Linux
Linux recommendations
Linux distro recommendations
Rocky Linux KDE
Recommended for everyone
Use Rocky Linux KDE if you want the computer not to break often. This is the mature and stable version of Fedora KDE. Rocky is 1=1 clone of RHEL, but it has KDE desktop
Fedora KDE
For testing and tinkering
Fedora KDE gets new features earlier, but that also means updates break things often. When updates are improved to stable condition, they are then passed on to Red Hat Enterprise Linux and Rocky Linux KDE.
Install useful software
Practical additions for a fresh Linux setup.
LibreOffice
Use LibreOffice on Linux, Windows and MacOS. Use these formats so that AI-assistants can edit the files.
Calc
(Excel).fods
Writer
(Word).fodt
Impress
(PowerPoint).fodp
Draw
(Visio).fodg
Math
(Equations).mmlMath also supports .odf, but .mml is easier for AI agents.
Terminal setup
My portable terminal setup combines Neovim, tmux, and Herdr. It has a VS Code-like feel with a clickable Dark 2026 / Light 2026 tmux status bar, seamless tmux–Neovim navigation, OSC 52 clipboard support over SSH, Git and worktree tools, Markdown editing, and no language-server stack. It is built for desktops, laptops, VPS, and low-power Raspberry Pi workflows where agents do most heavy coding and I mostly review, edit, and steer. For manual coding work I use VSCodium with the OpenCodeCommit extension.
Both tmux and Herdr use Ctrl+Space as their prefix; the default for each is Ctrl+b.
Portable terminal setup
Download the same guided installer on a desktop, laptop, VPS, or Raspberry Pi. Choose the full setup, individual components, or the Git-free tiny profile for Pi Zero-class machines. It downloads archives instead of cloning repositories; Neovim still needs Git when it installs plugins on first launch.
wget -O terminal-setup.sh https://nevaberry.com/linux/terminal-setup.sh bash terminal-setup.sh
System update script
One public Bash updater for Fedora/RHEL-family desktops and servers, Debian, Ubuntu, Raspberry Pi OS, Proxmox VE and Proxmox Backup Server. Run it once or configure scheduled package updates. Desktop setup can also schedule user tools and firmware. The server and Proxmox profiles update all packages from your configured current-release repositories; the VPS profile uses the distribution security policy. Keep repository suites pinned to your current release.
Proxmox uses full dependency resolution and stops if package removals or a Proxmox major upgrade are required. Containers leave the host kernel and firmware to their host. The script reports reboot needs; an existing maintenance policy can schedule reboots separately. Script releases are upgraded manually, without changing saved schedules.
- Download it to your home folder:
wget -O update.sh https://nevaberry.com/linux/update.sh - Install or update the command while preserving existing schedules:
bash update.sh install - Run a one-shot update:
bash update.sh - Configure automation:
bash update.sh setup - Configure a Proxmox host (02:30 in its local timezone):
sudo bash update.sh setup --profile proxmox --time 02:30 --yes - Configure a server, VM or LXC guest:
sudo bash update.sh setup --profile server --time 02:30 --yes - Fetch and install the latest script while preserving policy:
nevaberry-update self-update - Inspect automation and pending updates (cached; add --refresh for fresh metadata):
nevaberry-update status - Disable and remove the configured automation:
nevaberry-update disable
VPS hardening script
Staged baseline for Rocky/RHEL-family and Debian/Ubuntu web servers. It creates a key-only non-root administrator, keeps only production HTTP/HTTPS public, routes management and staging/preview/dev access through Tailscale, enables the native host firewall, preserves SELinux or AppArmor, applies conservative sysctl settings, and uses update.sh for daily security updates without automatic reboots. Public SSH closes only in a verified second-stage Tailscale session. A staging hostname sharing the public HTTPS listener still needs a Tailscale-only listener or reverse-proxy access rule.
Setup and lockdown refuse Proxmox hosts and LXC/Docker guests. Their host-managed networking and access policies need separate configuration. Re-running setup on a locked VPS is also refused; use install to upgrade the script. Existing update automation is preserved. Review Docker forwarding with either UFW or firewalld before accepting container exposure.
- Rocky / RHEL family
- Uses firewalld, the wheel administrator group, SELinux, DNF, and needs-restarting.
- Ubuntu / Debian family
- Uses UFW, the sudo group, AppArmor, APT, and needrestart. On Ubuntu 26.04, harden.sh preserves SSH_CONNECTION only for the configured administrator so sudo-rs cannot hide the verified Tailscale session during lockdown.
- Download it to your home folder:
wget -O harden.sh https://nevaberry.com/linux/harden.sh - Upgrade only the script, preserving existing hardening:
sudo bash harden.sh install - Inspect the server without changing it:
bash harden.sh audit - Stage the hardening baseline while public SSH remains available:
sudo bash harden.sh setup - From the new administrator's Tailscale SSH session, finish the lockdown:
sudo nevaberry-vps-harden lockdown - Inspect the managed state and current exposure:
sudo nevaberry-vps-harden status - Restore the configuration saved before the last setup:
sudo nevaberry-vps-harden rollback
UpCloud VPS firewall
Use UpCloud's Public & Utility firewall as a provider-edge filter in front of the stateful host firewall configured by harden.sh. It is stateless: accepting outgoing traffic does not automatically admit reply packets, so the incoming return paths below are intentional.
- Incoming default rule
- Drop all
- Outgoing default rule
- Accept all
Create separate IPv4 and IPv6 rules. In the address fields, choose “All IPv4 addresses” or “All IPv6 addresses” from the selector; do not turn an IPv4 rule into IPv6 by merely typing ::/0.
What the incoming addresses mean
The four exact addresses below are UpCloud DNS resolvers—not visitors and not addresses assigned to this VPS. The VPS sends a DNS query to destination port 53; the stateless edge then sees the reply from source port 53 as incoming traffic. Allowing these replies does not expose a DNS service on the VPS.
- IPv4 DNS resolvers
- 94.237.127.994.237.40.9
- IPv6 DNS resolvers
- 2a04:3540:53::12a04:3544:53::1
All IPv4 addresses means any IPv4 source (0.0.0.0/0), while All IPv6 addresses means any IPv6 source (::/0). Use those broad sources only for rules that genuinely require them.
Reference setup in UpCloud
Privacy-cropped screenshots from the configured Rocky Linux playground VPS. Click any preview to inspect the real UpCloud settings.
Enable Public Firewall, then use Drop all for incoming traffic and Accept all for outgoing traffic.
The first rules admit ICMP, DNS replies, temporary public SSH, and production HTTP/HTTPS for both IP families.
The stateless edge needs explicit web, NTP, STUN, direct Tailscale, and DHCP return paths.
Finish with secondary and TCP DNS replies, incoming Drop all, and outgoing Accept all. The SMTP block is UpCloud-managed.
| Rule | Allow | Purpose |
|---|---|---|
| ICMP | ICMP · IPv4 + IPv6 | Keeps path-MTU discovery, diagnostics, and IPv6 neighbor discovery working. |
| DNS return traffic | TCP/UDP src:53 · IPv4 + IPv6 | Allows replies from the exact UpCloud DNS resolvers listed above. Use “Auto-add these DNS rules”, or add both TCP and UDP source-port 53 rules manually. |
| Temporary public SSH | TCP dst:22 · IPv4 + IPv6 | Keep only while staging the hardening. Remove both rules after a verified non-root Tailscale login and lockdown. |
| Public production web | TCP dst:80,443 · IPv4 + IPv6 | Expose only the production HTTP/HTTPS listeners. Omit these rules for a fully private server. |
| HTTP/HTTPS return traffic | TCP src:80,443 · IPv4 + IPv6 | Required by the stateless edge for OS updates, API calls, container registries, and Tailscale DERP/control traffic. |
| NTP return traffic | UDP src:123 · IPv4 + IPv6 | Allows chrony time-synchronization replies. |
| Tailscale STUN return traffic | UDP src:3478 · IPv4 + IPv6 | Allows Tailscale NAT-discovery replies. |
| Direct Tailscale | UDP dst:41641 · IPv4 + IPv6 | Recommended for direct peer-to-peer paths; Tailscale can still fall back to DERP when direct UDP is unavailable. |
| DHCP return traffic | UDP src:67→dst:68 · src:547→dst:546 | Preserves IPv4 and IPv6 lease renewal on UpCloud interfaces. |
| Neon/PostgreSQL (conditional) | TCP src:5432 · IPv4 + IPv6 | Add only when the server opens direct PostgreSQL connections to Neon. HTTPS-only database access already uses the source-port 443 return rules. |
Lockout-safe rollout
- Save the rules while the firewall is still disabled, and keep the current SSH session open.
- Enable the firewall, then verify a fresh SSH connection, DNS, IPv4 and IPv6 HTTPS, chrony, and tailscale status.
- Run nevaberry-vps-harden lockdown from the administrator's Tailscale session, then delete both temporary public SSH rules.
Source-port return rules at a stateless provider firewall can be spoofed and are not a substitute for connection tracking. Keep firewalld or UFW enabled. UpCloud also cannot distinguish production and staging hostnames sharing TCP 443; enforce that split at the reverse proxy or bind staging to the Tailscale address.
Firewall rules assisted-by:gpt-5.6-sol date:2026-08-24
