Read It Later Service

Self-hosted application for saving web pages to read later (like Pocket or Instapaper).

Create Wallabag directory

sudo mkdir -p /opt/wallabag
sudo chown -R $USER:$USER /opt/wallabag
cd /opt/wallabag

Create Wallabag docker-compose.yml

vim docker-compose.yml

services:
  wallabag:
    image: wallabag/wallabag
    container_name: wallabag
    environment:
      - SYMFONY__ENV__DATABASE_DRIVER=pdo_sqlite
      - SYMFONY__ENV__DATABASE_NAME=wallabag
      - SYMFONY__ENV__DOMAIN_NAME=https://wallabag.yourdomain.com
      - SYMFONY__ENV__SERVER_NAME=My Wallabag   # no inner quotes — YAML's `- "key=value"` form already passes the value verbatim, so quoting "My Wallabag" inside would propagate the literal quotes to the container
    ports:
      - "192.168.0.101:8082:80"
    volumes:
      - ./data:/var/www/wallabag/data
      - ./images:/var/www/wallabag/web/assets/images
    restart: unless-stopped

Important: Replace https://wallabag.yourdomain.com with your actual domain.

Note: Using SQLite keeps everything simple—just one container, and the database is a single file in ./data. Perfect for personal use.

Start Wallabag

docker compose up -d

# Check logs
docker logs -f wallabag

Allow Wallabag through firewall

The consolidated firewall script in the Final Firewall Configuration section below already includes port 8082. If you’re setting Wallabag up first and haven’t reached that section yet, add the rule manually:

sudo iptables -A INPUT -i enp2s0 -p tcp --dport 8082 -j ACCEPT
sudo netfilter-persistent save

Expose Wallabag via NPM

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: wallabag.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 8082
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Access Wallabag

Open https://wallabag.yourdomain.com.

Default credentials:

Username: wallabag
Password: wallabag

Security note: Change the password immediately after logging in.

RustDesk - Self-Hosted Remote Desktop

Set up RustDesk server for secure, self-hosted remote desktop access.

For more details, see the official RustDesk server documentation.

Create RustDesk directory

sudo mkdir -p /opt/rustdesk
sudo chown -R $USER:$USER /opt/rustdesk
cd /opt/rustdesk

Create RustDesk docker-compose.yml

vim docker-compose.yml

services:
  hbbs:
    container_name: rustdesk-hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs -r rustdesk.yourdomain.com:21117
    volumes:
      - ./data:/root
    network_mode: host
    restart: unless-stopped

  hbbr:
    container_name: rustdesk-hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    network_mode: host
    restart: unless-stopped

Note: Replace rustdesk.yourdomain.com with your actual domain.

Start RustDesk

docker compose up -d

# Check logs
docker logs -f rustdesk-hbbs
docker logs -f rustdesk-hbbr

Get the public key

After starting, retrieve the public key needed for client configuration:

cat /opt/rustdesk/data/id_ed25519.pub

Save this key - you’ll need it when configuring RustDesk clients.

Configure RustDesk clients

On each device you want to control or connect from:

Download and install RustDesk from https://rustdesk.com
Open RustDesk settings
Click “Network” → “ID Server”
Set ID Server to: rustdesk.yourdomain.com
Set Relay Server to: rustdesk.yourdomain.com
Click “Key” and paste the public key from earlier
Click “Apply”

Usage

To allow someone to connect to you:

Open RustDesk
Share your ID and password with the remote user
They enter your ID and password in their RustDesk client

To connect to another device:

Open RustDesk
Enter the remote device’s ID
Click “Connect”
Enter the password when prompted

Immich - Self-Hosted Photo & Video Backup

High performance self-hosted photo and video management solution.

Create Immich directory

sudo mkdir -p /opt/immich
sudo chown -R $USER:$USER /opt/immich
cd /opt/immich

Download configuration files

Download the recommended docker-compose.yml and .env files:

wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env

Configure environment

Edit the .env file to configure your settings:

vim .env

Key settings to adjust:

UPLOAD_LOCATION: Set this to a path with plenty of storage. Since we have a large external drive mounted at /srv/share, let’s use that.
DB_PASSWORD: Set a secure password for the database.
TZ: Set your timezone (e.g., America/Chicago).

Create the upload directory:

sudo mkdir -p /srv/share/Immich
sudo chown -R $USER:$USER /srv/share/Immich

Then update .env:

UPLOAD_LOCATION=/srv/share/Immich
DB_PASSWORD=YourSecurePassword
TZ=America/Chicago

Start Immich

docker compose up -d

# Check logs
docker logs -f immich_server

Expose Immich via NPM

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: photos.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 2283
- Enable “Websockets Support”

Advanced tab:

In “Custom Nginx Configuration” box, add:

client_max_body_size 0;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;

SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Access Immich

Open https://photos.yourdomain.com or http://192.168.0.101:2283.

Create the admin account on first login.

Mobile Apps

Download the Immich app for iOS or Android and connect to your server URL (https://photos.yourdomain.com).

Troubleshooting: System Freeze (optional, I didn’t do this)

If the system locks up during docker compose up -d, it’s likely the Machine Learning container consuming all CPU resources. The i5-8500T has 6 cores, and Immich may try to use them all.

To fix this, add resource limits to docker-compose.yml:

  immich-machine-learning:
    # ... existing config ...
    deploy:
      resources:
        limits:
          cpus: '4'  # Leave 2 cores for the system
          memory: 8G

Calibre-Web - Ebook Library Access

Use desktop Calibre for editing/conversion; use Calibre-Web here for browsing/downloading. Sync the library from your desktop to the server; treat the server copy as read-mostly.

Create library directory

sudo mkdir -p /srv/share/CalibreLibrary
sudo chown -R $USER:$USER /srv/share/CalibreLibrary

Deploy Calibre-Web

sudo mkdir -p /opt/calibre-web
sudo chown -R $USER:$USER /opt/calibre-web
cd /opt/calibre-web

Create compose file:

vim docker-compose.yml

services:
  calibre-web:
    image: lscr.io/linuxserver/calibre-web:latest
    container_name: calibre-web
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - DOCKER_MODS=linuxserver/mods:universal-calibre
    volumes:
      - /opt/calibre-web/config:/config
      - /srv/share/CalibreLibrary:/books
    ports:
      - "192.168.0.101:8083:8083"
    restart: unless-stopped

Start:

docker compose up -d

# Check logs
docker logs -f calibre-web

Access Calibre-Web

Open http://192.168.0.101:8083 from your LAN.

First-run setup:

Set library path to: /books
Create admin user

Sync from desktop Calibre

On your desktop (after closing Calibre), run:

rsync -avz --delete "/path/to/DesktopCalibreLibrary/" user@yourserver:/srv/share/CalibreLibrary/

Important:

--delete removes books deleted locally (omit if you want to keep server copies)
Run only when Calibre desktop is closed to avoid database corruption

After sync, refresh the database in Calibre-Web (Settings → Re-scan Library).

Optional sync script

Create sync-calibre.sh on your desktop:

#!/usr/bin/env bash
set -e
SRC="/path/to/DesktopCalibreLibrary/"
DEST="user@yourserver:/srv/share/CalibreLibrary/"
rsync -avz --delete "$SRC" "$DEST"
echo "Sync complete. Refresh Calibre-Web database."

Make executable:

chmod +x sync-calibre.sh

Run manually after editing books in desktop Calibre.

LAN firewall rule

sudo iptables -A INPUT -i enp2s0 -p tcp --dport 8083 -j ACCEPT
sudo netfilter-persistent save

Optional reverse proxy via NPM

For external access:

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: books.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 8083
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Lightweight file server for browsing and uploading files to your shared drives via web interface.

Create Copyparty directory

sudo mkdir -p /opt/copyparty
sudo chown -R $USER:$USER /opt/copyparty
cd /opt/copyparty

Rather than exposing the entirety of /srv/share (which holds Plex Library/, CalibreLibrary/, and Immich/ photo backups) through copyparty, create a dedicated subfolder that copyparty will be the only thing reading or writing:

sudo mkdir -p /srv/share/copyparty
sudo chown -R $USER:$USER /srv/share/copyparty

This way the blast radius of any copyparty misconfiguration is bounded to that one directory.

Create Copyparty docker-compose.yml

vim docker-compose.yml

services:
  copyparty:
    image: copyparty/ac:latest
    container_name: copyparty
    user: "1000:1000"
    ports:
      - "192.168.0.101:3923:3923"
    volumes:
      - /srv/share/copyparty:/mnt/share   # sandbox — NOT /srv/share itself
      - /opt/copyparty/config:/cfg
    environment:
      LD_PRELOAD: /usr/lib/libmimalloc-secure.so.NOPE
      # enable mimalloc by replacing "NOPE" with "2" for a nice speed-boost (will use twice as much ram)

      PYTHONUNBUFFERED: 1
      # ensures log-messages are not delayed (but can reduce speed a tiny bit)

    stop_grace_period: 15s  # thumbnailer is allowed to continue finishing up for 10s after the shutdown signal
    healthcheck:
      # hide it from logs with "/._" so it matches the default --lf-url filter 
      test: ["CMD-SHELL", "wget --spider -q 127.0.0.1:3923/?reset=/._"]
      interval: 1m
      timeout: 2s
      retries: 5
      start_period: 15s

    restart: unless-stopped

Create configuration file

Create the configuration file to define your shares and settings:

vim /opt/copyparty/config/copyparty.conf

# not actually YAML but lets pretend:
# -*- mode: yaml -*-
# vim: ft=yaml:


[global]
  e2dsa  # enable file indexing and filesystem scanning
  e2ts   # enable multimedia indexing
  ansi   # enable colors in log messages (both in logfiles and stdout)
  name: File Server  # name displayed in browser title/header
  xff-src: lan  # trust X-Forwarded-For headers from private IPs (Docker/LAN)
  rproxy: 1     # 1 hop behind reverse proxy
  no-robots     # discourage search engines from indexing if you ever NPM-expose this

  # q, lo: /cfg/log/%Y-%m%d.log   # log to file instead of docker

  # p: 3939          # listen on another port
  # ipa: 10.89.      # only allow connections from 10.89.*
  # df: 16           # stop accepting uploads if less than 16 GB free disk space
  # ver              # show copyparty version in the controlpanel
  # grid             # show thumbnails/grid-view by default
  # theme: 2         # monokai
  # stats, nos-dup   # enable the prometheus endpoint, but disable the dupes counter (too slow)
  # force-js         # make it harder for search engines to read your server


[accounts]
  yourname: REPLACE_WITH_STRONG_PASSWORD   # username: password (use `openssl rand -base64 24` for the password)


[/]              # create a volume at the webroot which will
  /mnt/share     # share /mnt/share (host's /srv/share/copyparty sandbox)
  accs:
    rw: *             # anyone can read (browse/download) and write (upload).
                      # `rw` does NOT include move (`m`), delete (`d`), or admin (`a`)
                      # — anonymous users can drop files in but can't alter or remove
                      # what's there. Good fit for a LAN drop-box.
    rwmda: yourname   # `yourname` additionally gets move/delete/admin

Security note on rw: *: anon rw is read + upload only — destructive ops (move, delete) require the named-account permissions on the second line. That’s the intentional shape of this share. Two things to keep in mind anyway:

The mount is /srv/share/copyparty, not all of /srv/share, so the blast radius is bounded to that subfolder regardless of ACL.
Be more deliberate before NPM-exposing this. An internet-facing anonymous upload endpoint is abusable as a free file dump (warez, malware staging, etc.) — even without delete rights, attackers can fill the drive with arbitrary content under your domain. If you do expose it externally, see the layered Access List recommendation below, or drop the * and keep public access login-only via the proxy host.

Start Copyparty

docker compose up -d

# Check logs
docker logs -f copyparty

Access Copyparty

Open http://192.168.0.101:3923 from your LAN.

You’ll see your /srv/share drive mounted as /mnt/share with full browsing and download capabilities.

LAN firewall rule

sudo iptables -A INPUT -i enp2s0 -p tcp --dport 3923 -j ACCEPT
sudo netfilter-persistent save

Optional: Expose via NPM

Before exposing: anonymous rw: * is fine on the LAN as a drop-box, but treat NPM exposure as a different threat model. With the proxy host below, anyone on the internet can hit the URL — and anon upload (even without delete) means strangers can fill /srv/share/copyparty with arbitrary content under your domain. Either drop rw: * from the share before exposing, or layer an NPM Access List on top (see below) so basic-auth gates the proxy host before any request reaches copyparty.

For external access:

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: files.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 3923
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

For an even stronger setup, add an NPM Access List (Username/Password basic-auth) on top of copyparty’s own login, so an attacker would need to clear two layers before reaching the file UI.

OpenSpeedTest - Network Speed Testing

Self-hosted HTML5 network speed test server. No Flash or Java required.

Create OpenSpeedTest directory

sudo mkdir -p /opt/openspeedtest
sudo chown -R $USER:$USER /opt/openspeedtest
cd /opt/openspeedtest

Create OpenSpeedTest docker-compose.yml

vim docker-compose.yml

services:
  openspeedtest:
    image: openspeedtest/latest
    container_name: openspeedtest
    ports:
      - "192.168.0.101:3000:3000"
    restart: unless-stopped

Start OpenSpeedTest

docker compose up -d

# Check logs
docker logs -f openspeedtest

Access OpenSpeedTest

Open http://192.168.0.101:3000 from your LAN.

LAN firewall rule

sudo iptables -A INPUT -i enp2s0 -p tcp --dport 3000 -j ACCEPT
sudo netfilter-persistent save

Optional: Expose via NPM

For external access (to test speed from outside):

Open NPM at http://192.168.0.101:81
Go to “Proxy Hosts” → “Add Proxy Host”
Details tab:
- Domain Names: speed.yourdomain.com
- Scheme: http
- Forward Hostname/IP: 192.168.0.101
- Forward Port: 3000
- Enable “Websockets Support”
SSL tab:
- SSL Certificate: “Request a new SSL Certificate”
- Enable “Force SSL”
- Accept Let’s Encrypt Terms
Save

Netdata - Real-time Performance Monitoring

Real-time health monitoring and performance troubleshooting.

Create Netdata directory

sudo mkdir -p /opt/netdata
sudo chown -R $USER:$USER /opt/netdata
cd /opt/netdata

Create Netdata docker-compose.yml

vim docker-compose.yml

services:
  netdata:
    image: netdata/netdata
    container_name: netdata
    pid: host
    network_mode: host
    restart: unless-stopped
    cap_add:
      - SYS_PTRACE
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    volumes:
      - netdataconfig:/etc/netdata
      - netdatalib:/var/lib/netdata
      - netdatacache:/var/cache/netdata
      - /etc/passwd:/host/etc/passwd:ro
      - /etc/group:/host/etc/group:ro
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /etc/os-release:/host/etc/os-release:ro
      - /var/log:/host/var/log:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  netdataconfig:
  netdatalib:
  netdatacache:

Start Netdata

docker compose up -d

# Check logs
docker logs -f netdata

LAN firewall rule

Since Netdata uses host networking, we must explicitly allow the port in iptables. We need to allow access from the LAN (enp2s0) for direct access, and from Docker (br+) so NPM can reach it.

sudo iptables -A INPUT -i enp2s0 -p tcp --dport 19999 -j ACCEPT
sudo iptables -A INPUT -i br+ -p tcp --dport 19999 -j ACCEPT
sudo netfilter-persistent save

Access Netdata

Open http://192.168.0.101:19999 from your LAN.

Optional: Expose via NPM (Securely)

Security Warning: Netdata has no default password. Do not expose it to the internet without adding authentication via NPM Access Lists.

Create an Access List in NPM:
- Open NPM at http://192.168.0.101:81
- Go to Access Lists → “Add Access List”
- Name: Admin Access
- Authorization tab: Add a Username and Password
- Save
Create Proxy Host:
- Go to “Proxy Hosts” → “Add Proxy Host”
- Details tab:
  - Domain Names: monitor.yourdomain.com
  - Scheme: http
  - Forward Hostname/IP: 192.168.0.101
  - Forward Port: 19999
  - Access List: Select Admin Access (This is critical!)
  - Enable “Websockets Support”
- SSL tab:
  - SSL Certificate: “Request a new SSL Certificate”
  - Enable “Force SSL”
  - Accept Let’s Encrypt Terms
- Save

Now, when you visit https://monitor.yourdomain.com, you’ll be prompted for the username and password you set up in the Access List.

Watchtower - Container Update Monitoring

Watchtower monitors your Docker containers for updates and can optionally apply them automatically. We’ll use monitor-only mode to get notifications without automatic updates, giving you control over when to update critical services.

Create Watchtower directory

sudo mkdir -p /opt/watchtower
sudo chown -R $USER:$USER /opt/watchtower
cd /opt/watchtower

Create Watchtower docker-compose.yml

vim docker-compose.yml

services:
  watchtower:
    image: containrrr/watchtower:latest
    container_name: watchtower
    environment:
      - TZ=America/Chicago
      - DOCKER_API_VERSION=1.44
      - WATCHTOWER_MONITOR_ONLY=true
      - WATCHTOWER_NOTIFICATION_URL=ntfy://192.168.0.101:8080/watchtower?scheme=http&title=Watchtower
      - WATCHTOWER_NOTIFICATIONS=shoutrrr
      - WATCHTOWER_NOTIFICATIONS_LEVEL=info
      - WATCHTOWER_SCHEDULE=0 0 17 * * *  # Check daily at 5 PM
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_DISABLE_CONTAINERS=immich_postgres,immich_machine_learning,immich_redis
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

Configuration explained:

WATCHTOWER_MONITOR_ONLY=true: Only notify, don’t update
WATCHTOWER_NOTIFICATIONS: Send notifications via ntfy
WATCHTOWER_NOTIFICATIONS_LEVEL=info: Notify when updates are found (standard log level for findings)
WATCHTOWER_DISABLE_CONTAINERS: Exclude dependency containers (Immich’s postgres and machine-learning) from monitoring. Verify the names match your installation — recent Immich releases sometimes use hyphens (immich-postgres) instead of underscores. Run docker ps --format '' | grep immich and update this list to match what’s actually running.
WATCHTOWER_SCHEDULE: Cron schedule (5 PM daily)
WATCHTOWER_CLEANUP=true: Remove old images after updates (if you enable auto-update later)

Start Watchtower

docker compose up -d

# Check logs
docker logs -f watchtower

Triggering a Manual Check

If you want to run Watchtower immediately to check for updates without waiting for the schedule:

cd /opt/watchtower
docker compose run --rm watchtower --run-once

This will start a temporary instance that runs a single check, outputs the results to your terminal, and then exits. The --rm flag ensures the temporary container is automatically deleted after it finishes, so there is no cleanup required.

In ntfy (web or mobile app), subscribe to the watchtower topic to receive update notifications.

Optional: Enable auto-update for specific containers

If you want to auto-update only certain containers, modify the Watchtower config:

environment:
  - WATCHTOWER_LABEL_ENABLE=true  # Only update labeled containers

Then add labels to containers you trust to auto-update (in their docker-compose.yml):

services:
  ntfy:
    image: binwiederhier/ntfy:latest
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

Recommended for auto-update:

ntfy
Wallabag
Calibre-Web

NOT recommended for auto-update:

Nextcloud (database migrations need testing)
Plex (library compatibility)
Immich (breaking changes common)
NPM (reverse proxy config changes)

Manual update workflow

When you receive a notification:

Check the container’s changelog/release notes
Test the update on LAN first

Update manually:

cd /opt/service-name
docker compose pull
docker compose up -d

Verify the service still works
Clean up old images:
```
docker image prune -a
```

Final Firewall Configuration

Since the current firewall rules are messy and contain duplicates, use this script to safely reset them. This method sets the default policy to ACCEPT first to ensure you don’t get locked out of SSH when flushing rules.

Important: This script flushes ALL rules. It includes lines to restore access for SSH, Samba, Plex, and the Web UIs mentioned in this guide. It also restarts Docker to ensure Docker-managed rules (like WireGuard and NPM public ports) are correctly recreated.

You can copy and paste the commands below, or save them to a file (e.g., firewall.sh) and run it with sudo bash firewall.sh.

# 1. Set default policy to ACCEPT to prevent lockout during flush
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

# 2. Flush all existing rules and delete custom chains
sudo iptables -F
sudo iptables -X

# 3. Add base rules
# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT
# Allow established connections
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow Docker containers to communicate with host (Required for NPM -> Netdata)
sudo iptables -A INPUT -i docker0 -j ACCEPT
sudo iptables -A INPUT -i br+ -j ACCEPT
# Allow SSH (LAN only)
sudo iptables -A INPUT -i enp2s0 -p tcp --dport 22 -j ACCEPT

# 4. Add LAN Services (enp2s0)
# Samba (File Sharing)
sudo iptables -A INPUT -i enp2s0 -p udp -m multiport --dports 137,138 -j ACCEPT
sudo iptables -A INPUT -i enp2s0 -p tcp -m multiport --dports 139,445 -j ACCEPT
# Plex (Media Server)
sudo iptables -A INPUT -i enp2s0 -p tcp --dport 32400 -j ACCEPT
# RustDesk (Remote Desktop)
sudo iptables -A INPUT -i enp2s0 -p tcp -m multiport --dports 21115,21116,21117,21118,21119 -j ACCEPT
sudo iptables -A INPUT -i enp2s0 -p udp --dport 21116 -j ACCEPT
# Web UIs (NPM:81, ntfy:8080, Nextcloud:8081, Wallabag:8082, WG:51821, Immich:2283, Calibre-Web:8083, Copyparty:3923, OpenSpeedTest:3000, Netdata:19999)
sudo iptables -A INPUT -i enp2s0 -p tcp -m multiport --dports 81,8080,8081,8082,51821,2283,8083,3923,3000,19999 -j ACCEPT

# 5. Add External Services (eno1)
# Plex (Remote Access)
sudo iptables -A INPUT -i eno1 -p tcp --dport 32400 -j ACCEPT
# RustDesk (Remote Access)
sudo iptables -A INPUT -i eno1 -p tcp -m multiport --dports 21115,21116,21117,21118,21119 -j ACCEPT
sudo iptables -A INPUT -i eno1 -p udp --dport 21116 -j ACCEPT

# 6. Restart Docker to recreate Docker chains and rules
# This handles WireGuard (51820) and NPM (80/443) automatically
sudo systemctl restart docker

# 7. Set default policy back to DROP
sudo iptables -P INPUT DROP

# 8. Save rules
sudo netfilter-persistent save

Note: Since your server has a direct internet connection via eno1, no router port forwarding is needed. The firewall rules above allow direct access from the internet.

Moving Docker Data to /srv

If like me, you used Debian’s default “Server” partitioning scheme on a 1TB drive, your /var partition is small (22GB) and filling up (100% usage), while /srv has plenty of space (800GB+). Since Docker stores images and containers in /var/lib/docker by default, we should move this to /srv.

1. Stop Docker

sudo systemctl stop docker
sudo systemctl stop docker.socket

2. Create new directory

sudo mkdir -p /srv/docker

3. Configure Docker to use new path

Create or edit the daemon config:

sudo vim /etc/docker/daemon.json

Add the data-root configuration. If the file is empty, paste this:

{
  "data-root": "/srv/docker"
}

If the file already exists, just add the line inside the brackets (don’t forget the comma if needed).

4. Move existing data

Copy all existing Docker data to the new location:

sudo rsync -aqxP /var/lib/docker/ /srv/docker/

5. Start Docker

sudo systemctl start docker

6. Verify and clean up

Check that Docker is using the new path:

docker info | grep "Docker Root Dir"
# Should output: Docker Root Dir: /srv/docker

Check that your containers are running:

docker ps

Only after verifying everything works, remove the old data to free up space in /var:

sudo rm -rf /var/lib/docker

Verifying System Health

If the system freezes or reboots, use these commands to verify everything is back up and running correctly.

Check Docker Containers

Ensure all containers are running and healthy:

docker ps --format "table \t\t"

Monitor Resource Usage

Check if any container (specifically immich_machine_learning) is consuming excessive resources:

docker stats

If immich_machine_learning is using 100% of multiple cores for extended periods, consider applying the resource limits mentioned in the Immich section.

Check System Logs

Look for any system-level errors that might have occurred during the freeze:

sudo journalctl -p 3 -xb

Verify Network & Firewall

Ensure network interfaces are up and firewall rules are loaded:

networkctl status
sudo iptables -L -v -n | head

Arch Linux WiFi Hotspot Notes [Arch Linux]

Thu, 13 Nov 2025 00:00:00 +0000

Wanting to set up a WiFi hotspot on Arch Linux that used the 5 GHz band, it was necessary to set the country code for the wireless interface. This is required for regulatory compliance and to access all available channels in your region.

The iw command can be used to check the current setting:

iw reg get

iw can be installed by running the following command:

sudo pacman -S iw

In Arch Linux, to permanently set the domain, install wireless-regdb if not already installed:

sudo pacman -S wireless-regdb

Then create or edit the file /etc/conf.d/wireless-regdom to include the desired country code, for example for the United States:

WIRELESS_REGDOM="US"

After setting the country code, restart the system.

To verify the change, use the iw reg get command again to ensure the country code is correctly set.

To find the available channels for 5 GHz, run:

iw list

Refer to the output under “Frequencies” in the “Band 2” section (Band 1 is 2.4 GHz, Band 2 is 5 GHz).

Once you’ve identified an available channel, create the hotspot with:

nmcli dev wifi hotspot ifname wlp6s0 ssid my-hotspot password "mypassword" band a channel 36

band a specifies the 5 GHz band, and channel 36 is one of the available channels in that band.

Replace wlp6s0 with the appropriate wireless interface name, which can be found using the ip link command. Make sure to replace "mypassword" with a secure password of your choice.

To list previously created connections, use:

nmcli connection show

To remove a hotspot connection when it’s no longer needed, use the delete command with the connection name (usually the SSID):

nmcli connection delete "my-hotspot"

Start Steam minimized [Linux]

Sun, 09 Jun 2024 00:00:00 +0000

Auto start paths:

/usr/share/applications/ 
/usr/local/share/applications/
~/.local/share/applications/

In KDE Plasma, go to System Settings > Startup and Shutdown > Autostart, and add an entry for Steam. In the application menu, use -silent %U as arguments. (Note, it’s -silent and not --silent).

Uninstall Windows Web Experience Pack (Windows 11) [powershell]

Mon, 25 Sep 2023 00:00:00 +0000

The reintroduced Windows Widget Panel and shortcut (Win + W) can be completely disabled and removed from Windows 11 using the following command in PowerShell.

winget uninstall "Windows Web Experience Pack"

Keyboard shortcuts in Windows [Windows]

Mon, 04 Sep 2023 00:00:00 +0000

Keyboard shortcuts in Windows

Copy, paste, and other general keyboard shortcuts

Press this key	To do this
`Ctrl` + X	Cut the selected item.
`Ctrl` + C (or `Ctrl` + `Insert`)	Copy the selected item.
`Ctrl` + V (or `Shift` + `Insert`)	Paste the selected item.
`Ctrl` + Z	Undo an action.
`Alt` + `Tab`	Switch between open apps.
`Alt` + `F4`	Close the active item, or exit the active app.
`Win` + L	Lock your PC.
`Win` + D	Display and hide the desktop.
`F2`	Rename the selected item.
`F3`	Search for a file or folder in File Explorer.
`F4`	Display the address bar list in File Explorer.
`F5`	Refresh the active window.
`F6`	Cycle through screen elements in a window or on the desktop.
`F10`	Activate the Menu bar in the active app.
`Alt` + A	Set focus to the first icon in the Suggested actions menu.
`Alt` + `F8`	Show your password on the sign-in screen.
`Alt` + `Esc`	Cycle through items in the order in which they were opened.
`Alt` + underlined letter	Perform the command for that letter.
`Alt` + `Enter`	Display properties for the selected item.
`Alt` + `Spacebar`	Open the shortcut menu for the active window.
`Alt` + Left arrow	Go back.
`Alt` + Right arrow	Go forward.
`Alt` + Page Up	Move up one screen.
`Alt` + Page Down	Move down one screen.
`Ctrl` + `F4`	Close the active document (in apps that are full-screen and let you have multiple documents open at the same time).
`Ctrl` + A	Select all items in a document or window.
`Ctrl` + D (or Delete)	Delete the selected item and move it to the Recycle Bin.
`Ctrl` + E	Open Search (in most apps).
`Ctrl` + R (or `F5`)	Refresh the active window.
`Ctrl` + Y	Redo an action.
`Ctrl` + Right arrow	Move the cursor to the beginning of the next word.
`Ctrl` + Left arrow	Move the cursor to the beginning of the previous word.
`Ctrl` + Down arrow	Move the cursor to the beginning of the next paragraph.
`Ctrl` + Up arrow	Move the cursor to the beginning of the previous paragraph.
`Ctrl` + `Alt` + `Tab`	Use the arrow keys to switch between all open apps.
`Alt` + `Shift` + arrow keys	When a group or tile is in focus on the Start menu, move it in the direction specified.
`Ctrl` + `Shift` + arrow keys	When a tile is in focus on the Start menu, move it into another tile to create a folder.
`Ctrl` + arrow keys	Resize the Start menu when it’s open.
`Ctrl` + arrow key (to move to an item) + `Spacebar`	Select multiple individual items in a window or on the desktop.
`Ctrl` + `Shift` with an arrow key	Select a block of text.
`Ctrl` + `Esc`	Open Start.
`Ctrl` + `Shift` + `Esc`	Open Task Manager.
`Ctrl` + `Shift`	Switch the keyboard layout when multiple keyboard layouts are available.
`Ctrl` + `Spacebar`	Turn the Chinese input method editor (IME) on or off.
`Shift` + `F10`	Display the shortcut menu for the selected item.
`Shift` with any arrow key	Select more than one item in a window or on the desktop, or select text in a document.
`Shift` + Delete	Delete the selected item without moving it to the Recycle Bin first.
Right arrow	Open the next menu to the right, or open a submenu.
Left arrow	Open the next menu to the left, or close a submenu.
`Esc`	Stop or leave the current task.
`PrtScn`	Take a screenshot of your whole screen and copy it to the clipboard. (Note: You can change this shortcut so it also opens screen snipping, which lets you edit your screenshot. Select Start > Settings > Accessibility > Keyboard , and set Use the Print Screen button to open screen snipping to On.)

Windows logo key keyboard shortcuts

Press this key	To do this
`Win`	Open or close Start.
`Win` + A	Open Quick Settings. Updated in Windows 11.
`Win` + B	Set focus to the first icon in the Taskbar corner.
`Win` + C	Open Chat from Microsoft Teams. Updated in Windows 11.
`Win` + `Shift` + C	Open the charms menu.
`Win` + `Ctrl` + C	Turn on color filters (enable this shortcut first in Color Filter settings).
`Win` + D	Display and hide the desktop.
`Win` + E	Open File Explorer.
`Win` + F	Open Feedback Hub and take a screenshot.
`Win` + G	Open Xbox Game Bar when a game is open.
`Win` + `Alt` + B	Turn HDR on or off.
`Win` + H	Launch voice typing. Updated in Windows 11.
`Win` + I	Open Settings.
`Win` + J	Set focus to a Windows tip when one is available. (When a Windows tip appears, bring focus to the Tip. Pressing the keyboard shortcuts again to bring focus to the element on the screen to which the Windows tip is anchored.)
`Win` + K	Open Cast from Quick Settings. Updated in Windows 11.
`Win` + `Alt` + K	Toggle microphone mute in apps that support Call Mute. Available starting in Windows 11, version 22H2.
`Win` + L	Lock your PC or switch accounts.
`Win` + M	Minimize all windows.
`Win` + `Shift` + M	Restore minimized windows on the desktop.
`Win` + N	Open notification center and calendar. Updated in Windows 11.
`Win` + O	Lock device orientation.
`Win` + P	Choose a presentation display mode.
`Win` + `Ctrl` + Q	Open Quick Assist.
`Win` + R	Open the Run dialog box.
`Win` + `Alt` + R	Record video of game window in focus (using Xbox Game Bar).
`Win` + S	Open search.
`Win` + `Shift` + S	Take a screenshot of part of your screen.
`Win` + T	Cycle through apps on the taskbar.
`Win` + U	Open Accessibility Settings.
`Win` + V	Open the clipboard history.
`Win` + `Shift` + V	Set focus to a notification.
`Win` + W	Open Widgets. Updated in Windows 11.
`Win` + X	Open the Quick Link menu.
`Win` + Y	Switch input between Windows Mixed Reality and your desktop.
`Win` + Z	Open the snap layouts. Updated in Windows 11.
`Win` + period (.) or semicolon (;)	Open emoji panel.
`Win` + comma (,)	Temporarily peek at the desktop.
`Win` + `Pause`	Opens Start > Settings > System > About .
`Win` + `Ctrl` + F	Search for PCs (if you’re on a network).
`Win` + number	Open the desktop and start the app pinned to the taskbar in the position indicated by the number. If the app is already running, switch to that app.
`Win` + `Shift` + number	Open the desktop and start a new instance of the app pinned to the taskbar in the position indicated by the number.
`Win` + `Ctrl` + number	Open the desktop and switch to the last active window of the app pinned to the taskbar in the position indicated by the number.
`Win` + `Alt` + number	Open the desktop and open the Jump List for the app pinned to the taskbar in the position indicated by the number.
`Win` + `Ctrl` + `Shift` + number	Open the desktop and open a new instance of the app located at the given position on the taskbar as an administrator.
`Win` + `Tab`	Open Task view.
`Win` + Up arrow	Maximize the window.
`Win` + `Alt` + Up arrow	Snap window in focus to top half of screen. New with Windows 11.
`Win` + Down arrow	Remove current app from screen or minimize the desktop window.
`Win` + `Alt` + Down arrow	Snap window in focus to bottom half of screen. New with Windows 11.
`Win` + Left arrow	Maximize the app or desktop window to the left side of the screen.
`Win` + Right arrow	Maximize the app or desktop window to the right side of the screen.
`Win` + `Home`	Minimize all except the active desktop window (restores all windows on second stroke).
`Win` + `Shift` + Up arrow	Stretch the desktop window to the top and bottom of the screen.
`Win` + `Shift` + Down arrow	Restore/minimize active desktop windows vertically, maintaining width.
`Win` + `Shift` + Left arrow or Right arrow	Move an app or window in the desktop from one monitor to another.
`Win` + `Shift` + `Spacebar`	Cycle backwards through language and keyboard layout.
`Win`+ `Spacebar`	Switch input language and keyboard layout.
`Win`+ `Ctrl` + `Spacebar`	Change to a previously selected input.
`Win` + `Ctrl` + `Enter`	Turn on Narrator.
`Win` + Plus (+)	Open Magnifier and zoom in.
`Win` + Minus (-)	Zoom out in Magnifier.
`Win` + `Esc`	Close Magnifier.
`Win` + forward slash (/)	Begin IME reconversion.
`Win` + `Ctrl` + `Shift` + B	Wake PC from blank or black screen.
`Win` + `PrtScn`	Save full screen screenshot to file.
`Win` + `Alt` + `PrtScn`	Save screenshot of game window in focus to file (using Xbox Game Bar).
`Win` + `Alt` + `Enter` (on taskbar item focus)	Open taskbar settings.

Command Prompt keyboard shortcuts

Press this key	To do this
`Ctrl` + C (or `Ctrl` + `Insert`)	Copy the selected text.
`Ctrl` + V (or `Shift` + `Insert`)	Paste the selected text.
`Ctrl` + M	`Enter` Mark mode.
`Alt` + selection key	Begin selection in block mode.
Arrow keys	Move the cursor in the direction specified.
Page up	Move the cursor by one page up.
Page down	Move the cursor by one page down.
`Ctrl` + `Home` (Mark mode)	Move the cursor to the beginning of the buffer.
`Ctrl` + `End` (Mark mode)	Move the cursor to the end of the buffer.
`Ctrl` + Up arrow	Move up one line in the output history.
`Ctrl` + Down arrow	Move down one line in the output history.
`Ctrl` + `Home` (History navigation)	If the command line is empty, move the viewport to the top of the buffer. Otherwise, delete all the characters to the left of the cursor in the command line.
`Ctrl` + `End` (History navigation)	If the command line is empty, move the viewport to the command line. Otherwise, delete all the characters to the right of the cursor in the command line.

Dialog box keyboard shortcuts

Press this key	To do this
`F4`	Display the items in the active list.
`Ctrl` + `Tab`	Move forward through tabs.
`Ctrl` + `Shift` + `Tab`	Move back through tabs.
`Ctrl` + 1, 2, 3,…	Move to that tab number.
`Tab`	Move forward through options.
`Shift` + `Tab`	Move back through options.
`Alt` + underlined letter	Perform the command (or select the option) that is used with that letter.
`Spacebar`	Select or clear the check box if the active option is a check box.
`Backspace`	Open a folder one level up if a folder is selected in the Save As or Open dialog box.
Arrow keys	Select a button if the active option is a group of option buttons.

File Explorer keyboard shortcuts

Press this key	To do this
`Alt` + D	Select the address bar.
`Ctrl` + E	Select the search box.
`Ctrl` + F	Select the search box.
`Ctrl` + N	Open a new window.
`Ctrl` + T	Open a new tab and switch to it.
`Ctrl` + W	Closes the active tab. Closes the window if there’s only one tab open.
`Ctrl` + `Tab`	Move to the next tab.
`Ctrl` + `Shift` + `Tab`	Move to the previous tab.
`Ctrl` + 1, 2, 3,…	Move to that tab number.
`Ctrl` + mouse scroll wheel	Change the size and appearance of file and folder icons.
`Ctrl` + `Shift` + E	Display all folders above the selected folder.
`Ctrl` + `Shift` + N	Create a new folder.
`Num Lock` + asterisk (*)	Display all subfolders under the selected folder.
`Num Lock` + plus (+)	Display the contents of the selected folder.
`Num Lock` + minus (-)	Collapse the selected folder.
`Alt` + P	Display the preview panel.
`Alt` + `Enter`	Open the Properties dialog box for the selected item.
`Alt` + Right arrow	View the next folder.
`Alt` + Up arrow	View the folder that the folder was in.
`Alt` + Left arrow	View the previous folder.
`Backspace`	View the previous folder.
Right arrow	Display the current selection (if it’s collapsed), or select the first subfolder.
Left arrow	Collapse the current selection (if it’s expanded), or select the folder that the folder was in.
`End`	Display the bottom of the active window.
`Home`	Display the top of the active window.
`F11`	Maximize or minimize the active window.

Virtual desktops keyboard shortcuts

Press this key	To do this
`Win` + `Tab`	Open Task view.
`Win` + `Ctrl` + D	Add a virtual desktop.
`Win` + `Ctrl` + Right arrow	Switch between virtual desktops you’ve created on the right.
`Win` + `Ctrl` + Left arrow	Switch between virtual desktops you’ve created on the left.
`Win` + `Ctrl` + `F4`	Close the virtual desktop you’re using.

Taskbar keyboard shortucts

Press this key	To do this
`Shift` + click a taskbar button	Open an app or quickly open another instance of an app.
`Ctrl` + `Shift` + click a taskbar button	Open an app as an administrator.
`Shift` + right-click a taskbar button	Show the window menu for the app.
`Shift` + right-click a grouped taskbar button	Show the window menu for the group.
`Ctrl` + click a grouped taskbar button	Cycle through the windows of the group.

Settings keyboard shortcuts

Press this key	To do this
`Win` + I	Open settings.
`Backspace`	Go back to the settings home page.
Type on any page with search box	Search settings.

Resize active window to 1080p or 720p with Win+\ or Win+Shift+\ respectively [AutoHotKey]

Wed, 09 Mar 2022 00:00:00 +0000

AutoHotKey resize window to 1080p or 720p with Win+\ or Win+Shift+\ respectively

Create ahk file with the following two entries:

#\:: ; [Win]+[\]
    WinGet, window, ID, A
    WinMove, ahk_id %window%, , , , 1920, 1080
    return
#+\:: ; [Win]+[Shift]+[\]
    WinGet, window, ID, A
    WinMove, ahk_id %window%, , , , 1280, 720
    return

Update for AHK v2

#\:: ; [Win]+[\]
{
    WinMove(, , 1920, 1080, "A")
}

#+\:: ; [Win]+[Shift]+[\]
{
    WinMove(, , 1280, 720, "A")
}

Disable Web Search in Windows 10 Start Menu [powershell]

Sun, 07 Mar 2021 00:00:00 +0000

Disable the Bing search results in Windows 10 search

Annoyingly, this requires adding a new 0-value DWORD registry entry. In PowerShell:

Set-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Search -Name "BingSearchEnabled" -Value 0 -Type DWord

Kit's Git Cheat Sheet [git]

Wed, 12 Jun 2019 00:00:00 +0000

Repo Creation

cd to directory

git init

git init repo_dir

“Bare” repository creation (e.g. for use in network file-based share)

git init --bare

Clone an existing repository (default name of first remote is origin)

git clone repo_url

Changes

State of changed files in working directory

git status

Changes to tracked files

git diff

Changes to files that are added to index

git diff --cached

Add all current changes

git add .

Add some changes in <file> to the next commit

git add -p <file>

Commit all local changes in tracked files (quick-add and commit)

git commit -a

Commit staged

git commit

Change last commit with staged

git commit --amend

History

List commits, newest to oldest

git log

List commits within a range of revisions (rev identifiers can be branches, revision id’s, tags, etc.)

git log <from>..<to>

Show changes to a file

git log -p <file>

Show changes, excluding merge commits

git log --no-merged

Show changes

Kit’s “tab-separated changes we’re about to release with author name” one-liner

git log prod..test --pretty=format:"%h%x09%an%x09%s" --no-merges

Annotate file

git blame <file>

Branches & Tags

List all branches with last commit message, and tracking branch info

git branch -avv

Switch HEAD to a branch (note that this will check out remote branch and track if ref matches)

git checkout <branch>

Create new branch based on current HEAD and check it out

git checkout -b <new-branch>

Delete local branch (-D to force)

git branch -d <branch>

Delete branch on remote origin

git push origin --delete <branch>

List branches on remote that are not merged into specified branch on remote

git branch -r --no-merged origin/<branch>

Create a (lightweight) tag on the current commit

git tag <tag-name>

Push a specific tag to remote origin

git push origin <tag-name>

Push all tags to current default remote (not usually recommended)

git push --tags

Get a cool “tag plus number of commits plus short revision id” value for current head (e.g. 3.2.1-14-g3ef206ca)

git describe --tags

Update & Publish

Get latest branch info from remote and delete tracking branches no longer present on remote

git fetch --prune

Push local branch to remote and track (--set-upstream) (Note, no need to checkout branch you’re pushing if specified in the command)

git push -u origin <branch>

Merge & Rebase

Merge <branch> into your current HEAD

git merge <branch>

Rebase your current HEAD into <branch> (think opposite order of operations)

git rebase <branch>

After rebase is complete, stage changes and commit

In the event of merge conflicts, abort with git rebase --abort and git rebase --continue after resolving.

Advanced/Miscellaneous

Get a short revision identifier for the currently checked out commit

git rev-parse --short HEAD

Move last commit intended for a new branch from current branch to <new-branch>

git branch <new-branch>
git reset HEAD~ --hard
git checkout <new-branch>

Move last commit to another existing branch

# undo the last commit, but leave the changes available
git reset HEAD~ --soft
git stash
# move to the correct branch
git checkout name-of-the-correct-branch
git stash pop
git add . # or add individual files
git commit -m "your message here"
# now your changes are on the correct branch

or use cherry-pick

git checkout name-of-the-correct-branch
# grab the last commit to master
git cherry-pick master
# delete it from master
git checkout master
git reset HEAD~ --hard

Duplicate (mirror) an existing repository from one location to another

git clone --mirror <source-repository-url>

(This makes a bare repository with the config mirror = true set.) To set the push location

cd <repository-to-mirror>.git
git remote set-url --push origin <mirror-dest-repostiory-url>

Like bare clone, the mirror clone includes all branches and tags, but they’ll be overwritten each time you fetch. To update from the mirror source, fetch then push:

git fetch --prune origin
git push --mirror

Switching to, and making PowerShell work on Arch [bash]

Tue, 10 Jul 2018 00:00:00 +0000

env TERM=xterm pwsh

Yep, that’s it.

touch command (update Date Modified) in Windows [powershell]

Tue, 08 May 2018 00:00:00 +0000

How to update the “Date Modified” value for a given file in Windows

Known simply as the touch command in *nix, the same can be accomplished using PowerShell:

PS> (ls your-file-name-here).LastWriteTime = Get-Date

(note that PS> is the prompt, not part of the command.)

(with thanks to superuser.com)

Kit Roed

Home Server Setup Notes

Key preparations

Disable IP forwarding

Configure interfaces separately

Firewall with iptables

Install and configure iptables

Disable nftables

Set up Nginx Proxy Manager:

Create directories for NPM

Create NPM docker-compose.yml

Default Landing Page

Create landing page directory

Create index.html

Create robots.txt (deny crawlers)

Create default-page docker-compose.yml

Start the service

Configure NPM proxy hosts

Dynamic DNS with Namecheap

Enable Dynamic DNS in Namecheap

Configure DDNS with ddclient

WireGuard VPN with wg-easy

Create WireGuard directory

Create WireGuard docker-compose.yml

Start WireGuard

Access Web UI

Add and download client configurations

Connect clients

Check connected peers

Expose WireGuard Web UI via NPM (Optional)

External USB Drive as Samba Share Storage

Identify and format the drive

Mount the drive

Install and configure Samba

Create Samba user

Configure firewall

Plex Media Server

Create Plex directory structure

Create docker-compose.yml for Plex

Start Plex

Allow Plex through firewall

Access Plex

Enable Remote Access

Method 1: Direct Connection (Recommended for streaming)

Method 2: Reverse Proxy via NPM

ntfy - Push Notification Service

Create ntfy directory

Create ntfy docker-compose.yml

Start ntfy

Access ntfy

Send a test notification

Mobile apps

Expose ntfy via NPM

Nextcloud with Dedicated Drive

Format and mount the drive

Give your user read access

Create Nextcloud directory

Create Nextcloud docker-compose.yml

Start Nextcloud

Access Nextcloud

Expose Nextcloud via NPM

Configure trusted domains

Add Samba share for direct file access

Access the share

Sync changes to Nextcloud

Wallabag - Read It Later Service

Create Wallabag directory

Create Wallabag docker-compose.yml

Start Wallabag

Allow Wallabag through firewall

Expose Wallabag via NPM

Access Wallabag

RustDesk - Self-Hosted Remote Desktop

Create RustDesk directory

Create RustDesk docker-compose.yml

Start RustDesk

Get the public key

Configure RustDesk clients

Usage

Immich - Self-Hosted Photo & Video Backup