alavi.me - note

My Checklist And Tips For Server Setup

2025-02-21T00:00:00+00:00

Disclaimer: I'm by no means a professional systems administrator or DevOps engineer. I'm a software engineer that works a lot on servers.

These are just how I do things. Maybe not necessarily the best way or even the correct way. But I will be updating and refining this post as I learn more (or post them in separate new posts).

I will be very happy if you share your own tips and tricks with me(contact me)

Linux distribution preferences

If I want to work with a server with more than 4GiB of ram and I know that there will be many use cases for that server, I will go with Debian Linux. It is true and tested, stable and has good community support and resources for server use cases.

If the server is limited on resources, and it will be used for specific things like only containerization or only a single service, I will go with Alpine Linux. It is super lightweight and the package manager apk is so fast, it's unbelievable.

But for most cases, for the checklist and tips here the Linux distribution doesn't matter that much. So let's get started.

First tools to install

You can install all the tools on debian with this command:

sudo apt install neovim tmux nnn lnav btop

neovim

There is no way I am editing any text without my neovim. When you have a good editor that you are efficient with, editing config files and searching around the server becomes so much faster and less tiring.

Tmux

Tmux is an absolute life saver when SSH-ing into servers. The fact that you might get disconnected from the SSH server and don't lose any work is amazing, The way it lets you have multiple panes and windws and sessions is amazing, it just makes working on servers so much easier and more enjoyable. I hate the default tmux keymaps, so I always import my own config.

NOTE: You can also use Wezterm for multiplexing. Using wezterm ssh <user>@<domain/ip> will multiplex the SSH connection, but if a Wezterm daemon isn't installed and running on the host, The sessions will get destroyed. So this isn't as good as the Tmux method, since even with the daemon you have to install wezterm on both the client and the host. But it's good for simple sessions that don't have Tmux installed.

btop

Yes, htop is cool and all, but honestly the usability and information that btop provides is on another level. I install btop on anything I use, and it is the only "task manager" that I need.

nnn

Exploring files on a server can be a real pain, so I always install nnn to easily navigate and manipulate files and directories on my servers.

I used to use ranger but the instability of python and constant bugs and crashes really got on my nerves. I realized why you really shouldn't make TUI/CLI tools with python. nnn is much more stable and written in C.

I also looked into yazi but it really doesn't seem stable(I don't care that it's written in Rust) and the development approach doesn't seem to have stability and simplicity in mind(it's on version 25 and had 25 releases. A major release with every release!)

lnav

No more cat and tail for logs. Super useful for navigating logs and debugging.

lnav

firewalld

NOTE: ufw does not work with docker and docker bypasses the firewall. (see github issue) although you can use a tool like ufw-docker

NOTE: Remember to configure firewall for docker

NOTE: It's much better to use podman in production

These below articles provide good information on this matter https://docs.docker.com/engine/network/packet-filtering-firewalls/

https://dev.to/soerenmetje/how-to-secure-a-docker-host-using-firewalld-2joo

firewalld

honorable mentions

trash-cli on a server might sound strange, but honestly I think it's just good practice to use rm less and less. Why take unneeded risks? Recently, I accidentally ran rm -rf /* instead of rm -rf ./* and made a pinky promise to myself that I will only use trash from now on. There isn't a downside that I can think of. Only more safety.
rsync can be very useful if you want to transfer lots of files, much faster and better than scp

Server configurations

Update and upgrade the server
Set datetime and timezone
Setup firewall
- Allow ssh port
- Deny all incoming, allow all outgoing
Setup SSH
- Copy ssh key to server: ssh-copy-id -i ~/.ssh/[key name].pub [user]@[server ip]
- disable root login
- enable ssh-key auth
- disable password auth
Make sure swap is enabled
Set hostname
Enable and configure unattended-upgrades
- debian wiki
- sudo apt install unattended-upgrades apt-listchange
- Edit /etc/apt/apt.conf.d/50unattended-upgrades to send emails on upgrades and errors (setup a mail server)
- Enable automatic upgrades sudo dpkg-reconfigure -plow unattended-upgrades

Tips

Neovim as terminal multiplexer

When you realize that 90% of the work that you do on a server can be achieved from a neovim session, It really makes things a lot easier. You can use the netrw file explorer built within vim to explore files, use :term for a terminal within your neovim, and create splits (C-w) and tabs (:tabnew). So if you have a raw server with only vim, you have most of the things that you need right there. The tools that I listed prior are super useful and make things a lot easier and better, but if you want to keep it minimal, a lot can be done with just vim. Remember that more complete multiplexers like tmux also have sessions, meaning you can disconnect from the SSH and reconnect later and don't lose any work.

Consider podman instead of docker

Podman has a lot of benefits over docker. I haven't tested podman in serious conditions yet, but it seems like it is pretty mature. If feasible, it is a more desirable option.

5 reasons to choose podman in 2025 - redhat

podman vs docker comparison - geekygadgets

ultimate docker to podman migration guide

how to transition from docker to podman

Consider automation

If you setup a lot of servers(I don't. Maybe 10/year) consider automating your repetitive tasks. Automation can be achieved with tools like Ansible or simple bash/sh scripts.

Backups and snapshots

You don't notice that backups are important until you need them.

Try to keep the 3-2-1 principle in mind:

Three copies of your data: Your three copies include your original or production data plus two more copies.

On two different media: You should store your data on two different forms of media. This means something different today than it did in the late 2000s. I’ll talk a little more about this in a bit.

One copy off-site: You should keep one copy of your data off-site in a remote location, ideally more than a few miles away from your other two copies.[source]

I finally realized that for taking backups, you don't have strict how-tos. It very much depends on your use case and situation. Just be sure that you take backups from parts of the system that you can't afford to lose.

You also most likely will need custom bash scripts for taking backups, depending on the services running on the server. So don't try to find a "do it all" tool that just magically "does backups".

Here are some good tools that can help the backup process:

Understanding Sample Rate, Bit Rate And Bit Depth

2024-10-01T00:00:00+00:00

These are my notes as a software engineer on understanding Sample rate, bit rate and bit depth.

The explanations might seem incoherent at first, but I think if you read the whole post it becomes more clear. Also read the relevant and good posts for some other explanations from other perspectives.

The notes are written in an outline style.

Our World Is Continuous (Analog)

Sounds in our world are analog. The sounds that you hear or the sounds that you make are all analog signals
Analog signals happen in continuous time. Meaning, if we want to draw a diagram of the signal representing it's intensity on one axis and time on another (A signal is a series of changes in time), the diagram would look like this:
In order for these signals to be understood, used and processed in our digital devices (phones, PC, TV, etc.) they should be converted into digital signals, used within the device and then either be sent to another digital medium, or be converted to an analog signal again and then sent to an analog medium (Digital signals are explained later).
Example from sound:

Your voice(analog) -> travels through air to reach microphone(analog) -> microphone vibrates (analog) -> gets converted to digital -> sent as digital signal to a speaker via a digital medium (digital signals on a wire)-> the speaker vibrates the air in a way that recreates your voice (analog) -> travels through air (analog) -> The listener's ear picks up the vibrations(analog) -> Signals in nervous system (?)

Time, As we define it, is continuous(or as continuous as it gets) so anything happening in our world is continuous, since it happens in time.

Also note that all of the things that I said might not be true, since we really don't have a concrete definition of what time is, and the line between continuity and being discrete is blurry(like most other things in our world).

What Are Digital Signals?

A digital signal is a type of discrete signal(as opposed to continuous ).
Discrete signal: we will ignore the continuity of time, and assume that time happens in discrete amounts. So there will be nothing there between time 1 and time 2.
Now digital means: our time is discrete, and our intensities are also discrete
In digital signal processing, a digital signal is a representation of a physical(analog) signal that is sampled and quantized. A digital signal is an abstraction that is discrete in time and amplitude. [1]

See how in the above diagram, no values can exist between the defined values.

How To Convert Analog Signal To Digital Signal

Now, With that explanation of digital signals, we can understand the basics of how we convert analog signal to digital:
- In discrete time intervals (for example every second), we will sample our signal. Meaning, we will measure it at that moment. This is called our sample rate (here our sample rate is 1 sample per second)
- Now that we took the sample, since our original signal is continuous, our measured intensity value is a Real number($\mathbb{R}$) and can be something like 0.333333.... or $\pi$ (3.14...), we cannot use that number in our digital system! So we have to round it to a defined value.
- Imagine our digital signal graph as a checkered graph. The vertical lines are your time intervals (sample rate as we defined earlier) and the vertical lines are your defined values, to which you will round your intensities. The more dense the vertical lines are, the higher your sample rate. And the more dense your horizontal lines, the higher accuracy for rounding your intensities you have (Bit depth)
- Analog signal:
- Digital signal with lower bit depth and sample rate ( we consider the thicker lines as our bit depth and sample rate values in this example ):
- Digital signal with higher bit depth and sample rate ( all lines are considered as our bit depth and sample rate values):
- Notice how as we raise the sample rate and bit depth, we get closer to our actual analog signal

Why Is It Called "bit depth"?

A "bit" is the smallest value in a digital system. It's either 0 or 1
One bit can represent 2 values, and 2 bits can represent 4 values. The general rule is with $n$ bits we can represent $2^n$ values.
Bit depth refers to "how many bits do we have for the number we want to represent our intensity with?" so the more bits we have, more values we can express. So our estimations of our analog signal's intensity becomes more accurate
A 24-bit audio is more accurate in terms of the intensity of each sample than a 16-bit
Example with color: An image with 8-bit depth is more accurate in displaying different intensities (shades) of colors

We can say that:
if (sample_rate $\rightarrow \infty$ and bit_depth $\rightarrow \infty$) then Our signal is analog

What Is "bit rate"?

bit rate (bitrate or as a variable R) is the number of bits that are conveyed or processed per unit of time.[2]
The bit rate is expressed in the unit bit per second (symbol: bit/s), often in conjunction with an SI prefix such as kilo (1 kbit/s = 1,000 bit/s), mega (1 Mbit/s = 1,000 kbit/s), giga (1 Gbit/s = 1,000 Mbit/s) or tera (1 Tbit/s = 1,000 Gbit/s).[2]

Relevant And Good Posts

Sources

Authentication and Authorization: Quick notes

2024-09-14T00:00:00+00:00

These are some quick notes I took(read "copy/pasted") for understanding about auth in general and, the difference between Authentication and Authorization.

What Is Authentication?

image credit: Cloudflare

You go to the airport, the security guy checks your identification card(ID) which contains an identity. Then, the security guy checks your face or fingerprint to make sure you, are truly the owner of that identity (Authentication)
Authentication does not just apply to verifying human users. Computer systems also need to check servers, software, APIs, and other computers to be sure they are who they "say" they are.

How is authentication used in a security context?

Authentication is an important part of identity and access management (IAM), which dictates who can view data and what they can do with it. But it applies to many other areas of security as well, including:
- TLS: Almost all major websites today support Transport Layer Security (TLS). TLS, among other functions, authenticates the identity of a web server to ensure user devices do not load fake websites.
- APIs: Most modern web applications rely on APIs in order to function. Properly secured APIs authenticate both endpoints of the API integration in order to prevent attacks directed at those APIs.
- Email: Emails are authenticated using a process called DomainKey Identified Mail (DKIM). DKIM helps ensure email messages come from servers that are allowed to use the domain (e.g. @cloudflare.com) that the email comes from. Non-authenticated email messages are likely to end up in spam folders

Authentication vs. Authorization

While authentication is concerned with verifying identity, authorization is concerned with permissions, or what someone is allowed to do once they gain access to a protected system or resource.

Authentication	Authorization
users or persons are verified.	users or persons are validated.
It is done before the authorization process.	is done after the authentication process.
It needs usually the user’s login details.	While it needs the user’s privilege or security levels.
determines whether the person is user or not.	determines What permission does the user have?
Password, Paswordless Authentication, 2FA/MFA (Two-Factor Authentication / Multi-Factor Authentication), Single sign-on (SSO)	Role based access control (RBAC), Jason Web Token (JWT), SAML, OpenID, OAuth

What is identity in the context of computing?

A person's entire identity cannot be uploaded and stored in a computer, so "identity" in a computing context means a certain set of properties that can be conveniently measured and recorded digitally.
To verify identity, a computer system will assess a user for characteristics that are specific to them. (authentication factors)
- Something the user knows (e.g. a password)
- Something the user has (e.g. a soft token or hard token)
- Something the user is (e.g. fingerprint, face, biometrics)

sources

How to record meetings with high quality with light software on Linux (Easyeffects + SSR)

2024-08-28T00:00:00+00:00

NOTE: Helvum is a tool for Pipewire so this doesn't apply to systems that only use PulseAudio.

I was having problems with using Simple Screen Recorder(SSR) for recording meetings. Either the input voice from my microphone wouldn't be recorded, or the system sound from my sound card wouldn't be recorded.

I fixed it by using Helvum to connect the output of my microphone, directly to the input of SSR.

And while at it, why not use Easyeffects to get a good quality recording?

My preferred recording setup:

Set input profile of SSR > Audio input > Backend: PulseAudio , Source: Monitor of Built-in Audio Analog Stereo (or monitor of your preferred output device)
For meetings. I also like to scale to video down. More than HD is overkill for a meeting or conference recording in most cases.
Set Output profile of SSR > Video > Codec: Other > Codec name: libx265 (the default is H.246)
Connect "Easyeffect Source" capture channels to "SimpleScreenRecorder" input channels in Helvum

Now the recording consists of your enhanced(denoised, reverb, pitch corrected or whatever you like), plus the sounds coming from your system(your peers talking in a meeting or discord, your game, etc.)

Here is how it looks in Helvum:

NOTE: I installed Helvum from the arch repos but the recommended way(due to Helvum's docs) is flatpak.

NOTE: I use "Deep Noise Remover(DeepFilterNet)" in Easyeffects for noise canceling. It works really good, specially in very noisy environments. I installed it using using arch's AUR package but there are other ways to install it (docs)

I don't think this is necessarily the best way to record things, but it works well enough for me. SSR is very lightweight compared to things like OBS, and Easyeffects is great for controlling and enhancing the sound of your input and output sounds.