Where Paranoia?

If you use the shortlived profile and your key is compromised, you benefit from the short lifetime.

Maybe I’m just too stupid to understand how those certificates work.

But in what scenario is my key compromised but not my server? Because someone getting control of my server can just get an new long-term certificate. That was my actual point in the comment above. I understand the argument of added security if they only issue short-term certificates. But where is the benefit of my short-term certificate when someone compromising my server can just get a new long-term one in seconds?

Also we are talking about self hosting. I understand the issue of revoking certificates when you have a massive userbase where some might miss the revocation for quite some time. Not so much with the dozen max family and friends.

As of the manpages systemd-sleep looks for:

The main configuration file is loaded from one of the listed directories in order of priority, only the first file found is used: /etc/systemd/, /run/systemd/, /usr/local/lib/systemd/, /usr/lib/systemd/.

Also

The default configuration is set during compilation, so configuration is only needed when it is necessary to deviate from those defaults.

So yes, you can use any existing file from another computer as your template (root:root 644 would be the default owner/permissions for it).

PS: I tried on my PC and setting AllowHibernation=no in the config file produced a different “hibernate is disabled by config” error. Only if I remove the resume=<swap location> kernel parameter do I get the “not set up” error you mentioned but I’m not at home and only have my old (encrypted and able to hibernate) bios laptop with me. So I can’t check this for modern UEFI where systemd-sleep should automatically pick a suitable swap space and save the location in an EFI variable without any additional configuration.

You can however set the resume=UUID=<your swap's UUID> kernel parameter anyway. Even the automatic systemd/uefi setup accepts this as a way to manually select a location. So maybe you try that. If your problem is decryption of the swap at startup you should not get an error when initiating the hibernation as you do now but instead get problems when you try to restart from swap.

OP seems to use the systemd hooks anyway. And with them all disks get decrypted with the first given password (or at least try and only ask for additional passwords if that fails). So it’s not neccessary anymore to have everything on the root partition. Several encrypted with the same password will do. (For example I unlock a classic swap partition and 3 differently sized disks creating one btrfs raid1 for root with one password.)

I asked the same as resume= should still work in general, but strictly speaking it’s not neccesarry anymore. Modern UEFI systems work without it by saving the information where to locate the saved state in an HibernateLocation EFI variable.

I know that I could easily change my config. My point is that a) they are failing to advertise this and b) I don’t see any reason to do it. I understand the arguments about security benefits of shorter certificates on their side and iirc they are already planning to change it from 3 months to 1.5 months in the future. But in what scenario do I benefit from a short-term certificate as long as the regular ones are still available anyway?

Wild guess as I’m not using dacut and have only setup encrypted hibernation on an old bios laptop…

But did you edit the systemd-sleep.conf (usually /etc/systemd/sleep.conf, although there are some other possible locations)? The other old-school and universal way of telling your system that hibernate is enabled without systemd would be a resume= kernel parameter

That’s a very specific game where it doesn’t matter how you got corrupted and are killed anyway…

Certbot came with a systemd timer running twice a day (0, 12 +12h random) that only renews –iirc– when the certificate has 30 days or less to live. Also I looked it up and my (version 6.7) Certbot neither mentions the option with the --help option, nor in the manual (where there is just one instance of “profiles exist, no other details given”).

So they probably need another way than a random blog post when they want users to use (or even just know about) that option…

It’s been pretty much a set-and-forget experience

Yeah, that’s what it always has been. So no need to change anything unless they make it the new standard on their side with an update…

So exactly like an AGI emerging after just one more update.

You mean they are reaching geo-synchronous orbit after already skyrocketing this year?

Yes, it is. And yes, I saw that. That’s what I referenced with the game seemingly having survived CGL and now worth a look.

Not believing in quality control or even proof-reading. Not believing in testing or errata. Not believing in small details like paying the f****ing people writing or creating artwork for them.

This kind of totally normal stuff…

Why have I never heard about this one? *looking it up* Ohh… CGL 🤮

But as it seems to have survived their usual bullshit it seemsto be worth a look now. Thx 👍😀

But still listing year’s old vulnerabilities that got fixed long ago because they are still supporting ancient stuff like 5.10LTS is Debian-specific.

Bragging rights are for memes. The actual appeal is a system that just runs (and runs and runs without needing reinstalls or complete upgrade overhauls, thx rolling release), and that you can actually modify (or repair) because it’s close to upstream and does not stack one set of configurations on top of the build-in configs and another GUI tool (or two) again managing its own settings on top. All to isolate users from that somehow scary terminal…

Nice try, but yes does not help against error: failed to prepare transaction (could not satisfy dependencies)

Where can I get this graphic in better quality and with actually visible lines?

Edit: Okay, scrap that. At the second attempt the source actually loaded… And it’s interactive but not really better.

90% of this is usually based on knowing where on the keyboard the “–”-key is located and using it correctly over hyphens…

Are dvds some new-fangled form of cd? 🤔