Guides on Aquasp's blog

How to Setup Flutter for Development in Ubuntu 24.04

Tue, 14 Apr 2026 01:15:39 +0000

The fastest and easiest way with the latest Flutter version.

Step 1: Install Flutter using Snap

sudo snap install flutter --classic

Step 2: Install OpenJDK

sudo apt install openjdk-17-jdk -y

Step 3: Download Android CLI Tools

Go here and grab the latest for Linux.

Create folder:

mkdir ~/Android/Sdk

Make sure you are using this exact structure:

~/Android/Sdk/cmdline-tools/latest/bin/ ← sdkmanager

Step 4: Add to ~/.bashrc

export ANDROID_SDK_ROOT=$HOME/Android/Sdkexport ANDROID_HOME=$ANDROID_SDK_ROOTexport
PATH=$PATH:$ANDROID_SDK_ROOT/cmdline-tools/latest/binexport PATH=$PATH:$ANDROID_SDK_ROOT/platform-tools # Nextexport JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64export PATH=$PATH:$JAVA_HOME/binexport CHROME_EXECUTABLE=/usr/bin/brave-browser

Step 5: Install sdkmanager

sdkmanager "platform-tools" "platforms;android-36" "build-tools;36.0.0"
sdkmanager --update

Step 6: Flutter Setup

flutter config --android-sdk ~/Android/Sdkflutter doctor --android-licenses # Accept all

Step 7: Check

flutter doctor -v

You now have a clean Flutter setup without Android Studio.

Thanks – build on! 🚀

Ditch the Official App: Use Your Mi Band Privately with Open-Source Alternatives

Tue, 23 Dec 2025 20:23:05 +0000

If you love wearing a wearable device like a Mi Band but want to protect your privacy (like me), there’s a great way to do it!

Check Device Compatibility First

The first step is to verify if your device is supported. Xiaomi and Huawei devices generally have the best compatibility. I recommend checking two popular alternatives:

GadgetBridge: Fully open-source and highly privacy-focused. It works reliably, though the UI isn’t the most modern or beautiful.
Notify for Mi Band: Offers a much nicer, more polished UI (in my opinion), but it’s not open-source and the Pro version (ad-free) costs about $3.

Privacy-wise, both options are far superior to the official Xiaomi app—no constant data sharing with servers.

It’s almost ironic that Chinese-brand devices end up providing better privacy options than many Western brands when paired with these alternatives. This is likely just a side effect of their popularity and competitive pricing.

Extract the Authentication Token

Unfortunately, you’ll need the official app temporarily. Download the Xiaomi Mi Fitness app, pair your band, create a Xiaomi account, and update the firmware to the latest version*.

Once that’s done, you need to extract the authentication (auth) token from Xiaomi. The easiest method right now is using the Notify for Mi Band app.

Download Notify for Mi Band from the Google Play Store (there are two versions, ensure that you are downloading the correct one for your device)
Start the setup process in the app.
You’ll see two options for getting the token: Offline and Online.

The offline method requires exporting logs from the official Mi Fitness app and extracting the token from them. I tried this several times, but it never worked for me—I couldn’t even find the relevant logs manually.

So, I strongly recommend the online method:

Log in with your Xiaomi account email and password.
Xiaomi will send a verification code to your email.
Enter the code, and the app will automatically retrieve the token for you.

Final Steps: Switch Over and Uninstall the Official App

After getting the token:

Enter it in Notify for Mi Band (or GadgetBridge, if you’re using that).
Grant all necessary permissions.
Uninstall the official Mi Fitness app immediately.

The band can only connect and sync with one app at a time. Keeping the official app installed will cause connection issues or prevent proper syncing with your chosen alternative.

Now you’re all set! Customize notifications, enable/disable features as you like, find your phone or band, install free watchfaces, and track steps, calories, and heart rate—all in a clean, beautiful UI with no privacy compromises.

One minor issue I’ve noticed: sleep tracking is not syncing properly. I’m not sure if this is specific to the Mi Band 10, a firmware quirk, or a setting I changed. The data still shows correctly on the band itself, so it’s just a sync problem. Personally, I don’t mind—I mainly use my Mi Band for a convenient clock, flashlight,quick heart rate checks during workouts and changing music on a bluetooth speaker.

At least for the Mi Band 10, the latest firmware (as of Dec 2025) hasn’t broken compatibility with Notify for Mi Band.

How to enable hardware-Accelerated Video Decoding in Brave on Linux: Smoother Playback and Better Battery

Sun, 14 Dec 2025 01:35:15 +0000

Hardware-accelerated video decoding offloads playback from CPU to GPU, improving performance, reducing heat, and extending battery life—especially for high-resolution videos. On Linux, this works in Chromium-based browsers like Brave, but often requires flags. No more relying on h264ify extensions or downloading videos for MPV!

Benefits

Smoother high-res (1080p+) playback
Lower CPU usage
Better battery life on laptops

Prerequisites (Ubuntu-Based Distros, e.g., Mint)

For Intel GPUs (common on laptops):

sudo apt update
sudo apt install intel-media-va-driver-non-free vainfo

Verify with vainfo (should list supported profiles like VP9/H.264).

AMD/NVIDIA: Ensure Mesa/proprietary drivers are installed.

Enabling Flags Support on Ubuntu-Based Distros

Brave’s Debian package doesn’t read brave-flags.conf by default (unlike Arch’s AUR package). Create a wrapper:

Fix permissions:

sudo chown --reference=/usr/bin/brave-browser-stable.original /usr/bin/brave-browser-stable
sudo chmod --reference=/usr/bin/brave-browser-stable.original /usr/bin/brave-browser-stable

Create new launcher:Bash

sudo nano /usr/bin/brave-browser-stable

Paste:

#!/bin/sh
: $$ {XDG_CONFIG_HOME=" $${HOME}/.config"}
unset -v flags_conf
flags_conf="${XDG_CONFIG_HOME}/brave-flags.conf"
if [ -f "${flags_conf}" ]
then
 unset -v flags
 flags="$$ (sed 's/#.*//' < " $${flags_conf}" | tr '\n' ' ')"
 set -- $$ {flags} " $$@"
fi
exec /usr/bin/brave-browser-stable.original "$@"

Divert the original launcher:

sudo dpkg-divert --add --rename --divert /usr/bin/brave-browser-stable.original /usr/bin/brave-browser-stable

Now create/edit ~/.config/brave-flags.conf for flags.

Recommended Flags

Add to ~/.config/brave-flags.conf (one line, restart Brave):

Wayland (often default/best):

--enable-features=AcceleratedVideoDecodeLinuxGL,AcceleratedVideoDecodeLinuxZeroCopyGL,AcceleratedVideoEncoder

Xorg/X11 (or fallback):

--enable-features=VaapiVideoDecoder,VaapiIgnoreDriverChecks,Vulkan,DefaultANGLEVulkan,VulkanFromANGLE

Verification

Play a video (e.g., YouTube 1080p+).
Ctrl + Shift + I → Three dots → More tools → Media.
Check Decoder name: VaapiVideoDecoder = GPU accelerated (avoid FFmpegVideoDecoder).

Credits

This amazing commentary on github: https://github.com/brave/brave-browser/issues/2300#issuecomment-2718755680

As always, the Arch Wiki is an invaluable resource for all things Linux. If hardware video acceleration still doesn’t work, check the wiki directly for the latest flags and troubleshooting tips. https://wiki.archlinux.org/title/Chromium#Hardware_video_acceleration

7 things that you should do after installing WordPress

Tue, 09 Dec 2025 01:45:24 +0000

Introduction

Starting a fresh WordPress site in 2026? Whether it’s a blog, eCommerce store, or portfolio, these tweaks will supercharge speed, lock down security, and ensure buttery-smooth performance from day one.

No paid tools required — just free plugins and quick configs. Let’s dive in!

1. Auto-Resize & Compress Images on Upload

Images are the #1 bandwidth killer. Don’t upload a 10MB photo and hope for the best — automate compression to keep your site lean.

Recommended Plugin: Resize Image After Upload (Free, 90K+ active installs, 4.8/5 rating)

Install & activate it first thing.
Set max width/height (e.g., 1920px wide) and compression level (default 82% JPEG quality is solid).
It auto-resizes JPEG/PNG/GIF on upload, slashes file sizes by 50–80%, and boosts SEO with faster load times.

Pro tip: For bulk-optimizing existing images, pair it with Smush (free tier handles 50 images/month).

Result: Pages load 2–3x faster, less server strain, happier Google rankings.

2. Strip Out Unnecessary Bloat

WordPress ships with “extras” you might not need — like Gutenberg blocks, XML-RPC, or emoji scripts. Trim the fat for a lighter core.

Recommended Plugin: Unbloater (Free, 10K+ active installs, 5/5 rating)

Simple dashboard under Settings > Unbloater.
Recommended toggles:
- Backend: Disable auto-updates (if you handle them manually), limit post revisions to 3, hide update nags for non-admins, disable XML-RPC.
- Frontend: Remove RSD/WLW manifests, shortlinks, feed links, jQuery Migrate, emoji scripts.
- Block Editor: Fully disable Gutenberg (if using Classic Editor) or remove unused blocks.
- Extras: Block DNS prefetch to WordPress.org, remove generator meta tag.

Everything is reversible — toggle off if issues arise. This cuts database queries and JS/CSS bloat by 20–30%.

3. Tame the Heartbeat API

WordPress’ Heartbeat API pings your server every 15–60 seconds for autosave, user presence, etc. Great for collaboration, but it spikes CPU on shared hosting.

Recommended Plugin: Heartbeat Control (Free, 90K+ active installs, 4.1/5 rating)

Go to Settings > Heartbeat Control.
Set intervals: 60 seconds (frontend), 120 seconds (dashboard/editor).
Or disable entirely on frontend if you don’t need live previews.

Unbloater can handle this too. Expect 10–20% CPU savings on idle sessions.

4. Limit Post Revisions

By default, WordPress saves 25 revisions per post — bloating your database over time (e.g., a 1,000-post site = 25K+ entries).

Add to wp-config.php (before “That’s all, stop editing!”):

// Limit to 3 revisions (or false to disable)
define('WP_POST_REVISIONS', 3);

Unbloater has a toggle for this. Clean up old ones with WP-Optimize (free).

Result: Smaller DB = faster queries and backups.

5. Disable XML-RPC (Unless Needed)

XML-RPC enables remote posting/apps but is a brute-force magnet (most bots target it).

If using Jetpack/mobile apps: Keep it, but whitelist your IP.
Otherwise: Block via .htaccess (Apache/LiteSpeed):

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
# Allow from YOUR.IP.ADDRESS (uncomment if needed)
</Files>

Unbloater or Loginizer (free, 1M+ installs) can disable it too.

6. Lock Down Logins with Rate Limiting

Bots hammer /wp-login.php 24/7. Limit attempts to stop brute-force attacks cold.

Top Pick: Limit Login Attempts Reloaded (Free, 2M+ installs, 4.9/5 rating)

Defaults: 3 failed attempts → 15-min lockout (escalates to 24h).
Covers wp-admin, XML-RPC, WooCommerce, custom logins.
Logs + notifications included.

Alternative: BruteGuard (Free, cloud-based botnet blocking via shared network).

Loginizer (1M+ installs) adds 2FA + reCAPTCHA for extra layers.

Test: Try wrong logins — you’ll see instant blocks.

7. Vet Plugins Before Installing

Not all plugins are equal — some bloat your site with 1MB+ RAM usage or JS errors. Always check:

WP Hive: Chrome extension + site for automated tests (memory, page speed impact, PHP/WordPress compatibility, DB footprint). E.g., Yoast SEO 20.1: +0.1s load time, 1MB RAM (heavier than average).
PluginTests.com: Basic compatibility/smoke tests for 98% of WP.org plugins (activation errors, obvious breaks).

Quick Example (2025 Benchmarks):

Yoast SEO: Solid but resource-heavy (+0.1s load, 1MB RAM). Great for readability.
Rank Math SEO: Lighter (no load impact, <250KB RAM), more free features. Often 4x faster in tests.

Aim for lightweight picks — only add “heavy” ones if essential.

Wrap-Up

Implement these today, and your site will launch 2–3x faster, more secure, and future-proof. Total time: ~30 minutes. No excuses!

Thanks for reading! 🚀

How to avoid timeouts while you are logged on SSH

Tue, 09 Dec 2025 01:41:02 +0000

Introduction

One of the most frustrating things when working on a server?

Your SSH session dies because of a brief Wi-Fi hiccup, idle timeout, or flaky connection.

Fix it forever in 30 seconds.

The Universal Fix: Edit Your SSH Config

This works on Linux, macOS, and Windows — and survives network glitches up to ~4–5 minutes.

Step 1: Create or Edit the SSH Config File

On Linux / macOS:

mkdir -p ~/.ssh
nano ~/.ssh/config

On Windows (PowerShell):

# Replace YourUsername with your actual Windows username
mkdir "$HOME\.ssh" -Force
notepad "$HOME\.ssh\config"

Step 2: Add These Lines

sshHost *
 ServerAliveInterval 120
 ServerAliveCountMax 3
 TCPKeepAlive yes

Save and exit.

Done. That’s it.

What This Actually Does

Setting	Meaning
`Host *`	Apply these rules to every SSH connection
`ServerAliveInterval 120`	Every 2 minutes, your computer sends a tiny “I’m still here” packet
`ServerAliveCountMax 3`	If 3 packets in a row fail → only then close the connection (~6 min)
`TCPKeepAlive yes`	Extra OS-level keepalive (helps with some routers/firewalls)

Result: Your SSH session now survives:

Wi-Fi switching
Laptop sleep/wake
Brief internet drops
VPN reconnects

…without freezing or dying.

You’re Now Unbreakable

From now on, when your internet blinks, your SSH session just… waits patiently.

No more “Connection reset by peer” No more lost tmux sessions No more rage

You’ve officially leveled up.

Thank you for reading — stay connected!

How to check disk usage per file or directory on linux

Tue, 09 Dec 2025 01:34:27 +0000

Introduction

Whether you’re debugging a full VPS, cleaning up a home server, or just curious — here are the fastest and most useful commands to understand what’s eating your disk space.

1. Find the Biggest Files & Folders in the Current Directory

du -shc * | sort -rh | head -15

du -shc * → shows size of everything in the current folder (human-readable, with total)
sort -rh → sorts from biggest to smallest
head -15 → shows only the top 15 culprits (change number as needed)

Perfect for quickly spotting that one huge log file or backup folder.

Pro tip: Run it in /var, /home, or / to hunt down space hogs.

2. Check Overall Disk Usage (All Partitions)

df -h

Shows:

Total/used/available space
Percentage used
Mount point

Look for the line with / (root) or your main drive. Example: 64G used / 226G total → 28% full

Add –exclude-type=tmpfs to hide temporary filesystems:

df -h --exclude-type=tmpfs --exclude-type=devtmpfs

3. Check Inode Usage (When “Disk Full” But df Shows Space Left)

Sometimes your disk is full of millions of tiny files (logs, cache, sessions, etc.). Each file uses one inode.

Check inodes per folder in current directory:

du --inodes --max-depth=1 . | sort -nr

Or system-wide:

df -i

If “IUsed” is near 100%, you’re out of inodes — time to clean up small files!

Bonus One-Liners

# Top 10 biggest directories in /home
du -h /home | sort -rh | head -10

# Find files bigger than 1GB
find / -type f -size +1G 2>/dev/null

# Show only real disks (clean output)
df -h -x squashfs -x tmpfs -x devtmpfs

That’s it!

You now have the ultimate toolkit to never be surprised by a full disk again.

Thank you for reading!

How to easily export and import docker volumes

Tue, 09 Dec 2025 01:22:26 +0000

If you’re like me, you prefer to run everything in Docker containers. They’re fast, isolated, and perfect for running multiple apps on one VPS.

But what happens when you want to:

Move a container to a new server?
Backup a database volume (NextCloud, PhotoPrism, Vaultwarden, etc.)?
Restore data after a crash?

Docker doesn’t include a built-in “export volume” button — but there’s a super simple and reliable trick using a temporary Ubuntu container.

Let’s go!

Step 1: List Your Volumes

docker volume ls

Example output:

DRIVER VOLUME NAME
local nextcloud_data
local photoprism_storage
local vaultwarden_data

Pick the one you want to export (e.g., nextcloud_data).

Step 2: Export a Volume → backup.tar.gz

Run this one-line command (replace nextcloud_data with your volume name):

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -czf /backup/nextcloud-data-backup.tar.gz -C /data ./

What this does:

Mounts your volume to /data inside a temporary container
Mounts your current folder to /backup
Creates a compressed archive of the entire volume

After it finishes, you’ll have a file like: nextcloud-data-backup.tar.gz ← ready to download or move!

Pro tip: Add the date for clarity

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -czf "/backup/nextcloud-data-$(date +%Y-%m-%d).tar.gz" -C /data ./

Step 3: Import on the New Server

Copy your backup.tar.gz file to the new server (via scp, rsync, etc.)

Then, create the empty volume (important!):

docker volume create nextcloud_data

Run the import command (from the folder containing the backup file):

docker run --rm -v nextcloud_data:/data -v "$(pwd)":/backup ubuntu \
 tar -xzf /backup/nextcloud-data-2025-04-05.tar.gz -C /data

Done! Your volume is now fully restored.

Never let Docker auto-create the volume during import — it can cause permission issues or merge problems.

Bonus: Using External Volumes with Docker Compose

If you’re using docker-compose.yml, tell Docker that the volume is external (already exists):

services:
 nextcloud:
 image: nextcloud:latest
 volumes:
 - nextcloud_data:/var/www/html

volumes:
 nextcloud_data:
 external: true

Indentation matters — use exactly two spaces.

Real-World Use Cases

Migrating NextCloud to a new VPS
Backing up Vaultwarden before upgrading
Moving PhotoPrism library to a bigger server
Disaster recovery

This method is 100% reliable, works with any volume, and requires zero extra tools.

You now have a bulletproof Docker volume backup strategy.

Happy containerizing! 🐳

Thank you for reading!

How to easily self-host at home and put your projects online under CGNAT

Tue, 09 Dec 2025 01:13:41 +0000

Introduction

Want to run heavy services on a powerful server at home, even though your ISP puts you behind CGNAT? This guide shows you exactly how to put them online — the old-school, bulletproof way using SSH reverse tunnels.

No Cloudflare Tunnel. No Ngrok. Just SSH + systemd.

The Downsides (and Why They’re Manageable)

Home internet isn’t datacenter-grade (outages happen)
Most ISPs use CGNAT → you can’t open ports normally

Solution: Use a cheap VPS as a public “jump box”. Your heavy server stays home. The VPS only forwards ports.

How It Works – The Magic of Reverse SSH Tunnels (-R)

Internet → Cheap VPS (public IP) → SSH reverse tunnel → Your home server (behind CGNAT)

Your home server initiates an outbound SSH connection to the VPS and says: “Anything that hits port 8096 on you → send it to my local Jellyfin on 8096”

Zero ports opened on your home router. Zero exposure.

Step-by-Step Setup

1. On Your Home Server (the powerful one)

# Create folder for tunnel configs
sudo mkdir -p /etc/sshtunnels

# Example: expose Jellyfin (port 8096)
sudo nano /etc/sshtunnels/jellyfin.conf

Content of the file:

8096:8096 # remote_port:local_port
443:8443 # optional: HTTPS reverse proxy on VPS → your local 8443
80:8080

One line per service. First number = port on the VPS, second = port on your home server.

2. Generate an SSH Key (if you don’t have one)

ssh-keygen -t ed25519 -C "home-server-tunnel"

Copy the public key to your VPS:

ssh-copy-id user@your-vps-ip

3. Create the Tunnel Manager Script

sudo nano /usr/local/bin/sshtunnel.sh

#!/bin/bash

# === EDIT THESE ===
REMOTE_USER="root" # or your VPS user
REMOTE_HOST="123.45.67.89" # your VPS public IP
SSH_KEY="/home/youruser/.ssh/id_ed25519"
SSH_PORT="22" # change if you use a non-standard port
# ==================

INSTANCE="$1"
CONFIG_FILE="/etc/sshtunnels/${INSTANCE}.conf"

if [[ ! -f "$CONFIG_FILE" ]]; then
 echo "Error: Config file $CONFIG_FILE not found!"
 exit 1
fi

# Build -R arguments
FORWARD_OPTS=""
while IFS=: read -r remote_port local_port; do
 [[ -z "$remote_port" || "$remote_port" =~ ^# ]] && continue
 # Clean any old process using the remote port
 ssh -p "$SSH_PORT" "$REMOTE_USER@$REMOTE_HOST" \
 "lsof -i :$remote_port -t | xargs -r kill -9" 2>/dev/null
 FORWARD_OPTS="$FORWARD_OPTS -R $remote_port:localhost:$local_port"
done < "$CONFIG_FILE"

echo "Starting tunnel $INSTANCE → $REMOTE_HOST ($FORWARD_OPTS)"

exec ssh -o StrictHostKeyChecking=no \
 -o ServerAliveInterval=30 \
 -o ServerAliveCountThreshold=3 \
 -o ExitOnForwardFailure=yes \
 -o GatewayPorts=yes \
 -N -T \
 -i "$SSH_KEY" \
 -p "$SSH_PORT" \
 $FORWARD_OPTS \
 "$REMOTE_USER@$REMOTE_HOST"

Make it executable:

sudo chmod +x /usr/local/bin/sshtunnel.sh

4. Create a Systemd Service (Auto-Start & Auto-Reconnect)

sudo nano /etc/systemd/system/sshtunnel@.service

[Unit]
Description=SSH Reverse Tunnel for %i
After=network-online.target
Wants=network-online.target

[Service]
User=youruser # ← change to your home user (not root!)
Group=youruser
ExecStart=/usr/local/bin/sshtunnel.sh %i
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

Reload and enable:

sudo systemctl daemon-reload

# Start a tunnel (example: jellyfin)
sudo systemctl enable --now sshtunnel@jellyfin.service

Check status:

sudo systemctl status sshtunnel@jellyfin.service

5. On the VPS Side (Optional but Recommended)

Install a tiny web server or Caddy/nginx to terminate TLS and proxy to the forwarded ports.

Example with Caddy (automatic HTTPS):

# On the VPS
apt install caddy

# /etc/caddy/Caddyfile
jellyfin.yourdomain.com {
 reverse_proxy localhost:8096
}

Now jellyfin.yourdomain.com → your home Jellyfin, fully encrypted.

All running on my beast home server behind CGNAT.

Pros of This Setup

Works behind any CGNAT / ISP block
No third-party dependency (no Cloudflare, no Ngrok)
Full encryption possible
Survives reboots (systemd + Restart=always)
Costs almost nothing

Final Words

This is the one really cool way I’ve found to self-host heavy services at home in 2025.

Your powerful hardware stays home. Your $1/month VPS is just a traffic cop.

Thank you for reading — now go build your unstoppable home lab!

How to Automatically Backup Your Self-Hosted Ghost Blog

Tue, 09 Dec 2025 01:05:55 +0000

Introduction

Ghost is an incredibly fast and elegant blogging platform. But unlike WordPress, it doesn’t have built-in one-click backup plugins.

That changes today.

In this guide, you’ll set up a fully automated daily backup system that:

Dumps your MySQL database
Backs up all themes, images, and content
Compresses everything into a single .zip
Uploads it securely to your cloud storage (pCloud, NextCloud, Google Drive, Dropbox, etc.)

All using free tools: rclone + a simple bash script + cron.

Let’s get started.

Step 1: Install Rclone

sudo apt update && sudo apt install -y rclone

Rclone is the Swiss Army knife of cloud storage — it supports over 70 providers.

Full list: https://rclone.org/overview/

Step 2: Configure Rclone (Connect Your Cloud Storage)

Run:

rclone config

Follow the prompts:

n → new remote
Name it something like ghost-backup or pcloud
Choose your provider (e.g., webdav for NextCloud, pcloud, google drive, etc.)
Enter your credentials/URL when asked

Test it works:

rclone ls ghost-backup:

You should see your remote files (or an empty folder if new).

Type q to quit.

Step 3: Get Your Ghost Database Credentials

su - yourghostuser
cd /var/www/ghost # or wherever you installed Ghost
cat config.production.json

Look for the database section. You’ll see something like:

"database": {
 "client": "mysql",
 "connection": {
 "host": "localhost",
 "user": "ghost_db_user",
 "password": "yoursecretpassword",
 "database": "ghost_prod"
 }
}

Write down:

Database name (ghost_prod)
Username (ghost_db_user)
Password

Step 4: Create the Backup Script

Create the script as root:

nano /root/backup-ghost.sh

Paste this (then edit the variables below):

#!/bin/bash

# === EDIT THESE VALUES ===
GHOST_USER="yourghostuser" # e.g. ghost
GHOST_PATH="/var/www/ghost" # path to your Ghost install
DB_NAME="ghost_prod" # from config.production.json
DB_USER="ghost_db_user" # from config.production.json
DB_PASS="yoursecretpassword" # from config.production.json
BACKUP_NAME="theselfhostingart-blog" # name for your backup zip
RCLONE_REMOTE="ghost-backup" # name you gave in rclone config
RCLONE_PATH="/" # folder in your cloud (use / for root)
# =========================

DATE=$(date +'%Y-%m-%d_%H-%M')
BACKUP_DIR="/home/$GHOST_USER/backups/$DATE"
ZIP_FILE="$BACKUP_DIR/$BACKUP_NAME-$DATE.zip"

echo "Starting Ghost backup: $DATE"

# Create backup directory
mkdir -p "$BACKUP_DIR"

# Backup database
echo "Backing up database..."
mysqldump -u "$DB_USER" -p"$DB_PASS" --add-drop-table "$DB_NAME" | gzip > "$BACKUP_DIR/db.sql.gz"

# Backup content folder (themes, images, etc.)
echo "Backing up content folder..."
rsync -av --exclude='logs' --exclude='cache' "$GHOST_PATH/content/" "$BACKUP_DIR/content/"

# Compress everything
echo "Compressing backup..."
zip -r "$ZIP_FILE" "$BACKUP_DIR/content" "$BACKUP_DIR/db.sql.gz" > /dev/null

# Upload to cloud
echo "Uploading to cloud storage..."
rclone copy "$ZIP_FILE" "$RCLONE_REMOTE:$RCLONE_PATH"

# Cleanup: remove local backups older than 1 day (optional but recommended)
echo "Cleaning up old local backups..."
find /home/$GHOST_USER/backups -type d -mtime +1 -exec rm -rf {} +

echo "Backup complete: $ZIP_FILE → $RCLONE_REMOTE:$RCLONE_PATH"

Make it executable:

chmod +x /root/backup-ghost.sh

Test it manually first:

/root/backup-ghost.sh

Check your cloud storage — you should see a file like: theselfhostingart-blog-2025-04-05_03-22.zip

Step 5: Automate with Cron (Daily Backups)

crontab -e

Add this line for daily backup at 2:00 AM:

cron0 2 * * * /usr/bin/bash /root/backup-ghost.sh >> /var/log/ghost-backup.log 2>&1

Save and exit.

Your Ghost blog is now automatically backed up every day.

What’s Included in the Backup?

Full database (posts, users, settings)
All uploaded images
Custom themes
Everything needed to restore or migrate

You can even send this .zip to Ghost(Pro) support — they can import it directly.

Bonus: Restore in Case of Disaster

To restore:

Install fresh Ghost
Unzip backup
Import DB: gunzip < db.sql.gz | mysql -u user -p dbname
Replace content/ folder
Run ghost restart

Credits & Thanks

This method is inspired and improved from this excellent post: How to Automatically Backup Ghost Blogs – Kenton Vizdos

Thank you, Kenton!

Your self-hosted blog now sleeps better at night. 😴💾

Thank you for reading!

How to install NextCloud with OpenLiteSpeed (LOMP stack)

Tue, 09 Dec 2025 00:59:45 +0000

Introduction

Today I’ll show you how to build what I genuinely believe is the fastest NextCloud stack available in 2025:

OpenLiteSpeed – the fastest web server with built-in cache
LSPHP 8.1/8.2 – LiteSpeed’s ultra-fast PHP implementation
Redis + APCu – for blazing-fast caching and locking
Runs completely non-root, under its own user
Hardened with proper security headers, HSTS, and isolated data folder

Even if NextCloud gets compromised, the attacker still can’t touch the rest of your server.

Let’s go!

Step 1: Secure Your VPS First

Before anything, harden your server. Follow my full guide here: How to Make Your VPS Secure

Step 2: Install OpenLiteSpeed, LSPHP, Redis & Tools

Run as root:

# Update system
apt update && apt upgrade -y

# Add OpenLiteSpeed repository
wget -O - https://repo.litespeed.sh | bash

# Install essentials
apt install -y curl gnupg2 imagemagick ffmpeg redis openlitespeed lsphp81* lsphp82* zip unzip mariadb-server mariadb-client

Note: On Ubuntu 22.04+, the ImageMagick package might be libmagickwand-dev + imagemagick. The above works on most recent Debian/Ubuntu.

Enable and restart Redis:

systemctl enable --now redis-server

Step 3: Create a Dedicated System User for NextCloud

adduser --shell /bin/bash files
usermod -aG redis files # Allow access to Redis socket

Step 4: Download & Extract NextCloud as the “files” User

su - files
mkdir -p ~/public_html
cd ~/public_html

wget https://download.nextcloud.com/server/releases/latest.zip
unzip latest.zip
rsync -av nextcloud/ ./
rm -rf nextcloud latest.zip .htaccess .user.ini
exit

Step 5: Configure OpenLiteSpeed Web Admin (Port 7080)

Set an admin password:

/usr/local/lsws/admin/misc/admpass.sh

Now visit: https://your-vps-ip:7080 and log in.

Virtual Host Setup

Delete the default “Example” virtual host
Add new Virtual Host:

Virtual Host Name: yourdomain.com
Virtual Host Root: /home/files/
Config File: $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
Document Root: $VH_ROOT/public_html

Script Handler → Add:

Suffix: php
Handler Type: LiteSpeed LVE
Handler: lsphp81 (or lsphp82 if you prefer PHP 8.2)

Rewrite Rules (force HTTPS):

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]

Security Headers (Context → Static → Add new context /):

Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Content-Security-Policy "upgrade-insecure-requests"

External App → LSPHP → Edit:

Run as User/Group: files
PHP_LSAPI_CHILDREN = 100
LSAPI_AVOID_FORK = 0

Listeners:

Delete default listeners
Add HTTP → port 80
Add HTTPS → port 443 (Secure = Yes)
Map your domain to both listeners

Graceful restart → OpenLiteSpeed → Graceful Restart

Step 6: Issue Let’s Encrypt SSL

apt install -y certbot
certbot certonly --webroot -w /home/files/public_html -d yourdomain.com

Note the paths (you’ll need them):

Fullchain: /etc/letsencrypt/live/yourdomain.com/fullchain.pem
Privkey: /etc/letsencrypt/live/yourdomain.com/privkey.pem

Add them in:

Virtual Host → SSL tab
Listener HTTPS → SSL tab
Chained Certificate = Yes

Graceful restart again.

Step 7: Auto-Renew SSL

crontab -e

Add:

cron0 3 * * * /usr/bin/certbot renew --quiet

Step 8: Install & Secure MariaDB/MySQL

mysql_secure_installation

Then create database & user:

mysql -u root -p
CREATE DATABASE nextcloud CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
CREATE USER 'ncuser'@'localhost' IDENTIFIED BY 'strong-password-here';
GRANT ALL PRIVILEGES ON nextcloud.* TO 'ncuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 9: Optimize PHP & Enable OPCache + APCu

# Edit the correct php.ini (adjust path if using lsphp82)
sed -i '/usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini' \
 -e 's/memory_limit = .*/memory_limit = 1024M/' \
 -e 's/upload_max_filesize = .*/upload_max_filesize = 10G/' \
 -e 's/post_max_size = .*/post_max_size = 10G/' \
 -e 's/max_execution_time = .*/max_execution_time = 3600/' \
 -e 's/opcache.enable=.*/opcache.enable=1/' \
 -e 's/;opcache.memory_consumption=.*/opcache.memory_consumption=512/' \
 -e 's/;opcache.interned_strings_buffer=.*/opcache.interned_strings_buffer=64/' \
 -e 's/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=20000/'

# Enable APCu CLI
echo "apc.enable_cli = 1" >> /usr/local/lsws/lsphp81/etc/php/8.1/litespeed/php.ini

pkill -f lsphp
systemctl restart lsws

Step 10: Configure Redis as Unix Socket

sed -i 's/port 6379/port 0/' /etc/redis/redis.conf
sed -i 's|# unixsocket /var/run/redis/redis-server.sock|unixsocket /var/run/redis/redis-server.sock|' /etc/redis/redis.conf
sed -i 's/# unixsocketperm 700/unixsocketperm 770/' /etc/redis/redis.conf
sed -i 's/# maxmemory .*/maxmemory 1gb/' /etc/redis/redis.conf

systemctl restart redis-server

Step 11: Final NextCloud Configuration

Move Data Folder Outside Web Root (Critical!)

During setup, set data directory to: /home/files/data

su - files
nano /home/files/public_html/config/config.php

Add right after ‘installed’ => true,:

'memcache.local' => '\\OC\\Memcache\\APCu',
 'memcache.distributed' => '\\OC\\Memcache\\Redis',
 'memcache.locking' => '\\OC\\Memcache\\Redis',
 'redis' => [
 'host' => '/var/run/redis/redis-server.sock',
 'port' => 0,
 ],

Set Up Background Jobs (Cron)

su - files
crontab -e

Add:

cron*/5 * * * * /usr/local/lsws/lsphp81/bin/php -f /home/files/public_html/cron.php

Then in NextCloud Admin → Basic Settings → Background jobs → Select Cron (recommended).

Bonus: Make occ Easy to Use Forever

su - files
echo "alias occ='/usr/local/lsws/lsphp81/bin/php /home/files/public_html/occ'" >> ~/.bashrc
source ~/.bashrc

Now from anywhere in ~/public_html:

cd ~/public_html
occ status
occ maintenance:repair
occ db:add-missing-indices

You’re Done!

You now have:

The fastest NextCloud stack (OpenLiteSpeed + Redis + APCu)
Fully non-root and isolated
Automatic SSL renewal
Hardened security headers
Proper data folder protection

Enjoy your blazing-fast, private cloud!

Thank you for reading! 🚀

How to Make Your VPS Safer Against Accidental Deletions

Tue, 09 Dec 2025 00:31:57 +0000

Introduction

Have you ever deleted a file or a folder by mistake in a VPS? That feeling sucks. Sometimes you are working fast and you delete a really important file/folder. This happened to me previously. Today I want to share an amazing tool with you guys: trash-cli . It adds a trash in the CLI to prevent these human mistakes.

Installing trash-cli

trash-cli is a lightweight, command-line tool available in Debian repositories, making it ideal for VPS environments with limited resources.

Installation Steps

Update your package list:

sudo apt update

Install trash-cli:

sudo apt install trash-cli

Verify the installation:

trash --version

You should see version information if installed correctly.

This process is quick and adds minimal overhead to your VPS.

Using trash-cli for Safer Deletions

Once installed, trash-cli provides commands to manage files safely. It moves items to ~/.local/share/Trash/ instead of deleting them.

Basic Commands

Trash a file or directory: trash file.txt or trash directory.
List trashed items: trash-list (shows files with deletion dates).
Restore items: trash-restore (interactive menu to select and recover files).
Empty the trash: trash-empty (permanently deletes all trashed items).
Empty old items: trash-empty 30 (deletes items older than 30 days).

Example workflow:

trash important_file.txt # Move to trash
trash-list # Check what's there
trash-restore # Recover if needed

This replaces risky rm usage in daily operations.

Aliasing rm to Use trash-cli

To make rm safer by default, alias it to trash in your shell configuration. This ensures most deletions go to the trash bin.

Setting Up the Alias

Edit your ~/.bashrc file:

nano ~/.bashrc

Add this line at the end:

alias rm='trash'

Save and exit (Ctrl+X, Y, Enter).
Reload the configuration:

source ~/.bashrc

Now, rm file.txt will use trash instead of permanent deletion.

Automating Trash Emptying with Cron

To prevent the trash from accumulating indefinitely, automate emptying with a cron job.

Setting Up Weekly Emptying

Edit your crontab:

crontab -e

Add this line for weekly deletion (e.g., every Sunday at 2 AM):

0 2 * * 0 /usr/bin/trash-empty

0 2 * * 0: Sunday at 2:00 AM.
/usr/bin/trash-empty: Clears all trash.

Save and exit.
Verify:

crontab -l

Adjust the schedule as needed (e.g., change 0 to 1-6 for weekdays). For partial emptying, use trash-empty 30 to delete items older than 30 days.

Conclusion

By installing trash-cli, aliasing rm to trash, and setting up automated emptying, you can make your VPS much safer against accidental deletions. This approach adds a recoverable layer without sacrificing performance. Remember to combine it with regular backups and cautious command usage. If you’re new to VPS management, start small and test thoroughly. For more advanced setups, explore integrating with monitoring tools. Stay safe out there!

How to make your VPS secure

Tue, 09 Dec 2025 00:30:29 +0000

Introduction

If you just bought a VPS and are starting to self-host, this is one of the most important security improvements you can make.

By switching to SSH key authentication and disabling password login, your server becomes nearly immune to brute-force attacks — even if someone discovers your password or you’re still using the default port 22.

Step 1: Generate an SSH Key Pair on Your Local Machine

Linux & macOS

Open a terminal and run:

ssh-keygen -t rsa -b 4096

or (newer recommended format):

Bash

ssh-keygen -t ed25519

Press Enter to accept the default file location and leave the passphrase empty (just hit Enter twice).

Your keys will be saved as:

Private key: ~/.ssh/id_rsa or ~/.ssh/id_ed25519
Public key: ~/.ssh/id_rsa.pub or ~/.ssh/id_ed25519.pub

Never share the private key!

Windows (PowerShell)

Open PowerShell and run:

ssh-keygen.exe -t ed25519

(or -t rsa -b 4096 if ed25519 is not supported)

Press Enter through the prompts (no passphrase). Keys will be created in C:\Users\YourUser.ssh\

Step 2: Copy Your Public Key to the VPS

Linux & macOS (Easiest Method)

ssh-copy-id user@your-vps-ip

Replace user and your-vps-ip with your actual username and server IP.

Windows

Paste your public key (it’s one long line starting with ssh-ed25519 or ssh-rsa) → Save with Ctrl+O → Enter → Ctrl+X
Test it: Open a new terminal/PowerShell and try logging in. It should work without asking for a password.

Edit the file:Bash

nano ~/.ssh/authorized_keys

Create the .ssh folder and authorized_keys file (if they don’t exist):Bash

mkdir -p ~/.ssh
chmod 700 ~/.ssh
touch ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Log into your VPS normally (with password):PowerShell

ssh user@your-vps-ip

Copy your public key to clipboard:PowerShell

Get-Content $HOME\.ssh\id_ed25519.pub | Set-Clipboard

(or id_rsa.pub if you used RSA)

Step 3: Disable Password Authentication

Now that key login works, disable password login entirely.

Log into your VPS (using your key) and edit the SSH config:

sudo nano /etc/ssh/sshd_config

Find and change (or add) these lines:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
PubkeyAuthentication yes

Save and exit.

Restart the SSH service:

sudo systemctl restart sshd

(or sudo service ssh restart on older systems)

Final test: Try logging in from a new terminal. It should only work with your private key — password attempts will be rejected instantly.

Done!

Your VPS is now protected against:

Brute-force attacks
Credential stuffing
Weak or leaked passwords

Even if an attacker knows your username and password, they cannot log in without your private key file.

Pro tip: Back up your private key securely and consider adding a passphrase later using ssh-keygen -p.

Thank you for reading! 😊

How to remove upload limits on All In One WP Migration

Tue, 09 Dec 2025 00:25:04 +0000

Introduction

Unfortunately, many hosting providers impose very low upload limits (sometimes as little as 2–50 MB), and the official Unlimited Extension costs $69.

If you’re in that situation and need a free way to upload huge backups (10 GB, 40 GB, or more), this simple trick will help.

The Solution: Use “Big File Uploads” Plugin

The free version of All-in-One WP Migration doesn’t artificially limit uploads — it simply respects whatever limit your hosting or server enforces. The paid Unlimited Extension works by splitting the .wpress file into smaller chunks during upload.

Good news: there’s a completely free plugin that does the exact same chunking trick!

Step-by-Step Guide

Install and activate the plugin called Big File Uploads → Direct link: https://wordpress.org/plugins/tuxedo-big-file-uploads/
After activation, go to: Settings → Big File Uploads (or find it under the Plugins page → “Settings” link under the plugin name)
You’ll see the current maximum upload size (it will match your host’s default limit at first).
Change it to whatever you want:

1 GB = 1024 MB
10 GB = 10240 MB
40 GB = 40960 MB (Just type the number in megabytes — no need to add “MB” or “GB”)

Click Save Changes

That’s it! The new limit takes effect immediately.

Now when you go back to All-in-One WP Migration → Import, the max file size will reflect your new value (even 40 GB or higher works perfectly).

Conclusion

This is not meant as an attack on ServMask — they’ve built an amazing plugin and absolutely deserve support. If you can afford it, please buy the official Unlimited Extension.

But if budget is tight and you just need to migrate or restore a huge site once or twice, the Big File Uploads plugin is a 100% free and reliable alternative that works perfectly with the free version of All-in-One WP Migration.

Thank you for reading! 🙂

How to run your own monero node

Tue, 09 Dec 2025 00:07:50 +0000

Introduction

Monero is one of the most important cryptocurrencies in my opinion. It does not have the same market share as Bitcoin, but it is quite unique in one aspect: privacy. Monero is just like cash — no one needs to know how much Monero was sent or who sent it. It’s the opposite of Bitcoin in this regard. In fact, Bitcoin is worse than fiat money when it comes to privacy.

You can read more details here: https://lukesmith.xyz/articles/monero-maximalism-or-how-bitcoin-is-a-coin/

Obs: I’m NOT recommending anyone invest in Monero. Monero is supposed to be a currency, but since crypto is still extremely volatile, many people treat it as an investment. Do your own research — I’m not responsible for any investments you make.

1. Choose a VPS or set it up at home

First things first, you will need a server. You can use your own home PC if you prefer, or a VPS. A VPS is easier because it stays online 24/7 and you can always open the required ports.

At home, many ISPs block incoming ports, so your node wouldn’t be public (it would still help the network, but you couldn’t easily connect to it from outside without something like ngrok).

I personally recommend Contabo for running a Monero node because they offer excellent prices on storage VPS plans. Check their pricing here: Contabo Storage VPS

The Storage VPS S is more than enough. The Monero blockchain currently uses about 175 GB, less than 2 GB of RAM, and barely any CPU once fully synced (~3 % usage).

2. Securing the VPS

First of all, disable password login.

Then install and configure UFW (if it’s not already set up):

sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 18080
sudo ufw allow 18089
sudo ufw enable

3. Creating a dedicated user

For security reasons, never run Monero as root. Create a normal user instead:

adduser monerouser

Set a password and press Enter through the rest of the prompts.

4. Changing settings and syncing the node

Switch to the new user:

su monerouser
cd ~

Download the official Monero CLI binaries (Linux 64-bit):

wget -c https://downloads.getmonero.org/cli/monero-linux-x64-v0.18.3.4.tar.bz2
mkdir monero
tar -xjvf monero-linux-x64-v0.18.3.4.tar.bz2 -C monero --strip-components=1

(Replace the version in the URL/filename with the latest one from https://getmonero.org if needed.)

Enter the folder and start monerod once just to create the config files (stop it after a few seconds with Ctrl+C):

cd monero
./monerod

Now edit the configuration file:

nano ~/.bitmonero/bitmonero.conf

Paste the following recommended settings:

# P2P full node
public-node=true # Advertises the RPC-restricted port over p2p

# RPC settings
rpc-restricted-bind-ip=0.0.0.0
rpc-restricted-bind-port=18089

# Node settings
enforce-dns-checkpointing=true
db-sync-mode=safe # Slow but reliable db writes
enable-dns-blocklist=true # Block known-malicious nodes
no-igd=true # Disable UPnP
no-zmq=true

# Bandwidth settings (much faster sync + better contribution)
out-peers=32
in-peers=32
limit-rate-up=1048576 # 1 GB/s upload
limit-rate-down=1048576 # 1 GB/s download

Save with Ctrl+O → Enter → Ctrl+X.

Start the node in detached mode:

./monerod --detach

You’re done! Now just wait for it to fully sync.

Check sync status anytime with:

./monerod status

The initial sync usually takes a few hours depending on your connection and VPS speed.

Once it’s fully synced, you can connect any Monero wallet (Cake Wallet, Monero GUI, Feather, etc.) to your own node using your VPS IP and port 18089.

Conclusion & Credits

That’s it! Running your own full node is strongly encouraged by the Monero community. It makes the network more decentralized and gives you maximum privacy.

This guide wouldn’t have been possible without these excellent resources:

Thank you for reading! 🙂

How to Self Host your own Piped Instance

Mon, 08 Dec 2025 23:58:10 +0000

Introduction

Piped is a privacy-first, open-source alternative YouTube front-end. No Google tracking, no ads (even on videos that normally have unskippable ones), and it works perfectly with SponsorBlock and dearrow.

Self-hosting your own instance is incredibly easy with Docker and takes less than 20 minutes.

Requirements

A domain (or subdomain)
A cheap KVM VPS with Docker support (avoid OpenVZ — old kernel)
~$3–6/month is more than enough (1 CPU, 1–2 GB RAM)

Great cheap providers in 2025:

RackNerd
Hostinger (my affiliate if you want to support https://hostinger.com.br?REFERRALCODE=waterdownfall)
Cloudcone, Hetzner Cloud, BuyVM, etc.

Step 1: Secure & Prepare Your VPS

(SSH keys only, firewall, etc. — do this first!)

Then install Docker (Ubuntu/Debian example):

apt update && apt upgrade -y
apt install -y ca-certificates curl gnupg lsb-release

# Add Docker repo
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Step 2: Deploy Piped with the Official Docker Setup

cd /opt
git clone https://github.com/TeamPiped/Piped-Docker
cd Piped-Docker
./configure-instance.sh

During the script:

Choose Caddy as reverse proxy (easiest + automatic SSL)
Enter your domain and subdomains:
- Frontend → piped.yourdomain.com
- Backend API → pipedapi.yourdomain.com
- Proxy → pipedproxy.yourdomain.com

Step 3: Point DNS to Your VPS

Create three A records at your DNS provider:

piped.yourdomain.com → VPS_IP
pipedapi.yourdomain.com → VPS_IP
pipedproxy.yourdomain.com → VPS_IP

Step 4: Launch Everything

docker compose up -d

That’s it! After DNS propagates (usually < 10 minutes), your private YouTube will be live at:

https://piped.yourdomain.com

Caddy automatically handles free Let’s Encrypt SSL — no manual certbot needed.

Step 5: (Optional) Check Logs

Bash

# See what Caddy is doing
docker logs -f caddy

# Or any other container
docker logs -f piped-frontend

Bonus Tips

Want to make it public? Just share the URL — anyone can use your instance.
Want it private? Block it with Cloudflare firewall rules or basic auth in Caddy.
Pair it with the LibreTube (Android) app for the full de-Googled experience.

You now have your own ad-free, tracking-free, SponsorBlock-enabled YouTube — fully under your control.

Thanks for reading!

How to setup WordPress on LEMP with Redis and WP CLI on Debian 11

Mon, 08 Dec 2025 23:47:36 +0000

Introduction

This is the fastest, most secure, and most resource-efficient way to self-host WordPress in 2025. We’ll use a proper LEMP stack (Linux + Nginx + MySQL/MariaDB + PHP-FPM) with per-site PHP isolation, Redis object caching, automatic SSL, and WP-CLI — everything tuned for speed and security.

Let’s go.

Step 0: Secure & Update Your VPS

(If you haven’t already, follow a VPS hardening guide first — SSH keys only, firewall, fail2ban, etc.)

apt update && apt upgrade -y
apt autoremove --purge
reboot

Step 1: Install the Core Stack

# Nginx
apt install nginx -y
systemctl enable nginx

# MariaDB (better than MySQL on Debian)
apt install mariadb-server -y
systemctl enable mariadb

# PHP 8.3 + all needed extensions (using ondrej/sury repo)
apt install ca-certificates apt-transport-https lsb-release -y
wget -qO- https://packages.sury.org/php/apt.gpg | gpg --dearmor > /usr/share/keyrings/sury-php.gpg
echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/sury-php.list
apt update
apt install php8.3-fpm php8.3-mysql php8.3-curl php8.3-gd php8.3-mbstring php8.3-xml php8.3-zip php8.3-intl php8.3-imagick php8.3-redis -y
systemctl enable php8.3-fpm

# Redis
curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" > /etc/apt/sources.list.d/redis.list
apt update && apt install redis-server -y
systemctl enable redis-server

# Certbot + WP-CLI
apt install python3-certbot-nginx -y
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar && mv wp-cli.phar /usr/local/bin/wp

Step 2: Secure MariaDB & Create Database

mysql_secure_installation

mysql -u root -p
CREATE DATABASE wp_yoursite;
CREATE USER 'wp_yoursite'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON wp_yoursite.* TO 'wp_yoursite'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Step 3: Isolate PHP-FPM Per Site (Security + Stability)

cd /etc/php/8.3/fpm/pool.d/
cp www.conf yoursite.conf
nano yoursite.conf

Replace:

[www] → [yoursite]
user = www-data → user = yoursiteuser (we’ll create this user soon)
group = www-data → group = yoursiteuser
listen = /run/php/php8.3-fpm.sock → listen = /run/php/php8.3-fpm-yoursite.sock
Change process manager from dynamic → ondemand (saves RAM)

systemctl restart php8.3-fpm

(It will fail until the user exists — that’s fine.)

Step 4: Optimize PHP & Enable OPcache

sed -i "s/memory_limit = .*/memory_limit = 1024M/" /etc/php/8.3/fpm/php.ini
sed -i "s/upload_max_filesize = .*/upload_max_filesize = 10240M/" /etc/php/8.3/fpm/php.ini
sed -i "s/post_max_size = .*/post_max_size = 10240M/" /etc/php/8.3/fpm/php.ini
sed -i "s/max_execution_time = .*/max_execution_time = 600/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.enable=1/opcache.enable=1/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.memory_consumption=.*/opcache.memory_consumption=512/" /etc/php/8.3/fpm/php.ini
sed -i "s/;opcache.max_accelerated_files=.*/opcache.max_accelerated_files=20000/" /etc/php/8.3/fpm/php.ini
sed -i "s/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/" /etc/php/8.3/fpm/php.ini

Step 5: Create System User & Site Directory

adduser yoursiteuser --shell /bin/bash
su yoursiteuser
mkdir ~/public_html && cd ~/public_html
echo "cd ~/public_html" >> ~/.bashrc
exit

Step 6: Nginx Config (Fast & Secure)

nano /etc/nginx/sites-available/yoursite.conf

upstream php-yoursite {
 server unix:/run/php/php8.3-fpm-yoursite.sock;
}

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com www.yourdomain.com;
 root /home/yoursiteuser/public_html;
 index index.php index.html;

 client_max_body_size 10G;

 location / {
 try_files $uri $uri/ /index.php?$args;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass php-yoursite;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?|ttf|eot)$ {
 expires max;
 log_not_found off;
 }
}

ln -s /etc/nginx/sites-available/yoursite.conf /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

Step 7: Install WordPress via WP-CLI (as the site user)

su yoursiteuser
cd ~/public_html

wp core download
wp config create --dbname=wp_yoursite --dbuser=wp_yoursite --dbpass='strongpassword' --locale=en_US
wp core install --url=https://yourdomain.com --title="Your Site" --admin_user=admin --admin_password='strongpass' --admin_email=you@domain.com

Step 8: SSL with Let’s Encrypt (Auto-renew)

certbot --nginx -d yourdomain.com -d www.yourdomain.com
# Choose redirect to HTTPS when asked

Add auto-renew cron:

crontab -e
# Add:
0 0 * * 0 certbot renew --quiet

Step 9: Enable Redis Object Cache

# As root
usermod -aG redis yoursiteuser
chmod 770 /var/run/redis/redis-server.sock

# Optimize Redis config
sed -i 's/port 6379/port 0/' /etc/redis/redis.conf
sed -i 's|# unixsocket /run/redis/redis-server.sock|unixsocket /var/run/redis/redis-server.sock|' /etc/redis/redis.conf
sed -i 's/# unixsocketperm 700/unixsocketperm 770/' /etc/redis/redis.conf
sed -i 's/# maxmemory .*/maxmemory 1024mb/' /etc/redis/redis.conf
systemctl restart redis-server

# As yoursiteuser
cd ~/public_html
wp plugin install redis-cache --activate
wp config set WP_REDIS_SCHEME unix
wp config set WP_REDIS_PATH '/var/run/redis/redis-server.sock'
wp redis enable

Done!

You now have:

Fully isolated PHP-FPM pool (1 user = 1 site = no cross-site damage)
Redis object caching over Unix socket
OPcache + huge upload limits
Automatic SSL renewal
Fastest possible Nginx routing
WP-CLI ready

Your wp-admin will feel instant, and the site will handle traffic like a champ — even on a $5/month VPS.

Next steps:

Install a page cache plugin (any free one is ok)
Set up Cloudflare (optional but recommended)
Regular backups

Enjoy your blazing-fast, private WordPress setup!

Thanks for reading! 😊

How to setup your own email server

Mon, 08 Dec 2025 23:35:02 +0000

Introduction

Want your own ultra-private email like name@yourdomain.com with a beautiful webmail interface? This guide walks you through setting up a full mail server in under an hour using Luke Smith’s legendary EmailWiz script + Roundcube webmail — all on a $2–3/month VPS.

Everything is free, open-source, and 100% under your control.

Step 0: Grab a Cheap VPS

Good providers with frequent sales:

Contabo
LowEndTalk “Offers” section
Hostinger (my affiliate if you want to support me -> https://hostinger.com.br?REFERRALCODE=waterdownfall)

Requirements:

Any location (USA works fine)
Debian 10 or 11 (we’ll use Debian 10 in this guide)
At least 1 GB RAM (2 GB+ recommended)
Set hostname during signup to your domain (e.g., sobremail.com)

Wait for deployment → grab root password from email → SSH in.

Step 1: Basic VPS Hardening

ssh root@your-vps-ip
apt update && apt upgrade -y

Change root password:

passwd

Create and upload an SSH key (do this from your local machine):

ssh-copy-id root@your-vps-ip

Now disable password login:

nano /etc/ssh/sshd_config

Change:

PasswordAuthentication no
UsePAM no

Then:

systemctl restart sshd

Only your SSH key works now — much safer.

Step 2: Install EmailWiz (the magic script)

apt install curl nginx python3-certbot-nginx -y

Point these DNS records to your VPS IP:

yourdomain.com → VPS IP (A record)
mail.yourdomain.com → VPS IP (A record)

Run Luke’s script:

curl -LO lukesmith.xyz/emailwiz.sh
sh emailwiz.sh

Follow the prompts:

Say Yes/Y to everything
When asked for “System mail name” → enter ONLY yourdomain.com (NOT mail.yourdomain.com!)

Wait ~5–10 minutes. When it finishes, it gives you three DNS records to add:

DKIM TXT record (mail._domainkey.yourdomain.com)
DMARC TXT record (_dmarc.yourdomain.com)
SPF TXT record (root domain)

Add them at your DNS provider (Cloudflare, Namecheap, etc.).

Step 3: Set Up Reverse DNS (Critical for Deliverability!)

In Cloudcone panel → Networking → rDNS → set to yourdomain.com Do NOT enable IPv6 (Cloudcone doesn’t support IPv6 rDNS yet — it will hurt deliverability).

Step 4: Create Your First Mailbox

useradd -G mail -m yourusername
passwd yourusername

Your email is now: yourusername@yourdomain.com

Test in Thunderbird/IMAP client:

IMAP: mail.yourdomain.com (port 993, SSL/TLS)
SMTP: mail.yourdomain.com (port 465, SSL/TLS)

Step 5: Install Roundcube Webmail

Add backports + PHP 8.x repo:

apt install -y lsb-release ca-certificates apt-transport-https software-properties-common gnupg2
echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/sury-php.list
wget -qO - https://packages.sury.org/php/apt.gpg | apt-key add -
apt update
apt install -y php8.0-fpm php8.0-common php8.0-gd php8.0-imap php8.0-mysql php8.0-curl php8.0-zip php8.0-xml php8.0-mbstring php8.0-intl mariadb-server

Secure MySQL:

mysql_secure_installation

Create Roundcube database:

mysql -u root -p
CREATE DATABASE roundcube;
CREATE USER 'roundcubeuser'@'localhost' IDENTIFIED BY 'strongpassword';
GRANT ALL ON roundcube.* TO 'roundcubeuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Download & extract Roundcube (latest complete version):

cd /var/www
wget https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz
tar xvf roundcubemail-1.6.9-complete.tar.gz
mv roundcubemail-1.6.9 roundcube
rm roundcubemail-1.6.9-complete.tar.gz
chown -R www-data:www-data /var/www/roundcube/temp /var/www/roundcube/logs
mysql roundcube < /var/www/roundcube/SQL/mysql.initial.sql

Nginx config for Roundcube (/etc/nginx/sites-enabled/roundcube):

server {
 listen 80;
 listen [::]:80;
 server_name yourdomain.com;
 root /var/www/roundcube;
 index index.php;

 location / {
 try_files $uri $uri/ /index.php;
 }

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_pass unix:/run/php/php8.0-fpm.sock;
 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 }

 location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
 expires 360d;
 access_log off;
 }
}

Test & reload Nginx, then get SSL:

nginx -t && systemctl reload nginx
certbot --nginx -d yourdomain.com

Visit https://yourdomain.com/installer → follow the wizard:

Database: roundcube, user roundcubeuser, password you set
IMAP host: localhost
SMTP host: localhost
Default host: mail.yourdomain.com

Enable all plugins except Enigma (it breaks identities in older versions).

After finishing, delete the installer:

rm -rf /var/www/roundcube/installer

Step 6: Quality-of-Life Tweaks

Edit /var/www/roundcube/config/config.inc.php:

// Login with just username (no need to type @domain.com)
$config['username_domain'] = 'yourdomain.com';

// Stay logged in for 6 months
$config['session_lifetime'] = 259200;

// Disable Enigma if you enabled it
// Remove 'enigma' from $config['plugins'] array

Increase attachment size:

nano /etc/php/8.0/fpm/php.ini

upload_max_filesize = 50M
post_max_size = 50M

Then:

systemctl restart php8.0-fpm

Step 7: Brute-Force Protection with Fail2Ban

apt install fail2ban -y
cd /var/www/roundcube/plugins
wget https://github.com/texxasrulez/roundcube_fail2ban/archive/refs/tags/1.4.zip
unzip 1.4.zip
mv roundcube_fail2ban-1.4 fail2ban
rm 1.4.zip

Enable in Roundcube config (config.inc.php):

$config['plugins'][] = 'fail2ban';

Add jail (/etc/fail2ban/jail.local – create if missing):

[roundcube]
enabled = true
port = http,https
filter = roundcube
action = iptables-multiport[name=roundcube, port="http,https"]
logpath = /var/www/roundcube/logs/errors.log
maxretry = 5
bantime = 3600

Create filter (/etc/fail2ban/filter.d/roundcube.conf):

[Definition]
failregex = IMAP Error: Login failed for .* from <HOST>
ignoreregex =

Restart:

systemctl restart fail2ban php8.0-fpm

Done! Your webmail is now protected.

Final Result

You now have:

Full email server with DKIM, SPF, DMARC
Beautiful, fast Roundcube webmail
Zero Google/Microsoft involvement
Login once every 6 months
Brute-force protection
All for ~$50/year

Welcome to real email freedom.

Thanks for reading! 😊

How to use AI privately at Brave browser (2 methods)

Mon, 08 Dec 2025 23:15:59 +0000

Introduction

Brave Browser 1.69 introduced a game-changing feature: you can now connect Leo (Brave’s built-in AI assistant) to any model you want — including fully local models or third-party APIs. This means you get an always-available AI sidebar with zero subscription and total control over privacy and cost.

Here are the two best methods I’ve tested (one ultra-private, one smarter but cloud-based).

Method 1 – Maximum Privacy: Run a Local Model with Ollama (No GPU Needed)

You can run a surprisingly capable model completely offline, even on very modest hardware. The current sweet spot is Google’s Gemma 2 2B — it’s tiny (~1.4 GB), runs great on CPU, and works perfectly even with just 4–6 GB of RAM free.

Step 1: Install Ollama

Download and install Ollama from the official site: https://ollama.com (It has native packages for Windows, macOS, and Linux.)

Step 2: Download Gemma 2 2B

Open a terminal and run:

ollama pull gemma2:2b

(If you use Docker: docker exec -it ollama ollama pull gemma2:2b)

Step 3: Verify it’s running

Open http://localhost:11434 in your browser. You should see “Ollama is running” — that’s all you need.

Step 4: Add the model to Brave Leo

Open Brave → Settings → Leo
Click Add new model
Fill in the details exactly like this:

Label → anything you want (e.g., “Gemma 2 2B Local”)
Model Request Name → gemma2:2b
Server Endpoint → http://localhost:11434/v1/chat/completions
API Key → leave empty

(Optional but recommended) Set this model as your default for new chats.

Done! You now have a fully private, offline AI inside Brave that uses almost no resources.

Method 2 – Smarter Answers (Cloud): Use CryptoTalks.ai (Pay-as-you-go, No Subscription)

If you want access to the absolute best models (GPT-4o, Claude 3.5 Sonnet, Gemini 1.5 Flash, Llama 3.1 405B, etc.) without creating accounts at OpenAI/Anthropic/Google, CryptoTalks.ai is currently the best option. You pay only for what you use and can fund the account with Bitcoin or Lightning.

Step 1: Create an account & get your token

Go to https://cryptotalks.ai/signup → sign up → copy your API token (keep it safe!).

Step 2: Add a tiny amount of credit

Deposit any amount via Bitcoin or Lightning. Even $1–2 lasts a very long time for personal use.

Step 3: Add the model(s) to Brave Leo

Same process as before, just different values:

Label → e.g., “Claude 3.5 Sonnet”, “GPT-4o”, etc.
Model Request Name → exact model ID from their docs, examples:
- openai/chatgpt-4o-latest
- anthropic/claude-3.5-sonnet
- google/gemini-flash-1.5
- meta-llama/llama-3.1-405b-instruct
Server Endpoint → https://cryptotalks.ai/v1/chat/completions/
API Key → paste your token

You can add as many models as you want and switch between them instantly in the Leo sidebar.

Pro tip: Check current model rankings at https://artificialanalysis.ai/models to pick the best one for your needs.

Real-World Use

With Leo + your own model you can:

Summarize long articles or YouTube videos in one click
Explain complex code snippets
Draft emails or messages
Translate on the fly
All without ever leaving the browser and without sending data to big tech

When I’m on battery and want zero extra power draw → I switch to the local Gemma 2 2B. When I need maximum intelligence → I switch to Claude 3.5 Sonnet or GPT-4o via CryptoTalks.

Conclusion

Brave just turned every browser into a private, customizable AI workstation. Pick Method 1 for 100% privacy and zero cost, or Method 2 when you want the absolute best answers available today.

Either way — welcome to the future of browsing.

Thanks for reading! 😊

Page Cache, Object Cache and CDN cache - Understanding all types of caching

Mon, 08 Dec 2025 23:13:04 +0000

Understanding the Different Types of Caching (Especially for Scaling CMS Sites)

If you’ve ever wondered what people mean when they talk about “page cache,” “object cache,” or “CDN cache,” this post is for you. These are the three main caching layers that make a massive difference when scaling WordPress, WooCommerce, or any other CMS.

What is Page Caching?

Page caching (also called full-page caching or HTML caching) is exactly what it sounds like: the entire rendered HTML page is saved as a static file.

With a truly static site (plain HTML + CSS + JS), there’s no need for page caching because every file is already static. But with a CMS like WordPress, every request normally triggers PHP → theme → plugins → database queries → HTML output. That process eats CPU and takes time.

Full-page caching shortcuts all of that. The first visitor triggers the full PHP+MySQL process, the resulting HTML is saved, and every visitor after that gets served the pre-generated static HTML instantly — no PHP, no database queries, almost zero CPU.

Result: 10–100× lower server load and dramatically faster page loads.

What is Object Caching?

Object caching stores the results of expensive database queries (or any slow computation) in fast memory (usually Redis or Memcached).

Think of it as a super-fast middleman between your PHP code and the database.

Example with WordPress:

WordPress needs the list of published posts → it asks MySQL.
First request: MySQL does the work, returns the data, object cache saves it in RAM.
Next 10 000 requests: object cache instantly returns the same data from memory → MySQL sleeps peacefully.

Object cache is smart — it automatically invalidates itself when data changes (e.g., you publish a new post).

Why you still need it even with full-page caching:

Logged-in users (including the WordPress dashboard, WooCommerce account pages, etc.) can’t be fully cached for everyone.
Those pages still hit PHP and MySQL → object cache makes them tolerable instead of painfully slow.

Object cache + full-page cache together is the classic high-traffic combo.

What is CDN Caching?

A CDN (Content Delivery Network) copies your static assets (CSS, JS, images, fonts) — and optionally your full HTML pages — to “PoP” servers all over the world.

Without a CDN: a visitor in Japan downloads everything from your origin server in, say, Brazil → high latency.

With a CDN:

Static files are served from the closest PoP (often < 30 ms away).
If you also enable full-page caching on the CDN, the entire HTML page is served from that nearby PoP too → the origin server is never touched for cached pages.

This is why some sites load instantly from anywhere on the planet.

Real-World Example: WordPress Traffic Flow

No caching at all

Visitor → Web server → PHP → dozens of plugin files → MySQL queries → HTML → visitor → High CPU, slow TTFB, easily hits resource limits.

With full-page caching only

First visitor: same slow path as above (but the HTML is saved). Next 10 000 visitors: Web server instantly serves the pre-built HTML → almost zero CPU.

With object caching only

Every request still runs PHP + plugins, but database queries are answered from RAM instead of disk → faster than no cache, but still heavy.

With full-page cache + object cache

Anonymous visitors → static HTML (super fast, almost no load)
Logged-in users → PHP runs, but object cache makes DB queries instant → manageable load

Add CDN with full-page caching on top

Even the static HTML is now served from edge locations worldwide. Your origin server can basically take a nap until something actually needs PHP (e.g., form submissions, cache invalidation).

Conclusion

Here’s the hierarchy from most impactful to least (for most CMS sites):

Full-page caching on the CDN → fastest for visitors, scales to millions of hits with almost zero origin load.
Full-page caching on the origin → still massive win if you can’t cache on the CDN.
Object caching (Redis/Memcached) → mandatory for logged-in users, WooCommerce, dashboards, etc.
Everything else (OPcache, browser cache, etc.) → nice to have, usually enabled by default.

If you only do one thing: enable proper full-page caching (and push it to your CDN if possible). If you have logged-in traffic or a shop: add Redis/Memcached object caching.

That’s it — the three caching layers that power basically every high-traffic WordPress site on the planet.

Hope this cleared things up!

Thanks for reading! 😊

Top 7 things you should do after installing Xubuntu 22.04

Mon, 08 Dec 2025 22:24:22 +0000

Introduction

I recently reviewed Pop!_OS 22.04 after using it for a long time. I loved it, but I wanted to try something else long-term and ended up choosing Ubuntu 22.04 — specifically the Xubuntu flavor with XFCE.

Whenever I install a fresh OS, there are a few things I always do to make sure the system feels snappy, performs well in games, and (on laptops) gets the best possible battery life.

Before starting any of the steps below, I strongly recommend doing a full system upgrade

Install the Liquorix Kernel

Liquorix is an enthusiast Linux kernel optimized for desktop responsiveness, low-latency audio/video work, and reduced frame-time jitter in games.

The stock Ubuntu kernel is a general-purpose kernel that has to work well on both desktops and servers. Liquorix takes the same Linux kernel source and applies desktop-focused patches and build options. The result feels noticeably snappier, especially under heavy load or when alt-tabbing quickly in games.

Installing it on Ubuntu/Debian is one command:

Bash

curl 'https://liquorix.net/install-liquorix.sh' | sudo bash

Reboot afterward and you’ll be running the new kernel.

Add the Latest Graphics Drivers

For Nvidia users:

Bash

sudo add-apt-repository ppa:graphics-drivers/ppa
sudo dpkg --add-architecture i386
sudo apt update
sudo apt install -y nvidia-driver-560 libvulkan1 libvulkan1:i386

For AMD or Intel users (Kisak’s PPA – latest Mesa):

Bash

sudo add-apt-repository ppa:kisak/kisak-mesa
sudo dpkg --add-architecture i386
sudo apt update && sudo apt upgrade
sudo apt install libgl1-mesa-dri:i386 mesa-vulkan-drivers mesa-vulkan-drivers:i386

Even on an older LTS release, this gives you the newest open-source drivers and Vulkan support.

Lower Swappiness

Pop!_OS sets vm.swappiness=10 by default (swap is only used when RAM is ~90% full). Ubuntu/Xubuntu defaults to 60, which is far too aggressive for desktop use.

Change it permanently:

Bash

sudo nano /etc/sysctl.conf

Add this line at the end:

text

vm.swappiness=10

Save and exit. The change applies immediately or on next reboot.

Install Essential Utilities

These are the tools I install on every fresh setup:

Redshift – blue-light filter
Flameshot – best screenshot tool
AppImageLauncher – integrates AppImages into your menu
Gamemode – massive FPS improvements in many games
TLP – essential for laptops (often doubles battery life)

Bash

sudo apt install redshift flameshot appimagelauncher gamemode tlp tlp-rdw

(Enable TLP if needed: sudo tlp start)

Install Your Favorite Everyday Apps

My personal picks:

Brave Browser (privacy-focused Chromium)
VLC (preferably via AppImage/Flatpak/Snap to avoid heavy Qt dependencies on XFCE)
LibreOffice

Create Handy Aliases

Open your .bashrc:

Bash

nano ~/.bashrc

Add some useful aliases at the bottom, for example:

Bash

alias apply_filter='redshift -O 1900'
alias update='sudo apt update && sudo apt upgrade -y'
alias please='sudo $(history -p !!)' # rerun last command with sudo

Reload the file:

Bash

source ~/.bashrc

Customize the Look & Feel (Optional)

Xubuntu + XFCE is extremely customizable. I run a very minimal setup and control almost everything with keyboard shortcuts. You can configure them in Settings → Window Manager and Settings → Keyboard → Application Shortcuts.

Conclusion

The three biggest performance wins — Liquorix kernel, latest graphics drivers, and low swappiness — make a dramatic difference. Real-world example: Life is Strange: True Colors jumped from ~23 FPS with stuttering on stock settings to a smooth 40+ FPS after applying these changes.

If you’re getting random lags or freezes on Xubuntu/Ubuntu, try these steps first. They solve a surprising number of issues.

Thanks for reading!