https://wiki.alpinelinux.org/w/api.php?action=feedcontributions&feedformat=atom&user=BenakiAlpine Linux - User contributions [en]2026-04-30T08:25:32ZUser contributionsMediaWiki 1.40.0https://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32092Openconnect-SSO in Docker2026-02-25T13:40:01Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. It is assumed the WM / compositor of the client is Wayland.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.<br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
doas docker create -it \<br />
--name openconnect-sso \<br />
--privileged \<br />
--net=host \<br />
-v /etc/ssl/certs:/etc/ssl/certs:ro \<br />
-e WAYLAND_DISPLAY=$WAYLAND_DISPLAY \<br />
-e XDG_RUNTIME_DIR=/tmp \<br />
-e QT_QPA_PLATFORM=wayland \<br />
-v $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY:/tmp/$WAYLAND_DISPLAY:rw \<br />
--device /dev/net/tun \<br />
openconnect-sso:latest \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== Why use Docker? ==<br />
System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32091Openconnect-SSO in Docker2026-02-25T13:39:11Z<p>Benaki: /* Building the Docker image */</p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. Here the WM / compositor of the client is Wayland (I run sway or niri).<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.<br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
doas docker create -it \<br />
--name openconnect-sso \<br />
--privileged \<br />
--net=host \<br />
-v /etc/ssl/certs:/etc/ssl/certs:ro \<br />
-e WAYLAND_DISPLAY=$WAYLAND_DISPLAY \<br />
-e XDG_RUNTIME_DIR=/tmp \<br />
-e QT_QPA_PLATFORM=wayland \<br />
-v $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY:/tmp/$WAYLAND_DISPLAY:rw \<br />
--device /dev/net/tun \<br />
openconnect-sso:latest \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== Why use Docker? ==<br />
System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32090Openconnect-SSO in Docker2026-02-25T13:10:21Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. Here the WM / compositor of the client is Wayland (I run sway or niri).<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.<br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== Why use Docker? ==<br />
System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32089Openconnect-SSO in Docker2026-02-25T10:20:33Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. Here the WM / compositor of the client is Wayland (I run sway or niri).<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.<br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== Why use Docker? ==<br />
System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32088Openconnect-SSO in Docker2026-02-25T10:14:18Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.<br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== Why use Docker? ==<br />
System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32087Openconnect-SSO in Docker2026-02-25T10:10:11Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.<br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32086Openconnect-SSO in Docker2026-02-25T10:07:16Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32085Openconnect-SSO in Docker2026-02-25T10:06:41Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/.local/bin/vpn-connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== See also ==<br />
<br />
* [[Docker]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32084Openconnect-SSO in Docker2026-02-25T10:05:06Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* doas configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/vpn/connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/vpn/connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/vpn/connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== See also ==<br />
<br />
* [[Docker]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32083Openconnect-SSO in Docker2026-02-25T10:04:48Z<p>Benaki: </p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* [[doas]] configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/vpn/connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/vpn/connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/vpn/connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== See also ==<br />
<br />
* [[Docker]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Openconnect-SSO_in_Docker&diff=32082Openconnect-SSO in Docker2026-02-25T10:03:25Z<p>Benaki: Created page with "= VPN via openconnect-sso (Docker) = This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. == Prerequisites == * Docker installed and running * doas configured * The <code>openconnect-sso</code> Docker image built (see below) * A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code> == Building the Docker imag..."</p>
<hr />
<div>= VPN via openconnect-sso (Docker) =<br />
<br />
This guide describes how to connect to a Cisco AnyConnect-compatible VPN using [[openconnect-sso]] running inside a Docker container, with automatic DNS configuration on connect.<br />
<br />
== Prerequisites ==<br />
<br />
* [[Docker]] installed and running<br />
* [[doas]] configured<br />
* The <code>openconnect-sso</code> Docker image built (see below)<br />
* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code><br />
<br />
== Building the Docker image ==<br />
<br />
Save the following as <code>Dockerfile.openconnect-sso</code>:<br />
<br />
<pre><br />
FROM python:3.11-slim<br />
<br />
RUN apt-get update && \<br />
apt-get install -y \<br />
openconnect \<br />
sudo \<br />
libqt6gui6 \<br />
libqt6widgets6 \<br />
libqt6webenginecore6 \<br />
libqt6webenginewidgets6 \<br />
qt6-wayland \<br />
libgl1 \<br />
libxkbcommon0 \<br />
libdbus-1-3 \<br />
libegl1 \<br />
libnss3 \<br />
libnspr4 \<br />
libxcomposite1 \<br />
libxdamage1 \<br />
libxrandr2 \<br />
libxtst6 \<br />
libxslt1.1 \<br />
libglib2.0-0 \<br />
libasound2 \<br />
libxcursor1 \<br />
fonts-liberation && \<br />
apt-get clean && \<br />
rm -rf /var/lib/apt/lists/*<br />
<br />
RUN pip install --no-cache-dir openconnect-sso<br />
<br />
RUN useradd -m -s /bin/bash vpnuser && \<br />
echo "vpnuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers<br />
<br />
USER vpnuser<br />
WORKDIR /home/vpnuser<br />
<br />
ENV QT_QPA_PLATFORM=wayland<br />
ENV XDG_RUNTIME_DIR=/tmp<br />
<br />
ENTRYPOINT ["openconnect-sso"]<br />
</pre><br />
<br />
Build and create the container:<br />
<br />
<pre><br />
cd ~/vpn<br />
docker build -f Dockerfile.openconnect-sso -t openconnect-sso .<br />
docker create --name openconnect-sso \<br />
--cap-add NET_ADMIN \<br />
--device /dev/net/tun \<br />
openconnect-sso \<br />
--server your-vpn-gateway \<br />
--user your-username<br />
</pre><br />
<br />
== DNS configuration ==<br />
<br />
When the VPN connects, a <code>tun0</code> interface is created but the system DNS is not automatically updated. To resolve internal hostnames, save your VPN network's DNS settings to <code>~/.local/resolv.conf</code>. This file will be copied to <code>/etc/resolv.conf</code> once the tunnel is up.<br />
<br />
== Connecting ==<br />
<br />
Save the following script (e.g. <code>~/vpn/connect.sh</code>) and make it executable:<br />
<br />
<pre><br />
#!/bin/sh<br />
# Wait for tun interface, then set DNS<br />
(<br />
while ! ip addr show tun0 2>/dev/null | grep -q inet; do<br />
sleep 1<br />
done<br />
doas cp ~/.local/resolv.conf /etc/<br />
) &<br />
# Start VPN in foreground<br />
doas docker start -ai openconnect-sso<br />
</pre><br />
<br />
<pre><br />
chmod +x ~/vpn/connect.sh<br />
</pre><br />
<br />
Run it:<br />
<br />
<pre><br />
~/vpn/connect.sh<br />
</pre><br />
<br />
A browser window will open for SSO authentication. After completing login, the VPN tunnel will establish and DNS will be updated automatically.<br />
<br />
== How it works ==<br />
<br />
The script starts a background subshell that polls for the <code>tun0</code> interface. Once the interface has an IP address assigned (meaning the tunnel is up), it copies the VPN-specific <code>resolv.conf</code> into place. Meanwhile, the Docker container runs in the foreground so its output and the SSO browser window remain accessible.<br />
<br />
== Disconnecting ==<br />
<br />
Close the foreground process with {{Key|Ctrl|C}} or stop the container:<br />
<br />
<pre><br />
doas docker stop openconnect-sso<br />
</pre><br />
<br />
You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.<br />
<br />
== See also ==<br />
<br />
* [[OpenConnect]]<br />
* [[DNS]]<br />
* [[Docker]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Tutorials_and_Howtos&diff=32081Tutorials and Howtos2026-02-25T10:01:29Z<p>Benaki: /* VPN */</p>
<hr />
<div>[[Image:package_edutainment.svg|right|link=]]<br />
{{TOC left}}<br />
<br />
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''<br />
<br />
'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions. Howto's have been organized in the below page based on the topics. <br />
<br />
'''The [[#Tutorials|tutorials]] are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.<br />
<br />
{{Note|<br />
* Contributors are requested to refer to [[Help:Editing]] first and make use of resources like [[How to write a HOWTO]].<br />
* Contributions must be complete articles. <br />
* Don't override already made contributions, unless there is a mistake. <br />
* If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].}}<br />
<br />
== Desktop ==<br />
<br />
* {{:Daily driver guide}}<br />
<br />
=== Networking ===<br />
<br />
* [[Bluetooth]] - Instructions for installing and configuring Bluetooth<br />
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces<br />
* [[Bridge]] - Configuring a network bridge<br />
** [[Bridge wlan0 to eth0]]<br />
* [[Configure Networking]]<br />
* [[How to configure static routes]]<br />
* Modem<br />
** [[Using HSDPA modem]]<br />
** [[Using serial modem]]<br />
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine. <br />
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''<br />
* [[PXE boot]]<br />
* Wi-Fi<br />
** [[Wi-Fi|Connecting to a wireless access point]]<br />
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''<br />
* Use [https://github.com/ifupdown-ng/ifupdown-ng/blob/main/doc/interfaces-vxlan.scd vxlan], if using [[Ifupdown-ng]] instead of [[VLAN]]<br />
* [[Setting up a Home Router]]<br />
<br />
=== Backup and data migration ===<br />
<br />
* [[Migrating data]]<br />
* [[Rsnapshot]] - setting up periodic backups<br />
<br />
=== Other topics ===<br />
<br />
* [[Gaming on Alpine]]<br />
* [[Remote Desktop Server]]<br />
* [[Default applications|How to change default application]]<br />
* [[CPU frequency scaling]]<br />
* [[Mimalloc]]<br />
* [[Enable Serial Console on Boot]]<br />
* [[How to build the Alpine Linux kernel]]<br />
* [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''<br />
* [[Setting up lm_sensors]]<br />
* [[Fingerprint Authentication with swaylock]]<br />
* [[Mounting a LUKS Encrypted Data Partition at Boot]]<br />
* [[Desktop environments and Window managers|List of supported Desktop environments and Window managers]]<br />
<br />
== Diskless ==<br />
<br />
* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''<br />
** [[Back Up a Flash Memory Installation]]<br />
** [[Manually editing a existing apkovl]]<br />
<br />
== Other Architectures ==<br />
<br />
=== APU (PCEngines) ===<br />
<br />
* [[Alpine Install: from a disc to PC Engines APU|Alpine on PC Engines APU]]<br />
* [https://github.com/huubsch/Installation-of-Alpine-Linux-on-PC-Engines-APU3/tree/main?tab=readme-ov-file Installation of Alpine Linux on PCEngines APU, legacy BIOS]<br />
<br />
=== ARM ===<br />
<br />
* [[Alpine on ARM]]<br />
<br />
==== Raspberry Pi ====<br />
<br />
* [[Raspberry Pi|Raspberry Pi main page]]<br />
* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]<br />
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]<br />
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]<br />
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]<br />
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]<br />
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''<br />
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign<br />
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]<br />
* [[Raspberry Pi 3 - Setting Up Bluetooth]]<br />
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]<br />
* [[Raspberry_Pi_Zero_W_-_Installation|Raspberry Pi Zero W - Installation]]<br />
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''<br />
<br />
=== IBM Z (IBM z Systems) ===<br />
<br />
* [[s390x|s390x - Installation]]<br />
<br />
=== PowerPC ===<br />
<br />
* [[Ppc64le|Powerpc64le - Installation]]<br />
<br />
== Security ==<br />
<br />
* [[#Desktop security|Desktop security]] lists steps for securing Alpine Linux desktops<br />
* [[Setting up a laptop]] page has detailed guidelines to configure a secured laptop<br />
* [[Securing Alpine Linux|Secure Alpine Linux]] using Security Technical Implementation Guides (STIGs)<br />
* [[Sshguard|SSHGuard]] - Protects hosts against brute-force attacks: monitoring logs, attack detection, blocking using firewall.<br />
<br />
== Services == <br />
<br />
{{Note| Services are arranged in alphabetical order.}}<br />
<br />
=== Content management systems ===<br />
<br />
* [[DokuWiki]] ''(Simple and easy to use wiki, no database required)''<br />
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''<br />
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''<br />
* [[Mahara]] ''(E-portfolio and social networking system)''<br />
* [[MediaWiki]] ''(Free web-based wiki software application)''<br />
* [[Pastebin]] ''(Pastebin software application)''<br />
* [[WordPress]] ''(Web software to create website or blog)''<br />
* [[Moodle]] ''(Online Learning Management system)''<br />
<br />
=== Database === <br />
<br />
* [[MariaDB]] or [[MySQL|MySQL]]<br />
<br />
=== DNS ===<br />
<br />
* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''<br />
* [[Setting up nsd DNS server]]<br />
* [[Small-Time DNS with BIND9]] ''(A simple configuration with ad blocking for your home network)''<br />
* Unbound<br />
** [[Setting up unbound DNS server]]<br />
** [[Using Unbound as an Ad-blocker]] ''(Setup ad blocking for your network)''<br />
* [[TinyDNS Format]]<br />
<br />
=== File server ===<br />
<br />
* [[Setting up an NFS server|nfs-server]]<br />
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''<br />
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''<br />
<br />
=== Firewall ===<br />
<br />
* [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]<br />
** [[Zero-To-Awall]] -''AWall for dummies''<br />
** [[How-To Alpine Wall]] - ''AWall for Shorewall users''<br />
** [[Alpine Wall]] - ''AWall - Firewall management framework - Design Document''<br />
* [[Iptables]]<br />
* [[nftables]]<br />
* [[Uncomplicated Firewall|Uncomplicated Firewall or UFW]]<br />
<br />
=== HTTP and web services ===<br />
<br />
* [[Althttpd]]<br />
* [[Apache]]<br />
** [[Apache with php-fpm]]<br />
** [[Setting Up Apache with PHP]]<br />
** [[Apache authentication: NTLM Single Signon]]<br />
* [[Darkhttpd]]<br />
* [[Lighttpd]]<br />
** [[Lighttpd Advanced security]]<br />
** [[Setting Up Lighttpd With FastCGI]]<br />
** [[Production Web server: Lighttpd|Production web server: Lighttpd]]<br />
* [[Nginx]]<br />
** [[Nginx as reverse proxy with acme (letsencrypt)]]<br />
** [[Nginx with PHP]]<br />
* Squid Proxy<br />
** [[Setting up Explicit Squid Proxy]]<br />
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''<br />
** [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Tomcat]]<br />
** [[Production LAMP system: Lighttpd + PHP + MySQL|Production LAMP system: Lighttpd + PHP + MariaDB/MySQL]]<br />
<br />
=== IRC ===<br />
<br />
* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''<br />
<br />
=== Mail ===<br />
<br />
* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''<br />
* [[Hosting Web/Email services on Alpine]]<br />
* Exim/Dovecot<br />
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)<br />
** [[Setting up dovecot with imap and tls]]<br />
* [[relay email to gmail (msmtp, mailx, sendmail]]<br />
* [[relay email (nullmailer)]]<br />
* [[Roundcube]] ''(Webmail system)''<br />
* [[Setting up postfix with virtual domains]]<br />
* Server protection<br />
** [[Setting up clamsmtp]]<br />
<br />
=== Monitoring ===<br />
<br />
* [[Awstats]] ''(Free log file analyzer)''<br />
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''<br />
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' <!-- Monitoring and Security --><br />
* [[Linfo]]<br />
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''<br />
* [[Logcheck]] ''(log file monitoring tool)''<br />
* [[Matomo]] ''(A real time web analytics software program)''<br />
* [[Rasdaemon]] ''(Platform Reliability, Availability and Serviceability monitoring tool)''<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft, solution, Networking and Monitoring and Server --><br />
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' <!-- Networking and Monitoring --><br />
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' <!-- Networking and Monitoring --><br />
* [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Traffic monitoring]] <!-- Networking and Monitoring --><br />
** [[Setting up monitoring using rrdtool (and rrdcollect)]]<br />
** [[Setting up traffic monitoring using rrdtool (and snmp)]] <!-- Monitoring --><br />
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''<br />
* [[ZoneMinder video camera security and surveillance]]<br />
<br />
=== Remote Administration ===<br />
<br />
* ACF<br />
** [[Changing passwords for ACF|ACF - changing passwords]]<br />
** [[Generating SSL certs with ACF]] <!-- Generating SSL certs with ACF 1.9 --><br />
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''<br />
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''<br />
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''<br />
* [[OpenVCP]] ''(VServer Control Panel)''<br />
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''<br />
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''<br />
* [[Webmin]] ''(A web-based interface for Linux system)''<br />
<br />
=== Telephony ===<br />
<br />
* [[FreePBX|FreePBX on Alpine Linux]]<br />
* [[Setting up Zaptel/Asterisk on Alpine]]<br />
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''<br />
<br />
=== VPN ===<br />
* [[Freeradius Active Directory Integration]]<br />
* [[GNUnet]]<br />
* [[IGMPproxy]]<br />
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''<br />
* [[OpenVSwitch]]<br />
* [[Openconnect-SSO in Docker]]<br />
* [[Tor]]<br />
* [[Using Alpine on Windows domain with IPSEC isolation]]<br />
* [[Configure a Wireguard interface (wg)|Wireguard]]<br />
* [[Vpnc]]<br />
<br />
=== Other Servers ===<br />
<br />
* [[apcupsd]] ''(UPS Monitoring with apcupsd)''<br />
* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]<br />
* [[Glpi]] ''(Manage inventory of technical resources)''<br />
* [[How to setup a Alpine Linux mirror]]<br />
* [[nut-ups|NUT UPS]] ''(UPS Monitoring with Network UPS Tools)''<br />
* [[Odoo]]<br />
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''<br />
* [[Setting up a LLDAP server|lldap-server]] ''(Directory Server)''<br />
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]<br />
<br />
<br />
== Software development ==<br />
<br />
* [[Cgit]]<br />
* [[OsTicket]] ''(Ticket system)''<br />
* [[Patchwork]] ''(Patch review management system)''<br />
* [[Redmine]] ''(Project management system) [Deprecated]''<br />
* [[Request Tracker]] ''(Ticket system)''<br />
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''<br />
* [[Ansible]] ''(Configuration management)''<br />
* [[Installing Oracle Java|Oracle Java (installation)]]<br />
<br />
== Storage ==<br />
<br />
* [[Setting up disks manually|Manual partitioning]]<br />
* [[Disk Replication with DRBD|DRBD: Disk Replication]]<br />
* [[Filesystems]]<br />
** [[Burning ISOs]]<br />
* [[Setting up iSCSI|iSCSI Setup]]<br />
** [[iSCSI Raid and Clustered File Systems]]<br />
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]<br />
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]<br />
* [[Setting up Logical Volumes with LVM|LVM Setup]]<br />
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]<br />
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]<br />
** [[LVM on LUKS]]<br />
* RAID<br />
** [[Raid Administration]]<br />
** [[Setting up a software RAID array]]<br />
* [[ZFS]]<br />
** [[Root on ZFS with native encryption]]<br />
** [[Setting up ZFS on LUKS]]<br />
* [[CEPH|CEPH]]<br />
<br />
== Virtualization ==<br />
<br />
* [[Docker]]<br />
* [[Installing Alpine in a virtual machine]]<br />
** [[Install Alpine on VMware ESXi]]<br />
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''<br />
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''<br />
* [[QEMU]]<br />
* Xen<br />
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''<br />
** [[Xen Dom0 on USB or SD]]<br />
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]<br />
** [[Xen LiveCD]]<br />
** [[Xen PCI Passthrough]]<br />
** [[K8s]] Building a K8s Kubernetes Cluster on Alpine Linux<br />
* [[Runc]]<br />
<br />
== [[Simple_Walkthrough]] ==<br />
* [[About-virtualization-simple]]<br />
* [[LXC_Alpinelinux_Simple]]<br />
* [[Qemu-simple]]<br />
<br />
== Tutorials ==<br />
<br />
* [[TTY_Autologin|TTY Autologin]]<br />
* [[Kexec|Faster rebooting with kexec]]<br />
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]<br />
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]<br />
* [[Fault Tolerant Routing with Alpine Linux]]<br />
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''<br />
* [[Linux iSCSI Target (TCM)]]<br />
* [[ISP Mail Server 3.x HowTo]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''<br />
* [[Grommunio Mail Server]] ''(Mariadb+Postfix+Rspamd+Grommunio - Full-service mail server as MS exchange replacement)''<br />
* [[Replacing non-Alpine Linux with Alpine remotely]]<br />
* [[Streaming Security Camera Video with VLC]]<br />
* [[Install Alpine on a btrfs filesystem with refind as boot manager]]<br />
* [[Compile software from source|How to Compile a software from source in Alpine Linux]]<br />
* [https://ww2.coastal.edu/mmurphy2/oer/alpine/ Alpine Linux tutorials - Dr Murphy, Computing Science Associate Professor]<br />
* [[Michael's base installation procedure|Michael's base installation procedure]]<br />
* [[Michael's cwm desktop (minimal)|Michael's cwm desktop (minimal)]]<br />
* [[Michael's sway desktop (minimal)|Michael's Sway desktop (minimal)]]<br />
* [[Sway_customization_guide|Sway customization guide]] ''(Tutorial re Sway config file basics)''<br />
* [[Using Distrobox For VR Gaming|Using Distrobox For VR Gaming]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Unlock_an_encrypted_data_partition_on_login&diff=32027Unlock an encrypted data partition on login2026-02-07T14:40:58Z<p>Benaki: Blanked the page</p>
<hr />
<div></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Mounting_a_LUKS_Encrypted_Data_Partition_at_Boot&diff=32026Mounting a LUKS Encrypted Data Partition at Boot2026-02-07T14:38:59Z<p>Benaki: /* Mounting a LUKS Encrypted Data Partition at Boot */</p>
<hr />
<div>This guide covers how to set up a secondary LUKS-encrypted partition as a data drive that is automatically unlocked and mounted when Alpine Linux boots. This is useful if, for example, you have a root partition on one drive and want an encrypted data partition on another — or if you simply want a separate encrypted volume for personal data.<br />
<br />
== Prerequisites ==<br />
<br />
* A spare partition (this guide uses <code>/dev/sda1</code> as an example)<br />
* <code>cryptsetup</code> installed: <code>doas apk add cryptsetup</code><br />
* An Alpine system using OpenRC (the default)<br />
<br />
== 1. Set Up the LUKS Container ==<br />
<br />
If you are starting with a fresh or existing partition, format it as a LUKS container. '''This will erase all data on the partition.'''<br />
<br />
<pre><br />
doas cryptsetup luksFormat /dev/sda1<br />
doas cryptsetup luksOpen /dev/sda1 data<br />
doas mkfs.ext4 /dev/mapper/data<br />
doas cryptsetup luksClose data<br />
</pre><br />
<br />
== 2. Create a Keyfile for Automatic Unlocking ==<br />
<br />
A keyfile allows the partition to be unlocked at boot without a passphrase prompt. The keyfile itself is stored on your root partition, so it is protected by whatever encryption or access controls that partition has.<br />
<br />
<pre><br />
doas dd if=/dev/urandom of=/etc/crypto_keyfile.bin bs=512 count=1<br />
doas chmod 600 /etc/crypto_keyfile.bin<br />
doas cryptsetup luksAddKey /dev/sda1 /etc/crypto_keyfile.bin<br />
</pre><br />
<br />
Your original passphrase remains as a fallback for manual unlocking.<br />
<br />
== 3. Create the Mount Point ==<br />
<br />
<pre><br />
doas mkdir -p /mnt/data<br />
</pre><br />
<br />
== 4. Add an fstab Entry ==<br />
<br />
Add the following line to <code>/etc/fstab</code>:<br />
<br />
<pre><br />
/dev/mapper/data /mnt/data ext4 defaults,nofail 0 2<br />
</pre><br />
<br />
The <code>nofail</code> option ensures that if the device or keyfile is missing for any reason, the system will still boot.<br />
<br />
== 5. Create an OpenRC Init Script ==<br />
<br />
Alpine's OpenRC does not process <code>/etc/crypttab</code> by default. The root partition's LUKS container is typically unlocked via kernel parameters (<code>cryptroot</code>, <code>cryptdm</code>) in the initramfs, not via <code>crypttab</code>. For additional encrypted partitions, you need a custom init script to handle both the unlock and the mount.<br />
<br />
Create <code>/etc/init.d/cryptdata</code> with the following contents:<br />
<br />
<pre><br />
#!/sbin/openrc-run<br />
description="Unlock and mount LUKS encrypted data partition"<br />
<br />
RC_NEEDED="modules lvm"<br />
RC_AFTER="modules lvm"<br />
RC_BEFORE="local"<br />
<br />
start() {<br />
ebegin "Unlocking /dev/sda1"<br />
cryptsetup luksOpen /dev/sda1 data --key-file /etc/crypto_keyfile.bin<br />
eend $?<br />
<br />
ebegin "Mounting /mnt/data"<br />
mount /dev/mapper/data /mnt/data<br />
eend $?<br />
}<br />
</pre><br />
<br />
=== Why both unlock and mount in the script? ===<br />
<br />
The <code>RC_BEFORE="local"</code> directive is intended to make this script run before OpenRC processes <code>fstab</code> mounts. In practice, the timing is not always reliable, and the mount in <code>fstab</code> may be attempted before the LUKS container is open. Putting the mount directly in the init script guarantees the correct order: unlock first, then mount.<br />
<br />
=== Dependencies ===<br />
<br />
* <code>RC_AFTER="modules lvm"</code> — ensures kernel modules and LVM volumes are available before this script runs.<br />
* <code>RC_BEFORE="local"</code> — requests that this script runs before the <code>local</code> service, which is where general <code>fstab</code> mounts are processed.<br />
<br />
== 6. Enable the Service ==<br />
<br />
<pre><br />
doas chmod +x /etc/init.d/cryptdata<br />
doas rc-update add cryptdata boot<br />
</pre><br />
<br />
== 7. Test ==<br />
<br />
Reboot and verify:<br />
<br />
<pre><br />
df -h | grep data<br />
# Should show something like:<br />
# /dev/mapper/data 219G 2.0M 208G 0% /mnt/data<br />
</pre><br />
<br />
You can also confirm the LUKS container is active:<br />
<br />
<pre><br />
doas cryptsetup status data<br />
</pre><br />
<br />
== Manual Unlock (Fallback) ==<br />
<br />
If you ever need to unlock the partition by hand (e.g. the keyfile is missing), you can do so with your original passphrase:<br />
<br />
<pre><br />
doas cryptsetup luksOpen /dev/sda1 data<br />
doas mount /dev/mapper/data /mnt/data<br />
</pre></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Mounting_a_LUKS_Encrypted_Data_Partition_at_Boot&diff=32025Mounting a LUKS Encrypted Data Partition at Boot2026-02-07T14:38:45Z<p>Benaki: Created page with "= Mounting a LUKS Encrypted Data Partition at Boot = This guide covers how to set up a secondary LUKS-encrypted partition as a data drive that is automatically unlocked and mounted when Alpine Linux boots. This is useful if, for example, you have a root partition on one drive and want an encrypted data partition on another — or if you simply want a separate encrypted volume for personal data. == Prerequisites == * A spare partition (this guide uses <code>/dev/sda1</..."</p>
<hr />
<div>= Mounting a LUKS Encrypted Data Partition at Boot =<br />
<br />
This guide covers how to set up a secondary LUKS-encrypted partition as a data drive that is automatically unlocked and mounted when Alpine Linux boots. This is useful if, for example, you have a root partition on one drive and want an encrypted data partition on another — or if you simply want a separate encrypted volume for personal data.<br />
<br />
== Prerequisites ==<br />
<br />
* A spare partition (this guide uses <code>/dev/sda1</code> as an example)<br />
* <code>cryptsetup</code> installed: <code>doas apk add cryptsetup</code><br />
* An Alpine system using OpenRC (the default)<br />
<br />
== 1. Set Up the LUKS Container ==<br />
<br />
If you are starting with a fresh or existing partition, format it as a LUKS container. '''This will erase all data on the partition.'''<br />
<br />
<pre><br />
doas cryptsetup luksFormat /dev/sda1<br />
doas cryptsetup luksOpen /dev/sda1 data<br />
doas mkfs.ext4 /dev/mapper/data<br />
doas cryptsetup luksClose data<br />
</pre><br />
<br />
== 2. Create a Keyfile for Automatic Unlocking ==<br />
<br />
A keyfile allows the partition to be unlocked at boot without a passphrase prompt. The keyfile itself is stored on your root partition, so it is protected by whatever encryption or access controls that partition has.<br />
<br />
<pre><br />
doas dd if=/dev/urandom of=/etc/crypto_keyfile.bin bs=512 count=1<br />
doas chmod 600 /etc/crypto_keyfile.bin<br />
doas cryptsetup luksAddKey /dev/sda1 /etc/crypto_keyfile.bin<br />
</pre><br />
<br />
Your original passphrase remains as a fallback for manual unlocking.<br />
<br />
== 3. Create the Mount Point ==<br />
<br />
<pre><br />
doas mkdir -p /mnt/data<br />
</pre><br />
<br />
== 4. Add an fstab Entry ==<br />
<br />
Add the following line to <code>/etc/fstab</code>:<br />
<br />
<pre><br />
/dev/mapper/data /mnt/data ext4 defaults,nofail 0 2<br />
</pre><br />
<br />
The <code>nofail</code> option ensures that if the device or keyfile is missing for any reason, the system will still boot.<br />
<br />
== 5. Create an OpenRC Init Script ==<br />
<br />
Alpine's OpenRC does not process <code>/etc/crypttab</code> by default. The root partition's LUKS container is typically unlocked via kernel parameters (<code>cryptroot</code>, <code>cryptdm</code>) in the initramfs, not via <code>crypttab</code>. For additional encrypted partitions, you need a custom init script to handle both the unlock and the mount.<br />
<br />
Create <code>/etc/init.d/cryptdata</code> with the following contents:<br />
<br />
<pre><br />
#!/sbin/openrc-run<br />
description="Unlock and mount LUKS encrypted data partition"<br />
<br />
RC_NEEDED="modules lvm"<br />
RC_AFTER="modules lvm"<br />
RC_BEFORE="local"<br />
<br />
start() {<br />
ebegin "Unlocking /dev/sda1"<br />
cryptsetup luksOpen /dev/sda1 data --key-file /etc/crypto_keyfile.bin<br />
eend $?<br />
<br />
ebegin "Mounting /mnt/data"<br />
mount /dev/mapper/data /mnt/data<br />
eend $?<br />
}<br />
</pre><br />
<br />
=== Why both unlock and mount in the script? ===<br />
<br />
The <code>RC_BEFORE="local"</code> directive is intended to make this script run before OpenRC processes <code>fstab</code> mounts. In practice, the timing is not always reliable, and the mount in <code>fstab</code> may be attempted before the LUKS container is open. Putting the mount directly in the init script guarantees the correct order: unlock first, then mount.<br />
<br />
=== Dependencies ===<br />
<br />
* <code>RC_AFTER="modules lvm"</code> — ensures kernel modules and LVM volumes are available before this script runs.<br />
* <code>RC_BEFORE="local"</code> — requests that this script runs before the <code>local</code> service, which is where general <code>fstab</code> mounts are processed.<br />
<br />
== 6. Enable the Service ==<br />
<br />
<pre><br />
doas chmod +x /etc/init.d/cryptdata<br />
doas rc-update add cryptdata boot<br />
</pre><br />
<br />
== 7. Test ==<br />
<br />
Reboot and verify:<br />
<br />
<pre><br />
df -h | grep data<br />
# Should show something like:<br />
# /dev/mapper/data 219G 2.0M 208G 0% /mnt/data<br />
</pre><br />
<br />
You can also confirm the LUKS container is active:<br />
<br />
<pre><br />
doas cryptsetup status data<br />
</pre><br />
<br />
== Manual Unlock (Fallback) ==<br />
<br />
If you ever need to unlock the partition by hand (e.g. the keyfile is missing), you can do so with your original passphrase:<br />
<br />
<pre><br />
doas cryptsetup luksOpen /dev/sda1 data<br />
doas mount /dev/mapper/data /mnt/data<br />
</pre></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Tutorials_and_Howtos&diff=32024Tutorials and Howtos2026-02-07T14:38:05Z<p>Benaki: /* Other topics */</p>
<hr />
<div>[[Image:package_edutainment.svg|right|link=]]<br />
{{TOC left}}<br />
<br />
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''<br />
<br />
'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions. Howto's have been organized in the below page based on the topics. <br />
<br />
'''The [[#Tutorials|tutorials]] are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.<br />
<br />
{{Note|<br />
* Contributors are requested to refer to [[Help:Editing]] first and make use of resources like [[How to write a HOWTO]].<br />
* Contributions must be complete articles. <br />
* Don't override already made contributions, unless there is a mistake. <br />
* If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].}}<br />
<br />
== Desktop ==<br />
<br />
* {{:Daily driver guide}}<br />
<br />
=== Networking ===<br />
<br />
* [[Bluetooth]] - Instructions for installing and configuring Bluetooth<br />
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces<br />
* [[Bridge]] - Configuring a network bridge<br />
** [[Bridge wlan0 to eth0]]<br />
* [[Configure Networking]]<br />
* [[How to configure static routes]]<br />
* Modem<br />
** [[Using HSDPA modem]]<br />
** [[Using serial modem]]<br />
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine. <br />
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''<br />
* [[PXE boot]]<br />
* Wi-Fi<br />
** [[Wi-Fi|Connecting to a wireless access point]]<br />
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''<br />
* Use [https://github.com/ifupdown-ng/ifupdown-ng/blob/main/doc/interfaces-vxlan.scd vxlan], if using [[Ifupdown-ng]] instead of [[VLAN]]<br />
* [[Setting up a Home Router]]<br />
<br />
=== Backup and data migration ===<br />
<br />
* [[Migrating data]]<br />
* [[Rsnapshot]] - setting up periodic backups<br />
<br />
=== Other topics ===<br />
<br />
* [[Gaming on Alpine]]<br />
* [[Remote Desktop Server]]<br />
* [[Default applications|How to change default application]]<br />
* [[CPU frequency scaling]]<br />
* [[Mimalloc]]<br />
* [[Enable Serial Console on Boot]]<br />
* [[How to build the Alpine Linux kernel]]<br />
* [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''<br />
* [[Setting up lm_sensors]]<br />
* [[Fingerprint Authentication with swaylock]]<br />
* [[Mounting a LUKS Encrypted Data Partition at Boot]]<br />
* [[Desktop environments and Window managers|List of supported Desktop environments and Window managers]]<br />
<br />
== Diskless ==<br />
<br />
* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''<br />
** [[Back Up a Flash Memory Installation]]<br />
** [[Manually editing a existing apkovl]]<br />
<br />
== Other Architectures ==<br />
<br />
=== APU (PCEngines) ===<br />
<br />
* [[Alpine Install: from a disc to PC Engines APU|Alpine on PC Engines APU]]<br />
* [https://github.com/huubsch/Installation-of-Alpine-Linux-on-PC-Engines-APU3/tree/main?tab=readme-ov-file Installation of Alpine Linux on PCEngines APU, legacy BIOS]<br />
<br />
=== ARM ===<br />
<br />
* [[Alpine on ARM]]<br />
<br />
==== Raspberry Pi ====<br />
<br />
* [[Raspberry Pi|Raspberry Pi main page]]<br />
* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]<br />
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]<br />
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]<br />
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]<br />
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]<br />
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''<br />
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign<br />
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]<br />
* [[Raspberry Pi 3 - Setting Up Bluetooth]]<br />
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]<br />
* [[Raspberry_Pi_Zero_W_-_Installation|Raspberry Pi Zero W - Installation]]<br />
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''<br />
* [[RPI Video Receiver]]<br />
<br />
=== IBM Z (IBM z Systems) ===<br />
<br />
* [[s390x|s390x - Installation]]<br />
<br />
=== PowerPC ===<br />
<br />
* [[Ppc64le|Powerpc64le - Installation]]<br />
<br />
== Security ==<br />
<br />
* [[#Desktop security|Desktop security]] lists steps for securing Alpine Linux desktops<br />
* [[Setting up a laptop]] page has detailed guidelines to configure a secured laptop<br />
* [[Securing Alpine Linux|Secure Alpine Linux]] using Security Technical Implementation Guides (STIGs)<br />
* [[Sshguard|SSHGuard]] - Protects hosts against brute-force attacks: monitoring logs, attack detection, blocking using firewall.<br />
<br />
== Services == <br />
<br />
{{Note| Services are arranged in alphabetical order.}}<br />
<br />
=== Content management systems ===<br />
<br />
* [[DokuWiki]] ''(Simple and easy to use wiki, no database required)''<br />
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''<br />
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''<br />
* [[Mahara]] ''(E-portfolio and social networking system)''<br />
* [[MediaWiki]] ''(Free web-based wiki software application)''<br />
* [[Pastebin]] ''(Pastebin software application)''<br />
* [[WordPress]] ''(Web software to create website or blog)''<br />
* [[Moodle]] ''(Online Learning Management system)''<br />
<br />
=== Database === <br />
<br />
* [[MariaDB]] or [[MySQL|MySQL]]<br />
<br />
=== DNS ===<br />
<br />
* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''<br />
* [[Setting up nsd DNS server]]<br />
* [[Small-Time DNS with BIND9]] ''(A simple configuration with ad blocking for your home network)''<br />
* Unbound<br />
** [[Setting up unbound DNS server]]<br />
** [[Using Unbound as an Ad-blocker]] ''(Setup ad blocking for your network)''<br />
* [[TinyDNS Format]]<br />
<br />
=== File server ===<br />
<br />
* [[Setting up an NFS server|nfs-server]]<br />
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''<br />
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''<br />
<br />
=== Firewall ===<br />
<br />
* [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]<br />
** [[Zero-To-Awall]] -''AWall for dummies''<br />
** [[How-To Alpine Wall]] - ''AWall for Shorewall users''<br />
** [[Alpine Wall]] - ''AWall - Firewall management framework - Design Document''<br />
* [[Iptables]]<br />
* [[nftables]]<br />
* [[Uncomplicated Firewall|Uncomplicated Firewall or UFW]]<br />
<br />
=== HTTP and web services ===<br />
<br />
* [[Althttpd]]<br />
* [[Apache]]<br />
** [[Apache with php-fpm]]<br />
** [[Setting Up Apache with PHP]]<br />
** [[Apache authentication: NTLM Single Signon]]<br />
* [[Darkhttpd]]<br />
* [[Lighttpd]]<br />
** [[Lighttpd Advanced security]]<br />
** [[Setting Up Lighttpd With FastCGI]]<br />
** [[Production Web server: Lighttpd|Production web server: Lighttpd]]<br />
* [[Nginx]]<br />
** [[Nginx as reverse proxy with acme (letsencrypt)]]<br />
** [[Nginx with PHP]]<br />
* Squid Proxy<br />
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
** [[Setting up Explicit Squid Proxy]]<br />
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''<br />
** [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Tomcat]]<br />
** [[Production LAMP system: Lighttpd + PHP + MySQL|Production LAMP system: Lighttpd + PHP + MariaDB/MySQL]]<br />
<br />
=== IRC ===<br />
<br />
* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''<br />
<br />
=== Mail ===<br />
<br />
* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''<br />
* [[Hosting Web/Email services on Alpine]]<br />
* Exim/Dovecot<br />
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)<br />
** [[Setting up dovecot with imap and tls]]<br />
* [[relay email to gmail (msmtp, mailx, sendmail]]<br />
* [[relay email (nullmailer)]]<br />
* [[Roundcube]] ''(Webmail system)''<br />
* [[Setting up postfix with virtual domains]]<br />
* Server protection<br />
** [[Setting up clamsmtp]]<br />
<br />
=== Monitoring ===<br />
<br />
* [[Awstats]] ''(Free log file analyzer)''<br />
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''<br />
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' <!-- Monitoring and Security --><br />
* [[Linfo]]<br />
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''<br />
* [[Logcheck]] ''(log file monitoring tool)''<br />
* [[Matomo]] ''(A real time web analytics software program)''<br />
* [[Rasdaemon]] ''(Platform Reliability, Availability and Serviceability monitoring tool)''<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft, solution, Networking and Monitoring and Server --><br />
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' <!-- Networking and Monitoring --><br />
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' <!-- Networking and Monitoring --><br />
* [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Traffic monitoring]] <!-- Networking and Monitoring --><br />
** [[Setting up monitoring using rrdtool (and rrdcollect)]]<br />
** [[Setting up traffic monitoring using rrdtool (and snmp)]] <!-- Monitoring --><br />
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''<br />
* [[ZoneMinder video camera security and surveillance]]<br />
<br />
=== Remote Administration ===<br />
<br />
* ACF<br />
** [[Changing passwords for ACF|ACF - changing passwords]]<br />
** [[Generating SSL certs with ACF]] <!-- Generating SSL certs with ACF 1.9 --><br />
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''<br />
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''<br />
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''<br />
* [[OpenVCP]] ''(VServer Control Panel)''<br />
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''<br />
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''<br />
* [[Webmin]] ''(A web-based interface for Linux system)''<br />
<br />
=== Telephony ===<br />
<br />
* [[FreePBX|FreePBX on Alpine Linux]]<br />
* [[Setting up Zaptel/Asterisk on Alpine]]<br />
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''<br />
<br />
=== VPN ===<br />
* [[Freeradius Active Directory Integration]]<br />
* [[GNUnet]]<br />
* [[IGMPproxy]]<br />
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''<br />
* [[OpenVSwitch]]<br />
* [[Tor]]<br />
* [[Using Alpine on Windows domain with IPSEC isolation]]<br />
* [[Configure a Wireguard interface (wg)|Wireguard]]<br />
* [[Vpnc]]<br />
<br />
=== Other Servers ===<br />
<br />
* [[apcupsd]] ''(UPS Monitoring with apcupsd)''<br />
* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]<br />
* [[Glpi]] ''(Manage inventory of technical resources)''<br />
* [[How to setup a Alpine Linux mirror]]<br />
* [[nut-ups|NUT UPS]] ''(UPS Monitoring with Network UPS Tools)''<br />
* [[Odoo]]<br />
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''<br />
* [[Setting up a LLDAP server|lldap-server]] ''(Directory Server)''<br />
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]<br />
<br />
<br />
== Software development ==<br />
<br />
* [[Cgit]]<br />
* [[OsTicket]] ''(Ticket system)''<br />
* [[Patchwork]] ''(Patch review management system)''<br />
* [[Redmine]] ''(Project management system) [Deprecated]''<br />
* [[Request Tracker]] ''(Ticket system)''<br />
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''<br />
* [[Ansible]] ''(Configuration management)''<br />
* [[Installing Oracle Java|Oracle Java (installation)]]<br />
<br />
== Storage ==<br />
<br />
* [[Setting up disks manually|Manual partitioning]]<br />
* [[Disk Replication with DRBD|DRBD: Disk Replication]]<br />
* [[Filesystems]]<br />
** [[Burning ISOs]]<br />
* [[Setting up iSCSI|iSCSI Setup]]<br />
** [[iSCSI Raid and Clustered File Systems]]<br />
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]<br />
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]<br />
* [[Setting up Logical Volumes with LVM|LVM Setup]]<br />
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]<br />
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]<br />
** [[LVM on LUKS]]<br />
* RAID<br />
** [[Raid Administration]]<br />
** [[Setting up a software RAID array]]<br />
* [[ZFS]]<br />
** [[Root on ZFS with native encryption]]<br />
** [[Setting up ZFS on LUKS]]<br />
* [[CEPH|CEPH]]<br />
<br />
== Virtualization ==<br />
<br />
* [[Docker]]<br />
* [[Installing Alpine in a virtual machine]]<br />
** [[Install Alpine on VMware ESXi]]<br />
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''<br />
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''<br />
* [[QEMU]]<br />
* Xen<br />
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''<br />
** [[Xen Dom0 on USB or SD]]<br />
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]<br />
** [[Xen LiveCD]]<br />
** [[Xen PCI Passthrough]]<br />
** [[K8s]] Building a K8s Kubernetes Cluster on Alpine Linux<br />
* [[Runc]]<br />
<br />
== [[Simple_Walkthrough]] ==<br />
* [[About-virtualization-simple]]<br />
* [[LXC_Alpinelinux_Simple]]<br />
* [[Qemu-simple]]<br />
<br />
== Tutorials ==<br />
<br />
* [[TTY_Autologin|TTY Autologin]]<br />
* [[Kexec|Faster rebooting with kexec]]<br />
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]<br />
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]<br />
* [[Fault Tolerant Routing with Alpine Linux]]<br />
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''<br />
* [[Linux iSCSI Target (TCM)]]<br />
* [[ISP Mail Server 3.x HowTo]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''<br />
* [[Grommunio Mail Server]] ''(Mariadb+Postfix+Rspamd+Grommunio - Full-service mail server as MS exchange replacement)''<br />
* [[Replacing non-Alpine Linux with Alpine remotely]]<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft --><br />
* [[Streaming Security Camera Video with VLC]]<br />
* [[Install Alpine on a btrfs filesystem with refind as boot manager]]<br />
* [[Compile software from source|How to Compile a software from source in Alpine Linux]]<br />
* [https://ww2.coastal.edu/mmurphy2/oer/alpine/ Alpine Linux tutorials - Dr Murphy, Computing Science Associate Professor]<br />
* [[Michael's base installation procedure|Michael's base installation procedure]]<br />
* [[Michael's cwm desktop (minimal)|Michael's cwm desktop (minimal)]]<br />
* [[Michael's sway desktop (minimal)|Michael's Sway desktop (minimal)]]<br />
* [[Sway_customization_guide|Sway customization guide]] ''(Tutorial re Sway config file basics)''<br />
* [[Using Distrobox For VR Gaming|Using Distrobox For VR Gaming]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Unlock_an_encrypted_data_partition_on_login&diff=32023Unlock an encrypted data partition on login2026-02-07T14:35:35Z<p>Benaki: Created page with "= Mounting a LUKS Encrypted Data Partition at Boot = This guide covers how to set up a secondary LUKS-encrypted partition as a data drive that is automatically unlocked and mounted when Alpine Linux boots. This is useful if, for example, you have a root partition on one drive and want an encrypted data partition on another — or if you simply want a separate encrypted volume for personal data. == Prerequisites == * A spare partition (this guide uses <code>/dev/sda1</..."</p>
<hr />
<div>= Mounting a LUKS Encrypted Data Partition at Boot =<br />
<br />
This guide covers how to set up a secondary LUKS-encrypted partition as a data drive that is automatically unlocked and mounted when Alpine Linux boots. This is useful if, for example, you have a root partition on one drive and want an encrypted data partition on another — or if you simply want a separate encrypted volume for personal data.<br />
<br />
== Prerequisites ==<br />
<br />
* A spare partition (this guide uses <code>/dev/sda1</code> as an example)<br />
* <code>cryptsetup</code> installed: <code>doas apk add cryptsetup</code><br />
* An Alpine system using OpenRC (the default)<br />
<br />
== 1. Set Up the LUKS Container ==<br />
<br />
If you are starting with a fresh or existing partition, format it as a LUKS container. '''This will erase all data on the partition.'''<br />
<br />
<pre><br />
doas cryptsetup luksFormat /dev/sda1<br />
doas cryptsetup luksOpen /dev/sda1 data<br />
doas mkfs.ext4 /dev/mapper/data<br />
doas cryptsetup luksClose data<br />
</pre><br />
<br />
== 2. Create a Keyfile for Automatic Unlocking ==<br />
<br />
A keyfile allows the partition to be unlocked at boot without a passphrase prompt. The keyfile itself is stored on your root partition, so it is protected by whatever encryption or access controls that partition has.<br />
<br />
<pre><br />
doas dd if=/dev/urandom of=/etc/crypto_keyfile.bin bs=512 count=1<br />
doas chmod 600 /etc/crypto_keyfile.bin<br />
doas cryptsetup luksAddKey /dev/sda1 /etc/crypto_keyfile.bin<br />
</pre><br />
<br />
Your original passphrase remains as a fallback for manual unlocking.<br />
<br />
== 3. Create the Mount Point ==<br />
<br />
<pre><br />
doas mkdir -p /mnt/data<br />
</pre><br />
<br />
== 4. Add an fstab Entry ==<br />
<br />
Add the following line to <code>/etc/fstab</code>:<br />
<br />
<pre><br />
/dev/mapper/data /mnt/data ext4 defaults,nofail 0 2<br />
</pre><br />
<br />
The <code>nofail</code> option ensures that if the device or keyfile is missing for any reason, the system will still boot.<br />
<br />
== 5. Create an OpenRC Init Script ==<br />
<br />
Alpine's OpenRC does not process <code>/etc/crypttab</code> by default. The root partition's LUKS container is typically unlocked via kernel parameters (<code>cryptroot</code>, <code>cryptdm</code>) in the initramfs, not via <code>crypttab</code>. For additional encrypted partitions, you need a custom init script to handle both the unlock and the mount.<br />
<br />
Create <code>/etc/init.d/cryptdata</code> with the following contents:<br />
<br />
<pre><br />
#!/sbin/openrc-run<br />
description="Unlock and mount LUKS encrypted data partition"<br />
<br />
RC_NEEDED="modules lvm"<br />
RC_AFTER="modules lvm"<br />
RC_BEFORE="local"<br />
<br />
start() {<br />
ebegin "Unlocking /dev/sda1"<br />
cryptsetup luksOpen /dev/sda1 data --key-file /etc/crypto_keyfile.bin<br />
eend $?<br />
<br />
ebegin "Mounting /mnt/data"<br />
mount /dev/mapper/data /mnt/data<br />
eend $?<br />
}<br />
</pre><br />
<br />
=== Why both unlock and mount in the script? ===<br />
<br />
The <code>RC_BEFORE="local"</code> directive is intended to make this script run before OpenRC processes <code>fstab</code> mounts. In practice, the timing is not always reliable, and the mount in <code>fstab</code> may be attempted before the LUKS container is open. Putting the mount directly in the init script guarantees the correct order: unlock first, then mount.<br />
<br />
=== Dependencies ===<br />
<br />
* <code>RC_AFTER="modules lvm"</code> — ensures kernel modules and LVM volumes are available before this script runs.<br />
* <code>RC_BEFORE="local"</code> — requests that this script runs before the <code>local</code> service, which is where general <code>fstab</code> mounts are processed.<br />
<br />
== 6. Enable the Service ==<br />
<br />
<pre><br />
doas chmod +x /etc/init.d/cryptdata<br />
doas rc-update add cryptdata boot<br />
</pre><br />
<br />
== 7. Test ==<br />
<br />
Reboot and verify:<br />
<br />
<pre><br />
df -h | grep data<br />
# Should show something like:<br />
# /dev/mapper/data 219G 2.0M 208G 0% /mnt/data<br />
</pre><br />
<br />
You can also confirm the LUKS container is active:<br />
<br />
<pre><br />
doas cryptsetup status data<br />
</pre><br />
<br />
== Manual Unlock (Fallback) ==<br />
<br />
If you ever need to unlock the partition by hand (e.g. the keyfile is missing), you can do so with your original passphrase:<br />
<br />
<pre><br />
doas cryptsetup luksOpen /dev/sda1 data<br />
doas mount /dev/mapper/data /mnt/data<br />
</pre></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Tutorials_and_Howtos&diff=32022Tutorials and Howtos2026-02-07T14:30:10Z<p>Benaki: /* Other topics */</p>
<hr />
<div>[[Image:package_edutainment.svg|right|link=]]<br />
{{TOC left}}<br />
<br />
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''<br />
<br />
'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions. Howto's have been organized in the below page based on the topics. <br />
<br />
'''The [[#Tutorials|tutorials]] are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.<br />
<br />
{{Note|<br />
* Contributors are requested to refer to [[Help:Editing]] first and make use of resources like [[How to write a HOWTO]].<br />
* Contributions must be complete articles. <br />
* Don't override already made contributions, unless there is a mistake. <br />
* If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].}}<br />
<br />
== Desktop ==<br />
<br />
* {{:Daily driver guide}}<br />
<br />
=== Networking ===<br />
<br />
* [[Bluetooth]] - Instructions for installing and configuring Bluetooth<br />
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces<br />
* [[Bridge]] - Configuring a network bridge<br />
** [[Bridge wlan0 to eth0]]<br />
* [[Configure Networking]]<br />
* [[How to configure static routes]]<br />
* Modem<br />
** [[Using HSDPA modem]]<br />
** [[Using serial modem]]<br />
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine. <br />
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''<br />
* [[PXE boot]]<br />
* Wi-Fi<br />
** [[Wi-Fi|Connecting to a wireless access point]]<br />
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''<br />
* Use [https://github.com/ifupdown-ng/ifupdown-ng/blob/main/doc/interfaces-vxlan.scd vxlan], if using [[Ifupdown-ng]] instead of [[VLAN]]<br />
* [[Setting up a Home Router]]<br />
<br />
=== Backup and data migration ===<br />
<br />
* [[Migrating data]]<br />
* [[Rsnapshot]] - setting up periodic backups<br />
<br />
=== Other topics ===<br />
<br />
* [[Gaming on Alpine]]<br />
* [[Remote Desktop Server]]<br />
* [[Default applications|How to change default application]]<br />
* [[CPU frequency scaling]]<br />
* [[Mimalloc]]<br />
* [[Enable Serial Console on Boot]]<br />
* [[How to build the Alpine Linux kernel]]<br />
* [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''<br />
* [[Setting up lm_sensors]]<br />
* [[Fingerprint Authentication with swaylock]]<br />
* [[Unlock an encrypted data partition on login]]<br />
* [[Desktop environments and Window managers|List of supported Desktop environments and Window managers]]<br />
<br />
== Diskless ==<br />
<br />
* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''<br />
** [[Back Up a Flash Memory Installation]]<br />
** [[Manually editing a existing apkovl]]<br />
<br />
== Other Architectures ==<br />
<br />
=== APU (PCEngines) ===<br />
<br />
* [[Alpine Install: from a disc to PC Engines APU|Alpine on PC Engines APU]]<br />
* [https://github.com/huubsch/Installation-of-Alpine-Linux-on-PC-Engines-APU3/tree/main?tab=readme-ov-file Installation of Alpine Linux on PCEngines APU, legacy BIOS]<br />
<br />
=== ARM ===<br />
<br />
* [[Alpine on ARM]]<br />
<br />
==== Raspberry Pi ====<br />
<br />
* [[Raspberry Pi|Raspberry Pi main page]]<br />
* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]<br />
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]<br />
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]<br />
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]<br />
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]<br />
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''<br />
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign<br />
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]<br />
* [[Raspberry Pi 3 - Setting Up Bluetooth]]<br />
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]<br />
* [[Raspberry_Pi_Zero_W_-_Installation|Raspberry Pi Zero W - Installation]]<br />
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''<br />
* [[RPI Video Receiver]]<br />
<br />
=== IBM Z (IBM z Systems) ===<br />
<br />
* [[s390x|s390x - Installation]]<br />
<br />
=== PowerPC ===<br />
<br />
* [[Ppc64le|Powerpc64le - Installation]]<br />
<br />
== Security ==<br />
<br />
* [[#Desktop security|Desktop security]] lists steps for securing Alpine Linux desktops<br />
* [[Setting up a laptop]] page has detailed guidelines to configure a secured laptop<br />
* [[Securing Alpine Linux|Secure Alpine Linux]] using Security Technical Implementation Guides (STIGs)<br />
* [[Sshguard|SSHGuard]] - Protects hosts against brute-force attacks: monitoring logs, attack detection, blocking using firewall.<br />
<br />
== Services == <br />
<br />
{{Note| Services are arranged in alphabetical order.}}<br />
<br />
=== Content management systems ===<br />
<br />
* [[DokuWiki]] ''(Simple and easy to use wiki, no database required)''<br />
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''<br />
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''<br />
* [[Mahara]] ''(E-portfolio and social networking system)''<br />
* [[MediaWiki]] ''(Free web-based wiki software application)''<br />
* [[Pastebin]] ''(Pastebin software application)''<br />
* [[WordPress]] ''(Web software to create website or blog)''<br />
* [[Moodle]] ''(Online Learning Management system)''<br />
<br />
=== Database === <br />
<br />
* [[MariaDB]] or [[MySQL|MySQL]]<br />
<br />
=== DNS ===<br />
<br />
* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''<br />
* [[Setting up nsd DNS server]]<br />
* [[Small-Time DNS with BIND9]] ''(A simple configuration with ad blocking for your home network)''<br />
* Unbound<br />
** [[Setting up unbound DNS server]]<br />
** [[Using Unbound as an Ad-blocker]] ''(Setup ad blocking for your network)''<br />
* [[TinyDNS Format]]<br />
<br />
=== File server ===<br />
<br />
* [[Setting up an NFS server|nfs-server]]<br />
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''<br />
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''<br />
<br />
=== Firewall ===<br />
<br />
* [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]<br />
** [[Zero-To-Awall]] -''AWall for dummies''<br />
** [[How-To Alpine Wall]] - ''AWall for Shorewall users''<br />
** [[Alpine Wall]] - ''AWall - Firewall management framework - Design Document''<br />
* [[Iptables]]<br />
* [[nftables]]<br />
* [[Uncomplicated Firewall|Uncomplicated Firewall or UFW]]<br />
<br />
=== HTTP and web services ===<br />
<br />
* [[Althttpd]]<br />
* [[Apache]]<br />
** [[Apache with php-fpm]]<br />
** [[Setting Up Apache with PHP]]<br />
** [[Apache authentication: NTLM Single Signon]]<br />
* [[Darkhttpd]]<br />
* [[Lighttpd]]<br />
** [[Lighttpd Advanced security]]<br />
** [[Setting Up Lighttpd With FastCGI]]<br />
** [[Production Web server: Lighttpd|Production web server: Lighttpd]]<br />
* [[Nginx]]<br />
** [[Nginx as reverse proxy with acme (letsencrypt)]]<br />
** [[Nginx with PHP]]<br />
* Squid Proxy<br />
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
** [[Setting up Explicit Squid Proxy]]<br />
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''<br />
** [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Tomcat]]<br />
** [[Production LAMP system: Lighttpd + PHP + MySQL|Production LAMP system: Lighttpd + PHP + MariaDB/MySQL]]<br />
<br />
=== IRC ===<br />
<br />
* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''<br />
<br />
=== Mail ===<br />
<br />
* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''<br />
* [[Hosting Web/Email services on Alpine]]<br />
* Exim/Dovecot<br />
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)<br />
** [[Setting up dovecot with imap and tls]]<br />
* [[relay email to gmail (msmtp, mailx, sendmail]]<br />
* [[relay email (nullmailer)]]<br />
* [[Roundcube]] ''(Webmail system)''<br />
* [[Setting up postfix with virtual domains]]<br />
* Server protection<br />
** [[Setting up clamsmtp]]<br />
<br />
=== Monitoring ===<br />
<br />
* [[Awstats]] ''(Free log file analyzer)''<br />
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''<br />
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' <!-- Monitoring and Security --><br />
* [[Linfo]]<br />
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''<br />
* [[Logcheck]] ''(log file monitoring tool)''<br />
* [[Matomo]] ''(A real time web analytics software program)''<br />
* [[Rasdaemon]] ''(Platform Reliability, Availability and Serviceability monitoring tool)''<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft, solution, Networking and Monitoring and Server --><br />
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' <!-- Networking and Monitoring --><br />
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' <!-- Networking and Monitoring --><br />
* [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Traffic monitoring]] <!-- Networking and Monitoring --><br />
** [[Setting up monitoring using rrdtool (and rrdcollect)]]<br />
** [[Setting up traffic monitoring using rrdtool (and snmp)]] <!-- Monitoring --><br />
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''<br />
* [[ZoneMinder video camera security and surveillance]]<br />
<br />
=== Remote Administration ===<br />
<br />
* ACF<br />
** [[Changing passwords for ACF|ACF - changing passwords]]<br />
** [[Generating SSL certs with ACF]] <!-- Generating SSL certs with ACF 1.9 --><br />
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''<br />
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''<br />
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''<br />
* [[OpenVCP]] ''(VServer Control Panel)''<br />
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''<br />
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''<br />
* [[Webmin]] ''(A web-based interface for Linux system)''<br />
<br />
=== Telephony ===<br />
<br />
* [[FreePBX|FreePBX on Alpine Linux]]<br />
* [[Setting up Zaptel/Asterisk on Alpine]]<br />
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''<br />
<br />
=== VPN ===<br />
* [[Freeradius Active Directory Integration]]<br />
* [[GNUnet]]<br />
* [[IGMPproxy]]<br />
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''<br />
* [[OpenVSwitch]]<br />
* [[Tor]]<br />
* [[Using Alpine on Windows domain with IPSEC isolation]]<br />
* [[Configure a Wireguard interface (wg)|Wireguard]]<br />
* [[Vpnc]]<br />
<br />
=== Other Servers ===<br />
<br />
* [[apcupsd]] ''(UPS Monitoring with apcupsd)''<br />
* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]<br />
* [[Glpi]] ''(Manage inventory of technical resources)''<br />
* [[How to setup a Alpine Linux mirror]]<br />
* [[nut-ups|NUT UPS]] ''(UPS Monitoring with Network UPS Tools)''<br />
* [[Odoo]]<br />
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''<br />
* [[Setting up a LLDAP server|lldap-server]] ''(Directory Server)''<br />
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]<br />
<br />
<br />
== Software development ==<br />
<br />
* [[Cgit]]<br />
* [[OsTicket]] ''(Ticket system)''<br />
* [[Patchwork]] ''(Patch review management system)''<br />
* [[Redmine]] ''(Project management system) [Deprecated]''<br />
* [[Request Tracker]] ''(Ticket system)''<br />
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''<br />
* [[Ansible]] ''(Configuration management)''<br />
* [[Installing Oracle Java|Oracle Java (installation)]]<br />
<br />
== Storage ==<br />
<br />
* [[Setting up disks manually|Manual partitioning]]<br />
* [[Disk Replication with DRBD|DRBD: Disk Replication]]<br />
* [[Filesystems]]<br />
** [[Burning ISOs]]<br />
* [[Setting up iSCSI|iSCSI Setup]]<br />
** [[iSCSI Raid and Clustered File Systems]]<br />
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]<br />
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]<br />
* [[Setting up Logical Volumes with LVM|LVM Setup]]<br />
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]<br />
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]<br />
** [[LVM on LUKS]]<br />
* RAID<br />
** [[Raid Administration]]<br />
** [[Setting up a software RAID array]]<br />
* [[ZFS]]<br />
** [[Root on ZFS with native encryption]]<br />
** [[Setting up ZFS on LUKS]]<br />
* [[CEPH|CEPH]]<br />
<br />
== Virtualization ==<br />
<br />
* [[Docker]]<br />
* [[Installing Alpine in a virtual machine]]<br />
** [[Install Alpine on VMware ESXi]]<br />
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''<br />
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''<br />
* [[QEMU]]<br />
* Xen<br />
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''<br />
** [[Xen Dom0 on USB or SD]]<br />
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]<br />
** [[Xen LiveCD]]<br />
** [[Xen PCI Passthrough]]<br />
** [[K8s]] Building a K8s Kubernetes Cluster on Alpine Linux<br />
* [[Runc]]<br />
<br />
== [[Simple_Walkthrough]] ==<br />
* [[About-virtualization-simple]]<br />
* [[LXC_Alpinelinux_Simple]]<br />
* [[Qemu-simple]]<br />
<br />
== Tutorials ==<br />
<br />
* [[TTY_Autologin|TTY Autologin]]<br />
* [[Kexec|Faster rebooting with kexec]]<br />
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]<br />
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]<br />
* [[Fault Tolerant Routing with Alpine Linux]]<br />
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''<br />
* [[Linux iSCSI Target (TCM)]]<br />
* [[ISP Mail Server 3.x HowTo]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''<br />
* [[Grommunio Mail Server]] ''(Mariadb+Postfix+Rspamd+Grommunio - Full-service mail server as MS exchange replacement)''<br />
* [[Replacing non-Alpine Linux with Alpine remotely]]<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft --><br />
* [[Streaming Security Camera Video with VLC]]<br />
* [[Install Alpine on a btrfs filesystem with refind as boot manager]]<br />
* [[Compile software from source|How to Compile a software from source in Alpine Linux]]<br />
* [https://ww2.coastal.edu/mmurphy2/oer/alpine/ Alpine Linux tutorials - Dr Murphy, Computing Science Associate Professor]<br />
* [[Michael's base installation procedure|Michael's base installation procedure]]<br />
* [[Michael's cwm desktop (minimal)|Michael's cwm desktop (minimal)]]<br />
* [[Michael's sway desktop (minimal)|Michael's Sway desktop (minimal)]]<br />
* [[Sway_customization_guide|Sway customization guide]] ''(Tutorial re Sway config file basics)''<br />
* [[Using Distrobox For VR Gaming|Using Distrobox For VR Gaming]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Fingerprint_Authentication_with_swaylock&diff=30837Fingerprint Authentication with swaylock2025-09-01T16:17:09Z<p>Benaki: </p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
Not all fingerprint readers are supported, see [https://fprint.freedesktop.org/supported-devices.html here].<br />
<br />
<code>lsusb | grep finger</code><br />
<br />
will give you your USB ID.<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
doas apk add fprintd<br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
doas adduser $USER input<br />
<br />
'''Note:''' You must log out and back in (or reboot) for the group membership & PolicyKit rule to take effect.<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
<br />
Enroll your fingerprint(s):<br />
<br />
fprintd-enroll<br />
<br />
Verify the enrollment works:<br />
<br />
fprintd-verify<br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> <br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Fingerprint_Authentication_with_swaylock&diff=30836Fingerprint Authentication with swaylock2025-09-01T16:16:57Z<p>Benaki: usb id</p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
Not all fingerprint readers are supported, see [https://fprint.freedesktop.org/supported-devices.html here].<br />
<code>lsusb | grep finger</code><br />
will give you your USB ID.<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
doas apk add fprintd<br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
doas adduser $USER input<br />
<br />
'''Note:''' You must log out and back in (or reboot) for the group membership & PolicyKit rule to take effect.<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
<br />
Enroll your fingerprint(s):<br />
<br />
fprintd-enroll<br />
<br />
Verify the enrollment works:<br />
<br />
fprintd-verify<br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> <br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Fingerprint_Authentication_with_swaylock&diff=30834Fingerprint Authentication with swaylock2025-09-01T14:11:23Z<p>Benaki: </p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
doas apk add fprintd<br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
doas adduser $USER input<br />
<br />
'''Note:''' You must log out and back in (or reboot) for the group membership & PolicyKit rule to take effect.<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
<br />
Enroll your fingerprint(s):<br />
<br />
fprintd-enroll<br />
<br />
Verify the enrollment works:<br />
<br />
fprintd-verify<br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> <br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Setting_up_fprintd_for_swaylock&diff=30833Setting up fprintd for swaylock2025-09-01T14:09:44Z<p>Benaki: Blanked the page</p>
<hr />
<div></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Fingerprint_Authentication_with_swaylock&diff=30832Fingerprint Authentication with swaylock2025-09-01T14:08:25Z<p>Benaki: </p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
doas apk add fprintd<br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
doas adduser $USER input<br />
<br />
'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
<br />
Enroll your fingerprint(s):<br />
<br />
fprintd-enroll<br />
<br />
Verify the enrollment works:<br />
<br />
fprintd-verify<br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> <br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Fingerprint_Authentication_with_swaylock&diff=30831Fingerprint Authentication with swaylock2025-09-01T14:06:50Z<p>Benaki: Fingerprint Authentication with swaylock</p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
doas apk add fprintd<br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
doas adduser $USER input<br />
<br />
'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
<br />
Enroll your fingerprint(s):<br />
<br />
fprintd-enroll<br />
<br />
Verify the enrollment works:<br />
<br />
fprintd-verify<br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> or <code>doas</code><br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Tutorials_and_Howtos&diff=30830Tutorials and Howtos2025-09-01T14:04:56Z<p>Benaki: /* Other topics */</p>
<hr />
<div>[[Image:package_edutainment.svg|right|link=]]<br />
{{TOC left}}<br />
<br />
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''<br />
<br />
'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions. Howto's have been organized in the below page based on the topics. <br />
<br />
'''The [[#Tutorials|tutorials]] are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.<br />
<br />
{{Note|<br />
* Contributors are requested to refer to [[Help:Editing]] first and make use of resources like [[How to write a HOWTO]].<br />
* Contributions must be complete articles. <br />
* Don't override already made contributions, unless there is a mistake. <br />
* If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].}}<br />
<br />
== Desktop ==<br />
<br />
* {{:Daily driver guide}}<br />
<br />
=== Networking ===<br />
<br />
* [[Bluetooth]] - Instructions for installing and configuring Bluetooth<br />
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces<br />
* [[Bridge]] - Configuring a network bridge<br />
** [[Bridge wlan0 to eth0]]<br />
* [[Configure Networking]]<br />
* [[How to configure static routes]]<br />
* Modem<br />
** [[Using HSDPA modem]]<br />
** [[Using serial modem]]<br />
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine. <br />
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''<br />
* [[PXE boot]]<br />
* Wi-Fi<br />
** [[Wi-Fi|Connecting to a wireless access point]]<br />
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''<br />
* Use [https://github.com/ifupdown-ng/ifupdown-ng/blob/main/doc/interfaces-vxlan.scd vxlan], if using [[Ifupdown-ng]] instead of [[VLAN]]<br />
<br />
=== Backup and data migration ===<br />
<br />
* [[Migrating data]]<br />
* [[Rsnapshot]] - setting up periodic backups<br />
<br />
=== Other topics ===<br />
<br />
* [[Gaming on Alpine]]<br />
* [[Remote Desktop Server]]<br />
* [[Default applications|How to change default application]]<br />
* [[CPU frequency scaling]]<br />
* [[Mimalloc]]<br />
* [[Enable Serial Console on Boot]]<br />
* [[How to build the Alpine Linux kernel]]<br />
* [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''<br />
* [[Setting up lm_sensors]]<br />
* [[Fingerprint Authentication with swaylock]]<br />
* [[Desktop environments and Window managers|List of supported Desktop environments and Window managers]]<br />
<br />
== Diskless ==<br />
<br />
* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''<br />
** [[Back Up a Flash Memory Installation]]<br />
** [[Manually editing a existing apkovl]]<br />
<br />
== Other Architectures ==<br />
<br />
=== ARM ===<br />
<br />
* [[Alpine on ARM]]<br />
<br />
==== Raspberry Pi ====<br />
<br />
* [[Raspberry Pi|Raspberry Pi main page]]<br />
* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]<br />
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]<br />
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]<br />
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]<br />
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]<br />
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''<br />
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign<br />
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]<br />
* [[Raspberry Pi 3 - Setting Up Bluetooth]]<br />
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]<br />
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''<br />
* [[RPI Video Receiver]]<br />
<br />
=== IBM Z (IBM z Systems) ===<br />
<br />
* [[s390x|s390x - Installation]]<br />
<br />
=== PowerPC ===<br />
<br />
* [[Ppc64le|Powerpc64le - Installation]]<br />
<br />
== Security ==<br />
<br />
* [[#Desktop security|Desktop security]] lists steps for securing Alpine Linux desktops<br />
* [[Setting up a laptop]] page has detailed guidelines to configure a secured laptop<br />
* [[Securing Alpine Linux|Secure Alpine Linux]] using Security Technical Implementation Guides (STIGs)<br />
<br />
== Services == <br />
<br />
{{Note| Services are arranged in alphabetical order.}}<br />
<br />
=== Content management systems ===<br />
<br />
* [[DokuWiki]] ''(Simple and easy to use wiki, no database required)''<br />
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''<br />
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''<br />
* [[Mahara]] ''(E-portfolio and social networking system)''<br />
* [[MediaWiki]] ''(Free web-based wiki software application)''<br />
* [[Pastebin]] ''(Pastebin software application)''<br />
* [[WordPress]] ''(Web software to create website or blog)''<br />
* [[Moodle]] ''(Online Learning Management system)''<br />
<br />
=== Database === <br />
<br />
* [[MariaDB]] or [[MySQL|MySQL]]<br />
<br />
=== DNS ===<br />
<br />
* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''<br />
* [[Setting up nsd DNS server]]<br />
* [[Small-Time DNS with BIND9]] ''(A simple configuration with ad blocking for your home network)''<br />
* Unbound<br />
** [[Setting up unbound DNS server]]<br />
** [[Using Unbound as an Ad-blocker]] ''(Setup ad blocking for your network)''<br />
* [[TinyDNS Format]]<br />
<br />
=== File server ===<br />
<br />
* [[Setting up an NFS server|nfs-server]]<br />
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''<br />
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''<br />
<br />
=== Firewall ===<br />
<br />
* [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]<br />
** [[Zero-To-Awall]] -''AWall for dummies''<br />
** [[How-To Alpine Wall]] - ''AWall for Shorewall users''<br />
** [[Alpine Wall]] - ''AWall - Firewall management framework - Design Document''<br />
* [[Iptables]]<br />
* [[nftables]]<br />
* [[Uncomplicated Firewall|Uncomplicated Firewall or UFW]]<br />
<br />
=== HTTP and web services ===<br />
<br />
* [[Althttpd]]<br />
* [[Apache]]<br />
** [[Apache with php-fpm]]<br />
** [[Setting Up Apache with PHP]]<br />
** [[Apache authentication: NTLM Single Signon]]<br />
* [[Darkhttpd]]<br />
* [[Lighttpd]]<br />
** [[Lighttpd Advanced security]]<br />
** [[Setting Up Lighttpd With FastCGI]]<br />
** [[Production Web server: Lighttpd|Production web server: Lighttpd]]<br />
* [[Nginx]]<br />
** [[Nginx as reverse proxy with acme (letsencrypt)]]<br />
** [[Nginx with PHP]]<br />
* Squid Proxy<br />
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
** [[Setting up Explicit Squid Proxy]]<br />
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''<br />
** [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Tomcat]]<br />
** [[Production LAMP system: Lighttpd + PHP + MySQL|Production LAMP system: Lighttpd + PHP + MariaDB/MySQL]]<br />
<br />
=== IRC ===<br />
<br />
* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''<br />
<br />
=== Mail ===<br />
<br />
* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''<br />
* [[Hosting Web/Email services on Alpine]]<br />
* Exim/Dovecot<br />
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)<br />
** [[Setting up dovecot with imap and tls]]<br />
* [[relay email to gmail (msmtp, mailx, sendmail]]<br />
* [[relay email (nullmailer)]]<br />
* [[Roundcube]] ''(Webmail system)''<br />
* [[Setting up postfix with virtual domains]]<br />
* Server protection<br />
** [[Setting up clamsmtp]]<br />
<br />
=== Monitoring ===<br />
<br />
* [[Awstats]] ''(Free log file analyzer)''<br />
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''<br />
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' <!-- Monitoring and Security --><br />
* [[Linfo]]<br />
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''<br />
* [[Logcheck]] ''(log file monitoring tool)''<br />
* [[Matomo]] ''(A real time web analytics software program)''<br />
* [[Rasdaemon]] ''(Platform Reliability, Availability and Serviceability monitoring tool)''<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft, solution, Networking and Monitoring and Server --><br />
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' <!-- Networking and Monitoring --><br />
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' <!-- Networking and Monitoring --><br />
* [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Traffic monitoring]] <!-- Networking and Monitoring --><br />
** [[Setting up monitoring using rrdtool (and rrdcollect)]]<br />
** [[Setting up traffic monitoring using rrdtool (and snmp)]] <!-- Monitoring --><br />
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''<br />
* [[ZoneMinder video camera security and surveillance]]<br />
<br />
=== Remote Administration ===<br />
<br />
* ACF<br />
** [[Changing passwords for ACF|ACF - changing passwords]]<br />
** [[Generating SSL certs with ACF]] <!-- Generating SSL certs with ACF 1.9 --><br />
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''<br />
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''<br />
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''<br />
* [[OpenVCP]] ''(VServer Control Panel)''<br />
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''<br />
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''<br />
* [[Webmin]] ''(A web-based interface for Linux system)''<br />
<br />
=== Telephony ===<br />
<br />
* [[FreePBX|FreePBX on Alpine Linux]]<br />
* [[Setting up Zaptel/Asterisk on Alpine]]<br />
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''<br />
<br />
=== VPN ===<br />
* [[Freeradius Active Directory Integration]]<br />
* [[GNUnet]]<br />
* [[IGMPproxy]]<br />
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''<br />
* [[OpenVSwitch]]<br />
* [[Tor]]<br />
* [[Using Alpine on Windows domain with IPSEC isolation]]<br />
* [[Configure a Wireguard interface (wg)|Wireguard]]<br />
<br />
=== Other Servers ===<br />
<br />
* [[apcupsd]] ''(UPS Monitoring with apcupsd)''<br />
* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]<br />
* [[Glpi]] ''(Manage inventory of technical resources)''<br />
* [[How to setup a Alpine Linux mirror]]<br />
* [[nut-ups|NUT UPS]] ''(UPS Monitoring with Network UPS Tools)''<br />
* [[Odoo]]<br />
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''<br />
* [[Setting up a LLDAP server|lldap-server]] ''(Directory Server)''<br />
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]<br />
<br />
<br />
== Software development ==<br />
<br />
* [[Cgit]]<br />
* [[OsTicket]] ''(Ticket system)''<br />
* [[Patchwork]] ''(Patch review management system)''<br />
* [[Redmine]] ''(Project management system) [Deprecated]''<br />
* [[Request Tracker]] ''(Ticket system)''<br />
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''<br />
* [[Ansible]] ''(Configuration management)''<br />
* [[Installing Oracle Java|Oracle Java (installation)]]<br />
<br />
== Storage ==<br />
<br />
* [[Setting up disks manually|Manual partitioning]]<br />
* [[Disk Replication with DRBD|DRBD: Disk Replication]]<br />
* [[Filesystems]]<br />
** [[Burning ISOs]]<br />
* [[Setting up iSCSI|iSCSI Setup]]<br />
** [[iSCSI Raid and Clustered File Systems]]<br />
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]<br />
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]<br />
* [[Setting up Logical Volumes with LVM|LVM Setup]]<br />
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]<br />
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]<br />
** [[LVM on LUKS]]<br />
* RAID<br />
** [[Raid Administration]]<br />
** [[Setting up a software RAID array]]<br />
* [[ZFS]]<br />
** [[Root on ZFS with native encryption]]<br />
** [[Setting up ZFS on LUKS]]<br />
* [[CEPH|CEPH]]<br />
<br />
== Virtualization ==<br />
<br />
* [[Docker]]<br />
* [[Installing Alpine in a virtual machine]]<br />
** [[Install Alpine on VMware ESXi]]<br />
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''<br />
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''<br />
* [[QEMU]]<br />
* Xen<br />
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''<br />
** [[Xen Dom0 on USB or SD]]<br />
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]<br />
** [[Xen LiveCD]]<br />
** [[Xen PCI Passthrough]]<br />
** [[K8s]] Building a K8s Kubernetes Cluster on Alpine Linux<br />
* [[Runc]]<br />
<br />
== Tutorials ==<br />
<br />
* [[TTY_Autologin|TTY Autologin]]<br />
* [[Kexec|Faster rebooting with kexec]]<br />
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]<br />
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]<br />
* [[Fault Tolerant Routing with Alpine Linux]]<br />
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''<br />
* [[Linux iSCSI Target (TCM)]]<br />
* [[ISP Mail Server 3.x HowTo]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''<br />
* [[Grommunio Mail Server]] ''(Mariadb+Postfix+Rspamd+Grommunio - Full-service mail server as MS exchange replacement)''<br />
* [[Replacing non-Alpine Linux with Alpine remotely]]<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft --><br />
* [[Streaming Security Camera Video with VLC]]<br />
* [[Install Alpine on a btrfs filesystem with refind as boot manager]]<br />
* [[Compile software from source|How to Compile a software from source in Alpine Linux]]<br />
* [https://ww2.coastal.edu/mmurphy2/oer/alpine/ Alpine Linux tutorials - Dr Murphy, Computing Science Associate Professor]<br />
* [[Michael's base installation procedure|Michael's base installation procedure]]<br />
* [[Michael's sway desktop (minimal)|Michael's sway desktop (minimal)]]<br />
* [[Michael's cwm desktop (minimal)|Michael's cwm desktop (minimal)]]</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Setting_up_fprintd_for_swaylock&diff=30829Setting up fprintd for swaylock2025-09-01T13:41:22Z<p>Benaki: </p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
doas apk add fprintd<br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
doas adduser $USER input<br />
<br />
'''Note:''' You must log out and back in (or reboot) for the group membership to take effect.<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
<br />
Enroll your fingerprint(s):<br />
<br />
fprintd-enroll<br />
<br />
Verify the enrollment works:<br />
<br />
fprintd-verify<br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> or <code>doas</code><br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Setting_up_fprintd_for_swaylock&diff=30828Setting up fprintd for swaylock2025-09-01T13:36:08Z<p>Benaki: </p>
<hr />
<div>= Fingerprint Authentication with swaylock =<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
* <code>&lt;enter password&gt;</code> → <code>&lt;hit enter&gt;</code><br />
* <code>&lt;hit enter&gt;</code> → <code>&lt;touch fingerprint sensor&gt;</code><br />
<br />
== Installation ==<br />
<br />
Install the fprintd package:<br />
<br />
<syntaxhighlight lang="bash"><br />
doas apk add fprintd<br />
</syntaxhighlight><br />
<br />
== Configure PolicyKit Permissions ==<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the <code>input</code> group to manage fingerprints:<br />
<br />
<syntaxhighlight lang="bash"><br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
</syntaxhighlight><br />
<br />
Add your user to the <code>input</code> group:<br />
<br />
<syntaxhighlight lang="bash"><br />
doas adduser $USER input<br />
</syntaxhighlight><br />
<br />
{{Note|You must log out and back in (or reboot) for the group membership to take effect.}}<br />
<br />
== Enroll Fingerprints ==<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
<syntaxhighlight lang="bash"><br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
</syntaxhighlight><br />
<br />
Enroll your fingerprint(s):<br />
<br />
<syntaxhighlight lang="bash"><br />
fprintd-enroll<br />
</syntaxhighlight><br />
<br />
Verify the enrollment works:<br />
<br />
<syntaxhighlight lang="bash"><br />
fprintd-verify<br />
</syntaxhighlight><br />
<br />
== Configure PAM for swaylock ==<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
<syntaxhighlight lang="bash"><br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
</syntaxhighlight><br />
<br />
== Usage ==<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
* '''Password authentication:''' Type your password and press Enter<br />
* '''Fingerprint authentication:''' Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
== Troubleshooting ==<br />
<br />
* '''Permission denied during enrollment:''' Ensure you're in the <code>input</code> group and have logged out/in after adding the group<br />
* '''Fingerprint recognized but doesn't unlock:''' Check that fingerprints are enrolled for the correct user (not root)<br />
* '''No fallback to password:''' Verify the PAM configuration has <code>pam_unix.so</code> before <code>pam_fprintd.so</code><br />
<br />
== Extending to Other Services ==<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in <code>/etc/pam.d/</code> such as:<br />
* <code>sudo</code> or <code>doas</code><br />
* <code>polkit-1</code><br />
* <code>login</code><br />
* <code>su</code></div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Setting_up_fprintd_for_swaylock&diff=30827Setting up fprintd for swaylock2025-09-01T13:34:42Z<p>Benaki: </p>
<hr />
<div># Fingerprint Authentication with swaylock<br />
<br />
This guide shows how to configure fingerprint authentication for swaylock on Alpine Linux, allowing you to unlock using either:<br />
- `<enter password>` → `<hit enter>`<br />
- `<hit enter>` → `<touch fingerprint sensor>`<br />
<br />
## Installation<br />
<br />
Install the fprintd package:<br />
<br />
```bash<br />
doas apk add fprintd<br />
```<br />
<br />
## Configure PolicyKit Permissions<br />
<br />
Upon installation, standard users are not authorized to enroll fingerprints. Create a PolicyKit rule to allow members of the `input` group to manage fingerprints:<br />
<br />
```bash<br />
doas tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
```<br />
<br />
Add your user to the `input` group:<br />
<br />
```bash<br />
doas adduser $USER input<br />
```<br />
<br />
**Note:** You must log out and back in (or reboot) for the group membership to take effect.<br />
<br />
## Enroll Fingerprints<br />
<br />
If you previously enrolled fingerprints as root (or want to start fresh), delete existing enrollments:<br />
<br />
```bash<br />
# Delete fingerprints for current user<br />
fprintd-delete $(whoami)<br />
<br />
# If you accidentally enrolled as root, delete those too<br />
doas fprintd-delete root<br />
```<br />
<br />
Enroll your fingerprint(s):<br />
<br />
```bash<br />
fprintd-enroll<br />
```<br />
<br />
Verify the enrollment works:<br />
<br />
```bash<br />
fprintd-verify<br />
```<br />
<br />
## Configure PAM for swaylock<br />
<br />
Create the PAM configuration for swaylock:<br />
<br />
```bash<br />
doas tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so<br />
<br />
# KWallet integration (optional)<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF<br />
```<br />
<br />
## Usage<br />
<br />
Once configured, swaylock will accept both authentication methods:<br />
<br />
- **Password authentication:** Type your password and press Enter<br />
- **Fingerprint authentication:** Press Enter without typing anything, then touch the fingerprint sensor<br />
<br />
## Troubleshooting<br />
<br />
- **Permission denied during enrollment:** Ensure you're in the `input` group and have logged out/in after adding the group<br />
- **Fingerprint recognized but doesn't unlock:** Check that fingerprints are enrolled for the correct user (not root)<br />
- **No fallback to password:** Verify the PAM configuration has `pam_unix.so` before `pam_fprintd.so`<br />
<br />
## Extending to Other Services<br />
<br />
You can apply similar fingerprint authentication to other services by adding the same PAM configuration pattern to files in `/etc/pam.d/` such as:<br />
- `sudo` or `doas`<br />
- `polkit-1`<br />
- `login`<br />
- `su`</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Setting_up_fprintd_for_swaylock&diff=30826Setting up fprintd for swaylock2025-09-01T13:31:22Z<p>Benaki: </p>
<hr />
<div>To enable swaylock to unlock like so:<br />
<br />
<enter password> <hit enter><br />
<br />
or<br />
<br />
<hit enter> <touch fingerprint sensor><br />
<br />
To install fprintd:<br />
$ doas apk add fprintd<br />
<br />
Upon installation a standard user was not authorized to add prints.<br />
The below was used to allow members of the 'input' group to add prints:<br />
<br />
$ sudo tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
$ doas adduser $USER input<br />
<br />
(reboot)<br />
<br />
I previously enrolled a print for root accidentally, needed to delete it (as well as for my user for good measure):<br />
<br />
$ fprintd-delete $(whoami)<br />
$ fprintd-delete root<br />
<br />
Then enroll fresh print(s):<br />
<br />
$ fprintd-enroll<br />
$ fprintd-verify<br />
<br />
Then, to set the swaylock config:<br />
<br />
$ sudo tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so # Keep the wallet stuff<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Setting_up_fprintd_for_swaylock&diff=30825Setting up fprintd for swaylock2025-09-01T13:28:38Z<p>Benaki: Swaylock using fprintd</p>
<hr />
<div>To enable swaylock to unlock like so:<br />
<enter password> <hit enter><br />
or<br />
<hit enter> <touch fingerprint sensor><br />
<br />
To install fprintd:<br />
doas apk add fprintd<br />
<br />
Upon installation a standard user was not authorized to add prints.<br />
The below was used to allow members of the 'input' group to add prints:<br />
<br />
sudo tee /etc/polkit-1/rules.d/50-fingerprint.rules << 'EOF'<br />
polkit.addRule(function (action, subject) {<br />
if (action.id.indexOf("net.reactivated.fprint.") == 0) {<br />
if (subject.isInGroup("input")) {<br />
return polkit.Result.YES;<br />
}<br />
}<br />
});<br />
EOF<br />
<br />
doas adduser $USER input<br />
<br />
(reboot)<br />
<br />
I previously enrolled a print for root accidentally, needed to delete it (as well as for my user for good measure):<br />
<br />
fprintd-delete $(whoami)<br />
fprintd-delete root<br />
<br />
Then enroll fresh print(s):<br />
<br />
fprintd-enroll<br />
fprintd-verify<br />
<br />
Then, to set the swaylock config:<br />
<br />
sudo tee /etc/pam.d/swaylock << 'EOF'<br />
# Try password authentication first<br />
auth sufficient pam_unix.so nullok<br />
# If no password provided, try fingerprint<br />
auth sufficient pam_fprintd.so ignore-empty-password<br />
auth required pam_deny.so # Keep the wallet stuff<br />
-auth optional pam_kwallet.so<br />
-auth optional pam_kwallet5.so<br />
-session optional pam_kwallet.so auto_start<br />
-session optional pam_kwallet5.so auto_start<br />
EOF</div>Benakihttps://wiki.alpinelinux.org/w/index.php?title=Tutorials_and_Howtos&diff=30824Tutorials and Howtos2025-09-01T13:19:48Z<p>Benaki: /* Other topics */</p>
<hr />
<div>[[Image:package_edutainment.svg|right|link=]]<br />
{{TOC left}}<br />
<br />
'''Welcome to Tutorials and Howtos, a place of basic and advanced configuration tasks for your Alpine Linux.'''<br />
<br />
'''Howtos are smaller articles''' explaining how to perform a particular task with Alpine Linux, that expects a minimal knowledge from reader to perform actions. Howto's have been organized in the below page based on the topics. <br />
<br />
'''The [[#Tutorials|tutorials]] are hands-on''' and the reader is expected to try and achieve the goals described in each step, possibly with the help of a good example. The output in one step is the starting point for the following step.<br />
<br />
{{Note|<br />
* Contributors are requested to refer to [[Help:Editing]] first and make use of resources like [[How to write a HOWTO]].<br />
* Contributions must be complete articles. <br />
* Don't override already made contributions, unless there is a mistake. <br />
* If you want to request a topic, please add your request in this page's [[Talk:Tutorials_and_Howtos|Discussion]].}}<br />
<br />
== Desktop ==<br />
<br />
* {{:Daily driver guide}}<br />
<br />
=== Networking ===<br />
<br />
* [[Bluetooth]] - Instructions for installing and configuring Bluetooth<br />
* [[Bonding]] - Bond (or aggregate) multiple ethernet interfaces<br />
* [[Bridge]] - Configuring a network bridge<br />
** [[Bridge wlan0 to eth0]]<br />
* [[Configure Networking]]<br />
* [[How to configure static routes]]<br />
* Modem<br />
** [[Using HSDPA modem]]<br />
** [[Using serial modem]]<br />
* [[mDNS]] - Howto implement multicast DNS resolution in Alpine. <br />
* [[Multi ISP]] ''(Dual-ISP setup with load-balancing and automatic failover)''<br />
* [[PXE boot]]<br />
* Wi-Fi<br />
** [[Wi-Fi|Connecting to a wireless access point]]<br />
** [[How to setup a wireless access point]] ''(Setting up Secure Wireless AP w/ WPA encryption with bridge to wired network)''<br />
* Use [https://github.com/ifupdown-ng/ifupdown-ng/blob/main/doc/interfaces-vxlan.scd vxlan], if using [[Ifupdown-ng]] instead of [[VLAN]]<br />
<br />
=== Backup and data migration ===<br />
<br />
* [[Migrating data]]<br />
* [[Rsnapshot]] - setting up periodic backups<br />
<br />
=== Other topics ===<br />
<br />
* [[Gaming on Alpine]]<br />
* [[Remote Desktop Server]]<br />
* [[Default applications|How to change default application]]<br />
* [[CPU frequency scaling]]<br />
* [[Mimalloc]]<br />
* [[Enable Serial Console on Boot]]<br />
* [[How to build the Alpine Linux kernel]]<br />
* [[Nextcloud]] ''(Self hostable cloud suite - Dropbox Alternative)''<br />
* [[Setting up lm_sensors]]<br />
* [[Setting up fprintd for swaylock]]<br />
* [[Desktop environments and Window managers|List of supported Desktop environments and Window managers]]<br />
<br />
== Diskless ==<br />
<br />
* [[Alpine local backup|Alpine local backup (lbu)]] ''(Permanently store your modifications in case your box needs reboot)''<br />
** [[Back Up a Flash Memory Installation]]<br />
** [[Manually editing a existing apkovl]]<br />
<br />
== Other Architectures ==<br />
<br />
=== ARM ===<br />
<br />
* [[Alpine on ARM]]<br />
<br />
==== Raspberry Pi ====<br />
<br />
* [[Raspberry Pi|Raspberry Pi main page]]<br />
* [[Raspberry Pi Bluetooth Speaker|Raspberry Pi - Bluetooth Speaker]]<br />
* [[Linux Router with VPN on a Raspberry Pi|Raspberry Pi - Router with VPN]]<br />
* [[Linux Router with VPN on a Raspberry Pi (IPv6)|Raspberry Pi - Router with VPN (IPv6)]]<br />
* [[Classic install or sys mode on Raspberry Pi|Raspberry Pi - Sys mode install]]<br />
* [[Raspberry Pi LVM on LUKS|Raspberry Pi - Sys mode install - LVM on LUKS]]<br />
* [[RPI Video Receiver|Raspberry Pi - Video Receiver]] ''(network video decoder using Rasperry Pi and omxplayer)''<br />
* [[Raspberry Pi 3 - Browser Client]] - kiosk or digital sign<br />
* [[Raspberry Pi 3 - Configuring it as wireless access point -AP Mode]]<br />
* [[Raspberry Pi 3 - Setting Up Bluetooth]]<br />
* [[Raspberry Pi 4 - Persistent system acting as a NAS and Time Machine]]<br />
* [[How to set up Alpine as a wireless router|Raspberry Pi Zero W - Wireless router]] ''(Setting up a firewalled, Wireless AP with wired network on a Pi Zero W)''<br />
* [[RPI Video Receiver]]<br />
<br />
=== IBM Z (IBM z Systems) ===<br />
<br />
* [[s390x|s390x - Installation]]<br />
<br />
=== PowerPC ===<br />
<br />
* [[Ppc64le|Powerpc64le - Installation]]<br />
<br />
== Security ==<br />
<br />
* [[#Desktop security|Desktop security]] lists steps for securing Alpine Linux desktops<br />
* [[Setting up a laptop]] page has detailed guidelines to configure a secured laptop<br />
* [[Securing Alpine Linux|Secure Alpine Linux]] using Security Technical Implementation Guides (STIGs)<br />
<br />
== Services == <br />
<br />
{{Note| Services are arranged in alphabetical order.}}<br />
<br />
=== Content management systems ===<br />
<br />
* [[DokuWiki]] ''(Simple and easy to use wiki, no database required)''<br />
* [[Drupal]] ''(Content Management System (CMS) written in PHP)''<br />
* [[Kopano]] ''(Microsoft Outlook compatible Groupware)''<br />
* [[Mahara]] ''(E-portfolio and social networking system)''<br />
* [[MediaWiki]] ''(Free web-based wiki software application)''<br />
* [[Pastebin]] ''(Pastebin software application)''<br />
* [[WordPress]] ''(Web software to create website or blog)''<br />
* [[Moodle]] ''(Online Learning Management system)''<br />
<br />
=== Database === <br />
<br />
* [[MariaDB]] or [[MySQL|MySQL]]<br />
<br />
=== DNS ===<br />
<br />
* [[DNSCrypt-Proxy]] ''Encrypt and authenticate DNS calls from your system''<br />
* [[Setting up nsd DNS server]]<br />
* [[Small-Time DNS with BIND9]] ''(A simple configuration with ad blocking for your home network)''<br />
* Unbound<br />
** [[Setting up unbound DNS server]]<br />
** [[Using Unbound as an Ad-blocker]] ''(Setup ad blocking for your network)''<br />
* [[TinyDNS Format]]<br />
<br />
=== File server ===<br />
<br />
* [[Setting up an NFS server|nfs-server]]<br />
* [[Setting up a Samba server|samba-server]] ''(standard file sharing)''<br />
* [[Setting up a samba-ad-dc|samba-ad-dc]] ''(Active Directory compatible domain controller)''<br />
<br />
=== Firewall ===<br />
<br />
* [https://git.alpinelinux.org/awall/about/ Alpine Wall User's Guide]<br />
** [[Zero-To-Awall]] -''AWall for dummies''<br />
** [[How-To Alpine Wall]] - ''AWall for Shorewall users''<br />
** [[Alpine Wall]] - ''AWall - Firewall management framework - Design Document''<br />
* [[Iptables]]<br />
* [[nftables]]<br />
* [[Uncomplicated Firewall|Uncomplicated Firewall or UFW]]<br />
<br />
=== HTTP and web services ===<br />
<br />
* [[Althttpd]]<br />
* [[Apache]]<br />
** [[Apache with php-fpm]]<br />
** [[Setting Up Apache with PHP]]<br />
** [[Apache authentication: NTLM Single Signon]]<br />
* [[Darkhttpd]]<br />
* [[Lighttpd]]<br />
** [[Lighttpd Advanced security]]<br />
** [[Setting Up Lighttpd With FastCGI]]<br />
** [[Production Web server: Lighttpd|Production web server: Lighttpd]]<br />
* [[Nginx]]<br />
** [[Nginx as reverse proxy with acme (letsencrypt)]]<br />
** [[Nginx with PHP]]<br />
* Squid Proxy<br />
** [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
** [[Setting up Explicit Squid Proxy]]<br />
** [[Setting up Transparent Squid Proxy]] ''(Covers Squid proxy and URL Filtering system)''<br />
** [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Tomcat]]<br />
** [[Production LAMP system: Lighttpd + PHP + MySQL|Production LAMP system: Lighttpd + PHP + MariaDB/MySQL]]<br />
<br />
=== IRC ===<br />
<br />
* [[NgIRCd]] ''(Server for Internet Relay Chat/IRC)''<br />
<br />
=== Mail ===<br />
<br />
* [[Hosting services on Alpine]] ''(Hosting mail, webservices and other services)''<br />
* [[Hosting Web/Email services on Alpine]]<br />
* Exim/Dovecot<br />
** [[Small-Time Email with Exim and Dovecot]] ''(A simple configuration for your home network.)<br />
** [[Setting up dovecot with imap and tls]]<br />
* [[relay email to gmail (msmtp, mailx, sendmail]]<br />
* [[relay email (nullmailer)]]<br />
* [[Roundcube]] ''(Webmail system)''<br />
* [[Setting up postfix with virtual domains]]<br />
* Server protection<br />
** [[Setting up clamsmtp]]<br />
<br />
=== Monitoring ===<br />
<br />
* [[Awstats]] ''(Free log file analyzer)''<br />
* [[Cacti: traffic analysis and monitoring network]] ''(Front-end for rrdtool networking monitor)''<br />
* [[Cvechecker]] ''(Compare installed packages for Common Vulnerabilities Exposure)'' <!-- Monitoring and Security --><br />
* [[Linfo]]<br />
* [[Obtaining user information via SNMP]] ''(Using squark-auth-snmp as a Squid authentication helper)'' <!-- Networking and Server, <== Using squark-auth-snmp --><br />
* [[PhpSysInfo]] ''(A simple application that displays information about the host it's running on)''<br />
* [[Logcheck]] ''(log file monitoring tool)''<br />
* [[Matomo]] ''(A real time web analytics software program)''<br />
* [[Rasdaemon]] ''(Platform Reliability, Availability and Serviceability monitoring tool)''<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft, solution, Networking and Monitoring and Server --><br />
** [[Setting up NRPE daemon]] ''(Performs remote Nagios checks)'' <!-- Networking and Monitoring --><br />
* [[Setting Up Fprobe And Ntop|Ntop]] ''(NetFlow collection and analysis using a remote fprobe instance; for alpine 3.10-3.12 only)'' <!-- Networking and Monitoring --><br />
* [[SqStat]] ''(Script to look at active squid users connections)''<br />
* [[Traffic monitoring]] <!-- Networking and Monitoring --><br />
** [[Setting up monitoring using rrdtool (and rrdcollect)]]<br />
** [[Setting up traffic monitoring using rrdtool (and snmp)]] <!-- Monitoring --><br />
* [[Zabbix|Zabbix - the professional complete manager]] ''(Monitor and track the status of network services and hardware)''<br />
* [[ZoneMinder video camera security and surveillance]]<br />
<br />
=== Remote Administration ===<br />
<br />
* ACF<br />
** [[Changing passwords for ACF|ACF - changing passwords]]<br />
** [[Generating SSL certs with ACF]] <!-- Generating SSL certs with ACF 1.9 --><br />
** [[setup-acf| ACF - setup]] ''(Configures ACF (webconfiguration/webmin) so you can manage your box through https)''<br />
* [[Setting up a SSH server]] ''(Using ssh is a good way to administer your box remotely)''<br />
** [[HOWTO OpenSSH 2FA with password and Google Authenticator |OpenSSH 2FA]] ''(A simple two factor setup for OpenSSH)''<br />
* [[OpenVCP]] ''(VServer Control Panel)''<br />
* [[PhpMyAdmin]] ''(Web-based administration tool for MYSQL)''<br />
* [[PhpPgAdmin]] ''(Web-based administration tool for PostgreSQL)''<br />
* [[Webmin]] ''(A web-based interface for Linux system)''<br />
<br />
=== Telephony ===<br />
<br />
* [[FreePBX|FreePBX on Alpine Linux]]<br />
* [[Setting up Zaptel/Asterisk on Alpine]]<br />
* [[Kamailio]] ''(SIP Server, formerly OpenSER)''<br />
<br />
=== VPN ===<br />
* [[Freeradius Active Directory Integration]]<br />
* [[GNUnet]]<br />
* [[IGMPproxy]]<br />
* [[Setting up a OpenVPN server|OpenVPN server]] ''(Allowing single users or devices to remotely connect to your network)''<br />
* [[OpenVSwitch]]<br />
* [[Tor]]<br />
* [[Using Alpine on Windows domain with IPSEC isolation]]<br />
* [[Configure a Wireguard interface (wg)|Wireguard]]<br />
<br />
=== Other Servers ===<br />
<br />
* [[apcupsd]] ''(UPS Monitoring with apcupsd)''<br />
* [[Chrony and GPSD | Chrony, gpsd, and a garmin LVC 18 as a Stratum 1 NTP source ]]<br />
* [[Glpi]] ''(Manage inventory of technical resources)''<br />
* [[How to setup a Alpine Linux mirror]]<br />
* [[nut-ups|NUT UPS]] ''(UPS Monitoring with Network UPS Tools)''<br />
* [[Odoo]]<br />
* [[Configure OpenLDAP | OpenLDAP]] ''(Installing and configuring the Alpine package for OpenLDAP)''<br />
* [[Setting up a LLDAP server|lldap-server]] ''(Directory Server)''<br />
* [[Setting up Transmission (bittorrent) with Clutch WebUI]]<br />
<br />
<br />
== Software development ==<br />
<br />
* [[Cgit]]<br />
* [[OsTicket]] ''(Ticket system)''<br />
* [[Patchwork]] ''(Patch review management system)''<br />
* [[Redmine]] ''(Project management system) [Deprecated]''<br />
* [[Request Tracker]] ''(Ticket system)''<br />
* [[Setting up trac wiki|Trac]] ''(Enhanced wiki and issue tracking system for software development projects)''<br />
* [[Ansible]] ''(Configuration management)''<br />
* [[Installing Oracle Java|Oracle Java (installation)]]<br />
<br />
== Storage ==<br />
<br />
* [[Setting up disks manually|Manual partitioning]]<br />
* [[Disk Replication with DRBD|DRBD: Disk Replication]]<br />
* [[Filesystems]]<br />
** [[Burning ISOs]]<br />
* [[Setting up iSCSI|iSCSI Setup]]<br />
** [[iSCSI Raid and Clustered File Systems]]<br />
** [[Linux iSCSI Target (TCM)|iSCSI Target (TCM)/LinuxIO (LIO)]]<br />
** [[Linux iSCSI Target (tgt)|User space iSCSI Target (tgt)]]<br />
* [[Setting up Logical Volumes with LVM|LVM Setup]]<br />
** [[Setting up LVM on GPT-labeled disks|LVM on GPT-labeled disks]]<br />
** [[Installing on GPT LVM|LVM on GPT-labeled disks (updated)]]<br />
** [[LVM on LUKS]]<br />
* RAID<br />
** [[Raid Administration]]<br />
** [[Setting up a software RAID array]]<br />
* [[ZFS]]<br />
** [[Root on ZFS with native encryption]]<br />
** [[Setting up ZFS on LUKS]]<br />
* [[CEPH|CEPH]]<br />
<br />
== Virtualization ==<br />
<br />
* [[Docker]]<br />
* [[Installing Alpine in a virtual machine]]<br />
** [[Install Alpine on VMware ESXi]]<br />
* [[KVM]] ''(Setting up Alpine as a KVM hypervisor)''<br />
* [[LXC]] ''(Setting up a Linux container in Alpine Linux)''<br />
* [[QEMU]]<br />
* Xen<br />
** [[Xen Dom0]] ''(Setting up Alpine as a dom0 for Xen hypervisor)''<br />
** [[Xen Dom0 on USB or SD]]<br />
** [[Create Alpine Linux PV DomU|Xen DomU (paravirtualized)]]<br />
** [[Xen LiveCD]]<br />
** [[Xen PCI Passthrough]]<br />
** [[K8s]] Building a K8s Kubernetes Cluster on Alpine Linux<br />
* [[Runc]]<br />
<br />
== Tutorials ==<br />
<br />
* [[TTY_Autologin|TTY Autologin]]<br />
* [[Kexec|Faster rebooting with kexec]]<br />
* [[Dynamic Multipoint VPN (DMVPN)]] combined with [[Small Office Services]]<br />
* [[DIY Fully working Alpine Linux for Allwinner and Other ARM SOCs]]<br />
* [[Fault Tolerant Routing with Alpine Linux]]<br />
* [[High Availability High Performance Web Cache]] ''(uCarp + HAProxy for High Availability Services such as Squid web proxy)''<br />
* [[Linux iSCSI Target (TCM)]]<br />
* [[ISP Mail Server 3.x HowTo]] ''(Postfix+PostfixAdmin+DoveCot+Roundcube+ClamAV+Spamd - A full-service ISP mail server)''<br />
* [[Grommunio Mail Server]] ''(Mariadb+Postfix+Rspamd+Grommunio - Full-service mail server as MS exchange replacement)''<br />
* [[Replacing non-Alpine Linux with Alpine remotely]]<br />
* [[Setting up A Network Monitoring and Inventory System]] ''(Nagios + OpenAudit and related components)'' <!-- draft --><br />
* [[Streaming Security Camera Video with VLC]]<br />
* [[Install Alpine on a btrfs filesystem with refind as boot manager]]<br />
* [[Compile software from source|How to Compile a software from source in Alpine Linux]]<br />
* [https://ww2.coastal.edu/mmurphy2/oer/alpine/ Alpine Linux tutorials - Dr Murphy, Computing Science Associate Professor]<br />
* [[Michael's base installation procedure|Michael's base installation procedure]]<br />
* [[Michael's sway desktop (minimal)|Michael's sway desktop (minimal)]]<br />
* [[Michael's cwm desktop (minimal)|Michael's cwm desktop (minimal)]]</div>Benaki