How to Load Balance SSL IMAP, POP3, and SMTP with HAProxy and Dovecot / Postfix

Load balancing encrypted email traffic (IMAPS on port 993, POP3S on port 995, and SMTPS on port 465) using HAProxy requires two critical mechanisms: SSL offloading at the load balancer and the PROXY protocol to preserve the client's real public IP address in Dovecot and Postfix logs.

Architecture: Encrypted Client → HAProxy (SSL Termination & send-proxy) → Dovecot / Postfix (Real IP Preserved)

1. HAProxy Configuration (haproxy.cfg)

frontend imaps_in
    bind *:993 ssl crt /etc/ssl/certs/mail.pem
    mode tcp
    default_backend dovecot_imaps

backend dovecot_imaps
    mode tcp
    server mail1 10.0.0.1:10143 send-proxy check

2. Dovecot PROXY Protocol Support (/etc/dovecot/dovecot.conf)

Configure Dovecot to accept the PROXY protocol header to log the real client IP:

service imap-login {
    inet_listener imap_haproxy {
        port = 10143
        haproxy = yes
    }
}
haproxy_trusted_networks = 10.0.0.0/24

High-Availability Outbound Email: Postfix smtp_fallback_relay with HAProxy SMTP Balancing

For organizations operating mail infrastructure in restrictive networks or corporate subnets with unreliable direct port 25 connectivity, combining HAProxy as an SMTP proxy relay with Postfix's smtp_fallback_relay directive guarantees reliable email delivery without dropped messages.

Flow: Primary MTA → Direct MX Delivery Failure → smtp_fallback_relay → HAProxy Relay VPS → Destination MX

1. HAProxy TCP Relay Configuration (haproxy.cfg)

listen smtp-relay
    bind *:2525
    mode tcp
    option tcplog
    timeout connect 5s
    timeout client 1m
    timeout server 1m
    server mta-out 10.0.0.1:25 check

2. Postfix Fallback Configuration (/etc/postfix/main.cf)

Instruct Postfix to attempt direct MX delivery first, but automatically route through the HAProxy relay if destination mail servers are unreachable:

# Automatic fallback routing to HAProxy relay on port 2525
smtp_fallback_relay = [relay.example.com]:2525

How to Build a Dedicated WireGuard VPN Wi-Fi Gateway and LAN Router

Rather than manually configuring WireGuard client software on every smartphone, laptop, and smart TV in your home, you can configure a dedicated Linux machine (such as a Raspberry Pi, Orange Pi, or spare PC) as a standalone VPN Wi-Fi Gateway. Any device connecting to the designated Wi-Fi access point or Ethernet LAN automatically has all its traffic encrypted and tunneled through your remote WireGuard VPS.

Topology: Wi-Fi Clients → Access Point Router → Linux Gateway (dnsmasq + NAT) → Encrypted WireGuard Tunnel (wg0) → Cloud VPS Gateway

1. Cloud Server Configuration (/etc/wireguard/wg0.conf)

[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = GATEWAY_PUBLIC_KEY
AllowedIPs = 10.200.200.2/32

2. Linux Gateway Router Setup (wg0.conf)

[Interface]
Address = 10.200.200.2/24
PrivateKey = GATEWAY_PRIVATE_KEY
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

3. Routing and NAT Masquerading

Enable IPv4 packet forwarding and route traffic arriving on your local LAN NIC (e.g. eth1) through the WireGuard interface (wg0):

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
iptables -A FORWARD -i eth1 -o wg0 -j ACCEPT
iptables -A FORWARD -i wg0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

How to Install Aegisub Subtitle Editor on Ubuntu 18.10 and 19.04

Aegisub is the industry-standard open-source tool for creating, styling, and timing Advanced SubStation Alpha (.ass) subtitles. When Ubuntu temporarily removed Aegisub from official distribution archives in versions 18.10 and 19.04, users could maintain full access via the verified Anton multimedia PPA repository.

Compatibility: Ubuntu 18.10 (Cosmic Cuttlefish) • Ubuntu 19.04 (Disco Dingo) • Linux Mint

Installation via PPA

sudo add-apt-repository ppa:anton+/photo-video-apps -y
sudo apt-get update
sudo apt-get install aegisub -y

How to Install and Configure the Xymon Monitoring Client on CentOS 7 and Debian 9

The Xymon infrastructure monitoring system (formerly Hobbit / Big Brother) provides lightweight, low-overhead system health tracking for servers. While Debian repositories package xymon-client directly via APT, Enterprise Linux distributions like CentOS 7 require building from source.

Supported Platforms: CentOS 7 (Source compilation) • Debian 9 (APT package)

1. Compiling on CentOS 7

# 1. Create dedicated system user
groupadd xymon
useradd -g xymon -m xymon

# 2. Install build dependencies
yum install gcc make fping pcre-devel openssl-devel openldap-devel rrdtool-devel libtirpc-devel -y

# 3. Download and compile client
cd /usr/src
wget https://sourceforge.net/projects/xymon/files/Xymon/4.3.30/xymon-4.3.30.tar.gz
tar -zxf xymon-4.3.30.tar.gz
cd xymon-4.3.30
./configure --client

make && make install

# 4. Install system service script
cp rpm/xymon-client.init /etc/init.d/xymon-client
cp rpm/xymon-client.default /etc/default/xymon-client
chmod +x /etc/init.d/xymon-client

# Configure server IP in /etc/default/xymon-client:
# XYMONSERVERS="YOUR.XYMON.SERVER.IP"

service xymon-client start
chkconfig xymon-client on

2. Installation on Debian 9 / Ubuntu

sudo apt-get update
sudo apt-get install xymon-client -y

Fixing WebM Audio/Video Desync and Import Issues in FFmpeg, Shotcut, and OpenShot

Screen recordings saved in the WebM format (commonly exported by browser extensions like Nimbus Screenshot, Loom, or Screencastify) often use variable frame rates (VFR) and non-standard Opus/Vorbis audio packet chunking. When importing these files into open-source video editors like Shotcut, OpenShot, or processing them directly with FFmpeg, users frequently experience severe audio desynchronization or corrupted frame rendering.

Root Cause: Variable Frame Rate (VFR) container timing drift in libavformat demuxers.

The FFmpeg Solution: Transcode to Constant Frame Rate (CFR) MP4

Rather than relying on proprietary editors, use FFmpeg to normalize the video timeline to a fixed 30 or 60 fps stream with synchronized AAC audio:

ffmpeg -i input_recording.webm   -vsync cfr -r 30   -c:v libx264 -preset slow -crf 20   -c:a aac -b:a 192k -ar 48000   output_fixed.mp4

The resulting MP4 file maintains crystal-clear audio quality and imports into Shotcut, OpenShot, or Premiere Pro with flawless audio-video synchronization.

How to Cleanly Force HTTPS and WWW (or Non-WWW) Canonical Redirects in Nginx

Implementing clean 301 canonical redirects in Nginx prevents duplicate content penalties in search engines and ensures all incoming traffic is encrypted over HTTPS. Instead of convoluted rewrite regex rules, modular Nginx server blocks handle HTTP-to-HTTPS and subdomain canonicalization with maximum performance.

Canonical Best Practice: Always redirect in a single 301 hop to prevent redirect chains.

Scenario A: Force HTTPS with Non-WWW (example.com)

Create /etc/nginx/conf.d/force_ssl_non_www.conf:

# Redirect HTTP and WWW directly to canonical HTTPS non-WWW
server {
    listen 80;
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://example.com$request_uri;
}

server {
    listen 80;
    server_name example.com;
    return 301 https://example.com$request_uri;
}

Scenario B: Force HTTPS with WWW (www.example.com)

Create /etc/nginx/conf.d/force_ssl_www.conf:

server {
    listen 80;
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    return 301 https://www.example.com$request_uri;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://www.example.com$request_uri;
}