https://ygg.cz/en/ A chronological stream of everything — guides, troubleshooting, notes, analyses, projects and curated external sources. en Zdeněk Kubala - CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/) https://ygg.cz/en/note/journalctl-vacuum/ https://ygg.cz/en/note/journalctl-vacuum/ Thu, 10 Sep 2026 00:00:00 GMT note The default journal cap is a tenth of the partition. On a small root that means gigabytes of logs nobody wants. https://ygg.cz/en/project/infrastructure-stabilization/ https://ygg.cz/en/project/infrastructure-stabilization/ Wed, 01 Jul 2026 00:00:00 GMT project Stabilizing an organization’s technical backbone: administration rules, documentation, a platform for testing and hosting, and a link to the infrastructure one level up. https://ygg.cz/en/project/investment-assistant/ https://ygg.cz/en/project/investment-assistant/ Sun, 22 Mar 2026 00:00:00 GMT project Local decision support for a personal investment portfolio: broker data, regular reports and an analytical framework with a traceable history of decisions. https://ygg.cz/en/project/mojewebfoundry/ https://ygg.cz/en/project/mojewebfoundry/ Sat, 22 Aug 2026 00:00:00 GMT project A framework for building several separate static sites on SvelteKit. It came out of moving away from Jekyll and doubles as a way to find out what current tooling can do. https://ygg.cz/en/guide/esp32-rf433-doorbell/ https://ygg.cz/en/guide/esp32-rf433-doorbell/ Wed, 12 Aug 2026 00:00:00 GMT guide How to capture the signal of an ordinary 433 MHz wireless doorbell and send each press to Home Assistant via an ESP32-C3. https://ygg.cz/en/guide/esp32-ir-ceiling-light/ https://ygg.cz/en/guide/esp32-ir-ceiling-light/ Sun, 19 Jul 2026 00:00:00 GMT guide How to capture an infrared remote’s codes and control a light from Home Assistant via an ESP32-C3 – without the physical remote. https://ygg.cz/en/project/ai-projects/ https://ygg.cz/en/project/ai-projects/ Fri, 01 May 2026 00:00:00 GMT project Turning ideas into working solutions with AI – without a programming background, but with architecture, tests and quality checks as in team development. https://ygg.cz/en/note/postfix-spf-macros/ https://ygg.cz/en/note/postfix-spf-macros/ Sun, 01 Feb 2026 00:00:00 GMT note The most common reasons an SPF check rejects mail that is perfectly fine – in the DNS record, in Postfix and in rspamd. https://ygg.cz/en/explainer/dns-delegation/ https://ygg.cz/en/explainer/dns-delegation/ Thu, 01 Jan 2026 00:00:00 GMT explainer DNS is a delegated tree: every zone can hand responsibility one level down. Understand that and you understand why changes propagate slowly and where to look for faults. https://ygg.cz/en/project/multi-tenant-platform/ https://ygg.cz/en/project/multi-tenant-platform/ Wed, 01 Apr 2026 00:00:00 GMT project A web application for multiple organizations on a shared core: separate data and settings for each client, a modular architecture and security from day one. https://ygg.cz/en/link/dia-vyrocni-zprava/ https://ygg.cz/en/link/dia-vyrocni-zprava/ Sun, 01 Mar 2026 00:00:00 GMT link What actually moved in the digitalization of the Czech state – read through the data rather than the press releases. https://ygg.cz/en/reference/nftables-cheat-sheet/ https://ygg.cz/en/reference/nftables-cheat-sheet/ Sun, 01 Mar 2026 00:00:00 GMT reference A reference card for nftables: basic commands, tables and chains, and NAT masquerade for a home router. https://ygg.cz/en/guide/esp32-unknown-display/ https://ygg.cz/en/guide/esp32-unknown-display/ Thu, 26 Feb 2026 00:00:00 GMT guide How to get a TFT display without a datasheet working on an ESP32: identify it, wire it up and initialise it. Based on the E32R35T board with an ST7796S controller. https://ygg.cz/en/link/cadastre-open-data/ https://ygg.cz/en/link/cadastre-open-data/ Thu, 01 Jan 2026 00:00:00 GMT link The Czech register of territorial identification, addresses and real estate as open data – what it contains, how it is distributed and what to watch out for. https://ygg.cz/en/link/how-complex-systems-fail/ https://ygg.cz/en/link/how-complex-systems-fail/ Mon, 01 Dec 2025 00:00:00 GMT link The classic text by R. Cook – why failure never has a single cause. Required reading for anyone who runs systems. https://ygg.cz/en/guide/home-assistant-voice-czech/ https://ygg.cz/en/guide/home-assistant-voice-czech/ Thu, 23 Oct 2025 00:00:00 GMT guide Czech voice control in Home Assistant: local vs. cloud models (Whisper, Piper, Nabu Casa) and custom sentences for energy and the TV through Hassil intents. https://ygg.cz/en/troubleshooting/zha-custom-quirks/ https://ygg.cz/en/troubleshooting/zha-custom-quirks/ Thu, 25 Sep 2025 00:00:00 GMT troubleshooting Three cases of taming Zigbee devices in Home Assistant through a ZHA custom quirk: an mmWave presence sensor, a MOES thermostatic valve and the IKEA SOMRIG button. https://ygg.cz/en/project/smart-home/ https://ygg.cz/en/project/smart-home/ Sun, 01 Jun 2025 00:00:00 GMT project A household run mostly locally: heating by weather and time of day, electricity and gas metering, custom ESP32 devices and notifications on the phone. https://ygg.cz/en/note/ubuntu-25-04-plucky-puffin/ https://ygg.cz/en/note/ubuntu-25-04-plucky-puffin/ Thu, 17 Apr 2025 00:00:00 GMT note A non-LTS release from April 2025: TPM-backed disk encryption in the installer, an official ARM64 desktop, kernel 6.14 with sched_ext, APT 3.0 and the end of apt-key. https://ygg.cz/en/link/cyber-resilience-act/ https://ygg.cz/en/link/cyber-resilience-act/ Tue, 10 Dec 2024 00:00:00 GMT link EU Regulation 2024/2847 on security requirements for products with digital elements – with a note on the original proposal, which all but forgot about open source. https://ygg.cz/en/explainer/selinux-policy-basics/ https://ygg.cz/en/explainer/selinux-policy-basics/ Fri, 01 Nov 2024 00:00:00 GMT explainer How SELinux hangs off the LSM hooks, what the context on every file means, how a module is built from .te and .if, and how a policy bug is actually found. https://ygg.cz/en/link/eidas2-eu-digital-identity-wallet/ https://ygg.cz/en/link/eidas2-eu-digital-identity-wallet/ Mon, 20 May 2024 00:00:00 GMT link A 2024 amendment to the eIDAS regulation sets up the legal framework for a European digital identity wallet that member states must offer to citizens. https://ygg.cz/en/guide/systemd-resolved-split-dns/ https://ygg.cz/en/guide/systemd-resolved-split-dns/ Fri, 10 Nov 2023 00:00:00 GMT guide Making an internal domain resolve through a VPN resolver while the rest of the world stays public. Unfinished – the DNSSEC and fallback parts are missing. https://ygg.cz/en/explainer/disa-stig-applicability/ https://ygg.cz/en/explainer/disa-stig-applicability/ Thu, 02 Feb 2023 00:00:00 GMT explainer What DISA STIGs are, how the CAT I/II/III severity categories are read, and why rules are not applied blindly across the board. https://ygg.cz/en/link/grug-brained-developer/ https://ygg.cz/en/link/grug-brained-developer/ Wed, 01 Jun 2022 00:00:00 GMT link On humility towards complexity – why simplicity is an engineering discipline, not a lack of ambition. https://ygg.cz/en/note/openssh-9-defaults/ https://ygg.cz/en/note/openssh-9-defaults/ Fri, 08 Apr 2022 00:00:00 GMT note An April 2022 release in which scp stopped using the legacy protocol and the default key exchange gained a post-quantum component. https://ygg.cz/en/note/podman-rootless-containers/ https://ygg.cz/en/note/podman-rootless-containers/ Thu, 17 Feb 2022 00:00:00 GMT note A container tool with no permanently running daemon that can run as an ordinary user and generate systemd units. https://ygg.cz/en/project/selinux-engineering/ https://ygg.cz/en/project/selinux-engineering/ Sat, 01 Jan 2022 00:00:00 GMT project Working on SELinux in an enterprise Linux distribution: policies, their bugs and passing the knowledge on to colleagues. https://ygg.cz/en/link/opensuse-microos/ https://ygg.cz/en/link/opensuse-microos/ Mon, 08 Nov 2021 00:00:00 GMT link An immutable system with transactional updates on btrfs snapshots, where applications live in containers rather than in the root filesystem. https://ygg.cz/en/note/centos-rebuild-distros/ https://ygg.cz/en/note/centos-rebuild-distros/ Mon, 21 Jun 2021 00:00:00 GMT note After the December 2020 announcement that CentOS 8 would end, two independent RHEL rebuilds appeared during 2021 – AlmaLinux and Rocky Linux. https://ygg.cz/en/project/stig-certification/ https://ygg.cz/en/project/stig-certification/ Sat, 01 May 2021 00:00:00 GMT project Preparing a minimal enterprise distribution for DISA STIG certification: architecture, test adaptation, mitigations and judging which rules apply to the system at all. https://ygg.cz/en/link/eu-open-source-strategy/ https://ygg.cz/en/link/eu-open-source-strategy/ Wed, 21 Oct 2020 00:00:00 GMT link A strategy adopted in October 2020 in which the European Commission committed to publishing its own software, contributing back and setting up an open source programme office. https://ygg.cz/en/note/wireguard-linux-kernel-5-6/ https://ygg.cz/en/note/wireguard-linux-kernel-5-6/ Sun, 29 Mar 2020 00:00:00 GMT note The WireGuard VPN protocol landed directly in the mainline Linux kernel in March 2020, without needing a separately maintained module. https://ygg.cz/en/project/ansible-infrastructure-as-code/ https://ygg.cz/en/project/ansible-infrastructure-as-code/ Wed, 01 Jan 2020 00:00:00 GMT project Idempotent infrastructure deployment with Ansible – system and applications, roles driven by host groups, and contributions to an OpenStack deployment. https://ygg.cz/en/explainer/apparmor-intro/ https://ygg.cz/en/explainer/apparmor-intro/ Wed, 26 Jun 2019 00:00:00 GMT explainer What AppArmor is, how mandatory access control through profiles works, and how profiles are created and controlled. https://ygg.cz/en/project/cloud-test-automation/ https://ygg.cz/en/project/cloud-test-automation/ Sat, 01 Jun 2019 00:00:00 GMT project A framework for automated testing of OpenStack cloud platform updates, storage integration and CI/CD – including a period leading the test team. https://ygg.cz/en/project/model-railway-kubernetes/ https://ygg.cz/en/project/model-railway-kubernetes/ Tue, 01 Jan 2019 00:00:00 GMT project A model railway fully controlled and monitored from a small Intel NUC computer via Arduino, with the applications running in a Kubernetes cluster. https://ygg.cz/en/explainer/aix-for-linux-admin/ https://ygg.cz/en/explainer/aix-for-linux-admin/ Mon, 15 Oct 2018 00:00:00 GMT explainer The differences a Linux administrator meets when moving to AIX on IBM Power – tooling, LVM, LPARs, enterprise storage and backups, compared with SLES and RHEL. https://ygg.cz/en/explainer/clickable-participatory-budget/ https://ygg.cz/en/explainer/clickable-participatory-budget/ Thu, 04 Oct 2018 00:00:00 GMT explainer A short explanation of clickable and participatory budgets and how they work in practice, including acquisition costs (as of 2018). https://ygg.cz/en/explainer/open-data-why/ https://ygg.cz/en/explainer/open-data-why/ Sat, 30 Jun 2018 00:00:00 GMT explainer What open data is, what it can look like in a town and why it makes sense – with examples of good practice from 2018. https://ygg.cz/en/explainer/maintenance-update-testing/ https://ygg.cz/en/explainer/maintenance-update-testing/ Mon, 01 Jan 2018 00:00:00 GMT explainer Why a fix package for an enterprise Linux distribution goes through testing before release – regression testing, multiple architectures and virtualization. https://ygg.cz/en/explainer/kernel-isolation-linux/ https://ygg.cz/en/explainer/kernel-isolation-linux/ Sat, 07 Oct 2017 00:00:00 GMT explainer The difference between paravirtualization, full hardware virtualization and OS-level virtualization (containers) in Linux. https://ygg.cz/en/note/debian-9-stretch/ https://ygg.cz/en/note/debian-9-stretch/ Sat, 17 Jun 2017 00:00:00 GMT note A June 2017 release in which MariaDB became the default database and the X server stopped requiring root privileges. https://ygg.cz/en/guide/cacti-small-infra/ https://ygg.cz/en/guide/cacti-small-infra/ Thu, 06 Apr 2017 00:00:00 GMT guide How to deploy Cacti on a dedicated host and use SNMP to watch load on both the hosts and the virtual machines – paravirtualized and fully virtualized alike. https://ygg.cz/en/guide/ssh-proxyjump/ https://ygg.cz/en/guide/ssh-proxyjump/ Wed, 01 Mar 2017 00:00:00 GMT guide Getting scp, rsync and git through a jump host by writing it into ssh_config once. https://ygg.cz/en/link/lets-encrypt-general-availability/ https://ygg.cz/en/link/lets-encrypt-general-availability/ Tue, 12 Apr 2016 00:00:00 GMT link A certificate authority that left beta in April 2016 and made automated, free, domain-validated TLS certificates available through the ACME protocol. https://ygg.cz/en/note/dpkg-force-remove/ https://ygg.cz/en/note/dpkg-force-remove/ Sat, 25 Apr 2015 00:00:00 GMT note Force-removing a single package on a Debian-based system without letting apt pull the rest of a dependency chain with it. https://ygg.cz/en/guide/raspbian-read-only-root/ https://ygg.cz/en/guide/raspbian-read-only-root/ Wed, 01 Apr 2015 00:00:00 GMT guide How to turn Raspbian on an SD card into a read-only root so the device survives being unplugged, and how to turn it into an image for mass deployment. https://ygg.cz/en/explainer/xen-ha-nas-small/ https://ygg.cz/en/explainer/xen-ha-nas-small/ Thu, 26 Mar 2015 00:00:00 GMT explainer How high availability and shared storage work for a small cluster of virtual machines on XEN. https://ygg.cz/en/project/raspberry-pi-read-only/ https://ygg.cz/en/project/raspberry-pi-read-only/ Sun, 01 Mar 2015 00:00:00 GMT project Daily menu displays in canteens across the country: a Raspberry Pi that survives being unplugged and deploys without anyone touching it on site. https://ygg.cz/en/guide/compromised-server-rebuild/ https://ygg.cz/en/guide/compromised-server-rebuild/ Thu, 01 Jan 2015 00:00:00 GMT guide How the move of an organization’s services off a probably compromised server onto new infrastructure actually went: the old stack, the split into virtual machines, the upgrade trouble and the hardening. https://ygg.cz/en/project/party-websites/ https://ygg.cz/en/project/party-websites/ Thu, 01 Jan 2015 00:00:00 GMT project Running and developing several static websites of a political party in Jekyll, including a signpost site for regional elections. https://ygg.cz/en/link/rfc-7208-spf/ https://ygg.cz/en/link/rfc-7208-spf/ Sun, 01 Jun 2014 00:00:00 GMT link The source text for SPF. It answers the questions blog posts disagree on – lookup limits, macros, and what each result actually means. https://ygg.cz/en/project/multi-arch-update-testing/ https://ygg.cz/en/project/multi-arch-update-testing/ Wed, 07 May 2014 00:00:00 GMT project Verifying fixes of an enterprise Linux distribution before release – on x86, IBM Z and PowerPC, with a focus on virtualization. https://ygg.cz/en/project/infrastructure-migration/ https://ygg.cz/en/project/infrastructure-migration/ Tue, 01 Apr 2014 00:00:00 GMT project Moving an organization’s services off a probably compromised server onto a newly designed infrastructure, running it long term and leading a technical team of volunteers. https://ygg.cz/en/guide/roundcube-mysql-ssl/ https://ygg.cz/en/guide/roundcube-mysql-ssl/ Sat, 18 Jan 2014 00:00:00 GMT guide Connecting Roundcube to a MySQL server over SSL and a working password_query for the password plugin. https://ygg.cz/en/project/linux-packaging/ https://ygg.cz/en/project/linux-packaging/ Wed, 01 Jan 2014 00:00:00 GMT project Building packages for both RPM- and Debian-based distributions – spec, dsc and control files, builds locally and in the Open Build Service. https://ygg.cz/en/reference/postfix-header-checks/ https://ygg.cz/en/reference/postfix-header-checks/ Wed, 01 Jan 2014 00:00:00 GMT reference A reference for the Postfix header_checks directive: rewriting, prefixing and dropping headers with regexp rules. https://ygg.cz/en/note/maildir-mail-notification/ https://ygg.cz/en/note/maildir-mail-notification/ Fri, 06 Dec 2013 00:00:00 GMT note Getting new-mail notifications on login (including SSH) and reading local mail with mailx when the delivery agent uses Maildir. https://ygg.cz/en/project/xen-infrastructure/ https://ygg.cz/en/project/xen-infrastructure/ Fri, 01 Nov 2013 00:00:00 GMT project Consolidating several servers onto the XEN XCP virtualization platform with high availability, shared storage and backups – including migration of running services. https://ygg.cz/en/note/xen-xcp-notes/ https://ygg.cz/en/note/xen-xcp-notes/ Fri, 10 May 2013 00:00:00 GMT note Scattered fixes from running XEN Cloud Platform: VNC keymap, LVM storage type, the HVC console and CPU hotplug in a guest. https://ygg.cz/en/reference/network-bonding-debian/ https://ygg.cz/en/reference/network-bonding-debian/ Tue, 07 May 2013 00:00:00 GMT reference A reference for round-robin network bonding on Debian, including the variant with a bridge for XEN. https://ygg.cz/en/guide/ddrescue-loop-mdadm/ https://ygg.cz/en/guide/ddrescue-loop-mdadm/ Sun, 03 Mar 2013 00:00:00 GMT guide Imaging a failing drive with dd_rescue and inspecting its mdadm RAID member over a loop device – without touching the original disk. https://ygg.cz/en/guide/wpa-passphrase-audit/ https://ygg.cz/en/guide/wpa-passphrase-audit/ Sat, 05 Jan 2013 00:00:00 GMT guide How to check whether your home Wi-Fi uses a weak WPA passphrase by capturing your own handshake and testing it offline. https://ygg.cz/en/guide/extundelete-restore/ https://ygg.cz/en/guide/extundelete-restore/ Mon, 03 Dec 2012 00:00:00 GMT guide Recovering deleted files from an ext3/ext4 filesystem with extundelete – mount read-only first and work by inode. https://ygg.cz/en/project/aix-linux-administration/ https://ygg.cz/en/project/aix-linux-administration/ Sun, 01 Jan 2012 00:00:00 GMT project Installation, upgrades, configuration and support of AIX and Linux systems on IBM Power – logical partitions, SAN, backups and high availability. https://ygg.cz/en/reference/iptables-domaci-sit/ https://ygg.cz/en/reference/iptables-domaci-sit/ Wed, 01 Jun 2011 00:00:00 GMT reference A reference card for iptables. Superseded – on Debian 12 and newer, nftables does the same job. https://ygg.cz/en/note/debian-6-0-squeeze/ https://ygg.cz/en/note/debian-6-0-squeeze/ Sun, 06 Feb 2011 00:00:00 GMT note A February 2011 release that switched the default boot script ordering to dependency-based sequencing and offered a FreeBSD kernel port as a technology preview. https://ygg.cz/en/troubleshooting/portmap-shutdown-hang/ https://ygg.cz/en/troubleshooting/portmap-shutdown-hang/ Thu, 03 Jun 2010 00:00:00 GMT troubleshooting The portmapper service stalls for a minute during boot or halt – how the issue was tracked down and resolved. https://ygg.cz/en/note/port-forwarding-nat/ https://ygg.cz/en/note/port-forwarding-nat/ Mon, 31 May 2010 00:00:00 GMT note How to point a chosen port of a public IP at a service running on a private address on the firewall. https://ygg.cz/en/project/network-administration/ https://ygg.cz/en/project/network-administration/ Wed, 14 Apr 2010 00:00:00 GMT project End-to-end administration of networks and servers for private companies and the public sector – from network devices to mail, VPN and storage. https://ygg.cz/en/project/infrastructure-monitoring/ https://ygg.cz/en/project/infrastructure-monitoring/ Fri, 01 Jan 2010 00:00:00 GMT project Watching load and availability of servers and networks – from SNMP and an information system for monitoring and helpdesk to Cacti on top of a virtualization infrastructure.