Notes on Dominicus In

Blog

Fri, 14 Aug 2026 18:00:00 +0000

author: DominicusIn

channels.scm

Wed, 03 Sep 2025 08:08:12 +0000

author: DominicusIn

channels.scm

;; ~/.config/guix/channels.scm

(list (channel
 (name 'nonguix)
 (url "https://gitlab.com/nonguix/nonguix")
 (branch "master")
 (commit
 "477f283914ca771a8622e16b73d845b87c63335d")
 (introduction
 (make-channel-introduction
 "897c1a470da759236cc11798f4e0a5f7d4d59fbc"
 (openpgp-fingerprint
 "2A39 3FFF 68F4 EF7A 3D29 12AF 6F51 20A0 22FB B2D5"))))
 (channel
 (name 'guix)
 (url "https://git.guix.gnu.org/guix.git")
 (branch "master")
 (commit
 "b377ec079d9ffe8f0f372c43735ad012ea889b6f")
 (introduction
 (make-channel-introduction
 "9edb3f66fd807b096b48283debdcddccfea34bad"
 (openpgp-fingerprint
 "BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
 (channel
 (name 'pantherx)
 (url "https://channels.pantherx.org/git/panther.git")
 (branch "master")
 (commit
 "236f6a56cb78556eeeb64b4895ce59cdba644b0b")
 (introduction
 (make-channel-introduction
 "54b4056ac571611892c743b65f4c47dc298c49da"
 (openpgp-fingerprint
 "A36A D41E ECC7 A871 1003 5D24 524F EB1A 9D33 C9CB"))))
 (channel
 (name 'guix-gaming-games)
 (url "https://gitlab.com/guix-gaming-channels/games.git")
 (branch "master")
 (commit
 "b943b1e3cacffa8c9b7ea63d49f3f7d8fc3bee85")
 (introduction
 (make-channel-introduction
 "c23d64f1b8cc086659f8781b27ab6c7314c5cca5"
 (openpgp-fingerprint
 "50F3 3E2E 5B0C 3D90 0424 ABE8 9BDC F497 A4BB CC7F"))))
 (channel
 (name 'flat)
 (url "https://github.com/flatwhatson/guix-channel.git")
 (branch "master")
 (commit
 "b62ba3214ed0f781e2d6015044ae8a4a1bd5c7d7")
 (introduction
 (make-channel-introduction
 "33f86a4b48205c0dc19d7c036c85393f0766f806"
 (openpgp-fingerprint
 "736A C00E 1254 378B A982 7AF6 9DBE 8265 81B6 4490"))))
 (channel
 (name 'guix-science)
 (url "https://codeberg.org/guix-science/guix-science.git")
 (branch "master")
 (commit
 "6f6b833e7b258251abc33186d2775c333e91d11f")
 (introduction
 (make-channel-introduction
 "b1fe5aaff3ab48e798a4cce02f0212bc91f423dc"
 (openpgp-fingerprint
 "CA4F 8CF4 37D7 478F DA05 5FD4 4213 7701 1A37 8446"))))
 (channel
 (name 'guix-hpc)
 (url "https://gitlab.inria.fr/guix-hpc/guix-hpc.git")
 (branch "master")
 (commit
 "383fd2297febd03401d2b70c29db6eaff8c6384d"))
 (channel
 (name 'guix-past)
 (url "https://codeberg.org/guix-science/guix-past")
 (branch "master")
 (commit
 "b14d7f997ae8eec788a7c16a7252460cba3aaef8")
 (introduction
 (make-channel-introduction
 "0c119db2ea86a389769f4d2b9c6f5c41c027e336"
 (openpgp-fingerprint
 "3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5"))))
 (channel
 (name 'rde)
 (url "https://git.sr.ht/~abcdw/rde")
 (branch "master")
 (commit
 "46a2e694a4afc3d1dbce8b751389b566df16d46a")
 (introduction
 (make-channel-introduction
 "257cebd587b66e4d865b3537a9a88cccd7107c95"
 (openpgp-fingerprint
 "2841 9AC6 5038 7440 C7E9 2FFA 2208 D209 58C1 DEB0"))))
 (channel
 (name 'rosenthal)
 (url "https://codeberg.org/hako/rosenthal.git")
 (branch "trunk")
 (commit
 "9e51ad4215461702056e57557b89d56d9123713f")
 (introduction
 (make-channel-introduction
 "7677db76330121a901604dfbad19077893865f35"
 (openpgp-fingerprint
 "13E7 6CD6 E649 C28C 3385 4DF5 5E5A A665 6149 17F7"))))
 (channel
 (name 'babelfish)
 (url "https://codeberg.org/ifitzpat/babelfish.git")
 (branch "master")
 (commit
 "2a92e7289d260e21b64b3857dbab980adfc78b42"))
 (channel
 (name 'guix-cran)
 (url "https://github.com/guix-science/guix-cran.git")
 (branch "master")
 (commit
 "6ef1a68cb0b4e9949ec667c0fb4cd1c730e2015e"))
 (channel
 (name 'guix-bioc)
 (url "https://github.com/guix-science/guix-bioc.git")
 (branch "master")
 (commit
 "7500d208fc1f08abd0a382eba2984e622d814f13"))
 (channel
 (name 'ajattix)
 (url "https://git.ajattix.org/hashirama/ajattix.git")
 (branch "main")
 (commit
 "b62401404713cbdfcccb6172e8efab59934c62e5")
 (introduction
 (make-channel-introduction
 "5f1904f1a514b89b2d614300d8048577aa717617"
 (openpgp-fingerprint
 "F164 709E 5FC7 B32B AEC7 9F37 1F2E 76AC E3F5 31C8"))))
 (channel
 (name 'crafted-guix)
 (url "https://codeberg.org/ifitzpat/crafted-guix.git")
 (branch
 "docker-container-service-type-documentation")
 (commit
 "1eba6117713e06a27b40fc77606b9496fd7fe19b")))

dns

Wed, 13 Aug 2025 14:32:08 +0000

author: DominicusIn

dns

View on GitHub Gist

quic://dns.adguard-dns.com
quic://dns.comss.one
quic://dns.jupitrdns.com
quic://dns.surfsharkdns.com
quic://family.adguard-dns.com
quic://ibksturm.synology.me
quic://router.comss.one
quic://unfiltered.adguard-dns.com
quic://zero.dns0.eu
tls://101.101.101.101
tls://adblock.dns.mullvad.net
tls://adult-filter-dns.cleanbrowsing.org
tls://all.dns.mullvad.net
tls://anycast.censurfridns.dk
tls://anycast.dns.nextdns.io
tls://base.dns.mullvad.net
tls://child.joindns4.eu
tls://child-noads.joindns4.eu
tls://common.dot.dns.yandex.net
tls://dns10.quad9.net
tls://dns11.quad9.net
tls://dns.adguard-dns.com
tls://dns.alidns.com
tls://dns.cmrg.net
tls://dns.digitale-gesellschaft.ch
tls://dns-dot.dnsforfamily.com
tls://dnsforge.de
tls://dns.google
tls://dnsguard.pub
tls://dns.jupitrdns.com
tls://dns.marbledfennec.net
tls://dns.nextdns.io
tls://dns.opendns.com
tls://dns.quad9.net
tls://dns.surfsharkdns.com
tls://dns.switch.ch
tls://dot1.applied-privacy.net
tls://dot.360.cn
tls://dot.ffmuc.net
tls://dot.la.ahadns.net
tls://dot.libredns.gr
tls://dot.onedns.net
tls://dot.pub
tls://dot-pure.onedns.net
tls://dot.sb
tls://dot.tiar.app
tls://extended.dns.mullvad.net
tls://family.adguard-dns.com
tls://family.canadianshield.cira.ca
tls://family.cloudflare-dns.com
tls://family.dns.mullvad.net
tls://family.dot.dns.yandex.net
tls://family-filter-dns.cleanbrowsing.org
tls://familyshield.opendns.com
tls://getdnsapi.net
tls://ibksturm.synology.me
tls://jp.tiar.app
tls://noads.joindns4.eu
tls://odvr.nic.cz
tls://one.one.one.one
tls://ordns.he.net
tls://p1.freedns.controld.com
tls://p2.freedns.controld.com
tls://p3.freedns.controld.com
tls://private.canadianshield.cira.ca
tls://protected.canadianshield.cira.ca
tls://protective.joindns4.eu
tls://public.dns.iij.jp
tls://router.comss.one
tls://safe.dot.dns.yandex.net
tls://sandbox.opendns.com
tls://security.cloudflare-dns.com
tls://security-filter-dns.cleanbrowsing.org
tls://unfiltered.adguard-dns.com
tls://unicast.censurfridns.dk
tls://wikimedia-dns.org
quic://dns.adguard-dns.com
quic://dns.alidns.com:853
quic://dns.comss.one
quic://dns.jupitrdns.com
quic://dns.surfsharkdns.com
quic://doh.tiar.app:784
quic://family.adguard-dns.com
quic://ibksturm.synology.me
quic://router.comss.one
quic://unfiltered.adguard-dns.com
quic://zero.dns0.eu
https://adblock.dns.mullvad.net/dns-query
https://all.dns.mullvad.net/dns-query
https://anycast.dns.nextdns.io/dns-query
https://base.dns.mullvad.net/dns-query
https://basic.rethinkdns.com/
https://child.joindns4.eu/dns-query
https://child-noads.joindns4.eu/dns-query
https://common.dot.dns.yandex.net/dns-query
https://dns10.quad9.net/dns-query
https://dns11.quad9.net/dns-query
https://dns.adguard-dns.com/dns-query
https://dns.alidns.com/dns-query
https://dns.caliph.dev/dns-query
https://dns.cloudflare.com/dns-query
https://dns.comss.one/dns-query
https://dns.digitale-gesellschaft.ch/dns-query
https://dnsforge.de/dns-query
https://dns.google/dns-query
https://dns.jupitrdns.com/dns-query
https://dns.marbledfennec.net/dns-query
https://dns.mullvad.net/dns-query
https://dns.nextdns.io/dns-query
https://dns.pub/dns-query
https://dns.quad9.net/dns-query
https://dns.rabbitdns.org/dns-query
https://dns.surfsharkdns.com/dns-query
https://dns.switch.ch/dns-query
https://doh.360.cn/dns-query
https://doh.cleanbrowsing.org/doh/adult-filter/
https://doh.cleanbrowsing.org/doh/family-filter/
https://doh.cleanbrowsing.org/doh/security-filter/
https://doh.dns.sb/dns-query
https://doh.familyshield.opendns.com/dns-query
https://doh.ffmuc.net/dns-query
https://doh.libredns.gr/ads
https://doh.libredns.gr/dns-query
https://doh.onedns.net/dns-query
https://doh.opendns.com/dns-query
https://doh-pure.onedns.net/dns-query
https://doh.sandbox.opendns.com/dns-query
https://doh.tiarap.org/dns-query
https://doh.tiar.app/dns-query
https://private.canadianshield.cira.ca/dns-query
https://protected.canadianshield.cira.ca/dns-query
https://protective.joindns4.eu/dns-query
https://public.dns.iij.jp/dns-query
https://public.ns.nwps.fi/dns-query
https://resolver.dnsprivacy.org.uk/dns-query
https://router.comss.one/dns-query
https://rx.techomespace.com/dns-query
https://safe.dot.dns.yandex.net/dns-query
https://security.cloudflare-dns.com/dns-query
https://security.rabbitdns.org/dns-query
https://sm2.doh.pub/dns-query
https://unfiltered.adguard-dns.com/dns-query
https://v.recipes/dns-query
https://wikimedia-dns.org/dns-query
https://extended.dns.mullvad.net/dns-query
https://extended.dns.mullvad.net/dns-query
https://family.adguard-dns.com/dns-query
https://family.canadianshield.cira.ca/dns-query
https://family.cloudflare-dns.com/dns-query
https://family.dns.mullvad.net/dns-query
https://family.dot.dns.yandex.net/dns-query
https://family.rabbitdns.org/dns-query
https://ibksturm.synology.me/dns-query
https://jp.tiarap.org/dns-query
https://jp.tiar.app/dns-query
https://kids.ns.nwps.fi/dns-query
https://noads.joindns4.eu/dns-query
https://odvr.nic.cz/doh

arch

Thu, 03 Jul 2025 06:54:46 +0000

author: DominicusIn

arch

View on GitHub Gist

curl https://mirror.cachyos.org/cachyos-repo.tar.xz -o cachyos-repo.tar.xz
tar xvf cachyos-repo.tar.xz && cd cachyos-repo
sudo ./cachyos-repo.sh

curl -O https://blackarch.org/strap.sh
chmod +x strap.sh
sudo ./strap.sh

curl -LO git.io/strap.sh
sudo sh strap.sh

flatpaks

Sun, 04 May 2025 04:56:00 +0000

author: DominicusIn

flatpaks

View on GitHub Gist

 flatpak remote-add --from eos-sdk #http://endlessm.github.io/eos-knowledge-lib/eos-sdk.flatpakrepo
 flatpak remote-add --from eos-sdk http://endlessm.github.io/eos-knowledge-lib/eos-sdk.flatpakrepo
 flatpak remote-add --from eos-sdk-nightly http://endlessm.github.io/eos-knowledge-lib/eos-sdk-nightly.flatpakrepo
 flatpak remote-add --gpg-import=eos-flatpak-keyring.gpg eos-apps https://ostree.endlessm.com/ostree/eos-apps
 flatpak remote-add --gpg-import=eos-flatpak-keyring.gpg eos-sdk https://ostree.endlessm.com/ostree/eos-sdk
 flatpak remote-add --if-not-exists dragon-nightly https://cdn.kde.org/flatpak/dragon-nightly/dragon-nightly.flatpakrepo
 flatpak remote-add --if-not-exists eclipse-nightly https://download.eclipse.org/linuxtools/flatpak-I-builds/eclipse.flatpakrepo
 flatpak remote-add --if-not-exists elementaryos https://flatpak.elementary.io/repo.flatpakrepo
 flatpak remote-add --if-not-exists fedora oci+https://registry.fedoraproject.org
 flatpak remote-add --if-not-exists fedora-testing oci+https://registry.fedoraproject.org#testing
 flatpak remote-add --if-not-exists flathub-beta https://flathub.org/beta-repo/flathub-beta.flatpakrepo
 flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --if-not-exists gnome-nightly https://nightly.gnome.org/gnome-nightly.flatpakrepo
 flatpak remote-add --if-not-exists gnome-nightly https://nightly.gnome.org/gnome-nightly.flatpakrepo.
 flatpak remote-add --if-not-exists igalia https://software.igalia.com/flatpak-refs/igalia.flatpakrepo
 flatpak remote-add --if-not-exists kdeapps https://distribute.kde.org/kdeapps.flatpakrepo
 flatpak remote-add --if-not-exists kde-runtime-nightly https://cdn.kde.org/flatpak/kde-runtime-nightly/kde-runtime-nightly.flatpakrepo
 flatpak remote-add --if-not-exists PureOS https://store.puri.sm/repo/stable/pureos.flatpakrepo
 flatpak remote-add --if-not-exists --subset=floss flathub-floss https://dl.flathub.org/repo/flathub.flatpakrepo..
 flatpak remote-add --if-not-exists --subset=verified flathub-verified https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --if-not-exists --subset=verified_floss flathub-verified_floss https://dl.flathub.org/repo/flathub.flatpakrepo
 flatpak remote-add --if-not-exists tenacity oci+https://tenacityteam.github.io/tenacity-flatpak-nightly
 flatpak remote-add --if-not-exists --user appcenter https://flatpak.elementary.io/repo.flatpakrepo
 flatpak remote-add --if-not-exists webkit-sdk https://software.igalia.com/flatpak-refs/webkit-sdk.flatpakrepo
 flatpak remote-add rhel https://flatpaks.redhat.io/rhel.flatpakrepo
 flatpak remote-add --system elementary https://flatpak.elementary.io/elementary.flatpakrepo
 flatpak remote-add --user appcenter https://flatpak.elementary.io/appcenter.flatpakrepo
 flatpak remote-add --user --if-not-exists webkit https://software.igalia.com/flatpak-refs/webkit-sdk.flatpakrepo
 flatpak remote-add xwaylandvideobridge-nightly https://cdn.kde.org/flatpak/xwaylandvideobridge-nightly/xwaylandvideobridge-nightly.flatpakrepo
 flatpak --system remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

ed's

Thu, 27 Mar 2025 06:15:22 +0000

author: DominicusIn

ed’s

View on GitHub Gist

Adobe XD
Android Studio
AppCode
Aptana
Aqua
Arduino IDE
Azure Data Studio
Blender
BlueJ
Brackets
Brave
C++ Builder
CLion
Canva
Chrome
Cloud9
Coda
Code::Blocks
CodeLite
CodeTasty
Cursor
DBeaver
DataGrip
DataSpell
Delphi
Discord
Eclipse
Edge
EmEditor
Emacs
Eric
Espresso
Excel
Figma
Firefox
Flash Builder
Geany
Gedit
GoLand
HBuilder X
Helix
IDA Pro
IntelliJ IDEA
Jupyter
KDevelop
Kakoune
Kate
Komodo
Light Table
MPS
Micro
MySQL Workbench
Neovim
NetBeans
Notepad++
Nova
Obsidian
Onivim
Oxygen
Photoshop
PhpStorm
Postman
PowerPoint
Processing
Pulsar
PyCharm
Pymakr
QtCreator
RStudio
ReClassEx
Rider
Roblox Studio
RubyMine
RustRover
SQL Server Management Studio
SQL Server Studio
Safari
SiYuan
Sketch
SlickEdit
Spyder
Sublime Text
TeXstudio
Terminal
TextMate
Unity
VS Code
Vim
Visual Studio
WPS Office
WebStorm
Windsurf
Wing
Word
Xcode
Zed
Zotero

gistfile1 txt

Tue, 11 Mar 2025 06:38:07 +0000

author: DominicusIn

View on GitHub Gist

export LANG=C.UTF-8
export DEBIAN_FRONTEND=noninteractive
export APT_LISTCHANGES_FRONTEND=none
apt -y modernize-sources;apt-mark -y minimize-manual ;apt --allow-change-held-packages --allow-downgrades --allow-remove-essential --allow-unauthenticated --fix-broken --fix-missing --ignore-hold --install-recommends --install-suggests --update --show-progress --color --audit --autoremove --purge --reinstall --fix-broken --fix-missing --ignore-hold -t unstable --option DPkg::Options::="--force-confnew" --option DPkg::Options::="--force-all" -fym full-upgrade;aptitude --no-gui --with-recommends -t unstable -vfy full-upgrade;dpkg --configure -a --force-all

zpool create

Fri, 07 Feb 2025 16:29:56 +0000

author: DominicusIn

zpool create

View on GitHub Gist

#!/bin/bash

set -e

# Define disk arrays
HDD_DISKS=(
 "/dev/disk/by-id/ata-WDC_WD4003FRYZ-01F0DB0_VBGGLSNF"
 "/dev/disk/by-id/ata-WDC_WD4003FRYZ-01F0DB0_VBGGL0RF"
 "/dev/disk/by-id/ata-TOSHIBA_HDWR11A_X1K0A036FB4G"
 "/dev/disk/by-id/ata-TOSHIBA_HDWR11A_X1K0A031FB4G"
)

NVME_DISKS=(
 "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_1TB_S467NX0K822865W"
 "/dev/disk/by-id/nvme-CT2000P3PSSD8_2305E6A607AC"
 "/dev/disk/by-id/nvme-WD_Blue_SN580_2TB_23306X800120"
 "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S6Z2NF0X200223V"
 "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221858P"
 "/dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221870V"
)

# Partition type GUIDs
GUID_BIOS_BOOT="ef02"
GUID_XBOOTLDR="bc13c2ff-59e6-4262-a352-b275fd6f7172"
GUID_APPLE_BOOT="426F6F74-0000-11AA-AA11-00306543ECAC"
GUID_MS_RESERVED="e3c9e316-0b5c-4db8-817d-f92df00215ae"
GUID_WINDOWS_RECOVERY="27d7f88a-c0e4-4640-9bd3-4cfc0e305e6c"
GUID_SWAP="8200"
GUID_ZFS="bf00"

# Install necessary packages
#pacman -Sy --noconfirm sgdisk zfs-utils mdadm

# Function to determine swap size based on disk size
get_swap_size() {
 local disk_size_gib=$1
 if (( $(echo "$disk_size_gib <= 1.5" | bc -l) )); then
 echo "32G"
 elif (( $(echo "$disk_size_gib <= 4" | bc -l) )); then
 echo "64G"
 elif (( $(echo "$disk_size_gib <= 10" | bc -l) )); then
 echo "128G"
 else
 echo "512G"
 fi
}

# Function to partition HDDs
partition_hdd() {
 local DISK=$1
 local SWAP_SIZE=$2
 partprobe "$DISK"
 zpool labelclear -f "$DISK"
 wipefs -af "$DISK"
 sgdisk --zap-all "$DISK"
 sgdisk -og "$DISK"
# sgdisk --new=1:0:+2M --typecode=1:$GUID_BIOS_BOOT --change-name=1:"BIOS Boot" "$DISK"
 sgdisk -n 1:2048:4095 -c 1:"BIOS Boot Partition" -t 1:ef02 "$DISK"
 sgdisk --new=2:0:+4G --typecode=2:$GUID_XBOOTLDR --change-name=2:"XBOOTLDR" "$DISK"
 sgdisk --new=3:0:+200M --typecode=3:$GUID_APPLE_BOOT --change-name=3:"Apple Boot" "$DISK"
 sgdisk --new=4:0:+128M --typecode=4:$GUID_MS_RESERVED --change-name=4:"MS Reserved" "$DISK"
 sgdisk --new=5:0:+450M --typecode=5:$GUID_WINDOWS_RECOVERY --change-name=5:"Windows Recovery" "$DISK"
 sgdisk --new=6:0:+$SWAP_SIZE --typecode=6:$GUID_SWAP --change-name=6:"Linux Swap" "$DISK"
 ENDSECTOR=$(sgdisk -E "$DISK")
 sgdisk --new=7:0:"$ENDSECTOR" --typecode=7:$GUID_ZFS --change-name=7:"ZFS Data" "$DISK"
# sgdisk --new=7:0:0 --typecode=7:$GUID_ZFS --change-name=7:"ZFS Data" "$DISK"
 sgdisk -p "$DISK"
 partprobe "$DISK"
}

# Function to partition NVMe
partition_nvme() {
 local DISK=$1

 # Get disk size in GiB
 local DISK_SIZE_BYTES=$(lsblk -b -dn -o SIZE "$DISK")
 local DISK_SIZE_GIB=$(echo "scale=2; $DISK_SIZE_BYTES / (1024^3)" | bc)

 # Calculate sizes
 local SLOG_SIZE=$(echo "scale=2; $DISK_SIZE_GIB * 0.02" | bc) # 2%
 local L2ARC_SIZE=$(echo "scale=2; $DISK_SIZE_GIB * 0.30" | bc) # 30%
 local SPECIAL_SIZE=$(echo "scale=2; $DISK_SIZE_GIB * 0.10" | bc) # 10%

 # Convert to GiB with rounding
 SLOG_SIZE=$(printf "%.0f" "$SLOG_SIZE")
 L2ARC_SIZE=$(printf "%.0f" "$L2ARC_SIZE")
 SPECIAL_SIZE=$(printf "%.0f" "$SPECIAL_SIZE")

 # Remaining space after fixed partitions and ZFS components
 local FIXED_SIZE_MB=0
 FIXED_SIZE_MB=$((FIXED_SIZE_MB + 2)) # BIOS Boot
 FIXED_SIZE_MB=$((FIXED_SIZE_MB + 4096)) # XBOOTLDR
 FIXED_SIZE_MB=$((FIXED_SIZE_MB + 200)) # Apple Boot
 FIXED_SIZE_MB=$((FIXED_SIZE_MB + 128)) # MS Reserved
 FIXED_SIZE_MB=$((FIXED_SIZE_MB + 450)) # Windows Recovery

 local SWAP_SIZE_MB=$(echo "$SWAP_SIZE" | sed 's/G/*1024/' | bc)
 FIXED_SIZE_MB=$(echo "$FIXED_SIZE_MB + $SWAP_SIZE_MB" | bc)

 local TOTAL_SIZE_MB=$(echo "$DISK_SIZE_GIB * 1024" | bc)
 local REMAINING_MB=$(echo "$TOTAL_SIZE_MB - $FIXED_SIZE_MB - ($SLOG_SIZE * 1024) - ($L2ARC_SIZE * 1024) - ($SPECIAL_SIZE * 1024)" | bc)

 # Assign remaining to ZFS Data
 local ZFS_DATA_SIZE_MB=$(echo "$REMAINING_MB" | bc)

 # Create partitions
 partprobe "$DISK"
 zpool labelclear -f "$DISK"
 wipefs -af "$DISK"
 sgdisk --zap-all "$DISK"
 sgdisk -o "$DISK"
# sgdisk --new=1:0:+2M --typecode=1:$GUID_BIOS_BOOT --change-name=1:"BIOS Boot" "$DISK"
 sgdisk -n 1:2048:4095 -c 1:"BIOS Boot Partition" -t 1:ef02 "$DISK"
 sgdisk --new=2:0:+4G --typecode=2:$GUID_XBOOTLDR --change-name=2:"XBOOTLDR" "$DISK"
 sgdisk --new=3:0:+200M --typecode=3:$GUID_APPLE_BOOT --change-name=3:"Apple Boot" "$DISK"
 sgdisk --new=4:0:+128M --typecode=4:$GUID_MS_RESERVED --change-name=4:"MS Reserved" "$DISK"
 sgdisk --new=5:0:+450M --typecode=5:$GUID_WINDOWS_RECOVERY --change-name=5:"Windows Recovery" "$DISK"
 sgdisk --new=6:0:+${SWAP_SIZE}G --typecode=6:$GUID_SWAP --change-name=6:"Linux Swap" "$DISK"
 sgdisk --new=7:0:+${SLOG_SIZE}G --typecode=7:$GUID_ZFS --change-name=7:"ZFS SLOG" "$DISK"
 sgdisk --new=8:0:+${L2ARC_SIZE}G --typecode=8:$GUID_ZFS --change-name=8:"ZFS L2ARC" "$DISK"
 sgdisk --new=9:0:+${SPECIAL_SIZE}G --typecode=9:$GUID_ZFS --change-name=9:"ZFS Special" "$DISK"
 ENDSECTOR=$(sgdisk -E "$DISK")
 sgdisk --new=10:0:"$ENDSECTOR" --typecode=10:$GUID_ZFS --change-name=10:"ZFS Dedup" "$DISK"
# sgdisk --new=10:0:0 --typecode=10:$GUID_ZFS --change-name=10:"ZFS Data" "$DISK"
 sgdisk -p "$DISK"
 partprobe "$DISK"
}

# Partition HDDs
for DISK in "${HDD_DISKS[@]}"; do
 DISK_SIZE_BYTES=$(lsblk -b -dn -o SIZE "$DISK")
 DISK_SIZE_GIB=$(echo "scale=2; $DISK_SIZE_BYTES / (1024^3)" | bc)
 SWAP_SIZE=$(get_swap_size "$DISK_SIZE_GIB")
 partition_hdd "$DISK" "$SWAP_SIZE"
done

# Partition NVMe
for DISK in "${NVME_DISKS[@]}"; do
 partition_nvme "$DISK"
done

# Inform kernel of partition changes
#echo partprobe

# Format swap partitions and enable
for DISK in "${HDD_DISKS[@]}" "${NVME_DISKS[@]}"; do
 SWAP_PART="${DISK}-part6"
#echo mkswap "$SWAP_PART"
#echo swapon "$SWAP_PART"
done

# Create RAID0 arrays for log, cache, special on NVMe
#echo mdadm --create --verbose /dev/md0 --level=0 --raid-devices=3 "${NVME_DISKS[0]}-part7" "${NVME_DISKS[1]}-part7" "${NVME_DISKS[2]}-part7 ${NVME_DISKS[3]}-part7" "${NVME_DISKS[4]}-part7" "${NVME_DISKS[5]}-part7"
#echo mdadm --create --verbose /dev/md1 --level=0 --raid-devices=3 "${NVME_DISKS[0]}-part8" "${NVME_DISKS[1]}-part8" "${NVME_DISKS[2]}-part8 ${NVME_DISKS[3]}-part8" "${NVME_DISKS[4]}-part8" "${NVME_DISKS[5]}-part8"
#echo mdadm --create --verbose /dev/md2 --level=0 --raid-devices=3 "${NVME_DISKS[0]}-part9" "${NVME_DISKS[1]}-part9" "${NVME_DISKS[2]}-part9 ${NVME_DISKS[3]}-part9" "${NVME_DISKS[4]}-part9" "${NVME_DISKS[5]}-part9"

# Wait for RAID arrays to initialize
#sleep 10

# Create ZFS pool
#echo zpool create zfs_pool raidz0 "${HDD_DISKS[@]/%/-part7}" log "${NVME_DISKS[0]}-part7" "${NVME_DISKS[1]}-part7" "${NVME_DISKS[2]}-part7 ${NVME_DISKS[3]}-part7" "${NVME_DISKS[4]}-part7" "${NVME_DISKS[5]}-part7" cache "${NVME_DISKS[0]}-part8" "${NVME_DISKS[1]}-part8" "${NVME_DISKS[2]}-part8 ${NVME_DISKS[3]}-part8" "${NVME_DISKS[4]}-part8" "${NVME_DISKS[5]}-part8" special "${NVME_DISKS[0]}-part9" "${NVME_DISKS[1]}-part9" "${NVME_DISKS[2]}-part9 ${NVME_DISKS[3]}-part9" "${NVME_DISKS[4]}-part9" "${NVME_DISKS[5]}-part9"
#echo "ZFS pool 'zfs_pool' created successfully with log, cache, and special on RAID0 arrays."


#mkswap /dev/disk/by-id/ata-WDC_WD4003FRYZ-01F0DB0_VBGGLSNF-part6
#mkswap /dev/disk/by-id/ata-WDC_WD4003FRYZ-01F0DB0_VBGGL0RF-part6
#mkswap /dev/disk/by-id/ata-TOSHIBA_HDWR11A_X1K0A036FB4G-part6
#mkswap /dev/disk/by-id/ata-TOSHIBA_HDWR11A_X1K0A031FB4G-part6
#mkswap /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_1TB_S467NX0K822865W-part6
#mkswap /dev/disk/by-id/nvme-CT2000P3PSSD8_2305E6A607AC-part6
#mkswap /dev/disk/by-id/nvme-WD_Blue_SN580_2TB_23306X800120-part6
#mkswap /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S6Z2NF0X200223V-part6
#mkswap /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221858P-part6
#mkswap /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221870V-part6

#zpool destroy -f mypool


zpool create \
 -f \
 -m none \
 -R /mnt \
 -t mypool \
 -o ashift=12 \
 -o autoexpand=on \
 -o autoreplace=on \
 -o autotrim=on \
 -o cachefile=/etc/zfs/zpool.cache \
 -o comment="My zfs pool" \
 -o delegation=on \
 -o failmode=continue \
 -o feature@allocation_classes=enabled \
 -o feature@async_destroy=enabled \
 -o feature@bookmarks=enabled \
 -o feature@bookmark_v2=enabled \
 -o feature@bookmark_written=enabled \
 -o feature@device_rebuild=enabled \
 -o feature@device_removal=enabled \
 -o feature@draid=enabled \
 -o feature@edonr=enabled \
 -o feature@embedded_data=enabled \
 -o feature@empty_bpobj=enabled \
 -o feature@enabled_txg=enabled \
 -o feature@encryption=enabled \
 -o feature@extensible_dataset=enabled \
 -o feature@filesystem_limits=enabled \
 -o feature@hole_birth=enabled \
 -o feature@large_blocks=enabled \
 -o feature@large_dnode=enabled \
 -o feature@livelist=enabled \
 -o feature@log_spacemap=enabled \
 -o feature@lz4_compress=enabled \
 -o feature@multi_vdev_crash_dump=enabled \
 -o feature@obsolete_counts=enabled \
 -o feature@project_quota=enabled \
 -o feature@redacted_datasets=enabled \
 -o feature@redaction_bookmarks=enabled \
 -o feature@resilver_defer=enabled \
 -o feature@sha512=enabled \
 -o feature@skein=enabled \
 -o feature@spacemap_histogram=enabled \
 -o feature@spacemap_v2=enabled \
 -o feature@userobj_accounting=enabled \
 -o feature@zpool_checkpoint=enabled \
 -o feature@zstd_compress=enabled \
 -o listsnapshots=on \
 -o multihost=on \
 -O aclinherit=restricted \
 -O aclmode=groupmask \
 -O acltype=posixacl \
 -O atime=on \
 -O canmount=noauto \
 -O casesensitivity=sensitive \
 -O checksum=sha256 \
 -O compression=lz4 \
 -O copies=1 \
 -O dedup=sha256,verify \
 -O devices=on \
 -O dnodesize=auto \
 -O encryption=off \
 -O exec=on \
 -O filesystem_limit=none \
 -O logbias=throughput \
 -O mountpoint=legacy \
 -O nbmand=on \
 -O normalization=formD \
 -O overlay=on \
 -O primarycache=all \
 -O quota=none \
 -O readonly=off \
 -O recordsize=1M \
 -O redundant_metadata=some \
 -O refquota=none \
 -O relatime=on \
 -O reservation=none \
 -O secondarycache=all \
 -O setuid=on \
 -O sharenfs=on \
 -O sharesmb=on \
 -O snapdev=visible \
 -O snapdir=visible \
 -O snapshot_limit=none \
 -O sync=disabled \
 -O version=current \
 -O volmode=full \
 -O vscan=on \
 -O xattr=sa \
 zfs_pool draid \
 /dev/disk/by-id/ata-WDC_WD4003FRYZ-01F0DB0_VBGGLSNF-part7 /dev/disk/by-id/ata-WDC_WD4003FRYZ-01F0DB0_VBGGL0RF-part7 /dev/disk/by-id/ata-TOSHIBA_HDWR11A_X1K0A036FB4G-part7 /dev/disk/by-id/ata-TOSHIBA_HDWR11A_X1K0A031FB4G-part7 \
 log /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_1TB_S467NX0K822865W-part7 /dev/disk/by-id/nvme-CT2000P3PSSD8_2305E6A607AC-part7 /dev/disk/by-id/nvme-WD_Blue_SN580_2TB_23306X800120-part7 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S6Z2NF0X200223V-part7 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221858P-part7 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221870V-part7 \
 cache /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_1TB_S467NX0K822865W-part8 /dev/disk/by-id/nvme-CT2000P3PSSD8_2305E6A607AC-part8 /dev/disk/by-id/nvme-WD_Blue_SN580_2TB_23306X800120-part8 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S6Z2NF0X200223V-part8 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221858P-part8 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221870V-part8 \
 special /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_1TB_S467NX0K822865W-part9 /dev/disk/by-id/nvme-CT2000P3PSSD8_2305E6A607AC-part9 /dev/disk/by-id/nvme-WD_Blue_SN580_2TB_23306X800120-part9 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S6Z2NF0X200223V-part9 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221858P-part9 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221870V-part9 \
 dedup /dev/disk/by-id/nvme-Samsung_SSD_970_EVO_1TB_S467NX0K822865W-part10 /dev/disk/by-id/nvme-CT2000P3PSSD8_2305E6A607AC-part10 /dev/disk/by-id/nvme-WD_Blue_SN580_2TB_23306X800120-part10 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S6Z2NF0X200223V-part10 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221858P-part10 /dev/disk/by-id/nvme-Samsung_SSD_990_PRO_2TB_S7DNNJ0X221870V-part10 

#
#
#

chroot

Fri, 24 Jan 2025 09:46:30 +0000

author: DominicusIn

chroot

View on GitHub Gist

dnf --releasever='rawhide' --repofrompath='rawhide,http://mirrors.dotsrc.org/fedora-enchilada/linux/development/rawhide/Everything/x86_64/os/' --repofrompath='rawhide-modular,https://mirrors.huaweicloud.com/repository/fedora/development/rawhide/Modular/x86_64/os/' --installroot='/chroot/fedora' --enablerepo='rawhide,rawhide-modular' --setopt=install_weak_deps=True --nogpgcheck install dnf @core 
##dnf install --nogpgcheck --repofrompath 'terra,https://repos.fyralabs.com/terra$releasever' terra-release
debootstrap --verbose --no-check-gpg --no-merged-usr --components="main,contrib,non-free,non-free-firmware" ceres /chroot/devuan http://deb.devuan.org/merged
debootstrap --verbose --components=main,contrib,non-free-firmware,non-free --variant=minbase --merged-usr --force-check-gpg --log-extra-deps stable /chroot/debian https://deb.debian.org/debian
ARCH=amd64 debootstrap --arch=amd64 --verbose --components=main,multiverse,restricted,universe --extra-suites=plucky,plucky-backports,plucky-proposed,plucky-security,plucky-updates,devel-backports,devel-proposed,devel-security,devel-updates,devel --variant=minbase --merged-usr --force-check-sig --force-check-gpg --log-extra-deps --include=build-essential,tasksel,aptitude,mc,htop,most,mosh,screen,tmux plucky /mnt/Ubuntu http://archive.ubuntu.com/ubuntu/
zypper --root /chroot/suse install --allow-vendor-change --allow-arch-change --allow-name-change --allow-downgrade --recommends --force-resolution --auto-agree-with-licenses --replacefiles --no-confirm --force --allow-unsigned-rpm --oldpackage --details zypper
pacman -r /chroot/arch --cachedir=/chroot/arch/var/cache/pacman/pkg --config=/chroot/arch/etc/pacman.conf -Syyuu base base-devel
nixos-generate-config --root /mnt/NixOS; nixos-install --root /mnt/NixOS
guix time-machine -C /mnt/Guix/etc/channels.scm -- system init /mnt/Guix/etc/config.scm /mnt/Guix/

lists

Wed, 23 Oct 2024 11:15:44 +0000

author: DominicusIn

lists

View on GitHub Gist

deb [arch=all,amd64 signed-by=/usr/share/keyrings/prebuilt-mpr-archive-keyring.gpg] https://proget.makedeb.org prebuilt-mpr bookworm
deb [arch=amd64,arm64,armhf] https://packages.microsoft.com/repos/code stable main
deb [arch=amd64] http://dl.google.com/linux/earth/deb/ stable main
deb [arch=amd64] https://dl.google.com/linux/chrome/deb/ stable main
deb [arch=amd64] https://packages.microsoft.com/repos/edge/ stable main
deb [arch=amd64] https://repo.vivaldi.com/snapshot/deb/ stable main
deb [arch=amd64] https://repo.vivaldi.com/stable/deb/ stable main
deb [arch=amd64,i386 signed-by=/usr/share/keyrings/steam.gpg] https://repo.steampowered.com/steam/ beta steam
deb [arch=amd64,i386 signed-by=/usr/share/keyrings/steam.gpg] https://repo.steampowered.com/steam/ stable steam
deb [arch=amd64 signed-by=/etc/apt/keyrings/liquorix-keyring.gpg] https://liquorix.net/debian sid main
deb [arch=amd64 signed-by=/etc/apt/keyrings/liquorix-keyring.gpg] https://liquorix.net/debian stable main
deb [arch=amd64 signed-by=/etc/apt/keyrings/liquorix-keyring.gpg] https://liquorix.net/debian testing main
deb [arch=amd64 signed-by=/etc/apt/keyrings/liquorix-keyring.gpg] https://liquorix.net/debian unstable main
deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/keybase.gpg] http://prerelease.keybase.io/deb stable main
deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg] http://download.proxmox.com/debian/pve bookworm pvetest pve-no-subscription
deb [arch=amd64 signed-by=/usr/share/keyrings/brave-browser-archive-keyring.gpg] https://brave-browser-apt-release.s3.brave.com/ stable main
deb [arch=amd64 signed-by=/usr/share/keyrings/brave-browser-nightly-archive-keyring.gpg] https://brave-browser-apt-nightly.s3.brave.com/ stable main
deb [arch=amd64 signed-by=/usr/share/keyrings/oracle-virtualbox-2016.gpg] https://download.virtualbox.org/virtualbox/debian bookworm contrib
deb [arch=amd64 signed-by=/usr/share/keyrings/seafile-keyring.asc] https://linux-clients.seafile.com/seafile-deb/bookworm/ stable main
deb https://deb.debian.org/debian/ bookworm-proposed-updates main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ bullseye-backports main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ experimental main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ oldoldstable main contrib non-free
deb https://deb.debian.org/debian/ oldoldstable-proposed-updates main contrib non-free
deb https://deb.debian.org/debian/ oldoldstable-updates main contrib non-free
deb https://deb.debian.org/debian/ oldstable-backports-sloppy main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ oldstable main contrib non-free
deb https://deb.debian.org/debian/ oldstable-proposed-updates main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ oldstable-updates main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ rc-buggy main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ sid main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ stable-backports main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ stable-backports-sloppy main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ stable main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ stable-updates main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ testing-backports main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ testing main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ testing-proposed-updates main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ testing-updates main contrib non-free-firmware non-free
deb https://deb.debian.org/debian/ unstable main contrib non-free-firmware non-free
deb https://deb.opera.com/opera-beta/ stable non-free #Opera Browser (final releases)
deb https://deb.opera.com/opera-developer/ stable non-free #Opera Browser (final releases)
deb https://deb.opera.com/opera-stable/ stable non-free #Opera Browser (final releases)
deb https://download.sublimetext.com/ apt/dev/
deb https://ftp.gwdg.de/pub/linux/siduction/extra unstable main
deb https://ftp.gwdg.de/pub/linux/siduction/fixes unstable main
deb https://incoming.debian.org/debian-buildd buildd-unstable main contrib non-free-firmware non-free
deb https://www.bchemnet.com/suldr/ debian extra
deb https://www.deb-multimedia.org experimental main
deb https://www.deb-multimedia.org oldoldstable-backports main
deb https://www.deb-multimedia.org oldoldstable main non-free
deb https://www.deb-multimedia.org sid main non-free
deb https://www.deb-multimedia.org stable-backports main
deb https://www.deb-multimedia.org stable main non-free
deb https://www.deb-multimedia.org testing main non-free
deb [signed-by=/etc/apt/trusted.gpg.d/agp-debian-key.gpg] http://ag-projects.com/debian stable main
deb [signed-by=/etc/apt/trusted.gpg.d/agp-debian-key.gpg] http://ag-projects.com/debian unstable main
deb [signed-by=/usr/share/keyrings/cuda-archive-keyring.gpg] https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64/ /
deb [signed-by=/usr/share/keyrings/indexdata.gpg] https://ftp.indexdata.com/debian bullseye main
deb [signed-by=/usr/share/keyrings/jetbrains-ppa-archive-keyring.gpg] http://jetbrains-ppa.s3-website.eu-central-1.amazonaws.com any main
deb [signed-by=/usr/share/keyrings/makedeb-archive-keyring.gpg arch=all] https://proget.makedeb.org makedeb main
deb [signed-by=/usr/share/keyrings/meganz-archive-keyring.gpg] https://mega.nz/linux/repo/Debian_testing/ ./
deb [signed-by=/usr/share/keyrings/xanmod-archive-keyring.gpg] http://deb.xanmod.org releases main
deb [signed-by=/usr/share/keyrings/zotero-archive-keyring.gpg by-hash=force] https://zotero.retorque.re/file/apt-package-archive ./
deb-src [arch=amd64 signed-by=/etc/apt/keyrings/liquorix-keyring.gpg] https://liquorix.net/debian sid main

gcloud cheat sheet

Thu, 25 Jul 2019 01:55:00 +0000

author: DominicusIn

References
#

Other cheatsheets
#

https://github.com/dennyzhang/cheatsheet-gcp-A4

multiple gcloud config configurations
#

gcloud config configurations create pythonrocks
gcloud config configurations list
gcloud config configurations activate pythonrocks
gcloud config set core/account pythonrocks@gmail.com
gcloud auth login
gcloud projects list
gcloud config set project dev-193420

switch gcloud context with gcloud config
#

gcloud config list
gcloud config set account pythonrocksk8s201702@gmail.com 
gcloud config set project salt-163215
gcloud config set compute/region us-west1
gcloud config set compute/zone us-west1-a
alias demo='gcloud config set account pythonrocksk8s201702@gmail.com && gcloud config set project salt-163215 && gcloud config set compute/region us-west1 && gcloud config set compute/zone us-west1-a'


cluster=$(gcloud config get-value container/cluster 2> /dev/null)
zone=$(gcloud config get-value compute/zone 2> /dev/null)
project=$(gcloud config get-value core/project 2> /dev/null)

# switch project based on the name
gcloud config set project $(gcloud projects list --filter='name:wordpress-dev' --format='value(project_id)')

command -v gcloud >/dev/null 2>&1 || { \
 echo >&2 "I require gcloud but it's not installed. Aborting."; exit 1; }

REGION=$(gcloud config get-value compute/region)
if [[ -z "${REGION}" ]]; then
 echo "https://cloud.google.com/compute/docs/regions-zones/changing-default-zone-region" 1>&2
 echo "gcloud cli must be configured with a default region." 1>&2
 echo "run 'gcloud config set compute/region REGION'." 1>&2
 echo "replace 'REGION' with the region name like us-west1." 1>&2
 exit 1;
fi

auth
#

gcloud auth list
gcloud auth login
gcloud auth activate-service-account --key-file=sa_key.json

kubectl uses OAuth token generated by

dpiblock

Fri, 10 Nov 2017 16:58:00 +0000

author: DominicusIn

Провайдеры Российской Федерации, в большинстве своем, применяют системы глубокого анализа трафика (DPI, Deep Packet Inspection) для блокировки сайтов, внесенных в реестр запрещенных. Не существует единого стандарта на DPI, есть большое количество реализации от разных поставщиков DPI-решений, отличающихся по типу подключения и типу работы.

Существует два распространенных типа подключения DPI: пассивный и активный.

Пассивный DPI

Пассивный DPI — DPI, подключенный в провайдерскую сеть параллельно (не в разрез) либо через пассивный оптический сплиттер, либо с использованием зеркалирования исходящего от пользователей трафика. Такое подключение не замедляет скорость работы сети провайдера в случае недостаточной производительности DPI, из-за чего применяется у крупных провайдеров. DPI с таким типом подключения технически может только выявлять попытку запроса запрещенного контента, но не пресекать ее. Чтобы обойти это ограничение и заблокировать доступ на запрещенный сайт, DPI отправляет пользователю, запрашивающему заблокированный URL, специально сформированный HTTP-пакет с перенаправлением на страницу-заглушку провайдера, словно такой ответ прислал сам запрашиваемый ресурс (подделывается IP-адрес отправителя и TCP sequence). Из-за того, что DPI физически расположен ближе к пользователю, чем запрашиваемый сайт, подделанный ответ доходит до устройства пользователя быстрее, чем настоящий ответ от сайта.

Выявляем и блокируем пакеты пассивного DPI

Поддельные пакеты, формируемые DPI, легко обнаружить анализатором трафика, например, Wireshark.
Пробуем зайти на заблокированный сайт:

Мы видим, что сначала приходит пакет от DPI, с HTTP-перенаправлением кодом 302, а затем настоящий ответ от сайта. Ответ от сайта расценивается как ретрансмиссия и отбрасывается операционной системой. Браузер переходит по ссылке, указанной в ответе DPI, и мы видим страницу блокировки.

Рассмотрим пакет от DPI подробнее:

HTTP/1.1 302 Found
Connection: close
Location: http://warning.rt.ru/?id=17&st=0&dt=195.82.146.214&rs=http%3A%2F%2Frutracker.org%2F

В ответе DPI не устанавливается флаг «Don't Fragment», и в поле Identification указано 1. Серверы в интернете обычно устанавливают бит «Don't Fragment», и пакеты без этого бита встречаются нечасто. Мы можем использовать это в качестве отличительной особенности пакетов от DPI, вместе с тем фактом, что такие пакеты всегда содержат HTTP-перенаправление кодом 302, и написать правило iptables, блокирующее их:

# iptables -A FORWARD -p tcp --sport 80 -m u32 --u32 "0x4=0x10000 && 0x60=0x7761726e && 0x64=0x696e672e && 0x68=0x72742e72" -m comment --comment "Rostelecom HTTP" -j DROP

Что это такое? Модуль u32 iptables позволяет выполнять битовые операции и операции сравнения над 4-байтовыми данными в пакете. По смещению 0x4 хранится 2-байтное поле Indentification, сразу за ним идут 1-байтные поля Flags и Fragment Offset.
Начиная со смещения 0x60 расположен домен перенаправления (HTTP-заголовок Location).
Если Identification = 1, Flags = 0, Fragment Offset = 0, 0x60 = «warn», 0x64 = «ing.», 0x68 = «rt.ru», то отбрасываем пакет, и получаем настоящий ответ от сайта.

В случае с HTTPS-сайтами, DPI присылает TCP Reset-пакет, тоже с Identification = 1 и Flags = 0.

Активный DPI

Активный DPI — DPI, подключенный в сеть провайдера привычным образом, как и любое другое сетевое устройство. Провайдер настраивает маршрутизацию так, чтобы DPI получал трафик от пользователей к заблокированным IP-адресам или доменам, а DPI уже принимает решение о пропуске или блокировке трафика. Активный DPI может проверять как исходящий, так и входящий трафик, однако, если провайдер применяет DPI только для блокирования сайтов из реестра, чаще всего его настраивают на проверку только исходящего трафика.

Системы DPI разработаны таким образом, чтобы обрабатывать трафик с максимально возможной скоростью, исследуя только самые популярные и игнорируя нетипичные запросы, даже если они полностью соответствуют стандарту.

Изучаем стандарт HTTP

Типичные HTTP-запросы в упрощенном виде выглядят следующим образом:

GET / HTTP/1.1
Host: habrahabr.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/50.0
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

Запрос начинается с HTTP-метода, затем следует один пробел, после него указывается путь, затем еще один пробел, и заканчивается строка протоколом и переносом строки CRLF.
Заголовки начинаются с большой буквы, после двоеточия ставится символ пробела.

Давайте заглянем в последнюю версию стандарта HTTP/1.1 от 2014 года. Согласно RFC 7230, HTTP-заголовки не зависят от регистра символов, а после двоеточия может стоять произвольное количество пробелов (или не быть их вовсе).

 Each header field consists of a case-insensitive field name followed
 by a colon (":"), optional leading whitespace, the field value, and
 optional trailing whitespace.
 header-field = field-name ":" OWS field-value OWS

 field-name = token
 field-value = *( field-content / obs-fold )
 field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
 field-vchar = VCHAR / obs-text

 obs-fold = CRLF 1*( SP / HTAB )
 ; obsolete line folding</code></pre><br>

OWS — опциональный один или несколько символов пробела или табуляции, SP — одинарный символ пробела, HTAB — табуляция, CRLF — перенос строки и возврат каретки (\r\n).



Это значит, что запрос ниже полностью соответствует стандарту, его должны принять многие веб-серверы, придерживающиеся стандарта:



Prepare my Windows workstation
Sun, 05 Nov 2017 23:27:00 +0000
author: DominicusIn

Prepare my Windows workstation
 
 
 
 #
 
 


Identification
 
 
 
 #
 
 


Name: HP Z210 Convertible Minitower Base Model Workstation
Model #: XM856AV
Serial #: CZC13941PV


Windows 10 “Light”
 
 
 
 #
 
 

Download Windows 10 ISO tool from Microsoft


First post
Thu, 19 Nov 2015 01:41:00 +0000
author: DominicusIn
Domini’s Simple Blog
Hello everyone, I’m dominicusin l’esprit de mort Which way did the extinguished fire go? Honi soit qui mal y pens herzlich willkommen bei सच्चिदानंद Activity: ♡ umbra mortis ♧ Temet Nosce ♢ Hic locus est, ubi mors gaudet succurrere vitae ♤ Separabis terram ab igne, subtile a spisso, suaviter mango cum inqenio Interests: commedia dell’arte, triathlon, burning hearts with a soldering iron on a cake, guilloche The favorite music: Wu-Tang Clan

Notes on Dominicus In

Blog

channels.scm

dns

arch

flatpaks

ed's

gistfile1 txt

zpool create

chroot

lists

gcloud cheat sheet

References #

Other cheatsheets #

multiple gcloud config configurations #

switch gcloud context with gcloud config #

auth #

dpiblock

Пассивный DPI

Выявляем и блокируем пакеты пассивного DPI

Активный DPI

Изучаем стандарт HTTP

Prepare my Windows workstation

Prepare my Windows workstation #

Identification #

Windows 10 “Light” #

First post

References
#

Other cheatsheets
#

multiple gcloud config configurations
#

switch gcloud context with gcloud config
#

auth
#

Prepare my Windows workstation
#

Identification
#

Windows 10 “Light”
#