Aquasp's blog

How to Setup Flutter for Development in Ubuntu 24.04

Tue, 14 Apr 2026 01:15:39 +0000

The fastest and easiest way with the latest Flutter version.

Step 1: Install Flutter using Snap

sudo snap install flutter --classic

Step 2: Install OpenJDK

sudo apt install openjdk-17-jdk -y

Step 3: Download Android CLI Tools

Go here and grab the latest for Linux.

Create folder:

mkdir ~/Android/Sdk

Make sure you are using this exact structure:

~/Android/Sdk/cmdline-tools/latest/bin/ ← sdkmanager

Step 4: Add to ~/.bashrc

export ANDROID_SDK_ROOT=$HOME/Android/Sdkexport ANDROID_HOME=$ANDROID_SDK_ROOTexport
PATH=$PATH:$ANDROID_SDK_ROOT/cmdline-tools/latest/binexport PATH=$PATH:$ANDROID_SDK_ROOT/platform-tools # Nextexport JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64export PATH=$PATH:$JAVA_HOME/binexport CHROME_EXECUTABLE=/usr/bin/brave-browser

Step 5: Install sdkmanager

sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.0.0"
sdkmanager --update

Step 6: Flutter Setup

flutter config --android-sdk ~/Android/Sdkflutter doctor --android-licenses # Accept all

Step 7: Check

flutter doctor -v

You now have a clean Flutter setup without Android Studio.

Thanks – build on! 🚀

Ditch the Official App: Use Your Mi Band Privately with Open-Source Alternatives

Tue, 23 Dec 2025 20:23:05 +0000

If you love wearing a wearable device like a Mi Band but want to protect your privacy (like me), there’s a great way to do it!

Check Device Compatibility First

The first step is to verify if your device is supported. Xiaomi and Huawei devices generally have the best compatibility. I recommend checking two popular alternatives:

GadgetBridge: Fully open-source and highly privacy-focused. It works reliably, though the UI isn’t the most modern or beautiful.
Notify for Mi Band: Offers a much nicer, more polished UI (in my opinion), but it’s not open-source and the Pro version (ad-free) costs about $3.

Privacy-wise, both options are far superior to the official Xiaomi app—no constant data sharing with servers.

It’s almost ironic that Chinese-brand devices end up providing better privacy options than many Western brands when paired with these alternatives. This is likely just a side effect of their popularity and competitive pricing.

Extract the Authentication Token

Unfortunately, you’ll need the official app temporarily. Download the Xiaomi Mi Fitness app, pair your band, create a Xiaomi account, and update the firmware to the latest version*.

Once that’s done, you need to extract the authentication (auth) token from Xiaomi. The easiest method right now is using the Notify for Mi Band app.

Download Notify for Mi Band from the Google Play Store (there are two versions, ensure that you are downloading the correct one for your device)
Start the setup process in the app.
You’ll see two options for getting the token: Offline and Online.

The offline method requires exporting logs from the official Mi Fitness app and extracting the token from them. I tried this several times, but it never worked for me—I couldn’t even find the relevant logs manually.

So, I strongly recommend the online method:

Log in with your Xiaomi account email and password.
Xiaomi will send a verification code to your email.
Enter the code, and the app will automatically retrieve the token for you.

Final Steps: Switch Over and Uninstall the Official App

After getting the token:

Enter it in Notify for Mi Band (or GadgetBridge, if you’re using that).
Grant all necessary permissions.
Uninstall the official Mi Fitness app immediately.

The band can only connect and sync with one app at a time. Keeping the official app installed will cause connection issues or prevent proper syncing with your chosen alternative.

Now you’re all set! Customize notifications, enable/disable features as you like, find your phone or band, install free watchfaces, and track steps, calories, and heart rate—all in a clean, beautiful UI with no privacy compromises.

One minor issue I’ve noticed: sleep tracking is not syncing properly. I’m not sure if this is specific to the Mi Band 10, a firmware quirk, or a setting I changed. The data still shows correctly on the band itself, so it’s just a sync problem. Personally, I don’t mind—I mainly use my Mi Band for a convenient clock, flashlight,quick heart rate checks during workouts and changing music on a bluetooth speaker.

At least for the Mi Band 10, the latest firmware (as of Dec 2025) hasn’t broken compatibility with Notify for Mi Band.

Fixing Blank/Grey Screen on Album Pages in Finamp (Jellyfin Music Player)

Mon, 15 Dec 2025 15:02:30 +0000

If you’re using Finamp to stream or download music from your Jellyfin server and encountering a blank (or grey) screen when opening an album page—where no tracks load and you may need to force-close the app—this is a common issue, especially after upgrading Jellyfin to version 10.11.x.

This problem typically occurs due to changes in how Jellyfin handles music metadata in newer versions, causing Finamp to fail loading album tracks properly.

The Fix: Refresh Metadata in Jellyfin (Search for Missing Metadata)

The most reliable workaround is to force Jellyfin to refresh your music library metadata:

Log in to your Jellyfin web dashboard (admin account recommended).
Go to Dashboard > Libraries.
Select your Music library.
Click the three dots (…) menu next to the library name.
Choose Refresh Metadata.
In the refresh options:

Check Search for missing metadata.
Optionally enable other options like “Replace existing images” or “Replace all metadata” if needed.

Click Refresh (or OK) to start the scan.

Note: This process can take several minutes depending on your library size. Once done, restart Finamp and try opening albums again—they should now load tracks normally.

Additional Notes on Jellyfin 10.11.x

The Finamp team and users have reported performance regressions in Jellyfin 10.11.x, particularly with music libraries (slower loading, higher resource usage).
If possible, consider staying on or downgrading to Jellyfin 10.10.x for better performance until fixes are fully rolled out in later 10.11 patches.
For me. I can confirm that even on the latest 10.11.x, the metadata refresh resolves the blank album issue, and overall functionality works well afterward.

Credits

GitHub Issue: https://github.com/jmshrv/finamp/issues/1412

If the issue persists after the scan, check for Finamp updates or report it on the Finamp GitHub repository. Happy listening! :)

How to enable hardware-Accelerated Video Decoding in Brave on Linux: Smoother Playback and Better Battery

Sun, 14 Dec 2025 01:35:15 +0000

Hardware-accelerated video decoding offloads playback from CPU to GPU, improving performance, reducing heat, and extending battery life—especially for high-resolution videos. On Linux, this works in Chromium-based browsers like Brave, but often requires flags. No more relying on h264ify extensions or downloading videos for MPV!

Benefits

Smoother high-res (1080p+) playback
Lower CPU usage
Better battery life on laptops

Prerequisites (Ubuntu-Based Distros, e.g., Mint)

For Intel GPUs (common on laptops):

sudo apt update
sudo apt install intel-media-va-driver-non-free vainfo

Verify with vainfo (should list supported profiles like VP9/H.264).

AMD/NVIDIA: Ensure Mesa/proprietary drivers are installed.

Enabling Flags Support on Ubuntu-Based Distros

Brave’s Debian package doesn’t read brave-flags.conf by default (unlike Arch’s AUR package). Create a wrapper:

Fix permissions:

sudo chown --reference=/usr/bin/brave-browser-stable.original /usr/bin/brave-browser-stable
sudo chmod --reference=/usr/bin/brave-browser-stable.original /usr/bin/brave-browser-stable

Create new launcher:Bash

sudo nano /usr/bin/brave-browser-stable

Paste:

#!/bin/sh
: $$ {XDG_CONFIG_HOME=" $${HOME}/.config"}
unset -v flags_conf
flags_conf="${XDG_CONFIG_HOME}/brave-flags.conf"
if [ -f "${flags_conf}" ]
then
 unset -v flags
 flags="$$ (sed 's/#.*//' < " $${flags_conf}" | tr '\n' ' ')"
 set -- $$ {flags} " $$@"
fi
exec /usr/bin/brave-browser-stable.original "$@"

Divert the original launcher:

sudo dpkg-divert --add --rename --divert /usr/bin/brave-browser-stable.original /usr/bin/brave-browser-stable

Now create/edit ~/.config/brave-flags.conf for flags.

Recommended Flags

Add to ~/.config/brave-flags.conf (one line, restart Brave):

Wayland (often default/best):

--enable-features=AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoEncoder

Xorg/X11 (or fallback):

--enable-features=VaapiVideoDecoder,VaapiIgnoreDriverChecks,Vulkan,DefaultANGLEVulkan,VulkanFromANGLE

Verification

Play a video (e.g., YouTube 1080p+).
Ctrl + Shift + I → Three dots → More tools → Media.
Check Decoder name: VaapiVideoDecoder = GPU accelerated (avoid FFmpegVideoDecoder).

Credits

This amazing commentary on github: https://github.com/brave/brave-browser/issues/2300#issuecomment-2718755680

As always, the Arch Wiki is an invaluable resource for all things Linux. If hardware video acceleration still doesn’t work, check the wiki directly for the latest flags and troubleshooting tips. https://wiki.archlinux.org/title/Chromium#Hardware_video_acceleration

Quick Fix: Stop Ubuntu 24.04 from Automatically Suspending/Sleeping

Fri, 12 Dec 2025 19:58:45 +0000

If your Ubuntu 24.04 system (especially one that started as a server install) randomly suspends or goes to sleep even though it’s supposed to be a headless server, you’re not alone.

This seems to happen when a server installation gets partially or fully converted to a “desktop” environment at some point — even if you never intentionally installed a desktop. In my case, I installed Ubuntu Server 24.04 directly with balenaEtcher onto NVMe/SSD and I got this weird behavior (my N100 server was suspending after 15 minutes).

The Simple One-Liner Fix

Run this single command and the random suspensions stop immediately (and persist across reboots):

sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

That is it!

Fastest Monero Wallet on Android in 2025? I Timed All Three With My Own Node

Wed, 10 Dec 2025 22:46:43 +0000

Introduction

One of the major pain points of Monero is restoring an old wallet. Today, I will compare the speed of three popular Monero wallets to check which one is the fastest at restoring.

Test data

Date of test: 2025-12-10 Device: Samsung Galaxy A56 (Exynos 1580, 8 GB RAM, mid-range 2025 phone) Connection: Local Monero full node over Wi-Fi (same LAN, Using Deco S7) Wallet: Legacy 25-word seed created in December 2024 (~1 year old, moderate transaction history) Goal: Full restore + sync from my restore height with each wallet to see real-world performance on a typical self-hosted setup in 2025.

The contenders

Wallet	Version	Restore height method	Notes
Cake Wallet	5.6.2	Legacy 25-word	Official multi-coin wallet
Stack Wallet	2.4.2	Legacy 25-word	Privacy-focused, Bitcoin-first but good XMR support
Monerujo	4.1.7 (Exolix build)	Legacy 25-word	Long-time Android-only Monero favorite

Results

Wallet	Total time to full sync	Behavior at 90–100%	Screen stay-on?	Finished?	Notes
Monerujo	21 minutes 45 seconds	Steady speed, no slowdown	No	Yes	Absolutely crushed it
Cake Wallet	40 minutes and 13 seconds	Very slow after ~90%, ETA broken	Yes (huge W)	Yes	Got there, but it was a bit slow
Stack Wallet	Gave up after ~1 hour 16 minutes	Crawled after 98%, resync didn’t help	No	No	Stuck forever around 98–99%

Detailed observations

Monerujo 4.1.7 – The clear winner

Started scanning instantly
Progress was smooth and predictable the entire time
Never slowed down, even in the final 10%
Just worked. 21m45s from entering the 25th word to “synchronized”.
Does NOT prevent screen timeout → Android kept suspending the process

Cake Wallet 5.6.2 – It gets there… eventually

Restore started fine
ETA counter was not precise (showed 2 minutes for 30 minutes)
Massive slowdown after ~90%
Kept screen on the entire time ← this alone probably saved the sync from dying
Eventually finished

Stack Wallet 2.4.2 – Disappointing

Actually started the fastest of all three
Flew to 98% in ~25 minutes… then died
Speed dropped
Restarting the app resumed at 98.49% but didn’t fix the crawl
Tried using the “Resync” button – no improvement
Does NOT prevent screen timeout → Android kept suspending the process
Abandoned after 1+ hours of no meaningful progress

Conclusion: Monerujo is the fastest in 2025

If you want to restore an old Monero wallet on a phone using your own node in 2025, the answer is crystal clear:

Monerujo is in a completely different league.

Cake Wallet is still very usable and has an amazin UI/polish, but the sync performance lag is real. Stack Wallet unfortunately seems broken/super slow for large restores right now

Shoutout to the Monerujo dev(s) — whatever witchcraft you did with the scanning engine, thank you. Privacy on mobile just became faster.

Tested on 2025-12-10 with a local node. Your mileage may vary with transaction count, but the relative ordering should hold.

7 things that you should do after installing WordPress

Tue, 09 Dec 2025 01:45:24 +0000

Introduction

Starting a fresh WordPress site in 2026? Whether it’s a blog, eCommerce store, or portfolio, these tweaks will supercharge speed, lock down security, and ensure buttery-smooth performance from day one.

No paid tools required — just free plugins and quick configs. Let’s dive in!

1. Auto-Resize & Compress Images on Upload

Images are the #1 bandwidth killer. Don’t upload a 10MB photo and hope for the best — automate compression to keep your site lean.

Recommended Plugin: Resize Image After Upload (Free, 90K+ active installs, 4.8/5 rating)

Install & activate it first thing.
Set max width/height (e.g., 1920px wide) and compression level (default 82% JPEG quality is solid).
It auto-resizes JPEG/PNG/GIF on upload, slashes file sizes by 50–80%, and boosts SEO with faster load times.

Pro tip: For bulk-optimizing existing images, pair it with Smush (free tier handles 50 images/month).

Result: Pages load 2–3x faster, less server strain, happier Google rankings.

2. Strip Out Unnecessary Bloat

WordPress ships with “extras” you might not need — like Gutenberg blocks, XML-RPC, or emoji scripts. Trim the fat for a lighter core.

Recommended Plugin: Unbloater (Free, 10K+ active installs, 5/5 rating)

Simple dashboard under Settings > Unbloater.
Recommended toggles:
- Backend: Disable auto-updates (if you handle them manually), limit post revisions to 3, hide update nags for non-admins, disable XML-RPC.
- Frontend: Remove RSD/WLW manifests, shortlinks, feed links, jQuery Migrate, emoji scripts.
- Block Editor: Fully disable Gutenberg (if using Classic Editor) or remove unused blocks.
- Extras: Block DNS prefetch to WordPress.org, remove generator meta tag.

Everything is reversible — toggle off if issues arise. This cuts database queries and JS/CSS bloat by 20–30%.

3. Tame the Heartbeat API

WordPress’ Heartbeat API pings your server every 15–60 seconds for autosave, user presence, etc. Great for collaboration, but it spikes CPU on shared hosting.

Recommended Plugin: Heartbeat Control (Free, 90K+ active installs, 4.1/5 rating)

Go to Settings > Heartbeat Control.
Set intervals: 60 seconds (frontend), 120 seconds (dashboard/editor).
Or disable entirely on frontend if you don’t need live previews.

Unbloater can handle this too. Expect 10–20% CPU savings on idle sessions.

4. Limit Post Revisions

By default, WordPress saves 25 revisions per post — bloating your database over time (e.g., a 1,000-post site = 25K+ entries).

Add to wp-config.php (before “That’s all, stop editing!”):

// Limit to 3 revisions (or false to disable)
define('WP_POST_REVISIONS', 3);

Unbloater has a toggle for this. Clean up old ones with WP-Optimize (free).

Result: Smaller DB = faster queries and backups.

5. Disable XML-RPC (Unless Needed)

XML-RPC enables remote posting/apps but is a brute-force magnet (most bots target it).

If using Jetpack/mobile apps: Keep it, but whitelist your IP.
Otherwise: Block via .htaccess (Apache/LiteSpeed):

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
# Allow from YOUR.IP.ADDRESS (uncomment if needed)
</Files>

Unbloater or Loginizer (free, 1M+ installs) can disable it too.

6. Lock Down Logins with Rate Limiting

Bots hammer /wp-login.php 24/7. Limit attempts to stop brute-force attacks cold.

Top Pick: Limit Login Attempts Reloaded (Free, 2M+ installs, 4.9/5 rating)

Defaults: 3 failed attempts → 15-min lockout (escalates to 24h).
Covers wp-admin, XML-RPC, WooCommerce, custom logins.
Logs + notifications included.

Alternative: BruteGuard (Free, cloud-based botnet blocking via shared network).

Loginizer (1M+ installs) adds 2FA + reCAPTCHA for extra layers.

Test: Try wrong logins — you’ll see instant blocks.

7. Vet Plugins Before Installing

Not all plugins are equal — some bloat your site with 1MB+ RAM usage or JS errors. Always check:

WP Hive: Chrome extension + site for automated tests (memory, page speed impact, PHP/WordPress compatibility, DB footprint). E.g., Yoast SEO 20.1: +0.1s load time, 1MB RAM (heavier than average).
PluginTests.com: Basic compatibility/smoke tests for 98% of WP.org plugins (activation errors, obvious breaks).

Quick Example (2025 Benchmarks):

Yoast SEO: Solid but resource-heavy (+0.1s load, 1MB RAM). Great for readability.
Rank Math SEO: Lighter (no load impact, <250KB RAM), more free features. Often 4x faster in tests.

Aim for lightweight picks — only add “heavy” ones if essential.

Wrap-Up

Implement these today, and your site will launch 2–3x faster, more secure, and future-proof. Total time: ~30 minutes. No excuses!

Thanks for reading! 🚀

How to avoid timeouts while you are logged on SSH

Tue, 09 Dec 2025 01:41:02 +0000

Introduction

One of the most frustrating things when working on a server?

Your SSH session dies because of a brief Wi-Fi hiccup, idle timeout, or flaky connection.

Fix it forever in 30 seconds.

The Universal Fix: Edit Your SSH Config

This works on Linux, macOS, and Windows — and survives network glitches up to ~4–5 minutes.

Step 1: Create or Edit the SSH Config File

On Linux / macOS:

mkdir -p ~/.ssh
nano ~/.ssh/config

On Windows (PowerShell):

# Replace YourUsername with your actual Windows username
mkdir "$HOME\.ssh" -Force
notepad "$HOME\.ssh\config"

Step 2: Add These Lines

sshHost *
 ServerAliveInterval 120
 ServerAliveCountMax 3
 TCPKeepAlive yes

Save and exit.

Done. That’s it.

What This Actually Does

Setting	Meaning
`Host *`	Apply these rules to every SSH connection
`ServerAliveInterval 120`	Every 2 minutes, your computer sends a tiny “I’m still here” packet
`ServerAliveCountMax 3`	If 3 packets in a row fail → only then close the connection (~6 min)
`TCPKeepAlive yes`	Extra OS-level keepalive (helps with some routers/firewalls)

Result: Your SSH session now survives:

Wi-Fi switching
Laptop sleep/wake
Brief internet drops
VPN reconnects

…without freezing or dying.

You’re Now Unbreakable

From now on, when your internet blinks, your SSH session just… waits patiently.

No more “Connection reset by peer” No more lost tmux sessions No more rage

You’ve officially leveled up.

Thank you for reading — stay connected!

How to check disk usage per file or directory on linux

Tue, 09 Dec 2025 01:34:27 +0000

Introduction

Whether you’re debugging a full VPS, cleaning up a home server, or just curious — here are the fastest and most useful commands to understand what’s eating your disk space.

1. Find the Biggest Files & Folders in the Current Directory

du -shc * | sort -rh | head -15

du -shc * → shows size of everything in the current folder (human-readable, with total)
sort -rh → sorts from biggest to smallest
head -15 → shows only the top 15 culprits (change number as needed)

Perfect for quickly spotting that one huge log file or backup folder.

Pro tip: Run it in /var, /home, or / to hunt down space hogs.

2. Check Overall Disk Usage (All Partitions)

df -h

Shows:

Total/used/available space
Percentage used
Mount point

Look for the line with / (root) or your main drive. Example: 64G used / 226G total → 28% full

Add –exclude-type=tmpfs to hide temporary filesystems:

df -h --exclude-type=tmpfs --exclude-type=devtmpfs

3. Check Inode Usage (When “Disk Full” But df Shows Space Left)

Sometimes your disk is full of millions of tiny files (logs, cache, sessions, etc.). Each file uses one inode.

Check inodes per folder in current directory:

du --inodes --max-depth=1 . | sort -nr

Or system-wide:

df -i

If “IUsed” is near 100%, you’re out of inodes — time to clean up small files!

Bonus One-Liners

# Top 10 biggest directories in /home
du -h /home | sort -rh | head -10

# Find files bigger than 1GB
find / -type f -size +1G 2>/dev/null

# Show only real disks (clean output)
df -h -x squashfs -x tmpfs -x devtmpfs

That’s it!

You now have the ultimate toolkit to never be surprised by a full disk again.

Thank you for reading!

How to easily export and import docker volumes

Tue, 09 Dec 2025 01:22:26 +0000

If you’re like me, you prefer to run everything in Docker containers. They’re fast, isolated, and perfect for running multiple apps on one VPS.

But what happens when you want to:

Move a container to a new server?
Backup a database volume (NextCloud, PhotoPrism, Vaultwarden, etc.)?
Restore data after a crash?

Docker doesn’t include a built-in “export volume” button — but there’s a super simple and reliable trick using a temporary Ubuntu container.

Let’s go!

Step 1: List Your Volumes

docker volume ls

Example output:

DRIVER VOLUME NAME
local nextcloud_data
local photoprism_storage
local vaultwarden_data

Pick the one you want to export (e.g., nextcloud_data).

Step 2: Export a Volume → backup.tar.gz

Run this one-line command (replace nextcloud_data with your volume name):

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -czf /backup/nextcloud-data-backup.tar.gz -C /data ./

What this does:

Mounts your volume to /data inside a temporary container
Mounts your current folder to /backup
Creates a compressed archive of the entire volume

After it finishes, you’ll have a file like: nextcloud-data-backup.tar.gz ← ready to download or move!

Pro tip: Add the date for clarity

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -czf "/backup/nextcloud-data-$(date +%Y-%m-%d).tar.gz" -C /data ./

Step 3: Import on the New Server

Copy your backup.tar.gz file to the new server (via scp, rsync, etc.)

Then, create the empty volume (important!):

docker volume create nextcloud_data

Run the import command (from the folder containing the backup file):

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -xzf /backup/nextcloud-data-2025-04-05.tar.gz -C /data

Done! Your volume is now fully restored.

Never let Docker auto-create the volume during import — it can cause permission issues or merge problems.

Bonus: Using External Volumes with Docker Compose

If you’re using docker-compose.yml, tell Docker that the volume is external (already exists):

services:
 nextcloud:
 image: nextcloud:latest
 volumes:
 - nextcloud_data:/var/www/html

volumes:
 nextcloud_data:
 external: true

Indentation matters — use exactly two spaces.

Real-World Use Cases

Migrating NextCloud to a new VPS
Backing up Vaultwarden before upgrading
Moving PhotoPrism library to a bigger server
Disaster recovery

This method is 100% reliable, works with any volume, and requires zero extra tools.

You now have a bulletproof Docker volume backup strategy.

Happy containerizing! 🐳

Thank you for reading!

How to easily self-host at home and put your projects online under CGNAT

Tue, 09 Dec 2025 01:13:41 +0000

Introduction

Want to run heavy services on a powerful server at home, even though your ISP puts you behind CGNAT? This guide shows you exactly how to put them online — the old-school, bulletproof way using SSH reverse tunnels.

No Cloudflare Tunnel. No Ngrok. Just SSH + systemd.

The Downsides (and Why They’re Manageable)

Home internet isn’t datacenter-grade (outages happen)
Most ISPs use CGNAT → you can’t open ports normally

Solution: Use a cheap VPS as a public “jump box”. Your heavy server stays home. The VPS only forwards ports.

How It Works – The Magic of Reverse SSH Tunnels (-R)

Internet → Cheap VPS (public IP) → SSH reverse tunnel → Your home server (behind CGNAT)

Your home server initiates an outbound SSH connection to the VPS and says: “Anything that hits port 8096 on you → send it to my local Jellyfin on 8096”

Zero ports opened on your home router. Zero exposure.

Step-by-Step Setup

1. On Your Home Server (the powerful one)

# Create folder for tunnel configs
sudo mkdir -p /etc/sshtunnels

# Example: expose Jellyfin (port 8096)
sudo nano /etc/sshtunnels/jellyfin.conf

Content of the file:

8096:8096 # remote_port:local_port
443:8443 # optional: HTTPS reverse proxy on VPS → your local 8443
80:8080

One line per service. First number = port on the VPS, second = port on your home server.

2. Generate an SSH Key (if you don’t have one)

ssh-keygen -t ed25519 -C "home-server-tunnel"

Copy the public key to your VPS:

ssh-copy-id user@your-vps-ip

3. Create the Tunnel Manager Script

sudo nano /usr/local/bin/sshtunnel.sh

#!/bin/bash

# === EDIT THESE ===
REMOTE_USER="root" # or your VPS user
REMOTE_HOST="123.45.67.89" # your VPS public IP
SSH_KEY="/home/youruser/.ssh/id_ed25519"
SSH_PORT="22" # change if you use a non-standard port
# ==================

INSTANCE="$1"
CONFIG_FILE="/etc/sshtunnels/${INSTANCE}.conf"

if [[ ! -f "$CONFIG_FILE" ]]; then
 echo "Error: Config file $CONFIG_FILE not found!"
 exit 1
fi

# Build -R arguments
FORWARD_OPTS=""
while IFS=: read -r remote_port local_port; do
 [[ -z "$remote_port" || "$remote_port" =~ ^# ]] && continue
 # Clean any old process using the remote port
 ssh -p "$SSH_PORT" "$REMOTE_USER@$REMOTE_HOST" \
 "lsof -i :$remote_port -t | xargs -r kill -9" 2>/dev/null
 FORWARD_OPTS="$FORWARD_OPTS -R $remote_port:localhost:$local_port"
done < "$CONFIG_FILE"

echo "Starting tunnel $INSTANCE → $REMOTE_HOST ($FORWARD_OPTS)"

exec ssh -o StrictHostKeyChecking=no \
 -o ServerAliveInterval=30 \
 -o ServerAliveCountThreshold=3 \
 -o ExitOnForwardFailure=yes \
 -o GatewayPorts=yes \
 -N -T \
 -i "$SSH_KEY" \
 -p "$SSH_PORT" \
 $FORWARD_OPTS \
 "$REMOTE_USER@$REMOTE_HOST"

Make it executable:

sudo chmod +x /usr/local/bin/sshtunnel.sh

4. Create a Systemd Service (Auto-Start & Auto-Reconnect)

sudo nano /etc/systemd/system/sshtunnel@.service

[Unit]
Description=SSH Reverse Tunnel for %i
After=network-online.target
Wants=network-online.target

[Service]
User=youruser # ← change to your home user (not root!)
Group=youruser
ExecStart=/usr/local/bin/sshtunnel.sh %i
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

Reload and enable:

sudo systemctl daemon-reload

# Start a tunnel (example: jellyfin)
sudo systemctl enable --now sshtunnel@jellyfin.service

Check status:

sudo systemctl status sshtunnel@jellyfin.service

5. On the VPS Side (Optional but Recommended)

Install a tiny web server or Caddy/nginx to terminate TLS and proxy to the forwarded ports.

Example with Caddy (automatic HTTPS):

# On the VPS
apt install caddy

# /etc/caddy/Caddyfile
jellyfin.yourdomain.com {
 reverse_proxy localhost:8096
}

Now jellyfin.yourdomain.com → your home Jellyfin, fully encrypted.

All running on my beast home server behind CGNAT.

Pros of This Setup

Works behind any CGNAT / ISP block
No third-party dependency (no Cloudflare, no Ngrok)
Full encryption possible
Survives reboots (systemd + Restart=always)
Costs almost nothing

Final Words

This is the one really cool way I’ve found to self-host heavy services at home in 2025.

Your powerful hardware stays home. Your $1/month VPS is just a traffic cop.

Thank you for reading — now go build your unstoppable home lab!

How to Automatically Backup Your Self-Hosted Ghost Blog

Tue, 09 Dec 2025 01:05:55 +0000

Introduction

Ghost is an incredibly fast and elegant blogging platform. But unlike WordPress, it doesn’t have built-in one-click backup plugins.

That changes today.

In this guide, you’ll set up a fully automated daily backup system that:

Dumps your MySQL database
Backs up all themes, images, and content
Compresses everything into a single .zip
Uploads it securely to your cloud storage (pCloud, NextCloud, Google Drive, Dropbox, etc.)

All using free tools: rclone + a simple bash script + cron.

Let’s get started.

Step 1: Install Rclone

sudo apt update && sudo apt install -y rclone

Rclone is the Swiss Army knife of cloud storage — it supports over 70 providers.

Full list: https://rclone.org/overview/

Step 2: Configure Rclone (Connect Your Cloud Storage)

Run:

rclone config

Follow the prompts:

n → new remote
Name it something like ghost-backup or pcloud
Choose your provider (e.g., webdav for NextCloud, pcloud, google drive, etc.)
Enter your credentials/URL when asked

Test it works:

rclone ls ghost-backup:

You should see your remote files (or an empty folder if new).

Type q to quit.

Step 3: Get Your Ghost Database Credentials

su - yourghostuser
cd /var/www/ghost # or wherever you installed Ghost
cat config.production.json

Look for the database section. You’ll see something like:

"database": {
 "client": "mysql",
 "connection": {
 "host": "localhost",
 "user": "ghost_db_user",
 "password": "yoursecretpassword",
 "database": "ghost_prod"
 }
}

Write down:

Database name (ghost_prod)
Username (ghost_db_user)
Password

Step 4: Create the Backup Script

Create the script as root:

nano /root/backup-ghost.sh

Paste this (then edit the variables below):

#!/bin/bash

# === EDIT THESE VALUES ===
GHOST_USER="yourghostuser" # e.g. ghost
GHOST_PATH="/var/www/ghost" # path to your Ghost install
DB_NAME="ghost_prod" # from config.production.json
DB_USER="ghost_db_user" # from config.production.json
DB_PASS="yoursecretpassword" # from config.production.json
BACKUP_NAME="theselfhostingart-blog" # name for your backup zip
RCLONE_REMOTE="ghost-backup" # name you gave in rclone config
RCLONE_PATH="/" # folder in your cloud (use / for root)
# =========================

DATE=$(date +'%Y-%m-%d_%H-%M')
BACKUP_DIR="/home/$GHOST_USER/backups/$DATE"
ZIP_FILE="$BACKUP_DIR/$BACKUP_NAME-$DATE.zip"

echo "Starting Ghost backup: $DATE"

# Create backup directory
mkdir -p "$BACKUP_DIR"

# Backup database
echo "Backing up database..."
mysqldump -u "$DB_USER" -p"$DB_PASS" --add-drop-table "$DB_NAME" | gzip > "$BACKUP_DIR/db.sql.gz"

# Backup content folder (themes, images, etc.)
echo "Backing up content folder..."
rsync -av --exclude='logs' --exclude='cache' "$GHOST_PATH/content/" "$BACKUP_DIR/content/"

# Compress everything
echo "Compressing backup..."
zip -r "$ZIP_FILE" "$BACKUP_DIR/content" "$BACKUP_DIR/db.sql.gz" > /dev/null

# Upload to cloud
echo "Uploading to cloud storage..."
rclone copy "$ZIP_FILE" "$RCLONE_REMOTE:$RCLONE_PATH"

# Cleanup: remove local backups older than 1 day (optional but recommended)
echo "Cleaning up old local backups..."
find /home/$GHOST_USER/backups -type d -mtime +1 -exec rm -rf {} +

echo "Backup complete: $ZIP_FILE → $RCLONE_REMOTE:$RCLONE_PATH"

Make it executable:

chmod +x /root/backup-ghost.sh

Test it manually first:

/root/backup-ghost.sh

Check your cloud storage — you should see a file like: theselfhostingart-blog-2025-04-05_03-22.zip

Step 5: Automate with Cron (Daily Backups)

crontab -e

Add this line for daily backup at 2:00 AM:

cron0 2 * * * /usr/bin/bash /root/backup-ghost.sh >> /var/log/ghost-backup.log 2>&1

Save and exit.

Your Ghost blog is now automatically backed up every day.

What’s Included in the Backup?

Full database (posts, users, settings)
All uploaded images
Custom themes
Everything needed to restore or migrate

You can even send this .zip to Ghost(Pro) support — they can import it directly.

Bonus: Restore in Case of Disaster

To restore:

Install fresh Ghost
Unzip backup
Import DB: gunzip < db.sql.gz | mysql -u user -p dbname
Replace content/ folder
Run ghost restart

Credits & Thanks

This method is inspired and improved from this excellent post: How to Automatically Backup Ghost Blogs – Kenton Vizdos

Thank you, Kenton!

Your self-hosted blog now sleeps better at night. 😴💾

Thank you for reading!

How to install NextCloud with OpenLiteSpeed (LOMP stack)

Tue, 09 Dec 2025 00:59:45 +0000

Introduction

Today I’ll show you how to build what I genuinely believe is the fastest NextCloud stack available in 2025:

OpenLiteSpeed – the fastest web server with built-in cache
LSPHP 8.1/8.2 – LiteSpeed’s ultra-fast PHP implementation
Redis + APCu – for blazing-fast caching and locking
Runs completely non-root, under its own user
Hardened with proper security headers, HSTS, and isolated data folder

Even if NextCloud gets compromised, the attacker still can’t touch the rest of your server.

Let’s go!

Step 1: Secure Your VPS First

Before anything, harden your server. Follow my full guide here: How to Make Your VPS Secure

Step 2: Install OpenLiteSpeed, LSPHP, Redis & Tools

Run as root:

# Update system
apt update && apt upgrade -y

# Add OpenLiteSpeed repository
wget -O - https://repo.litespeed.sh | bash

# Install essentials
apt install -y curl gnupg2 imagemagick ffmpeg redis openlitespeed lsphp81* lsphp82* zip unzip mariadb-server mariadb-client

Note: On Ubuntu 22.04+, the ImageMagick package might be libmagickwand-dev + imagemagick. The above works on most recent Debian/Ubuntu.

Enable and restart Redis:

systemctl enable --now redis-server

Step 3: Create a Dedicated System User for NextCloud

adduser --shell /bin/bash files
usermod -aG redis files # Allow access to Redis socket

Step 4: Download & Extract NextCloud as the “files” User

su - files
mkdir -p ~/public_html
cd ~/public_html

wget https://download.nextcloud.com/server/releases/latest.zip
unzip latest.zip
rsync -av nextcloud/ ./
rm -rf nextcloud latest.zip .htaccess .user.ini
exit

Step 5: Configure OpenLiteSpeed Web Admin (Port 7080)

Set an admin password:

/usr/local/lsws/admin/misc/admpass.sh

Now visit: https://your-vps-ip:7080 and log in.

Virtual Host Setup

Delete the default “Example” virtual host
Add new Virtual Host:

Virtual Host Name: yourdomain.com
Virtual Host Root: /home/files/
Config File: $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
Document Root: $VH_ROOT/public_html

Script Handler → Add:

Suffix: php
Handler Type: LiteSpeed LVE
Handler: lsphp81 (or lsphp82 if you prefer PHP 8.2)

Rewrite Rules (force HTTPS):

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]

Security Headers (Context → Static → Add new context /):

Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Content-Security-Policy "upgrade-insecure-requests"

External App → LSPHP → Edit:

Run as User/Group: files
PHP_LSAPI_CHILDREN = 100
LSAPI_AVOID_FORK = 0

Listeners:

Delete default listeners
Add HTTP → port 80
Add HTTPS → port 443 (Secure = Yes)
Map your domain to both listeners

Graceful restart → OpenLiteSpeed → Graceful Restart

Step 6: Issue Let’s Encrypt SSL

apt install -y certbot
certbot certonly --webroot -w /home/files/public_html -d yourdomain.com

Note the paths (you’ll need them):

Fullchain: /etc/letsencrypt/live/yourdomain.com/fullchain.pem
Privkey: /etc/letsencrypt/live/yourdomain.com/privkey.pem

Add them in:

Virtual Host → SSL tab
Listener HTTPS → SSL tab
Chained Certificate = Yes

Graceful restart again.

Step 7: Auto-Renew SSL

crontab -e

Add:

cron0 3 * * * /usr/bin/certbot renew --quiet

Step 8: Install & Secure MariaDB/MySQL

mysql_secure_installation

Then create database & user:

mysql -u root -p
CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'ncuser'@'localhost' IDENTIFIED BY 'strong-password-here';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'ncuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 9: Optimize PHP & Enable OPCache + APCu

# Edit the correct php.ini (adjust path if using lsphp82)
sed -i '/usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini' \
 -e 's/memory_limit = .*/memory_limit = 1024M/' \
 -e 's/upload_max_filesize = .*/upload_max_filesize = 10G/' \
 -e 's/post_max_size = .*/post_max_size = 10G/' \
 -e 's/max_execution_time = .*/max_execution_time = 3600/' \
 -e 's/opcache.enable=.*/opcache.enable=1/' \
 -e 's/;opcache.memory_consumption=.*/opcache.memory_consumption=512/' \
 -e 's/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=64/' \
 -e 's/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=20000/'

# Enable APCu CLI
echo "apc.enable_cli = 1" >> /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini

pkill -f lsphp
systemctl restart lsws

Step 10: Configure Redis as Unix Socket

sed -i 's/port 6379/port 0/' /etc/redis/redis.conf
sed -i 's|# unixsocket /var/run/redis/redis-server.sock|unixsocket /var/run/redis/redis-server.sock|' /etc/redis/redis.conf
sed -i 's/# unixsocketperm 700/unixsocketperm 770/' /etc/redis/redis.conf
sed -i 's/# maxmemory .*/maxmemory 1gb/' /etc/redis/redis.conf

systemctl restart redis-server

Step 11: Final NextCloud Configuration

Move Data Folder Outside Web Root (Critical!)

During setup, set data directory to: /home/files/data

su - files
nano /home/files/public_html/config/config.php

Add right after ‘installed’ => true,:

'memcache.local' => '\\OC\\Memcache\\APCu',
 'memcache.distributed' => '\\OC\\Memcache\\Redis',
 'memcache.locking' => '\\OC\\Memcache\\Redis',
 'redis' => [
 'host' => '/var/run/redis/redis-server.sock',
 'port' => 0,
 ],

Set Up Background Jobs (Cron)

su - files
crontab -e

Add:

cron*/5 * * * * /usr/local/lsws/lsphp81/bin/php -f /home/files/public_html/cron.php

Then in NextCloud Admin → Basic Settings → Background jobs → Select Cron (recommended).

Bonus: Make occ Easy to Use Forever

su - files
echo "alias occ='/usr/local/lsws/lsphp81/bin/php /home/files/public_html/occ'" >> ~/.bashrc
source ~/.bashrc

Now from anywhere in ~/public_html:

cd ~/public_html
occ status
occ maintenance:repair
occ db:add-missing-indices

You’re Done!

You now have:

The fastest NextCloud stack (OpenLiteSpeed + Redis + APCu)
Fully non-root and isolated
Automatic SSL renewal
Hardened security headers
Proper data folder protection

Enjoy your blazing-fast, private cloud!

Thank you for reading! 🚀

How to Make Your VPS Safer Against Accidental Deletions

Tue, 09 Dec 2025 00:31:57 +0000

Introduction

Have you ever deleted a file or a folder by mistake in a VPS? That feeling sucks. Sometimes you are working fast and you delete a really important file/folder. This happened to me previously. Today I want to share an amazing tool with you guys: trash-cli . It adds a trash in the CLI to prevent these human mistakes.

Installing trash-cli

trash-cli is a lightweight, command-line tool available in Debian repositories, making it ideal for VPS environments with limited resources.

Installation Steps

Update your package list:

sudo apt update

Install trash-cli:

sudo apt install trash-cli

Verify the installation:

trash --version

You should see version information if installed correctly.

This process is quick and adds minimal overhead to your VPS.

Using trash-cli for Safer Deletions

Once installed, trash-cli provides commands to manage files safely. It moves items to ~/.local/share/Trash/ instead of deleting them.

Basic Commands

Trash a file or directory: trash file.txt or trash directory.
List trashed items: trash-list (shows files with deletion dates).
Restore items: trash-restore (interactive menu to select and recover files).
Empty the trash: trash-empty (permanently deletes all trashed items).
Empty old items: trash-empty 30 (deletes items older than 30 days).

Example workflow:

trash important_file.txt # Move to trash
trash-list # Check what's there
trash-restore # Recover if needed

This replaces risky rm usage in daily operations.

Aliasing rm to Use trash-cli

To make rm safer by default, alias it to trash in your shell configuration. This ensures most deletions go to the trash bin.

Setting Up the Alias

Edit your ~/.bashrc file:

nano ~/.bashrc

Add this line at the end:

alias rm='trash'

Save and exit (Ctrl+X, Y, Enter).
Reload the configuration:

source ~/.bashrc

Now, rm file.txt will use trash instead of permanent deletion.

Automating Trash Emptying with Cron

To prevent the trash from accumulating indefinitely, automate emptying with a cron job.

Setting Up Weekly Emptying

Edit your crontab:

crontab -e

Add this line for weekly deletion (e.g., every Sunday at 2 AM):

0 2 * * 0 /usr/bin/trash-empty

0 2 * * 0: Sunday at 2:00 AM.
/usr/bin/trash-empty: Clears all trash.

Save and exit.
Verify:

crontab -l

Adjust the schedule as needed (e.g., change 0 to 1-6 for weekdays). For partial emptying, use trash-empty 30 to delete items older than 30 days.

Conclusion

By installing trash-cli, aliasing rm to trash, and setting up automated emptying, you can make your VPS much safer against accidental deletions. This approach adds a recoverable layer without sacrificing performance. Remember to combine it with regular backups and cautious command usage. If you’re new to VPS management, start small and test thoroughly. For more advanced setups, explore integrating with monitoring tools. Stay safe out there!

How to make your VPS secure

Tue, 09 Dec 2025 00:30:29 +0000

Introduction

If you just bought a VPS and are starting to self-host, this is one of the most important security improvements you can make.

By switching to SSH key authentication and disabling password login, your server becomes nearly immune to brute-force attacks — even if someone discovers your password or you’re still using the default port 22.

Step 1: Generate an SSH Key Pair on Your Local Machine

Linux & macOS

Open a terminal and run:

ssh-keygen -t rsa -b 4096

or (newer recommended format):

Bash

ssh-keygen -t ed25519

Press Enter to accept the default file location and leave the passphrase empty (just hit Enter twice).

Your keys will be saved as:

Private key: ~/.ssh/id_rsa or ~/.ssh/id_ed25519
Public key: ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub

Never share the private key!

Windows (PowerShell)

Open PowerShell and run:

ssh-keygen.exe -t ed25519

(or -t rsa -b 4096 if ed25519 is not supported)

Press Enter through the prompts (no passphrase). Keys will be created in C:\Users\YourUser.ssh\

Step 2: Copy Your Public Key to the VPS

Linux & macOS (Easiest Method)

ssh-copy-id user@your-vps-ip

Replace user and your-vps-ip with your actual username and server IP.

Windows

Paste your public key (it’s one long line starting with ssh-ed25519 or ssh-rsa) → Save with Ctrl+O → Enter → Ctrl+X
Test it: Open a new terminal/PowerShell and try logging in. It should work without asking for a password.

Edit the file:Bash

nano ~/.ssh/authorized_keys

Create the .ssh folder and authorized_keys file (if they don’t exist):Bash

mkdir -p ~/.ssh
chmod 700 ~/.ssh
touch ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Log into your VPS normally (with password):PowerShell

ssh user@your-vps-ip

Copy your public key to clipboard:PowerShell

Get-Content $HOME\.ssh\id_ed25519.pub | Set-Clipboard

(or id_rsa.pub if you used RSA)

Step 3: Disable Password Authentication

Now that key login works, disable password login entirely.

Log into your VPS (using your key) and edit the SSH config:

sudo nano /etc/ssh/sshd_config

Find and change (or add) these lines:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
PubkeyAuthentication yes

Save and exit.

Restart the SSH service:

sudo systemctl restart sshd

(or sudo service ssh restart on older systems)

Final test: Try logging in from a new terminal. It should only work with your private key — password attempts will be rejected instantly.

Done!

Your VPS is now protected against:

Brute-force attacks
Credential stuffing
Weak or leaked passwords

Even if an attacker knows your username and password, they cannot log in without your private key file.

Pro tip: Back up your private key securely and consider adding a passphrase later using ssh-keygen -p.

Thank you for reading! 😊

How to remove upload limits on All In One WP Migration

Tue, 09 Dec 2025 00:25:04 +0000

Introduction

Unfortunately, many hosting providers impose very low upload limits (sometimes as little as 2–50 MB), and the official Unlimited Extension costs $69.

If you’re in that situation and need a free way to upload huge backups (10 GB, 40 GB, or more), this simple trick will help.

The Solution: Use “Big File Uploads” Plugin

The free version of All-in-One WP Migration doesn’t artificially limit uploads — it simply respects whatever limit your hosting or server enforces. The paid Unlimited Extension works by splitting the .wpress file into smaller chunks during upload.

Good news: there’s a completely free plugin that does the exact same chunking trick!

Step-by-Step Guide

Install and activate the plugin called Big File Uploads → Direct link: https://wordpress.org/plugins/tuxedo-big-file-uploads/
After activation, go to: Settings → Big File Uploads (or find it under the Plugins page → “Settings” link under the plugin name)
You’ll see the current maximum upload size (it will match your host’s default limit at first).
Change it to whatever you want:

1 GB = 1024 MB
10 GB = 10240 MB
40 GB = 40960 MB (Just type the number in megabytes — no need to add “MB” or “GB”)

Click Save Changes

That’s it! The new limit takes effect immediately.

Now when you go back to All-in-One WP Migration → Import, the max file size will reflect your new value (even 40 GB or higher works perfectly).

Conclusion

This is not meant as an attack on ServMask — they’ve built an amazing plugin and absolutely deserve support. If you can afford it, please buy the official Unlimited Extension.

But if budget is tight and you just need to migrate or restore a huge site once or twice, the Big File Uploads plugin is a 100% free and reliable alternative that works perfectly with the free version of All-in-One WP Migration.

Thank you for reading! 🙂

How to run your own monero node

Tue, 09 Dec 2025 00:07:50 +0000

Introduction

Monero is one of the most important cryptocurrencies in my opinion. It does not have the same market share as Bitcoin, but it is quite unique in one aspect: privacy. Monero is just like cash — no one needs to know how much Monero was sent or who sent it. It’s the opposite of Bitcoin in this regard. In fact, Bitcoin is worse than fiat money when it comes to privacy.

You can read more details here: https://lukesmith.xyz/articles/monero-maximalism-or-how-bitcoin-is-a-coin/

Obs: I’m NOT recommending anyone invest in Monero. Monero is supposed to be a currency, but since crypto is still extremely volatile, many people treat it as an investment. Do your own research — I’m not responsible for any investments you make.

1. Choose a VPS or set it up at home

First things first, you will need a server. You can use your own home PC if you prefer, or a VPS. A VPS is easier because it stays online 24/7 and you can always open the required ports.

At home, many ISPs block incoming ports, so your node wouldn’t be public (it would still help the network, but you couldn’t easily connect to it from outside without something like ngrok).

I personally recommend Contabo for running a Monero node because they offer excellent prices on storage VPS plans. Check their pricing here: Contabo Storage VPS

The Storage VPS S is more than enough. The Monero blockchain currently uses about 175 GB, less than 2 GB of RAM, and barely any CPU once fully synced (~3 % usage).

2. Securing the VPS

First of all, disable password login.

Then install and configure UFW (if it’s not already set up):

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 18080
sudo ufw allow 18089
sudo ufw enable

3. Creating a dedicated user

For security reasons, never run Monero as root. Create a normal user instead:

adduser monerouser

Set a password and press Enter through the rest of the prompts.

4. Changing settings and syncing the node

Switch to the new user:

su monerouser
cd ~

Download the official Monero CLI binaries (Linux 64-bit):

wget -c https://downloads.getmonero.org/cli/monero-linux-x64-v0.18.3.4.tar.bz2
mkdir monero
tar -xjvf monero-linux-x64-v0.18.3.4.tar.bz2 -C monero --strip-components=1

(Replace the version in the URL/filename with the latest one from https://getmonero.org if needed.)

Enter the folder and start monerod once just to create the config files (stop it after a few seconds with Ctrl+C):

cd monero
./monerod

Now edit the configuration file:

nano ~/.bitmonero/bitmonero.conf

Paste the following recommended settings:

# P2P full node
public-node=true # Advertises the RPC-restricted port over p2p

# RPC settings
rpc-restricted-bind-ip=0.0.0.0
rpc-restricted-bind-port=18089

# Node settings
enforce-dns-checkpointing=true
db-sync-mode=safe # Slow but reliable db writes
enable-dns-blocklist=true # Block known-malicious nodes
no-igd=true # Disable UPnP
no-zmq=true

# Bandwidth settings (much faster sync + better contribution)
out-peers=32
in-peers=32
limit-rate-up=1048576 # 1 GB/s upload
limit-rate-down=1048576 # 1 GB/s download

Save with Ctrl+O → Enter → Ctrl+X.

Start the node in detached mode:

./monerod --detach

You’re done! Now just wait for it to fully sync.

Check sync status anytime with:

./monerod status

The initial sync usually takes a few hours depending on your connection and VPS speed.

Once it’s fully synced, you can connect any Monero wallet (Cake Wallet, Monero GUI, Feather, etc.) to your own node using your VPS IP and port 18089.

Conclusion & Credits

That’s it! Running your own full node is strongly encouraged by the Monero community. It makes the network more decentralized and gives you maximum privacy.

This guide wouldn’t have been possible without these excellent resources:

Thank you for reading! 🙂

How to Self Host your own Piped Instance

Mon, 08 Dec 2025 23:58:10 +0000

Introduction

Piped is a privacy-first, open-source alternative YouTube front-end. No Google tracking, no ads (even on videos that normally have unskippable ones), and it works perfectly with SponsorBlock and dearrow.

Self-hosting your own instance is incredibly easy with Docker and takes less than 20 minutes.

Requirements

A domain (or subdomain)
A cheap KVM VPS with Docker support (avoid OpenVZ — old kernel)
~$3–6/month is more than enough (1 CPU, 1–2 GB RAM)

Great cheap providers in 2025:

RackNerd
Hostinger (my affiliate if you want to support https://hostinger.com.br?REFERRALCODE=waterdownfall)
Cloudcone, Hetzner Cloud, BuyVM, etc.

Step 1: Secure & Prepare Your VPS

(SSH keys only, firewall, etc. — do this first!)

Then install Docker (Ubuntu/Debian example):

apt update && apt upgrade -y
apt install -y ca-certificates curl gnupg lsb-release

# Add Docker repo
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Step 2: Deploy Piped with the Official Docker Setup

cd /opt
git clone https://github.com/TeamPiped/Piped-Docker
cd Piped-Docker
./configure-instance.sh

During the script:

Choose Caddy as reverse proxy (easiest + automatic SSL)
Enter your domain and subdomains:
- Frontend → piped.yourdomain.com
- Backend API → pipedapi.yourdomain.com
- Proxy → pipedproxy.yourdomain.com

Step 3: Point DNS to Your VPS

Create three A records at your DNS provider:

piped.yourdomain.com → VPS_IP
pipedapi.yourdomain.com → VPS_IP
pipedproxy.yourdomain.com → VPS_IP

Step 4: Launch Everything

docker compose up -d

That’s it! After DNS propagates (usually < 10 minutes), your private YouTube will be live at:

https://piped.yourdomain.com

Caddy automatically handles free Let’s Encrypt SSL — no manual certbot needed.

Step 5: (Optional) Check Logs

Bash

# See what Caddy is doing
docker logs -f caddy

# Or any other container
docker logs -f piped-frontend

Bonus Tips

Want to make it public? Just share the URL — anyone can use your instance.
Want it private? Block it with Cloudflare firewall rules or basic auth in Caddy.
Pair it with the LibreTube (Android) app for the full de-Googled experience.

You now have your own ad-free, tracking-free, SponsorBlock-enabled YouTube — fully under your control.

Thanks for reading!

How to setup grub for Dual Boot on Ubuntu 23.10 (fix)

Mon, 08 Dec 2025 23:53:06 +0000

Introduction

GRUB Menu Not Showing → Windows Not Appearing on Boot

Just installed Xubuntu (or Ubuntu) 23.10 alongside Windows and now it boots straight into Linux without showing the GRUB menu? Don’t worry — this is the new default behavior. Starting with recent Ubuntu versions, GRUB_TIMEOUT_STYLE is set to hidden and the timeout is 0 seconds, so the menu is completely skipped unless you hold Shift during boot.

Here’s the permanent two-line fix.

The Fix (Takes 30 Seconds)

Open a terminal and edit the GRUB config:

sudo nano /etc/default/grub

Make sure these lines are present and exactly like this (add them if missing):

GRUB_TIMEOUT_STYLE=menu
GRUB_TIMEOUT=10

Optional but recommended — make the menu look nicer and be 100% reliable:

GRUB_TERMINAL=console

Full example of the relevant section:

# Show the GRUB menu every time
GRUB_TIMEOUT_STYLE=menu
GRUB_TIMEOUT=10 # seconds to wait before auto-booting the default entry
GRUB_TERMINAL=console

Save (Ctrl+O → Enter → Ctrl+X) and update GRUB:

sudo update-grub

Reboot and you’ll now see the full GRUB menu with both Ubuntu/Xubuntu and Windows listed. You can change the 10 to any number you like (or even -1 to wait indefinitely until you pick an entry).

Why This Happens

Canonical decided to hide the menu by default for a “cleaner” boot experience on single-OS machines. For dual-boot users it’s just annoying — this fix restores the classic behavior permanently.

That’s it — enjoy easy access to both operating systems again!

(Original solution via AskUbuntu community)

Thanks for reading!

How to setup WordPress on LEMP with Redis and WP CLI on Debian 11

Mon, 08 Dec 2025 23:47:36 +0000

Introduction

This is the fastest, most secure, and most resource-efficient way to self-host WordPress in 2025. We’ll use a proper LEMP stack (Linux + Nginx + MySQL/MariaDB + PHP-FPM) with per-site PHP isolation, Redis object caching, automatic SSL, and WP-CLI — everything tuned for speed and security.

Let’s go.

Step 0: Secure & Update Your VPS

(If you haven’t already, follow a VPS hardening guide first — SSH keys only, firewall, fail2ban, etc.)

apt update && apt upgrade -y
apt autoremove --purge
reboot

Step 1: Install the Core Stack

# Nginx
apt install nginx -y
systemctl enable nginx

# MariaDB (better than MySQL on Debian)
apt install mariadb-server -y
systemctl enable mariadb

# PHP 8.3 + all needed extensions (using ondrej/sury repo)
apt install ca-certificates apt-transport-https lsb-release -y
wget -qO- https://packages.sury.org/php/apt.gpg | gpg --dearmor > /usr/share/keyrings/sury-php.gpg
echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/sury-php.list
apt update
apt install php8.3-fpm php8.3-mysql php8.3-curl php8.3-gd php8.3-mbstring php8.3-xml php8.3-zip php8.3-intl php8.3-imagick php8.3-redis -y
systemctl enable php8.3-fpm

# Redis
curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" > /etc/apt/sources.list.d/redis.list
apt update && apt install redis-server -y
systemctl enable redis-server

# Certbot + WP-CLI
apt install python3-certbot-nginx -y
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar && mv wp-cli.phar /usr/local/bin/wp

Step 2: Secure MariaDB & Create Database

mysql_secure_installation

mysql -u root -p
CREATE DATABASE wp_yoursite;
CREATE USER 'wp_yoursite'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON wp_yoursite.* TO 'wp_yoursite'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 3: Isolate PHP-FPM Per Site (Security + Stability)

cd /etc/php/8.3/fpm/pool.d/
cp www.conf yoursite.conf
nano yoursite.conf

Replace:

[www] → [yoursite]
user = www-data → user = yoursiteuser (we’ll create this user soon)
group = www-data → group = yoursiteuser
listen = /run/php/php8.3-fpm.sock → listen = /run/php/php8.3-fpm-yoursite.sock
Change process manager from dynamic → ondemand (saves RAM)

systemctl restart php8.3-fpm

(It will fail until the user exists — that’s fine.)

Step 4: Optimize PHP & Enable OPcache

sed -i "s/memory_limit = .*/memory_limit = 1024M/" /etc/php/8.3/fpm/php.ini
sed -i "s/upload_max_filesize = .*/upload_max_filesize = 10240M/" /etc/php/8.3/fpm/php.ini
sed -i "s/post_max_size = .*/post_max_size = 10240M/" /etc/php/8.3/fpm/php.ini
sed -i "s/max_execution_time = .*/max_execution_time = 600/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.enable=1/opcache.enable=1/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=512/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=20000/" /etc/php/8.3/fpm/php.ini
sed -i "s/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/" /etc/php/8.3/fpm/php.ini

Step 5: Create System User & Site Directory

adduser yoursiteuser --shell /bin/bash
su yoursiteuser
mkdir ~/public_html && cd ~/public_html
echo "cd ~/public_html" >> ~/.bashrc
exit

Step 6: Nginx Config (Fast & Secure)

nano /etc/nginx/sites-available/yoursite.conf

upstream php-yoursite {
 server unix:/run/php/php8.3-fpm-yoursite.sock;
}

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com www.yourdomain.com;
 root /home/yoursiteuser/public_html;
 index index.php index.html;

 client_max_body_size 10G;

 location / {
 try_files $uri $uri/ /index.php?$args;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass php-yoursite;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf|eot)$ {
 expires max;
 log_not_found off;
 }
}

ln -s /etc/nginx/sites-available/yoursite.conf /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

Step 7: Install WordPress via WP-CLI (as the site user)

su yoursiteuser
cd ~/public_html

wp core download
wp config create --dbname=wp_yoursite --dbuser=wp_yoursite --dbpass='strongpassword' --locale=en_US
wp core install --url=https://yourdomain.com --title="Your Site" --admin_user=admin --admin_password='strongpass' --admin_email=you@domain.com

Step 8: SSL with Let’s Encrypt (Auto-renew)

certbot --nginx -d yourdomain.com -d www.yourdomain.com
# Choose redirect to HTTPS when asked

Add auto-renew cron:

crontab -e
# Add:
0 0 * * 0 certbot renew --quiet

Step 9: Enable Redis Object Cache

# As root
usermod -aG redis yoursiteuser
chmod 770 /var/run/redis/redis-server.sock

# Optimize Redis config
sed -i 's/port 6379/port 0/' /etc/redis/redis.conf
sed -i 's|# unixsocket /run/redis/redis-server.sock|unixsocket /var/run/redis/redis-server.sock|' /etc/redis/redis.conf
sed -i 's/# unixsocketperm 700/unixsocketperm 770/' /etc/redis/redis.conf
sed -i 's/# maxmemory .*/maxmemory 1024mb/' /etc/redis/redis.conf
systemctl restart redis-server

# As yoursiteuser
cd ~/public_html
wp plugin install redis-cache --activate
wp config set WP_REDIS_SCHEME unix
wp config set WP_REDIS_PATH '/var/run/redis/redis-server.sock'
wp redis enable

Done!

You now have:

Fully isolated PHP-FPM pool (1 user = 1 site = no cross-site damage)
Redis object caching over Unix socket
OPcache + huge upload limits
Automatic SSL renewal
Fastest possible Nginx routing
WP-CLI ready

Your wp-admin will feel instant, and the site will handle traffic like a champ — even on a $5/month VPS.

Next steps:

Install a page cache plugin (any free one is ok)
Set up Cloudflare (optional but recommended)
Regular backups

Enjoy your blazing-fast, private WordPress setup!

Thanks for reading! 😊

How to setup your own email server

Mon, 08 Dec 2025 23:35:02 +0000

Introduction

Want your own ultra-private email like name@yourdomain.com with a beautiful webmail interface? This guide walks you through setting up a full mail server in under an hour using Luke Smith’s legendary EmailWiz script + Roundcube webmail — all on a $2–3/month VPS.

Everything is free, open-source, and 100% under your control.

Step 0: Grab a Cheap VPS

Good providers with frequent sales:

Contabo
LowEndTalk “Offers” section
Hostinger (my affiliate if you want to support me -> https://hostinger.com.br?REFERRALCODE=waterdownfall)

Requirements:

Any location (USA works fine)
Debian 10 or 11 (we’ll use Debian 10 in this guide)
At least 1 GB RAM (2 GB+ recommended)
Set hostname during signup to your domain (e.g., sobremail.com)

Wait for deployment → grab root password from email → SSH in.

Step 1: Basic VPS Hardening

ssh root@your-vps-ip
apt update && apt upgrade -y

Change root password:

passwd

Create and upload an SSH key (do this from your local machine):

ssh-copy-id root@your-vps-ip

Now disable password login:

nano /etc/ssh/sshd_config

Change:

PasswordAuthentication no
UsePAM no

Then:

systemctl restart sshd

Only your SSH key works now — much safer.

Step 2: Install EmailWiz (the magic script)

apt install curl nginx python3-certbot-nginx -y

Point these DNS records to your VPS IP:

yourdomain.com → VPS IP (A record)
mail.yourdomain.com → VPS IP (A record)

Run Luke’s script:

curl -LO lukesmith.xyz/emailwiz.sh
sh emailwiz.sh

Follow the prompts:

Say Yes/Y to everything
When asked for “System mail name” → enter ONLY yourdomain.com (NOT mail.yourdomain.com!)

Wait ~5–10 minutes. When it finishes, it gives you three DNS records to add:

DKIM TXT record (mail._domainkey.yourdomain.com)
DMARC TXT record (_dmarc.yourdomain.com)
SPF TXT record (root domain)

Add them at your DNS provider (Cloudflare, Namecheap, etc.).

Step 3: Set Up Reverse DNS (Critical for Deliverability!)

In Cloudcone panel → Networking → rDNS → set to yourdomain.com Do NOT enable IPv6 (Cloudcone doesn’t support IPv6 rDNS yet — it will hurt deliverability).

Step 4: Create Your First Mailbox

useradd -G mail -m yourusername
passwd yourusername

Your email is now: yourusername@yourdomain.com

Test in Thunderbird/IMAP client:

IMAP: mail.yourdomain.com (port 993, SSL/TLS)
SMTP: mail.yourdomain.com (port 465, SSL/TLS)

Step 5: Install Roundcube Webmail

Add backports + PHP 8.x repo:

apt install -y lsb-release ca-certificates apt-transport-https software-properties-common gnupg2
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/sury-php.list
wget -qO - https://packages.sury.org/php/apt.gpg | apt-key add -
apt update
apt install -y php8.0-fpm php8.0-common php8.0-gd php8.0-imap php8.0-mysql php8.0-curl php8.0-zip php8.0-xml php8.0-mbstring php8.0-intl mariadb-server

Secure MySQL:

mysql_secure_installation

Create Roundcube database:

mysql -u root -p
CREATE DATABASE roundcube;
CREATE USER 'roundcubeuser'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON roundcube.* TO 'roundcubeuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Download & extract Roundcube (latest complete version):

cd /var/www
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz
tar xvf roundcubemail-1.6.9-complete.tar.gz
mv roundcubemail-1.6.9 roundcube
rm roundcubemail-1.6.9-complete.tar.gz
chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
mysql roundcube < /var/www/roundcube/SQL/mysql.initial.sql

Nginx config for Roundcube (/etc/nginx/sites-enabled/roundcube):

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com;
 root /var/www/roundcube;
 index index.php;

 location / {
 try_files $uri $uri/ /index.php;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass unix:/run/php/php8.0-fpm.sock;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
 expires 360d;
 access_log off;
 }
}

Test & reload Nginx, then get SSL:

nginx -t && systemctl reload nginx
certbot --nginx -d yourdomain.com

Visit https://yourdomain.com/installer → follow the wizard:

Database: roundcube, user roundcubeuser, password you set
IMAP host: localhost
SMTP host: localhost
Default host: mail.yourdomain.com

Enable all plugins except Enigma (it breaks identities in older versions).

After finishing, delete the installer:

rm -rf /var/www/roundcube/installer

Step 6: Quality-of-Life Tweaks

Edit /var/www/roundcube/config/config.inc.php:

// Login with just username (no need to type @domain.com)
$config['username_domain'] = 'yourdomain.com';

// Stay logged in for 6 months
$config['session_lifetime'] = 259200;

// Disable Enigma if you enabled it
// Remove 'enigma' from $config['plugins'] array

Increase attachment size:

nano /etc/php/8.0/fpm/php.ini

upload_max_filesize = 50M
post_max_size = 50M

Then:

systemctl restart php8.0-fpm

Step 7: Brute-Force Protection with Fail2Ban

apt install fail2ban -y
cd /var/www/roundcube/plugins
wget https://github.com/texxasrulez/roundcube_fail2ban/archive/refs/tags/1.4.zip
unzip 1.4.zip
mv roundcube_fail2ban-1.4 fail2ban
rm 1.4.zip

Enable in Roundcube config (config.inc.php):

$config['plugins'][] = 'fail2ban';

Add jail (/etc/fail2ban/jail.local – create if missing):

[roundcube]
enabled = true
port = http,https
filter = roundcube
action = iptables-multiport[name=roundcube, port="http,https"]
logpath = /var/www/roundcube/logs/errors.log
maxretry = 5
bantime = 3600

Create filter (/etc/fail2ban/filter.d/roundcube.conf):

[Definition]
failregex = IMAP Error: Login failed for .* from <HOST>
ignoreregex =

Restart:

systemctl restart fail2ban php8.0-fpm

Done! Your webmail is now protected.

Final Result

You now have:

Full email server with DKIM, SPF, DMARC
Beautiful, fast Roundcube webmail
Zero Google/Microsoft involvement
Login once every 6 months
Brute-force protection
All for ~$50/year

Welcome to real email freedom.

Thanks for reading! 😊

How to use AI privately at Brave browser (2 methods)

Mon, 08 Dec 2025 23:15:59 +0000

Introduction

Brave Browser 1.69 introduced a game-changing feature: you can now connect Leo (Brave’s built-in AI assistant) to any model you want — including fully local models or third-party APIs. This means you get an always-available AI sidebar with zero subscription and total control over privacy and cost.

Here are the two best methods I’ve tested (one ultra-private, one smarter but cloud-based).

Method 1 – Maximum Privacy: Run a Local Model with Ollama (No GPU Needed)

You can run a surprisingly capable model completely offline, even on very modest hardware. The current sweet spot is Google’s Gemma 2 2B — it’s tiny (~1.4 GB), runs great on CPU, and works perfectly even with just 4–6 GB of RAM free.

Step 1: Install Ollama

Download and install Ollama from the official site: https://ollama.com (It has native packages for Windows, macOS, and Linux.)

Step 2: Download Gemma 2 2B

Open a terminal and run:

ollama pull gemma2:2b

(If you use Docker: docker exec -it ollama ollama pull gemma2:2b)

Step 3: Verify it’s running

Open http://localhost:11434 in your browser. You should see “Ollama is running” — that’s all you need.

Step 4: Add the model to Brave Leo

Open Brave → Settings → Leo
Click Add new model
Fill in the details exactly like this:

Label → anything you want (e.g., “Gemma 2 2B Local”)
Model Request Name → gemma2:2b
Server Endpoint → http://localhost:11434/v1/chat/completions
API Key → leave empty

(Optional but recommended) Set this model as your default for new chats.

Done! You now have a fully private, offline AI inside Brave that uses almost no resources.

Method 2 – Smarter Answers (Cloud): Use CryptoTalks.ai (Pay-as-you-go, No Subscription)

If you want access to the absolute best models (GPT-4o, Claude 3.5 Sonnet, Gemini 1.5 Flash, Llama 3.1 405B, etc.) without creating accounts at OpenAI/Anthropic/Google, CryptoTalks.ai is currently the best option. You pay only for what you use and can fund the account with Bitcoin or Lightning.

Step 1: Create an account & get your token

Go to https://cryptotalks.ai/signup → sign up → copy your API token (keep it safe!).

Step 2: Add a tiny amount of credit

Deposit any amount via Bitcoin or Lightning. Even $1–2 lasts a very long time for personal use.

Step 3: Add the model(s) to Brave Leo

Same process as before, just different values:

Label → e.g., “Claude 3.5 Sonnet”, “GPT-4o”, etc.
Model Request Name → exact model ID from their docs, examples:
- openai/chatgpt-4o-latest
- anthropic/claude-3.5-sonnet
- google/gemini-flash-1.5
- meta-llama/llama-3.1-405b-instruct
Server Endpoint → https://cryptotalks.ai/v1/chat/completions/
API Key → paste your token

You can add as many models as you want and switch between them instantly in the Leo sidebar.

Pro tip: Check current model rankings at https://artificialanalysis.ai/models to pick the best one for your needs.

Real-World Use

With Leo + your own model you can:

Summarize long articles or YouTube videos in one click
Explain complex code snippets
Draft emails or messages
Translate on the fly
All without ever leaving the browser and without sending data to big tech

When I’m on battery and want zero extra power draw → I switch to the local Gemma 2 2B. When I need maximum intelligence → I switch to Claude 3.5 Sonnet or GPT-4o via CryptoTalks.

Conclusion

Brave just turned every browser into a private, customizable AI workstation. Pick Method 1 for 100% privacy and zero cost, or Method 2 when you want the absolute best answers available today.

Either way — welcome to the future of browsing.

Thanks for reading! 😊

Page Cache, Object Cache and CDN cache - Understanding all types of caching

Mon, 08 Dec 2025 23:13:04 +0000

Understanding the Different Types of Caching (Especially for Scaling CMS Sites)

If you’ve ever wondered what people mean when they talk about “page cache,” “object cache,” or “CDN cache,” this post is for you. These are the three main caching layers that make a massive difference when scaling WordPress, WooCommerce, or any other CMS.

What is Page Caching?

Page caching (also called full-page caching or HTML caching) is exactly what it sounds like: the entire rendered HTML page is saved as a static file.

With a truly static site (plain HTML + CSS + JS), there’s no need for page caching because every file is already static. But with a CMS like WordPress, every request normally triggers PHP → theme → plugins → database queries → HTML output. That process eats CPU and takes time.

Full-page caching shortcuts all of that. The first visitor triggers the full PHP+MySQL process, the resulting HTML is saved, and every visitor after that gets served the pre-generated static HTML instantly — no PHP, no database queries, almost zero CPU.

Result: 10–100× lower server load and dramatically faster page loads.

What is Object Caching?

Object caching stores the results of expensive database queries (or any slow computation) in fast memory (usually Redis or Memcached).

Think of it as a super-fast middleman between your PHP code and the database.

Example with WordPress:

WordPress needs the list of published posts → it asks MySQL.
First request: MySQL does the work, returns the data, object cache saves it in RAM.
Next 10 000 requests: object cache instantly returns the same data from memory → MySQL sleeps peacefully.

Object cache is smart — it automatically invalidates itself when data changes (e.g., you publish a new post).

Why you still need it even with full-page caching:

Logged-in users (including the WordPress dashboard, WooCommerce account pages, etc.) can’t be fully cached for everyone.
Those pages still hit PHP and MySQL → object cache makes them tolerable instead of painfully slow.

Object cache + full-page cache together is the classic high-traffic combo.

What is CDN Caching?

A CDN (Content Delivery Network) copies your static assets (CSS, JS, images, fonts) — and optionally your full HTML pages — to “PoP” servers all over the world.

Without a CDN: a visitor in Japan downloads everything from your origin server in, say, Brazil → high latency.

With a CDN:

Static files are served from the closest PoP (often < 30 ms away).
If you also enable full-page caching on the CDN, the entire HTML page is served from that nearby PoP too → the origin server is never touched for cached pages.

This is why some sites load instantly from anywhere on the planet.

Real-World Example: WordPress Traffic Flow

No caching at all

Visitor → Web server → PHP → dozens of plugin files → MySQL queries → HTML → visitor → High CPU, slow TTFB, easily hits resource limits.

With full-page caching only

First visitor: same slow path as above (but the HTML is saved). Next 10 000 visitors: Web server instantly serves the pre-built HTML → almost zero CPU.

With object caching only

Every request still runs PHP + plugins, but database queries are answered from RAM instead of disk → faster than no cache, but still heavy.

With full-page cache + object cache

Anonymous visitors → static HTML (super fast, almost no load)
Logged-in users → PHP runs, but object cache makes DB queries instant → manageable load

Add CDN with full-page caching on top

Even the static HTML is now served from edge locations worldwide. Your origin server can basically take a nap until something actually needs PHP (e.g., form submissions, cache invalidation).

Conclusion

Here’s the hierarchy from most impactful to least (for most CMS sites):

Full-page caching on the CDN → fastest for visitors, scales to millions of hits with almost zero origin load.
Full-page caching on the origin → still massive win if you can’t cache on the CDN.
Object caching (Redis/Memcached) → mandatory for logged-in users, WooCommerce, dashboards, etc.
Everything else (OPcache, browser cache, etc.) → nice to have, usually enabled by default.

If you only do one thing: enable proper full-page caching (and push it to your CDN if possible). If you have logged-in traffic or a shop: add Redis/Memcached object caching.

That’s it — the three caching layers that power basically every high-traffic WordPress site on the planet.

Hope this cleared things up!

Thanks for reading! 😊

Pop!_OS 22.04 review after 6 months of use

Mon, 08 Dec 2025 22:28:25 +0000

Introduction

Pop!_OS is one of the most used Linux Distros. It’s also a recommendation for beginners, gamers and even experienced users.

But is it worthy it? In today’s post I will write about my experience using it, from the installation to the day-to-day usage.

Installation

Pop have one of the best installers there, I must admit. It’s simple, beautiful and feels modern. The installation is pretty simple, you can just click in a few buttons to setup language and a few other options. It’s also possible to encrypt the disk during the installation, which helps if you travel a lot and contain confidential information inside your laptop (like personal passwords, documents, photos, etc).

For the installation process, I will rate Pop 9/10. Why not 10? Well, it doesn’t contain a option to dual boot automatically. You need to do it manually if you are using Windows for example. Other than that, it works really well and does a great job to provide you a nice experience.

First boot

Pop first boot is also a great experience. You will be able to create your user and password and login normally at your new Gnome environment. Pop helps you to customize a few options (dark mode, docker location and online accounts). Those are all great options for beginners.

The default apps are also well integrated with the system and everything feels just in place.

Overall, I hate the post installation as 10/10, I don’t see anything to improve here, they just did great.

Details that makes Pop!_OS special

Probably this is the best part of Pop, that makes it a really really solid choice. These are some characteristics that are rare to find in other Distros:

System76 Scheduler - Did you konow that Pop contains CPU optimizations by default? Yep, that is right. By defualt, Pop will reduce the latency and improve performance on apps, specially when the laptop is charging. This is also great for gaming, since you don’t need gamemode anymore.
System76-Power - By default, Pop provides three options for your Battery: Economy, Balanced and high performance. That is amazing because under pop, battery optmimizations are already applied by default. You don’t need TLP and you have a easy GUI to control the battery mode. That is just awesome.
Swappiness is set to 10. On most linux distros that I’ve ever used, swappiness is set to 60. This means that your Distro will start to use swap when ram usage reaches 40%. On Pop, swap will only be used when you use abour 90% of your ram. That feels amazing and much smoother since swap is really slow, even on a NVME ssd.
Kernel isn’t the same of Ubuntu 22.04. Pop does a great job on keeping the kernel updated. This is great specially if you are using a newer desktop/laptop. As far as I know, Ubuntu 22.04 is serving Kernel 5.15.x. Pop os already on 6.1.x
Custom shortcuts. At first, I hated it, but after trying the “pop way”, I loved it and I actually change other distros to their defaults on shortcuts! For example, instead of alt + f4 (which usually requires 2 hands), Pop uses “windows + q” which is more accessible and easier to use. Instead of ctrl + alt + t for the terminal, you can use “windows + t” on Pop. This is really great and helps when you are working with a lot of multitasking (pretty much anyone who works with CS will love it).
Easy Firmware updates. Pop comes with a option inside gnome settings to make hardware updates. That is really great because it gives you more controls and details on these upgrades.
Recovery as a option. On pop, you can have a “copy of the ISO” in the settings and “refresh the OS” if you ever need it. It may be useful if you broke something and want to restore the system without using a USB stick.
SystemD boost instead of Grub. This doesn’t makes difference for me, but a lot of people seems to praise systemdboot. I think it provides a faster boot time and it’s “simpler to setup” (I’m used to grub, so grub is easier for me, but I barely customize anything on the boot)
Pipewire instead of Pulseaudio. For years one of the softwares that people used to complain a lot about was Pulseaudio. It used to lag, crash, do not recognize devices, etc. Pipewire is the new guy that is leaner and has a lower latency. A lot of people praise it too. For much, I prefer Pipewire too as it just feels simpler and better to use than Pulseaudio.
Flatpak theming right and not Snap. Snaps are being “forced” by Ubuntu distros, but a lot of people dislike them. Some dislike about the server not being open source, some complain about the bugs, space used some complain about auto updates (which can’t be turned off). For me, I also prefer Flatpaks, and it’s great to see that on Pop Flatpaks looks like native applications and flathub is Added by default. It’s also nice to see that Pop_Shop integrates well with Flatpaks.
Pop created popsicle. This probably doesn’t get enough attention, but man! It’s WONDERFUL to have a iso flasher by default. And this one is so beautiful and integrates well with Pop. I like it more than Balena Etcher and other common software used on linux to create bootable sticks.

Pop downsides

Although Pop is amazing, I see a few downsides on it as well. Most of them are personal, so you may not actually see them as downsides.

Gnome. I just don’t like gnome at all. Feels heavy and changes all the time with major updates, breaking plugins and the user experience. The good part is that Pop is developing their own rust DE, which will be HOT when it releases.
Pop_Shop uses 0.5GB of ram when idle. That may not be a issue for computers with more ram, but when you have less, that is kinda bad. If you have 4GB of ram for example (that is still common on third world countries) you will feel the difference. You can disable pop shop, but honestly the usage in idle should be lower.
tracker-miner-fs can suck your CPU if you download folders that contains a lot of subdfolders. Once I downloaded a WordPress site backup and extracted it. It had a lot of subfolders. I did notice my laptop slower, but I didn’t know what was happening. When I checked the task manage, tracker miner was acting and sucking all the CPU trying to index that subfolder. I tried to reset tracker miner, clean, see the status but it wasn’t replying. In the end, I disabled it as a pop developer said it was 100% safe.

Performance overall after 6 months

After 6 months using Pop, I can say that I was quite satisfied with the performance. I had a issue while for a few seconds mouse was slow and audio was freezing, but that is probably due to something I did (or maybe due to my hardware not being able to handle encryption well. I’m on a 12GB ram Ryzen 5 5500U laptop with NVME ssd of 256GB).

Due to the issues with tracker miner and this freezing issue, I decided to leave Pop and try Linux Mint XFCE for a while (I love XFCE and Mint is stable enough, so I decided to give it a try). I will probably review it after using it for a while as well.

Overall, using pop was a pleasure and I could do a bunch of great work on it. I work as CS/Devops, so most of the time I was chatting with customers or using bash scripts on the server, and for that Pop worked fine. For gaming it also worked well so I’m not complaining and I definitely would recommend it for most people. Pop has the best defaults that I’ve ever seen. It’s the distro that I tweaked less, because it comes with everything that I need and use.

Conclusion

Pop is awesome! If you like gnome, give it a try. It will give you a great performance and all optimizations that matters are there out of the box. Battery will be nice on laptops and drivers will probably be optimized for gaming. Vulkan is also enabled by default.

My dad is using Pop on his laptop (I installed it) and he loves it.

I will definitely try Pop again once they release their new DE. In the meanwhile, I will enjoy my XFCE experience.

Thank you for reading :)

Top 7 things you should do after installing Xubuntu 22.04

Mon, 08 Dec 2025 22:24:22 +0000

Introduction

I recently reviewed Pop!_OS 22.04 after using it for a long time. I loved it, but I wanted to try something else long-term and ended up choosing Ubuntu 22.04 — specifically the Xubuntu flavor with XFCE.

Whenever I install a fresh OS, there are a few things I always do to make sure the system feels snappy, performs well in games, and (on laptops) gets the best possible battery life.

Before starting any of the steps below, I strongly recommend doing a full system upgrade

Install the Liquorix Kernel

Liquorix is an enthusiast Linux kernel optimized for desktop responsiveness, low-latency audio/video work, and reduced frame-time jitter in games.

The stock Ubuntu kernel is a general-purpose kernel that has to work well on both desktops and servers. Liquorix takes the same Linux kernel source and applies desktop-focused patches and build options. The result feels noticeably snappier, especially under heavy load or when alt-tabbing quickly in games.

Installing it on Ubuntu/Debian is one command:

Bash

curl 'https://liquorix.net/install-liquorix.sh' | sudo bash

Reboot afterward and you’ll be running the new kernel.

Add the Latest Graphics Drivers

For Nvidia users:

Bash

sudo add-apt-repository ppa:graphics-drivers/ppa
sudo dpkg --add-architecture i386
sudo apt update
sudo apt install -y nvidia-driver-560 libvulkan1 libvulkan1:i386

For AMD or Intel users (Kisak’s PPA – latest Mesa):

Bash

sudo add-apt-repository ppa:kisak/kisak-mesa
sudo dpkg --add-architecture i386
sudo apt update && sudo apt upgrade
sudo apt install libgl1-mesa-dri:i386 mesa-vulkan-drivers mesa-vulkan-drivers:i386

Even on an older LTS release, this gives you the newest open-source drivers and Vulkan support.

Lower Swappiness

Pop!_OS sets vm.swappiness=10 by default (swap is only used when RAM is ~90% full). Ubuntu/Xubuntu defaults to 60, which is far too aggressive for desktop use.

Change it permanently:

Bash

sudo nano /etc/sysctl.conf

Add this line at the end:

text

vm.swappiness=10

Save and exit. The change applies immediately or on next reboot.

Install Essential Utilities

These are the tools I install on every fresh setup:

Redshift – blue-light filter
Flameshot – best screenshot tool
AppImageLauncher – integrates AppImages into your menu
Gamemode – massive FPS improvements in many games
TLP – essential for laptops (often doubles battery life)

Bash

sudo apt install redshift flameshot appimagelauncher gamemode tlp tlp-rdw

(Enable TLP if needed: sudo tlp start)

Install Your Favorite Everyday Apps

My personal picks:

Brave Browser (privacy-focused Chromium)
VLC (preferably via AppImage/Flatpak/Snap to avoid heavy Qt dependencies on XFCE)
LibreOffice

Create Handy Aliases

Open your .bashrc:

Bash

nano ~/.bashrc

Add some useful aliases at the bottom, for example:

Bash

alias apply_filter='redshift -O 1900'
alias update='sudo apt update && sudo apt upgrade -y'
alias please='sudo $(history -p !!)' # rerun last command with sudo

Reload the file:

Bash

source ~/.bashrc

Customize the Look & Feel (Optional)

Xubuntu + XFCE is extremely customizable. I run a very minimal setup and control almost everything with keyboard shortcuts. You can configure them in Settings → Window Manager and Settings → Keyboard → Application Shortcuts.

Conclusion

The three biggest performance wins — Liquorix kernel, latest graphics drivers, and low swappiness — make a dramatic difference. Real-world example: Life is Strange: True Colors jumped from ~23 FPS with stuttering on stock settings to a smooth 40+ FPS after applying these changes.

If you’re getting random lags or freezes on Xubuntu/Ubuntu, try these steps first. They solve a surprising number of issues.

Thanks for reading!

Zcash is losing

Mon, 08 Dec 2025 22:11:49 +0000

Zcash is NOT the most important project in the world, and it is losing.

Zcash was born as a project to fix Bitcoin’s major flaw: privacy. But launching a new coin isn’t easy, and it’s not just about technical aspects.

A serious cryptocurrency is supposed to be money, and it needs to be better than what we currently have with governments; otherwise, we should keep using the dollar. This means that while the technical aspects of any cryptocurrency are important, it should also be reliable, trustworthy, and as stable as possible. The main flaw in government money is inflation. Governments typically love to spend money and can charge a hidden tax by printing it. When money is printed, the amount of goods and services in society remains the same, but there is more money in circulation.

This means your money will now have reduced value. The winner in this case is the government or whoever spends the newly printed money first, because the market will adjust itself, leading to higher prices for services and goods.

The issue with Zcash

Zcash sounds good. It deploys zk-SNARKs technology to prove transactions and store them privately, meaning that when you send transactions, everything is hidden (so no one can see the sender, the amount sent, or the receiver). Sounds amazing, right? Let’s buy Zcash then!!

No. And why not?

1. Zcash was launched with a trusted setup

Yes, that’s right. When Zcash launched, it utilized a trusted setup to bootstrap the network. In this event, multiple participants collaboratively created cryptographic parameters without any single party having full control. This assumed that at least one participant destroyed their portion of the secret keys to guarantee privacy. If participants united their parameters, they could, in theory, create unlimited Zcash and trace shielded transactions.

Now, I have to be fair. Zcash is currently running on NU5 (Network Upgrade 5). This upgrade removed the trusted setup, ensuring that after May 2022, Zcash does not depend on trusting anyone else.

But at the same time, as far as I know, there is no way to prove that everyone destroyed their parameters and that no Zcash was generated or traced.

2. Zcash is not private by default.

Considering the latest updates (not using Sprout or Sapling), users can leave Zcash in a public address (t-address) or a shielded address (Orchard, ideally). So if some users want to use Zcash just like Bitcoin, they can.

Zcash aims to fix this by recommending privacy-friendly wallets. For example, Zashi wallet tries to shield your funds by default. The issue with this? Zcash is not widely used, so buying Zcash peer-to-peer or from a decentralized exchange like Bisq or Haveno Reto is very hard.

So you have to buy it from a non-privacy-friendly exchange like Binance or Coinbase. And of course, these exchanges do not support shielded addresses. You need to use your transparent address to receive your Zcash before shielding it.

Zcash somehow believes it can provide full privacy while complying with governments and anti-privacy laws. Zcash community and users are accustomed to buying their coins through non-private means. If the government decides that shielding your Zcash is illegal, you will not be able to buy and shield your coins because the government knows the t-address is related to you, and if you make a shielding transaction, you’ve just committed a crime.

They can even block “tainted” coins, so if a Zcash was ever shielded, it can be considered “tainted” and blocked on exchanges. During the Canada convoy protest, the government tried to seize Bitcoin, but since the wallet was non-custodial, they couldn’t. They quickly realized they could ask all exchanges to refuse those “dirty” Bitcoins.

Now you may be wondering how Monero is any different. Well, Monero is private by default, meaning users don’t have to worry about shielding and “unshielding” coins. And every shop that accepts Monero does so for privacy, unlike Zcash, where shoppers and exchanges can accept Zcash only on transparent addresses.

And yes, as you may have thought, some governments and exchanges have banned Monero, which was actually good for Monero. Why? Because it is now miles ahead of Zcash. Monero has an actual ecosystem. You can buy goods and services directly with Monero, you can buy Monero without any exchanges, and Monero knows how to survive in an environment without legal approval.

For example, you can buy gift cards at Coinsbee or Cake Pay directly with Monero, sell services and products for Monero directly at XMRBazaar, find different kinds of services accepting Monero at Monerica, use AI privately with Monero at Nano-GPT, or trade Monero privately with no KYC at RetoSwap.

And this is just the beginning. Monero usage has been increasing, and the goal is to be able to live entirely with Monero to achieve financial freedom.

So, private by default is definitely the superior choice. Cash is private by default, just like Monero.

3. Zcash is very centralized

Yep, that’s right. Perhaps you aren’t aware of this, but one mining pool of Zcash, ViaBTC, has nearly 70% of the mining power.

This means that if ViaBTC starts to act maliciously, they could, in theory, double-spend ZEC or censor transactions.

Zcash has a plan to fix that, but for now, it’s a promise and not something live. They want to create a PoS layer (proof-of-stake) to ensure users have more control over transaction validation.

I don’t have a specific opinion about this PoS layer yet, so I will refrain from talking about it.

The point remains valid, though: Zcash is very centralized. And not only due to the mining pool. We can clearly see that the community on Reddit is not very active; you don’t see people promoting and running Zcash nodes as you do in the Monero community. The community groups are typically made up of Zcash-related institutions.

Zcash has to put effort into marketing and convincing people to use it, while Monero has natural adoption, and users spread the word for free. There are several community-based sites, podcasts, and you can actually see people using it instead of just buying it and hoping for a massive price increase.

There are several guides on how to use a Monero wallet, how to run a node, how to spend it, etc. With Zcash, you typically have promises that “the technology is amazing and it will have more value than Bitcoin.”

4. Zcash has a developer tax

If you were proposing a global money to be used by everyone in the world, do you think it’s fair to allocate 20% of the mined money to pay for its development?

I don’t think so, and most people don’t think so. Zcash did exactly that. 20% of the mined coins go directly to Zcash institutions that are supposed to develop and market Zcash.

With this proposal, developers and the governance of the coin do not need to gain the trust of users. They are compensated by default and will obviously sell the Zcash for fiat since that is basically their salary, and they have bills to pay.

With that in mind, potential investors and users will always fear a massive dump in the cryptocurrency when prices spike.

5. Zcash UX still sucks

Zcash is still somewhat complex for the average user. To fix that, the recommended way to use Zcash nowadays is with Zashi, which tries to shield transactions by default.

Zashi has some serious issues, though. The first issue is the language. Only English is supported. I mean, is that serious? The most recommended wallet only supports English? Is Zcash only meant to be used in America/UK? It’s a shame that a project with a development tax can’t make a multi-language wallet. Cake Wallet, Stack Wallet, and Monerujo didn’t have any development tax, but they support several languages. What is your excuse, Zashi?

The second issue is that Zashi doesn’t seem to be stable, especially with larger amounts of Zcash. Recently, a user reported that he cannot spend his Zcash. That happens because Zashi only allows you to spend shielded Zcash, and the wallet is unable to shield his Zcash.

I know this isn’t specifically a skill issue because not long ago, when I was testing Zcash, I had a similar issue. I received Zcash on Zashi but was unable to shield it. I don’t remember exactly what I did to solve the issue (I was trying Ywallet and Nighthawk), but it definitely wasn’t a good first impression of Zcash. I remember testing receiving Zcash on an older phone vs. a newer phone (both using Zashi), and my newer phone was able to receive and shield the coins easily, but the older phone struggled.

I’m not sure if this was a coincidence, but it seemed that Zashi is heavy on your phone. I never had this issue with Monero before.

Sure, syncing Monero takes a while, but it works in the background seamlessly with Monerujo by just waiting. It runs even faster if you have a local Monero node running at your home, which I suspect 99% of Zcash users don’t have.

Right now, Zashi also needs to be synced to be properly used, and it takes a lot of time and requires you to leave your screen turned on.

Both coins need to be easier to use, but Monero is still better than Zcash for UI. Users don’t need to worry about Sapling or Orchard pools or have issues “shielding” their coins.

6. Price action

Due to the trusted setup launch and the development tax, Zcash is likely destined to be a pump coin. With no real-world adoption, its price can be manipulated to rise, but such gains are unlikely to last.

Cryptocurrency enthusiasts are currently focused on Zcash due to a massive price pump, but I doubt this will sustain. If you zoom out the price graph for Zcash, it still looks ridiculous. In contrast, zooming out for Monero reveals steady and slow growth over time.

Conclusion

Zcash sucks. After studying it better, calling it Ztrash is the right thing to do. Doing otherwise is not honest.

Credits

https://lukesmith.xyz/articles/monero-and-other-privacy-coins/