01. Setup Ubuntu Server 22.04
02. Set timezone: timedatectl set-timezone \\"Europe/Athens\\"
03. Update server and reboot: sudo apt-get update -y ; sudo apt-get upgrade -y
03. Create a user to hold the site: sudo adduser frappe-user ; usermod -aG sudo frappe-user ; sudo su - frappe-user
04. Install git: sudo apt-get install git
05. Install Python: sudo apt-get install python3-dev python3.10-dev python3-setuptools python3-pip python3-distutils
06. Install Python Virtual Environment: sudo apt-get install python3.10-venv
07. Install Software Properties Common: sudo apt-get install software-properties-common
08. Install MariaDB: sudo apt install mariadb-server mariadb-client
09. Install Redis Server: sudo apt-get install redis-server
10. Install other necessary packages: sudo apt-get install xvfb libfontconfig wkhtmltopdf ; sudo apt-get install libmysqlclient-dev
11. Setup the server: sudo mysql_secure_installation
12. Edit the MySQL default config file: sudo vim /etc/mysql/my.cnf
12.a. Add the below code block at the bottom of the file:
[mysqld]
character-set-client-handshake = FALSE
character-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
[mysql]
default-character-set = utf8mb4
13. Restart the MySQL server: sudo service mysql restart
14. Install CURL: sudo apt install curl
15. Install Node: curl https://raw.githubusercontent.com/creationix/nvm/master/install.sh | bash ; source ~/.profile ; nvm install 16.15.0
16. Install NPM: sudo apt-get install npm
17. Install Yarn: sudo npm install -g yarn
18. Install Frappe Bench: sudo pip3 install frappe-bench
19. Initialize Frappe Bench: bench init --frappe-branch version-14 frappe-bench
20. Go to Frappe Bench directory: cd frappe-bench/
21. Change user directory permissions: chmod -R o+rx /home/frappe-user/
22. Create a New Site: bench new-site site1.local (Όπου site1.local, το όνομα του site)
23. Download the necessary apps to our server
23.a. Download the payments apps: bench get-app payments
23.b. Download the main ERPNext app: bench get-app --branch version-14 erpnext
23.c. Download the HR & Payroll app (optional): bench get-app hrms
23.d. Download the ecommerce integrations apps (optional): bench get-app ecommerce_integrations --branch main
23.e. Check if all the apps are correctly downloaded: bench version --format table
24. Install the main ERPNext app: bench --site site1.local install-app erpnext (Όπου site1.local, το όνομα του site)
25. Install the HR & Payroll app (optional): bench --site site1.local install-app hrms (Όπου site1.local, το όνομα του site)
26. Install the ecommerce integrations apps (optional): bench --site site1.local install-app ecommerce_integrations (Όπου site1.local, το όνομα του site)
SETUP PRODUCTION SERVER
27. Enable scheduler service: bench --site site1.local enable-scheduler (Όπου site1.local, το όνομα του site)
28. Disable maintenance mode: bench --site site1.local set-maintenance-mode off (Όπου site1.local, το όνομα του site)
29. Setup production config: sudo bench setup production frappe-user
30. Setup NGINX web server: bench setup nginx
31. Final server setup: sudo supervisorctl restart all ; sudo bench setup production frappe-user
32. Enable firewall: sudo ufw allow 22,25,143,80,443,3306,3022,8000/tcp ; sudo ufw enable
Self-Hosting Guide - Debian/Ubuntu server
Follow these steps for a quick Jitsi-Meet installation on a Debian-based GNU/Linux system. The following distributions are supported out-of-the-box:
Debian 11 (Bullseye) or newer
Ubuntu 22.04 (Jammy Jellyfish) or newer
note
Many of the installation steps require root or sudo access. So it's recommended to have sudo/root access to your system.
Required packages and repository updates
You will need the following packages:
gnupg2
nginx-full
sudo => Only needed if you use sudo
curl => Or wget to Add the Jitsi package repository
Note
OpenJDK 17 must be used.
Make sure your system is up-to-date and required packages are installed:
Run as root or with sudo:
# Retrieve the latest package versions across all repositories
sudo apt update
# Ensure support for apt repositories served via HTTPS
sudo apt install apt-transport-https
On Ubuntu systems, Jitsi requires dependencies from Ubuntu's universe package repository. To ensure this is enabled, run this command:
sudo apt-add-repository universe
Retrieve the latest package versions across all repositories:
sudo apt update
Install Jitsi Meet
Domain of your server and set up DNS
Decide what domain your server will use. For example, meet.example.org.
Set a DNS A record for that domain, using:
your server's public IP address, if it has its own public IP; or
the public IP address of your router, if your server has a private (RFC1918) IP address (e.g. 192.168.1.2) and connects through your router via Network Address Translation (NAT).
If your computer/server or router has a dynamic IP address (the IP address changes constantly), you can use a dynamic dns-service instead. Example DuckDNS.
DNS Record Example:
Record Type\tHostname\tPublic IP\tTTL (Seconds)
A\tmeet.example.org\tYour Meeting Server Public IP (x.x.x.x)\t1800
Set up the Fully Qualified Domain Name (FQDN) (optional)
If the machine used to host the Jitsi Meet instance has a FQDN (for example meet.example.org) already set up in DNS, you can set it with the following command:
sudo hostnamectl set-hostname meet.example.org
Then add the same FQDN in the /etc/hosts file:
127.0.0.1 localhost x.x.x.x meet.example.org
note
x.x.x.x is your server's public IP address.
Finally on the same machine test that you can ping the FQDN with:
ping "$(hostname)"
If all worked as expected, you should see: meet.example.org
Add the Prosody package repository
This will add the Prosody repository so that an up to date Prosody is installed, which is necessary for features including the lobby feature.
sudo curl -sL https://prosody.im/files/prosody-debian-packages.key -o /usr/share/keyrings/prosody-debian-packages.key
echo "deb [signed-by=/usr/share/keyrings/prosody-debian-packages.key] http://packages.prosody.im/debian $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/prosody-debian-packages.list
sudo apt install lua5.2
Add the Jitsi package repository
This will add the jitsi repository to your package sources to make the Jitsi Meet packages available.
curl -sL https://download.jitsi.org/jitsi-key.gpg.key | sudo sh -c 'gpg --dearmor > /usr/share/keyrings/jitsi-keyring.gpg'
echo "deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/" | sudo tee /etc/apt/sources.list.d/jitsi-stable.list
Update all package sources:
sudo apt update
Setup and configure your firewall
The following ports need to be open in your firewall, to allow traffic to the Jitsi Meet server:
80 TCP => For SSL certificate verification / renewal with Let's Encrypt. Required
443 TCP => For general access to Jitsi Meet. Required
10000 UDP => For General Network Audio/Video Meetings. Required
22 TCP => For Accessing your Server using SSH (change the port accordingly if it's not 22). Required
3478 UDP => For querying the stun server (coturn, optional, needs config.js change to enable it).
5349 TCP => For fallback network video/audio communications over TCP (when UDP is blocked for example), served by coturn. Required
If you are using ufw, you can use the following commands:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 10000/udp
sudo ufw allow 22/tcp
sudo ufw allow 3478/udp
sudo ufw allow 5349/tcp
sudo ufw enable
Check the firewall status with:
sudo ufw status verbose
Using SSH
For more details on using and hardening SSH access, see the corresponding Debian or Ubuntu documentation.
Forward ports via your router
If you are running Jitsi Meet on a server behind NAT, forward the ports on your router to your server's IP address.
Note: if participants cannot see or hear each other, double check your firewall / NAT rules.
TLS Certificate
In order to have encrypted communications, you need a TLS certificate.
During installation of Jitsi Meet you can choose between different options:
The recommended option is to choose Let's Encrypt Certificate option
But if you want to use a different certificate you should get that certificate first and then install jitsi-meet and choose I want to use my own certificate.
You could also use the self-signed certificate(Generate a new self-signed certificate) but this is not recommended for the following reasons:
Using a self-signed certificate will result in warnings being shown in your users browsers, because they cannot verify your server's identity.
Jitsi Meet mobile apps require a valid certificate signed by a trusted Certificate Authority and will not be able to connect to your server if you choose a self-signed certificate.
Install Jitsi Meet
Note: The installer will check if Nginx or Apache are present (in that order) and configure a virtual host within the web server it finds to serve Jitsi Meet.
If you are already running Nginx on port 443 on the same machine, turnserver configuration will be skipped as it will conflict with your current port 443.
# jitsi-meet installation
sudo apt install jitsi-meet
SSL/TLS certificate generation: You will be asked about SSL/TLS certificate generation. See above for details.
Hostname: You will also be asked to enter the hostname of the Jitsi Meet instance. If you have a domain, use the specific domain name, for example: meet.example.org. Alternatively you can enter the IP address of the machine (if it is static or doesn't change).
This hostname will be used for virtualhost configuration inside Jitsi Meet and also, you and your correspondents will be using it to access the web conferences.
Access Control
Jitsi Meet server: Note: By default, anyone who has access to your Jitsi Meet server will be able to start a conference: if your server is open to the world, anyone can have a chat with anyone else. If you want to limit the ability to start a conference to registered users, follow the instructions to set up a secure domain.
Conferences/Rooms: The access control for conferences/rooms is managed in the rooms, you can set a password on the webpage of the specific room after creation. See the User Guide for details: https://jitsi.github.io/handbook/docs/user-guide/user-guide-start-a-jitsi-meeting
Advanced configuration
If the installation is on a machine behind NAT jitsi-videobridge should configure itself automatically on boot. If three way calls do not work, further configuration of jitsi-videobridge is needed in order for it to be accessible from outside.
Provided that all required ports are routed (forwarded) to the machine that it runs on. By default these ports are TCP/443 and UDP/10000.
Add a static mapping to the ice4j.harvest.mapping section in /etc/jitsi/videobridge/jvb.conf:
ice4j {
harvest {
mapping {
static-mappings = [
{
local-address = "
~4 min
For Debian 11 hosts
Define hosts in a file called: hosts
#!/bin/shsudo apt update
sudo apt upgrade -y
sudo apt-get install curl gnupg apt-transport-https -y## Team RabbitMQ\\'s main signing key
curl -1sLf \\"https://keys.openpgp.org/vks/v1/by-fingerprint/0A9AF2115F4687BD29803A206B73A36E6026DFCA\\" | sudo gpg --dearmor | sudo tee /usr/share/keyrings/com.rabbitmq.team.gpg > /dev/null
## Community mirror of Cloudsmith: modern Erlang repository
curl -1sLf https://ppa1.novemberain.com/gpg.E495BB49CC4BBE5B.key | sudo gpg --dearmor | sudo tee /usr/share/keyrings/rabbitmq.E495BB49CC4BBE5B.gpg > /dev/null
## Community mirror of Cloudsmith: RabbitMQ repository
curl -1sLf https://ppa1.novemberain.com/gpg.9F4587F226208342.key | sudo gpg --dearmor | sudo tee /usr/share/keyrings/rabbitmq.9F4587F226208342.gpg > /dev/null## Add apt repositories maintained by Team RabbitMQ
sudo tee /etc/apt/sources.list.d/rabbitmq.list <<EOF
## Provides modern Erlang/OTP releases from a Cloudsmith mirror
##
deb [signed-by=/usr/share/keyrings/rabbitmq.E495BB49CC4BBE5B.gpg] https://ppa1.novemberain.com/rabbitmq/rabbitmq-erlang/deb/debian bullseye main
deb-src [signed-by=/usr/share/keyrings/rabbitmq.E495BB49CC4BBE5B.gpg] https://ppa1.novemberain.com/rabbitmq/rabbitmq-erlang/deb/debian bullseye main## Provides RabbitMQ from a Cloudsmith mirror
##
deb [signed-by=/usr/share/keyrings/rabbitmq.9F4587F226208342.gpg] https://ppa1.novemberain.com/rabbitmq/rabbitmq-server/deb/debian bullseye main
deb-src [signed-by=/usr/share/keyrings/rabbitmq.9F4587F226208342.gpg] https://ppa1.novemberain.com/rabbitmq/rabbitmq-server/deb/debian bullseye main
EOF## Update package indices
sudo apt-get update -y## Install Erlang packages
sudo apt-get install -y erlang-base \\\\
erlang-asn1 erlang-crypto erlang-eldap erlang-ftp erlang-inets \\\\
erlang-mnesia erlang-os-mon erlang-parsetools erlang-public-key \\\\
erlang-runtime-tools erlang-snmp erlang-ssl \\\\
erlang-syntax-tools erlang-tftp erlang-tools erlang-xmerl Install rabbitmq-server and its dependencies
sudo apt-get install rabbitmq-server -y --fix-missing
#!/bin/bash
# Script to install rabbitMQ based on the debian 11 distro and done by install.sh script
# which will be copied and run on each host
# hosts file has the list of servers, the first to be the cluster server
# ruser is the ssh user for connecting to the servers
ruser=adminreadarray -t allhosts < hosts
all=${#allhosts[@]}echo \\"127.0.0.1 localhost\\" > hostsfile
for (( a=0; a<$all; a++ )); do
host=${allhosts[$a]}
echo $host mq-node$a >> hostsfile
done# Copy the install script on all the servers and run it.
for (( a=0; a<$all; a++ )); do
host=${allhosts[$a]}
echo Installing on host $host
scp hostsfile $ruser@$host:/tmp
scp install.sh $ruser@$host:/tmp
ssh $ruser@$host \\"sudo hostnamectl set-hostname mq-node$a\\"
ssh $ruser@$host \\"cat /tmp/hostsfile|sudo tee /etc/hosts;chmod 755 /tmp/install.sh;/tmp/install.sh\\"
done# Get the erlang cookie and copy it to all the rest of the servers.
rm -f .erlang.cookie
server=${allhosts[0]}
ssh $ruser@$server \\"sudo cp /var/lib/rabbitmq/.erlang.cookie /tmp/.erlang.cookie; sudo chmod 666 /tmp/.erlang.cookie\\"
scp $ruser@$server:/tmp/.erlang.cookie .# Get the cluster name to use for joining the rest of the nodes
cluster=$(ssh ${ruser}@${server} \\"sudo rabbitmqctl cluster_status | grep Cluster\\\\ name|awk \\'{print \\\\$3}\\'\\")# Copy the erlang cookie to the rest of the nodes
# Join the rest of the nodes to the RabbitMQ Cluster
for (( a=1; a<$all; a++ )); do
host=${allhosts[$a]}
echo Doing $a : $host
scp .erlang.cookie $ruser@$host:/tmp
ssh $ruser@$host \\"sudo systemctl stop rabbitmq-server\\"
ssh $ruser@$host \\"sudo cp /tmp/.erlang.cookie /var/lib/rabbitmq/.erlang.cookie\\"
ssh $ruser@$host \\"sudo chown rabbitmq:rabbitmq /var/lib/rabbitmq/.erlang.cookie\\"
ssh $ruser@$host \\"sudo chmod 400 /var/lib/rabbitmq/.erlang.cookie\\"
ssh $ruser@$host \\"sudo systemctl start rabbitmq-server\\"
ssh $ruser@$host \\"sudo rabbitmqctl stop_app\\"
ssh $ruser@$host \\"sudo rabbitmqctl reset\\"
ssh $ruser@$host \\"sudo rabbitmqctl join_cluster $cluster\\"
ssh $ruser@$host \\"sudo rabbitmqctl start_app\\"done
Edit the ssh user (e.g. admin), make sure you have ssh access to the hosts and run the deploy.sh
Create a filter file in /etc/fail2ban/filter.d/ as e.g. block-url.conf (/etc/fail2ban/filter.d/block-url.conf)
Containing:
[Definition]
failregex = ^<HOST> -.*\\"(GET|POST).*/cgi-bin/luci.*$
# ignoreregex =
datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \\\\-%%f
This will detect the string /cgi-bin/luci in apache logs
Then create a local jail file e.g. /etc/fail2ban/jail.local
containing this:
[block-url]
enabled = true
filter = block-url
logpath = /var/log/httpd/*_log
maxretry = 1
bantime = 999000
This will locate log files from /var/log/httpd/*_log
and ban it for 999000 seconds.
Use the following script:
#! /usr/bin/env bash
#
# Run parallel commands and fail if any of them fails.
#
set -eu
pids=()
for x in 1 2 3; do
ls /not-a-file &
pids+=($!)
done
for pid in \\"${pids[@]}\\"; do
wait \\"$pid\\"
done
OR use the simpler script if no error is expected:
#!/bin/bash
sleep 2 &
sleep 3 &
sleep 1 &
wait
echo Finished.
Script to backup KVM VMs to backup location online
In order to move or copy the VM to a different server, you need to extract the qcow2 file to a disk location:
#!/bin/bash
# ----------- Configuration -----------
VM_NAME="your_vm_name"
[[ $# -gt 0 ]] && VM_NAME="$1"
BACKUP_DIR="/backups/kvm/${VM_NAME}"
TIMESTAMP=$(date +%F_%H-%M-%S)
SNAPSHOT_PREFIX="backup_snapshot_${TIMESTAMP}"
VM_XML_FILE="${BACKUP_DIR}/${VM_NAME}_config_${TIMESTAMP}.xml"
declare -a CREATED_SNAPSHOTS
# ------------------------------------
set -euo pipefail
# Cleanup handler in case of error or interrupt
cleanup_on_exit() {
echo "[!] Cleanup triggered due to error or interruption."
for SNAP_INFO in "${CREATED_SNAPSHOTS[@]}"; do
IFS='|' read -r DEVICE DISK <<< "$SNAP_INFO"
SNAP_PATH="${DISK}.snap"
if [[ -f "$SNAP_PATH" ]]; then
echo " ✘ Removing leftover snapshot: $SNAP_PATH"
rm -f "$SNAP_PATH"
fi
# Try to pivot back if snapshot is still active
echo " ↻ Attempting to blockcommit $DEVICE..."
virsh blockcommit "$VM_NAME" "$DEVICE" --active --pivot 2>/dev/null || true
done
echo "[!] Cleanup complete. Exiting."
}
trap cleanup_on_exit ERR INT
echo "[*] Starting backup of VM: $VM_NAME"
mkdir -p "$BACKUP_DIR"
# Step 0: Save VM XML
echo "[0] Saving VM configuration..."
virsh dumpxml "$VM_NAME" > "$VM_XML_FILE"
echo " ✔ Saved to $VM_XML_FILE"
# Step 1: Get disks
mapfile -t DISK_ENTRIES < <(virsh domblklist "$VM_NAME" --details | awk '$2 == "disk" {print $3 "|" $4}')
if [[ ${#DISK_ENTRIES[@]} -eq 0 ]]; then
echo "[!] No disks found for VM: $VM_NAME"
exit 1
fi
# Step 2: Snapshot
echo "[1] Creating snapshots..."
for ENTRY in "${DISK_ENTRIES[@]}"; do
IFS='|' read -r DEVICE DISK <<< "$ENTRY"
SNAP_PATH="${DISK}.snap"
if [[ -f "$SNAP_PATH" ]]; then
echo " ⚠ Snapshot file already exists: $SNAP_PATH (removing)"
rm -f "$SNAP_PATH"
fi
virsh snapshot-create-as --domain "$VM_NAME" \\
--name "$SNAPSHOT_PREFIX" \\
--no-metadata \\
--atomic \\
--disk-only \\
--diskspec "$DEVICE",snapshot=external,file="$SNAP_PATH"
CREATED_SNAPSHOTS+=("${DEVICE}|${DISK}")
echo " ✔ Created snapshot for $DEVICE ($DISK → $SNAP_PATH)"
done
# Step 3: Compress with zstd
echo "[2] Backing up disks with zstd..."
for ENTRY in "${DISK_ENTRIES[@]}"; do
IFS='|' read -r DEVICE DISK <<< "$ENTRY"
DISK_BASENAME=$(basename "$DISK")
BACKUP_FILE="${BACKUP_DIR}/${VM_NAME}_${DISK_BASENAME}_${TIMESTAMP}.qcow2.zst"
echo " → Compressing $DISK to $BACKUP_FILE"
zstd -T0 -19 -o "$BACKUP_FILE" "$DISK"
done
# Step 4: Blockcommit snapshots
echo "[3] Merging snapshots..."
for ENTRY in "${DISK_ENTRIES[@]}"; do
IFS='|' read -r DEVICE DISK <<< "$ENTRY"
virsh blockcommit "$VM_NAME" "$DEVICE" --active --pivot
echo " ✔ Committed snapshot for $DEVICE"
done
# Step 5: Remove snapshot files
echo "[4] Cleaning up snapshot files..."
for ENTRY in "${DISK_ENTRIES[@]}"; do
IFS='|' read -r DEVICE DISK <<< "$ENTRY"
SNAP_PATH="${DISK}.snap"
if [[ -f "$SNAP_PATH" ]]; then
rm -f "$SNAP_PATH"
echo " ✘ Removed $SNAP_PATH"
fi
done
# Reset trap
trap - ERR INT
echo "[✓] Backup completed successfully for VM: $VM_NAME"
zstd -d your_vm_disk.qcow2.zst -o your_vm_disk.qcow2
and import the vm definition with:
virsh define your_vm_config.xml
- - ada : Build the ADA language (GNAT) frontend
+ + cet : (Restricted to >=sys-devel/gcc-10)
Enable support for control flow hijacking protection. On amd64, this provides Intel Control
Flow Enforcement Technology (CET). On arm64, this provides Branch Target Identification
(BTI) and Pointer Authentication Code (PAC) support. This is only effective on amd64 or
arm64. Only provides benefits on newer CPUs. For Intel, the CPU must be at least as new as
Tiger Lake. For AMD, it must be at least as new as Zen 3. This is harmless on older CPUs,
but provides no benefit either. For ARM64, PAC was introduced in armv8.3-a, and BTI was
introduced in armv8.5-a. When combined with USE=hardened on amd64, GCC will set
-fcf-protection by default when building software. The effect is minimal on systems which do
not support it, other than a possible small increase in codesize for the NOPs. The generated
code is therefore compatible with i686 at the earliest. On arm64, GCC will set
-mbranch-protection=standard by default when building software.
- - d : Enable support for the D programming language
- - debug : Enables GCC's 'checking' facility via --enable-checking=yes,extra,rtl. This adds checks to
various compiler passes for integrity and input validation. This can help catch possible
miscompilations early as well as latent bugs which could become real problems in future, but
at the cost of slower compile times when using GCC. Unrelated to backtraces.
- - doc : Add extra documentation (API, Javadoc, etc). It is recommended to enable per package instead
of globally
+ + fortran : Add support for fortran
- - go : Build the GCC Go language frontend.
+ + graphite : Add support for the framework for loop optimizations based on a polyhedral intermediate
representation
- - hardened : Activate default security enhancements for toolchain (gcc, glibc, binutils)
+ + jit : Enable libgccjit so other applications can embed gcc for Just-In-Time compilation.
+ + lto : Build using Link Time Optimizations (LTO). Note that GCC is always built with support for
building other programs with LTO. This USE flag is for whether GCC itself is built and
optimized with LTO.
- - modula2 : Build the GCC Modula-2 language frontend.
+ + nls : Add Native Language Support (using gettext - GNU locale utilities)
+ + objc : Build support for the Objective C code language
+ + objc++ : Build support for the Objective C++ language
- - objc-gc : Build support for the Objective C code language Garbage Collector
+ + openmp : Build support for the OpenMP (support parallel computing), requires >=sys-devel/gcc-4.2
built with USE="openmp"
+ + pgo : Build GCC using Profile Guided Optimization (PGO). GCC will build itself and then analyze
the just-built binary and then rebuild itself using the data obtained from analysis of
codepaths taken. It does not affect whether GCC itself supports PGO when building other
software. This substantially increases the build time needed for building GCC itself.
- - rust : Build support for the Rust language, installs gccrs.
+ + sanitize : Build support for various sanitizer functions (ASAN/TSAN/etc...) to find runtime problems in
applications.
+ + ssp : Build packages with stack smashing protection on by default
- - systemtap : enable systemtap static probe points
- - test : Enable dependencies and/or preparations necessary to run tests (usually controlled by
FEATURES=test but can be toggled independently)
- - valgrind : Enable annotations for accuracy. May slow down runtime slightly. Safe to use even if not
currently using dev-debug/valgrind
- - vanilla : Do not add extra patches which change default behaviour; DO NOT USE THIS ON A GLOBAL SCALE
as the severity of the meaning changes drastically
- - vtv : Build support for virtual table verification (a C++ hardening feature). This does not
control whether GCC defaults to using VTV> Note that actually using VTV breaks ABI and hence
the whole system must be built with -fvtable-verify.
+ + zstd : Enable support for ZSTD compression
Should/Must have:
OS Desktop:
Gentoo
Fedora
OS Server:
Debian
Alma/Rocky
RedHat
Ubuntu
Server Apps:
FreeIPA
Postfix/Dovecot (opendkim,opendmarc,spamassassin)
amavisd-new
Apache
Bind9
certbot
fetchmail
mariadb
rkhunter
roundcube
webmin
usermin
wireguard
zabbix
General:
bash-completion
mc
Backup:
Veeam
Seurity:
chkrootkit
rkhunter
clamav
fail2ban
gpg
nmap
openscap
sshguard
Browsers:
Chromium
Firefox
Brave
Chrome
Virtualization:
kvm
qemu
Linux must/should have applications
OS Desktop:
Gentoo
Fedora
OS Server:
Debian
Alma/Rocky
RedHat
Ubuntu
Server Apps:
FreeIPA
Postfix/Dovecot (opendkim,opendmarc,spamassassin)
amavisd-new
Apache
Bind9
certbot
fetchmail
mariadb
rkhunter
roundcube
webmin
usermin
wireguard
zabbix
General:
bash-completion
mc
Backup:
Veeam
Seurity:
chkrootkit
rkhunter
clamav
fail2ban
gpg
nmap
openscap
sshguard
Browsers:
Chromium
Firefox
Brave
Chrome
Virtualization:
kvm
qemu
Desktop Apps:
Thunderbird
Filezilla
Putty
VSCodium
Remmina
Libreoffice
A Gentoo desktop can be as minimal or as feature-rich as you want. Since Gentoo emphasizes customization, the "must-have" applications are usually those that are stable, well-maintained, and integrate well regardless of your desktop environment.
Here's a practical set of applications by category.
Beyond applications, many Gentoo users consider these indispensable:
My default stack would be:
That combination provides a fast, modern, Wayland-native desktop while staying close to the Unix philosophy that many Gentoo users appreciate.
Server 2019 Activation Error: Run “slui.exe 0x2a 0xC004F069” to display the error text
nThis can be worked around by using two DISM commands.\r\nnOpen an elevated command prompt, and type (or copy) DISM.exe /Online /Get-TargetEditions
nIt may get stuck on the 10% mark for a few
nOR
nTo activate your Windows Server:
nTo get the available editions:
1. Open an elevated command prompt.
2. Run the following command: DISM.exe /Online /Get-TargetEditions
And a link to the resource I useHere are the notes to get an MAK key working on an evaluation ISO.\r\n
nWindows Server 2022 - KMS Client Setup Key
nWindows Server 2022 Standard
- VDYBN-27WPP-V4HQT-9VMD4-VMK7H
Windows Server 2019 Datacenter
- WMDGN-G9PQG-XVVXX-R3X43-63DFG
Windows Server 2019 Essentials
- WVDHN-86M7X-466P6-VHXV7-YY726
Windows Server 2016 Datacenter
- CB7KF-BWN84-R7R2Y-793K2-8XDDG
Windows Server 2016 Essentials
- JCKRF-N37P4-C2D82-9YXRT-4M63B
If the Eval version is all you have access to you can totally convert it to the correct version and apply. Use this method to change eval to VLSC License
Server 2019 Activation Error: Run “slui.exe 0x2a 0xC004F069” to display the error text
This can be worked around by using two DISM commands.\\r\\n\n
Open an elevated command prompt, and type (or copy) DISM.exe /Online /Get-TargetEditions
Then enter DISM /online /Set-Edition:ServerStandard /ProductKey:ENTER-YOUR-SERIAL-FROM-TABLE /AcceptEula (use key from below table if this is a MAK/Volume license key)\\r\\n\n
It may get stuck on the 10% mark for a few
Use one of the below keys first:\\r\\n\n
OR
For Retial\n
To activate your Windows Server:
1. Enter key via GUI or run the command: slmgr.vbs /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX\\r\\n\n
To get the available editions:
1. Open an elevated command prompt.
2. Run the following command: DISM.exe /Online /Get-TargetEditions
To set your Windows Server to a higher edition:
1. Run the following command: DISM.exe /online /Set-Edition:ServerStandard /ProductKey:XXXXX-XXXXX-XXXXX-XXXXX-XXXXX /AcceptEula
(Use key from table below if this is a MAK/Volume license key)\\r\\n\n
And a link to the resource I useHere are the notes to get an MAK key working on an evaluation ISO.\\r\\n
Windows Server 2022 - KMS Client Setup Key
Windows Server 2022 Datacenter
- WX4NM-KYWYW-QJJR4-XV3QB-6VM33\\r\\n\n
Windows Server 2022 Standard
- VDYBN-27WPP-V4HQT-9VMD4-VMK7H
Windows Server 2019 - KMS Client Setup Key\\r\\n\n
Windows Server 2019 Datacenter
- WMDGN-G9PQG-XVVXX-R3X43-63DFG
Windows Server 2019 Standard
- N69G4-B89J2-4G8F4-WWYCC-J464C\\r\\n\n
Windows Server 2019 Essentials
- WVDHN-86M7X-466P6-VHXV7-YY726
Windows Server 2016 - KMS Client Setup Key\\r\\n\n
Windows Server 2016 Datacenter
- CB7KF-BWN84-R7R2Y-793K2-8XDDG
Windows Server 2016 Standard
- WC2BQ-8NRM3-FDDYY-2BFGV-KHKQY\\r\\n\n
Windows Server 2016 Essentials
- JCKRF-N37P4-C2D82-9YXRT-4M63B
Windows Server 2019
Product GVLK
Windows Server 2019 Datacenter WMDGN-G9PQG-XVVXX-R3X43-63DFG
Windows Server 2019 Standard N69G4-B89J2-4G8F4-WWYCC-J464C
Windows Server 2019 Essentials WVDHN-86M7X-466P6-VHXV7-YY726
Windows Server 2019 Azure Core FDNH6-VW9RW-BXPJ7-4XTYG-239TB
Windows Server 2019 Datacenter Semi-Annual Channel (v.1809) 6NMRW-2C8FM-D24W7-TQWMY-CWH2D
Windows Server 2019 Standard Semi-Annual Channel (v.1809) N2KJX-J94YW-TQVFB-DG9YT-724CC
Windows Server 2019 ARM64 GRFBW-QNDC4-6QBHG-CCK3B-2PR88
Windows Server 2016
Product GVLK
Windows Server 2016 Standard Semi-Annual Channel (v.1803) PTXN8-JFHJM-4WC78-MPCBR-9W4KR
Windows Server 2016 Datacenter Semi-Annual Channel (v.1803) 2HXDN-KRXHB-GPYC7-YCKFJ-7FVDG
Windows Server 2016 Datacenter Semi-Annual Channel (v.1709) 6Y6KB-N82V8-D8CQV-23MJW-BWTG6
Windows Server 2016 Standard Semi-Annual Channel (v.1709) DPCNP-XQFKJ-BJF7R-FRC8D-GF6G4
Windows Server 2016 ARM64 K9FYF-G6NCK-73M32-XMVPY-F9DRR
Windows Server 2016 Datacenter CB7KF-BWN84-R7R2Y-793K2-8XDDG
Windows Server 2016 Standard WC2BQ-8NRM3-FDDYY-2BFGV-KHKQY
Windows Server 2016 Essentials JCKRF-N37P4-C2D82-9YXRT-4M63B
Windows Server 2016 Cloud Storage QN4C6-GBJD2-FB422-GHWJK-GJG2R
Windows Server 2016 Azure Core VP34G-4NPPG-79JTQ-864T4-R3MQX
WNCYY-GFBH2-M4WTT-XQ2FP-PG2K9
Finally reboot and enter your purchased key:
- Enter key via GUI
or
- slmgr.vbs /ipk <your product key>
- slmgr.vbs /ato
Run as administrator the following script:
# Disable TLS 1.0 and 1.1 for both Client and Server
$protocols = @(\\"TLS 1.0\\", \\"TLS 1.1\\")
$baseKey = \\"HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\\\SCHANNEL\\\\Protocols\\"
foreach ($protocol in $protocols) {
foreach ($subKey in @(\\"Client\\", \\"Server\\")) {
$fullPath = Join-Path -Path \\"$baseKey\\\\$protocol\\" -ChildPath $subKey
# Create key if it doesn\\'t exist
if (-not (Test-Path $fullPath)) {
New-Item -Path $fullPath -Force | Out-Null
}
# Set the registry values
New-ItemProperty -Path $fullPath -Name \\"Enabled\\" -PropertyType DWORD -Value 0 -Force | Out-Null
New-ItemProperty -Path $fullPath -Name \\"DisabledByDefault\\" -PropertyType DWORD -Value 1 -Force | Out-Null
}
}
Write-Host \\"✅ TLS 1.0 and 1.1 disabled.\\"
# Ensure RDP uses TLS Security Layer
$rdpTcpKey = \\"HKLM:\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\"
Set-ItemProperty -Path $rdpTcpKey -Name \\"SecurityLayer\\" -Value 3
Set-ItemProperty -Path $rdpTcpKey -Name \\"MinEncryptionLevel\\" -Value 3
Write-Host \\"✅ RDP Security Layer set to TLS and Encryption Level to High.\\"
# Prompt to restart
Write-Host \\"`n⚠ A system restart is required for changes to take effect.\\"
This will result in:
HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SecurityProviders\\\\SCHANNEL\\\\Protocols
For Client and Server for TLS v1.0 and TLS v1.0 to disabled.