Merge branch 'h-0.3.2' into develop

30 files changed, 1275 insertions, 475 deletions

diff --git a/core/ports.html b/core/ports.html
index 6a5e4a8..2d1a17d 100644
--- a/core/ports.html
+++ b/core/ports.html
@@ -73,45 +73,18 @@
         native flag will not run on different hardware. This is the best choice
         if you want gcc to find the best settings based on your hardware.</p>
 
-        <p>Edit /etc/pkgmk.conf and remove pipe from compiler
-        flags;</p>
-
-        <pre>
-        export CFLAGS="-O2 -march=x86-64"
-        </pre>
-
-        <p>If you want native build change the above example to;</p>
-
-        <pre>
-        export CFLAGS="-O2 -march=native -mtune=native"
-        </pre>
-
-        <p>Discover number of cores/cpus to hard code -j option.</p>
-
-        <pre>
-        $ nproc
-        2
-        </pre>
-
-        <p>Set number of cores to use;</p>
-
-        <pre>
-        export MAKEFLAGS="-j2"
-        </pre>
-
-        <p>Example of complete pkgmk.conf for x86_64 with 4 cores, separate
-        distribution files, packages and work directories, uses crux mirror
-        to get the sources.</p>
+        <p>Edit /etc/pkgmk.conf, remove pipe from compiler flags and let the system
+        get from nproc how many cpu's it can use for compiling;</p>
 
         <pre>
         #
         # /etc/pkgmk.conf: pkgmk(8) configuration
         #
 
-        export CFLAGS="-O2 -march=native -mtune=native"
+        export CFLAGS="-O2 -march=x86-64"
         export CXXFLAGS="${CFLAGS}"
 
-        export MAKEFLAGS="-j4"
+        # export MAKEFLAGS="-j$(nproc)"
 
         case ${PKGMK_ARCH} in
                 "64"|"")
@@ -128,11 +101,13 @@
                         ;;
         esac
 
-        #PKGMK_SOURCE_MIRRORS=(http://crux.nu/distfiles/)
-        PKGMK_SOURCE_DIR="/usr/ports/distfiles"
-        PKGMK_PACKAGE_DIR="/usr/ports/packages"
-        PKGMK_WORK_DIR="/usr/ports/work/$name"
+        # PKGMK_SOURCE_MIRRORS=()
+        # PKGMK_SOURCE_DIR="$PWD"
+        # PKGMK_PACKAGE_DIR="$PWD"
+        # PKGMK_WORK_DIR="$PWD/work"
         # PKGMK_DOWNLOAD="no"
+        # PKGMK_IGNORE_SIGNATURE="no"
+        # PKGMK_IGNORE_MD5SUM="no"
         # PKGMK_IGNORE_FOOTPRINT="no"
         # PKGMK_IGNORE_NEW="no"
         # PKGMK_NO_STRIP="no"
@@ -144,6 +119,15 @@
         # End of file
         </pre>
 
+        <p>If you want native build change the above example to;</p>
+
+        <pre>
+        export CFLAGS="-O2 -march=native -mtune=native"
+        </pre>
+
+        <p>Check <a href="toolchain.html">toolchain</a> for more options on how packages
+        are build.</p>
+
         <h2 id="prtget">1.3.4. Configure prt-get</h2>
 
         <p>Edit /etc/prt-get.conf;</p>
diff --git a/core/scripts/act-chroot.sh b/core/scripts/act-chroot.sh
index 5411bc5..317b5b7 100644
--- a/core/scripts/act-chroot.sh
+++ b/core/scripts/act-chroot.sh
@@ -1,26 +1,25 @@
 #!/bin/bash
 
-DEV=$1
 
 CHROOT="/mnt"
-##read BLK_EFI
-BLK_EFI="${DEV}2"
-##read BLK_BOOT
-BLK_BOOT="${DEV}3"
-##read BLK_ROOT
-BLK_ROOT="${DEV}4"
-##read BLK_VAR
-BLK_VAR="${DEV}5"
-##read BLK_USR
-BLK_USR="${DEV}6"
-##read BLK_SWP
-BLK_SWP="${DEV}7"
-##read BLK_HOME
-BLK_HOME="${DEV}8"
-
-#read CHROOT
-CHROOT="/mnt"
 
+#DEV=$1
+#
+###read BLK_EFI
+#BLK_EFI="${DEV}2"
+###read BLK_BOOT
+#BLK_BOOT="${DEV}3"
+###read BLK_ROOT
+#BLK_ROOT="${DEV}4"
+###read BLK_VAR
+#BLK_VAR="${DEV}5"
+###read BLK_USR
+#BLK_USR="${DEV}6"
+###read BLK_SWP
+#BLK_SWP="${DEV}7"
+###read BLK_HOME
+#BLK_HOME="${DEV}8"
+#
 #mount $BLK_ROOT $CHROOT
 #
 #mount $BLK_BOOT $CHROOT/boot
diff --git a/core/scripts/backup-system.sh b/core/scripts/backup-system.sh
index 379e449..2bced8a 100644
--- a/core/scripts/backup-system.sh
+++ b/core/scripts/backup-system.sh
@@ -1,55 +1,125 @@
 #!/bin/sh
 
-echo -n "root directory you want backup (/mnt/): "
-read ROOT_DIR
+ConfirmOrExit ()
+{
+    while true
+    do
+        echo -n "Please confirm (y or n) :"
+        read CONFIRM
+        case $CONFIRM in
+            y|Y|YES|yes|Yes) break ;;
+            n|N|no|NO|No)
+                echo "Aborting - you entered $CONFIRM"
+                exit
+                ;;
+            *) echo "Please enter only y or n"
+        esac
+    done
+    echo "You entered $CONFIRM. Continuing ..."
+}
 
-echo -n "where you want to save (/home/user): "
-read DEST_DIR
+mkbk_metadata() {
+
+    # must be using gwak instead of sed, xargs and echo
+    prt-get listinst -v | sed -s s/" "/#/g | xargs -i echo {}.pkg.tar.gz > ${DEST_DIR}/installed.pkg
+
+    # make list and copy installed core packages
+    prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/core" | cut -d " " -f 3 > ${DEST_DIR}/core.pkg
+
+    prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/opt" | cut -d " " -f 3 > $DEST_DIR/opt.pkg
+
+    prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/contrib" | cut -d " " -f 3 > $DEST_DIR/contrib.pkg
 
-bk_coll() {
+    prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/xorg" | cut -d " " -f 3 > $DEST_DIR/xorg.pkg
+
+    prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep -v "yes /usr/ports/core" | grep -v "yes /usr/ports/opt" | grep -v "yes /usr/ports/contrib" | grep -v "yes /usr/ports/xorg" | grep "yes " | cut -d " " -f 3 > $DEST_DIR/other.pkg
+
+}
+
+mkbk_coll_pkg() {
     col=$1
     # make copy of packages
-    mkdir ${BKDIR}/${col}
+    mkdir ${PORT_PKG}/${col}
     while read line; do
             if [ ! -f /usr/ports/packages/${line} ]; then
                 echo "Building package: ${line};\n"
                 name=$(echo ${line} | cut -d "#" -f 1)
-                sudo prt-get update -fr ${name}
+                #$sudo prt-get update -fr ${name}
             fi
 
             if [ -f /usr/ports/packages/${line} ]; then
                 echo "Backing up package: ${line}"
-                echo ${line} >> ${BKDIR}/backup.pkg
-                cp /usr/ports/packages/${line} ${BKDIR}/${col}/
+                echo ${line} >> ${DEST_DIR}/backup.pkg
+                cp /usr/ports/packages/${line} ${PORT_PKG}/${col}/
             else
                 echo "Package not found: ${line}"
-                echo ${line} >> ${BKDIR}/${col}-notfound.pkg
+                echo ${line} >> ${DEST_DIR}/${col}-notfound.pkg
             fi
-    done < $BKDIR/${col}.pkg
+    done < $DEST_DIR/${col}.pkg
 }
 
-# Temporary directory
-BKDIR=$(pwd)/bkdir
-mkdir -p ${BKDIR}
+mkbk_coll_ports() {
+    col=$1
 
-# must be using gwak instead of sed, xargs and echo
-prt-get listinst -v | sed -s s/" "/#/g | xargs -i echo {}.pkg.tar.gz > ${BKDIR}/installed.pkg
+#    tar --xattrs -zcpf $PORT_PRT/${col}-`date '+%Y-%j-%H-%M-%S'`.tar.gz \
+#    --directory=$ROOT_DIR/usr/ports/${col} \
+#    .
+    tar --xattrs -zcpf $PORT_PRT/${col}.tar.gz \
+    --directory=$ROOT_DIR/usr/ports/${col} \
+    --exclude=.git/ \
+    .
+
+}
+
+mkbk_data_conf() {
+
+    tar --xattrs -zcpf $DATA_CNF/etc.tar.gz \
+        --directory=$ROOT_DIR/etc \
+        .
+
+    tar --xattrs -zcpf $DATA_CNF/usr_etc.tar.gz \
+        --directory=$ROOT_DIR/usr/etc \
+        .
+}
+
+
+echo -n "root directory you want backup (/mnt/): "
+#read ROOT_DIR
+ROOT_DIR=$1
+
+echo -n "where you want to save (/home/user): "
+DEST_DIR=$2
+
+# Temporary directory
+PORT_PKG="${DEST_DIR}/crux"
+PORT_PRT="${DEST_DIR}/ports"
+DATA_CNF="${DEST_DIR}/conf"
 
-# make list and copy installed core packages
-prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/core" | cut -d " " -f 3 > ${BKDIR}/core.pkg
-bk_coll "core"
+echo "ROOT_DIR=${ROOT_DIR}"
+echo "DEST_DIR=${DEST_DIR}"
+echo "PORT_PKG=${PORT_PKG}"
+echo "PORT_PRT=${PORT_PRT}"
+echo "DATA_CNF=${DATA_CNF}"
 
+ConfirmOrExit
 
-prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/opt" | cut -d " " -f 3 > $BKDIR/opt.pkg
-bk_coll "opt"
+mkdir -p ${PORT_PKG}
+mkdir -p ${PORT_PRT}
+mkdir -p ${DATA_CNF}
 
-prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/contrib" | cut -d " " -f 3 > $BKDIR/contrib.pkg
-bk_coll "contrib"
+mkbk_metadata
+mkbk_data_conf
 
-prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep "yes /usr/ports/xorg" | cut -d " " -f 3 > $BKDIR/xorg.pkg
-bk_coll "xorg"
+mkbk_coll_ports "core"
+mkbk_coll_pkg "core"
+mkbk_coll_ports "opt"
+mkbk_coll_pkg "opt"
+mkbk_coll_ports "contrib"
+mkbk_coll_pkg "contrib"
+mkbk_coll_ports "xorg"
+mkbk_coll_pkg "xorg"
 
-prt-get printf "%i %p %n#%v-%r.pkg.tar.gz\n" | grep -v "yes /usr/ports/core" | grep -v "yes /usr/ports/opt" | grep -v "yes /usr/ports/contrib" | grep -v "yes /usr/ports/xorg" | grep "yes " | cut -d " " -f 3 > $BKDIR/other.pkg
+mkbk_coll_pkg "other"
 
 #echo $DES_DIR
 #echo $ROOT_DIR
diff --git a/core/scripts/setup-install.sh b/core/scripts/setup-install.sh
index c1d2765..aca0115 100755
--- a/core/scripts/setup-install.sh
+++ b/core/scripts/setup-install.sh
@@ -1,29 +1,34 @@
 #!/bin/bash
 
-# Set Global Vars
-ADMIN_USER=c9admin
-DEV=$1
-CHROOT=$2
-
 # Absolute path to this script,
 # e.g. /home/user/c9-doc/core/scripts/foo.sh
 SCRIPT=$(readlink -f "$0")
-# Absolute path this script is in, 
+# Absolute path this script is in,
 # e.g. /home/user/c9-doc/core/scripts
 SCRIPTPATH=$(dirname "$SCRIPT")
 # Absolute path to doc section,
 # e.g /home/user/c9-doc/core
-DIR=$(dirname "$SCRIPTPATH");
+DIR_SCRIPT=$(dirname "$SCRIPTPATH");
 # Absolute path to local data,
 # e.g /home/user/local
-DIR_LOCAL="$(dirname $(dirname ${DIR}))/local";
-
-
-DIR_CONF="${DIR}/conf"
-DIR_PRT="${DIR}/ports";
-ISO_FILE="${DIR_LOCAL}/crux-3.3.iso"
+DIR_LOCAL="$(dirname $(dirname ${DIR_SCRIPT}))/local";
 
-ConfirmOrExit ()
+# Set Global Vars
+ADMIN_USER=c9admin
+CHROOT=$1
+
+# DATA_DIR directory with data to
+# to be installed, can be mounted
+# iso file or backup directory from
+# backup-system script
+# from iso monted;
+DATA_DIR=$(dirname "$SCRIPTPATH");
+PORT_PKG="${CHROOT}/media/crux"
+# from backup;
+#DATA_DIR=$2
+#PORT_PKG="${DATA_DIR}/crux"
+
+ConfirmOrExit()
 {
     while true
     do
@@ -44,47 +49,110 @@ ConfirmOrExit ()
 
 install_core() {
 
-    echo "1.1.4 Create core.lst and install pkgadd"
-    for p in ${CHROOT}mnt/media/crux/core/*; do echo $p >> ${CHROOT}core.lst; done
+    mkdir -p ${CHROOT}/usr/ports/packages
+    mkdir -p ${CHROOT}/var/lib/pkg
+    touch ${CHROOT}/var/lib/pkg/db
+
+    CORE_LS="${DATA_DIR}/core.pkg"
 
-    tar xf "${CHROOT}mnt/media/crux/core/pkgutils#5.40-1.pkg.tar.xz" usr/bin/pkgadd -O > ${CHROOT}pkgadd
+    if [ ! -f ${CORE_LS} ]; then
+        CORE_LS=${CHROOT}/core.pkg
+        echo "1.1.4 Create core.pkg and install pkgadd"
+        for p in ${PORT_PKG}/core/*;
+        do
+            echo $(basename $p) >> ${CORE_LS};
+        done
+    fi
 
-    chmod +x ${CHROOT}pkgadd
+    tar xf "${PORT_PKG}/core/pkgutils#5.40-1.pkg.tar.xz" usr/bin/pkgadd -O > ${CHROOT}/pkgadd
 
-    echo "1.1.4 File core.lst complete, review list of packages before continue..."
+    chmod +x ${CHROOT}/pkgadd
+
+    echo "1.1.4 File core.pkg complete, review list of packages before continue..."
     read PAUSE
-    vim ${CHROOT}core.lst
+    vim ${CORE_LS}
 
     echo "1.1.4 Starting install"
-    touch ${CHROOT}/var/lib/pkg/db
 
-    cd $CHROOT
+    #cd $CHROOT
     while read line; do
-        echo "Installing $line;\n"
-        ${CHROOT}pkgadd -u -f -r ${CHROOT} ${line}
-    done < ${CHROOT}core.lst
+        pkg=${PORT_PKG}/core/${line}
+        echo "Installing ${pkg};\n"
+        ${CHROOT}/pkgadd -f -r ${CHROOT} ${pkg}
+    done < ${CORE_LS}
 
-    rm ${CHROOT}pkgadd
-    rm ${CHROOT}core.lst
+    rm ${CHROOT}/pkgadd
 
-    mkdir ${CHROOT}usr/ports/packages
-    cp ${CHROOT}media/crux/core/* ${CHROOT}usr/ports/packages
+    if [ -f ${CHROOT}/core.pkg ]; then
+        rm ${CHROOT}/core.pkg;
+    fi
+}
+
+install_ports()
+{
 
+    echo "1.1.5. Install core packages and ports;"
+    cp ${PORT_PKG}/core/* ${CHROOT}/usr/ports/packages
+    if [ -f "${PORT_PRT}/core.tar.gz" ]; then
+        mkdir -p ${CHROOT}/usr/ports/core
+        tar --xattrs -xpvf $PORT_PRT/core.tar.gz --directory=$CHROOT/usr/ports/core
+    fi
+
+    echo "1.1.5. Install opt packages and ports;"
+    cp ${PORT_PKG}/opt/* $CHROOT/usr/ports/packages
+    if [ -f "${PORT_PRT}/opt.tar.gz" ]; then
+        mkdir -p ${CHROOT}/usr/ports/opt
+        tar --xattrs -xpvf $PORT_PRT/opt.tar.gz --directory=$CHROOT/usr/ports/opt
+    fi
+
+    echo "1.1.5. Install contrib packages and ports;"
+    cp ${PORT_PKG}/contrib/* $CHROOT/usr/ports/packages
+    if [ -f "${PORT_PRT}/contrib.tar.gz" ]; then
+        mkdir -p ${CHROOT}/usr/ports/contrib
+        tar --xattrs -xpvf $PORT_PRT/contrib.tar.gz --directory=$CHROOT/usr/ports/contrib
+    fi
+
+
+    echo "1.1.5. Install xorg packages and ports;"
+    cp ${PORT_PKG}/xorg/* $CHROOT/usr/ports/packages
+    if [ -f "${PORT_PRT}/xorg.tar.gz" ]; then
+        mkdir -p ${CHROOT}/usr/ports/xorg
+        tar --xattrs -xpvf $PORT_PRT/xorg.tar.gz --directory=$CHROOT/usr/ports/xorg
+    fi
+
+    echo "1.1.6. Install extra packages;"
+    cp ${PORT_PKG}/other/* $CHROOT/usr/ports/packages
 }
 
 setup_core() {
 
+    if [ -f "${DATA_CNF}/etc.tar.gz" ]; then
+        echo "1.1. Extracting configuration data;\n"
+        tar --xattrs -xpvf $DATA_CNF/etc.tar.gz --directory=$CHROOT/etc
+        tar --xattrs -xpvf $DATA_CNF/usr_etc.tar.gz --directory=$CHROOT/usr/etc
+    else
+        echo "1.1. Copying configuration data;\n"
+        cp -r $DATA_CNF/skel $CHROOT/etc/
+        cp ${PORT_PKG}/handbook.txt $CHROOT/root/
+        cp /etc/resolv.conf $CHROOT/etc
+        cp $DATA_CNF/fstab $CHROOT/etc/
+        cp $DATA_CNF/prt-get.conf $CHROOT/etc/
+        cp $DATA_CNF/sudoers $CHROOT/etc/
+        cp $DATA_CNF/rc.d/* $CHROOT/etc/rc.d/
+        cp $DATA_CNF/rc.conf $CHROOT/etc/
+        cp $DATA_CNF/pkgmk.conf $CHROOT/etc/
+        cp $DATA_CNF/hosts $CHROOT/etc/
+
+    fi
+
     echo "1.1.7. dns resolver, copy resolv.conf;\n"
-    cp /etc/resolv.conf $CHROOT/etc
+    vim /etc/resolv.conf
 
     echo "1.1.8. Install Handbook\n"
-    cp $CHROOT/media/crux/handbook.txt $CHROOT/root/
 
     echo "1.1.9. Install Skeletons\n"
-    cp -r $DIR_CONF/skel $CHROOT/etc/
 
     echo "1.2.1. Set hostname and hosts;"
-    cp $DIR_CONF/hosts $CHROOT/etc/
     vim $CHROOT/etc/hosts
 
     echo "1.2.2. Set timezone;"
@@ -103,16 +171,19 @@ setup_core() {
     chroot $CHROOT /bin/bash -c "usermod -a -G wheel $ADMIN_USER"
     echo "1.2.4.3. Uncomment to allow members of group wheel to execute any command\n
     #    %wheel ALL=(ALL) ALL"
-    cp $DIR_CONF/sudoers $CHROOT/etc/
 
     echo "1.2.5. File system table;"
-    cp $DIR_CONF/fstab $CHROOT/etc/
+
     chroot $CHROOT /bin/bash -c "mount >> /etc/fstab"
+
+    chroot $CHROOT /usr/bin/env -i \
+        HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \
+        PATH=/bin:/usr/bin:/sbin:/usr/sbin \
+        /bin/bash -c "pkgmk   /usr/ports/work tmpfs size=30G,gid=$(id -g pkgmk),uid=$(id pkgmk),defaults,mode=0750 0    0 >> /etc/fstab"
+
     vim $CHROOT/etc/fstab
 
     echo "1.2.6. Initialization Scripts;"
-    cp $DIR_CONF/rc.d/* $CHROOT/etc/rc.d/
-    cp $DIR_CONF/rc.conf $CHROOT/etc/
     vim $CHROOT/etc/rc.conf
 
     echo "1.3.1. Build as unprivileged user;"
@@ -130,7 +201,7 @@ setup_core() {
     chroot $CHROOT /usr/bin/env -i \
         HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \
         PATH=/bin:/usr/bin:/sbin:/usr/sbin \
-        /bin/bash -c "chown -R root:pkgmk /usr/ports"
+        /bin/bash -c "chown -R pkgmk:pkgmk /usr/ports"
 
     chroot $CHROOT /usr/bin/env -i \
         HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \
@@ -148,30 +219,16 @@ setup_core() {
     chroot --userspec=pkgmk:pkgmk $CHROOT /bin/bash -c "mkdir /usr/ports/pkgbuild"
     chroot --userspec=pkgmk:pkgmk $CHROOT /bin/bash -c "mkdir /usr/ports/distfiles"
 
-    chroot $CHROOT /usr/bin/env -i \
-        HOME=/root TERM="$TERM" PS1='\u:\w\$ ' \
-        PATH=/bin:/usr/bin:/sbin:/usr/sbin \
-        /bin/bash -c "id pkgmk >> /etc/fstab"
-
-    echo "pkgmk                                           /usr/ports/work tmpfs size=30G,gid=102,uid=101,defaults,mode=0750 0    0" >> $CHROOT/etc/fstab
-
-    vim $CHROOT/etc/fstab
-
     echo "1.3.3 Configure pkgmk;"
-    cp $DIR_CONF/pkgmk.conf $CHROOT/etc/
     #vim $CHROOT/etc/pkgmk.conf
 
     echo "1.3.4 Configure prt-get;"
     mv $CHROOT/etc/ports/contrib.rsync.inactive $CHROOT/etc/ports/contrib.rsync
-    cp $DIR_CONF/prt-get.conf $CHROOT/etc/
     #vim $CHROOT/etc/prt-get.conf
 }
 
-install_packages() {
 
-    echo "1.1.5. Install extra packages;"
-    cp $CHROOT/media/crux/opt/* $CHROOT/usr/ports/packages
-    cp $CHROOT/media/crux/xorg/* $CHROOT/usr/ports/packages
+install_packages() {
 
     echo "Installing $CHROOT/usr/ports/packages/fakeroot"
     $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/fakeroot#*
@@ -212,27 +269,28 @@ install_packages() {
     echo "Installing $CHROOT/usr/ports/packages/dosfstools"
     $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/dosfstools#*
 
-    echo "1.1.6. Install extra ports;\n"
+}
+
 
-    mkdir $CHROOT/usr/ports/c9-ports
-    cp -r $DIR_PRT/* $CHROOT/usr/ports/c9-ports/
+DATA_CNF="${DATA_DIR}/conf"
+PORT_PRT="${DATA_DIR}/ports";
 
-}
-echo "SCRIPT=$SCRIPT";
+#echo "SCRIPT=$SCRIPT";
 echo "SCRIPTPATH=$SCRIPTPATH";
 
-echo "ADMIN_USER="$ADMIN_USER"\n"
+echo "ADMIN_USER=${ADMIN_USER}"
 echo "CHROOT=$CHROOT";
-echo "DIR=$DIR";
-echo "DIR_CONF=$DIR_CONF";
-echo "DIR_PRT=$DIR_PRT";
 
-echo "ISO_FILE=$ISO_FILE";
+echo "DATA_DIR=$DATA_DIR";
+echo "DATA_CNF=$DATA_CNF";
+echo "PORT_PKG=${PORT_PKG}";
+echo "PORT_PRT=${PORT_PRT}";
+
 ConfirmOrExit
-echo "press enter to continue"
-read
+
 install_core
-#setup_core
-#install_packages
+install_ports
+setup_core
+install_packages
 
 echo "Ready to chroot $CHROOT /bin/bash \n"
diff --git a/core/scripts/setup-virtual.sh b/core/scripts/setup-virtual.sh
new file mode 100644
index 0000000..2b27a9f
--- /dev/null
+++ b/core/scripts/setup-virtual.sh
@@ -0,0 +1,76 @@
+#!/bin/sh
+
+# First we define the function
+ConfirmOrExit ()
+{
+    while true
+    do
+        echo -n "Please confirm (y or n) :"
+        read CONFIRM
+        case $CONFIRM in
+            y|Y|YES|yes|Yes) break ;;
+            n|N|no|NO|No)
+                echo "Aborting - you entered $CONFIRM"
+                exit
+                ;;
+            *) echo "Please enter only y or n"
+        esac
+    done
+    echo "You entered $CONFIRM. Continuing ..."
+}
+
+DEV_NAME=${1}
+CHROOT="/mnt"
+DEV="/dev/${DEV_NAME}"
+
+echo "DEV_NAME=${DEV_NAME}"
+echo "DEV=${DEV}"
+echo "CHROOT=${CHROOT}"
+
+ConfirmOrExit
+
+parted --script ${DEV} \
+        mklabel gpt \
+        unit mib \
+        mkpart primary 1 3 \
+        set 1 bios_grub on \
+        name 1 grub \
+        mkpart ESP fat32 3 59 \
+        set 2 boot on \
+        name 2 efi \
+        mkpart primary ext4 103 200 \
+        name 3 boot \
+        mkpart primary linux-swap 200 456 \
+        name 4 swap \
+        mkpart primary ext4 456 3700 \
+        name 5 root \
+        mkpart primary ext4 3700 4000 \
+        name 6 var \
+        mkpart primary ext4 4000 100% \
+        name 7 home
+
+kpartx -a -s -l -u ${DEV}
+
+mkfs.fat -F 32  /dev/mapper/${DEV_NAME}p2
+mkfs.ext4       /dev/mapper/${DEV_NAME}p3
+mkswap          /dev/mapper/${DEV_NAME}p4
+mkfs.ext4       /dev/mapper/${DEV_NAME}p5
+mkfs.ext4       /dev/mapper/${DEV_NAME}p6
+mkfs.ext4       /dev/mapper/${DEV_NAME}p7
+
+mount /dev/mapper/${DEV_NAME}p5 $CHROOT
+mkdir -p $CHROOT/proc
+mkdir -p $CHROOT/sys
+mkdir -p $CHROOT/dev
+mkdir -p $CHROOT/media
+
+mkdir -p $CHROOT/boot
+mount /dev/mapper/${DEV_NAME}p3 $CHROOT/boot
+mkdir -p $CHROOT/boot/efi
+mount /dev/mapper/${DEV_NAME}p2 $CHROOT/boot/efi
+mkdir -p $CHROOT/var
+mount /dev/mapper/${DEV_NAME}p6 $CHROOT/var
+mkdir -p $CHROOT/home
+mount /dev/mapper/${DEV_NAME}p7 $CHROOT/home
+
+
diff --git a/dev/c/index.html b/dev/c/index.html
index 684c7d2..1c3b478 100644
--- a/dev/c/index.html
+++ b/dev/c/index.html
@@ -7,92 +7,6 @@
     <body>
         <a href="../index.html">Development Index</a>
 
-        <h1>System Development</h1>
-
-        <p>System development requires debug kernel know how,
-        in this example will be used qemu and gdb. A simple init
-        program is created. Create init.S;</p>
-
-        <pre>
-	.global _start
-	_start:
-	    mov $1, %rax
-	    mov $1, %rdi
-	    mov $message, %rsi
-	    mov $message_len, %rdx
-	    syscall
-	    jmp .
-	    message: .ascii "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n"
-	    .equ message_len, . - message
-	</pre>
-
-	<p>Assemble, link and create simple initial ram disk;</p>
-
-	<pre>
-	mkdir d
-	as --64 -o init.o init.S # assemble
-	ld -o d/init init.o      # link
-	cd d
-	find . | cpio -o -H newc | gzip > ../rootfs.cpio.gz
-	</pre>
-
-	<p>Clean temporary directory;</p>
-
-	<pre>
-	cd ..
-	rm -r d/
-	</pre>
-
-	<p>Can be used C to create init program;</p>
-
-	<pre>
-	#include &lt;stdio.h&gt;
-	#include &lt;unistd.h&gt;
-
-	int main() {
-	    printf("FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n");
-	    sleep(0xFFFFFFFF);
-	    return 0;
-	}
-	</pre>
-
-	<pre>
-	$ gcc -static init.c -o init
-	</pre>
-
-	<p>Test qemu, kernel and simple init program, you should see
-	"FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR";</p>
-
-	<pre>
-	$ qemu-system-x86_64 -enable-kvm --kernel arch/x86_64/boot/bzImage \
-    	--initrd rootfs.cpio.gz
-	</pre>
-
-	<p>If everything goes well you can start qemu without start CPU at
-	startup (-S) and with gdb server on TCP port 1234 (-s).</p>
-
-	<pre>
-	$ qemu-system-x86_64 -enable-kvm --kernel arch/x86/boot/bzImage \
-                --initrd rootfs.cpio.gz \
-		-S -s
-	</pre>
-
-	<p>On another terminal start gdb;</p>
-
-	<pre>
-	gdb \
-	    -ex "add-auto-load-safe-path $(pwd)" \
-	    -ex "file vmlinux" \
-	    -ex 'set arch i386:x86-64:intel' \
-	    -ex 'target remote localhost:1234' \
-	    -ex 'break start_kernel' \
-	    -ex 'continue' \
-	    -ex 'disconnect' \
-	    -ex 'set arch i386:x86-64' \
-	    -ex 'target remote localhost:1234'
-	</pre>
-
-	
         <h1>C &amp; GDB</h1>
 
         <p><a href="http://blog.fourthbit.com/2013/06/18/creating-an-open-source-program-in-c-with-autotools-part-1-of-2/">C program with autotools</a>
@@ -172,6 +86,7 @@
         <pre>
         strace -c ./program
         </pre>
+
         <a href="../index.html">Development Index</a>
         <p>
         This is part of the c9-doc Manual.
diff --git a/dev/c/system.html b/dev/c/system.html
new file mode 100644
index 0000000..c91dc34
--- /dev/null
+++ b/dev/c/system.html
@@ -0,0 +1,182 @@
+<!DOCTYPE html>
+<html dir="ltr" lang="en">
+    <head>
+        <meta charset='utf-8'>
+        <title>System Development &amp; GDB</title>
+    </head>
+    <body>
+        <a href="../index.html">Development Index</a>
+
+        <h1>System Development</h1>
+
+        <p>System development requires knowing how to debug
+        kernel know how, in this example will be used Qemu
+        and GDB. Qemu creates the virtual machine that kernel
+        will run on and GDB will connect to it to help us
+        understand how things tick.</p>
+
+        <h2>Kernel Build</h2>
+
+        <pre>
+        $ tar xf linux-4.9.48.tar.xz
+        $ cd linux-4.9.48
+        </pre>
+
+        <p>Default configuration disable some security
+        configurations that allow us to debug (random memory
+        layout).</p>
+
+        <pre>
+        $ make x86_64_defconfig
+        </pre>
+
+        <p>Enable CONFIG_DEBUG_INFO, CONFIG_DEBUG_INFO_DWARF4
+        and CONFIG_GDB_SCRIPTS in the kernel;</p>
+
+        <pre>
+        make x86_64_defconfig
+        cat &lt;&lt;EOF &gt;.config-fragment
+        CONFIG_DEBUG_INFO=y
+        CONFIG_DEBUG_KERNEL=y
+        CONFIG_GDB_SCRIPTS=y
+        EOF
+        ./scripts/kconfig/merge_config.sh .config .config-fragment
+        </pre>
+
+        <p>Check or change to your needs the configuration;</p>
+        <pre>
+        $ make nconfig
+        </pre>
+
+        <p>Build Kernel and modules;</p>
+
+        <pre>
+        $ make -j $(nproc)
+        </pre>
+
+        <h2>Simple Init</h2>
+
+        <p>Now that you have the kernel compiled you can
+        create a simple init program, this program is called
+        when kernel finish to load and setup its internals
+        and is ready to launch first process.
+        Init program should not exit or kernel will panic.
+        Create init.S;</p>
+
+        <pre>
+        .global _start
+        _start:
+            mov $1, %rax
+            mov $1, %rdi
+            mov $message, %rsi
+            mov $message_len, %rdx
+            syscall
+            jmp .
+            message: .ascii "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n"
+            .equ message_len, . - message
+        </pre>
+
+        <p>Assemble, link and create simple initial ram disk;</p>
+
+        <pre>
+        mkdir d
+        as --64 -o init.o init.S # assemble
+        ld -o d/init init.o      # link
+        cd d
+        find . | cpio -o -H newc | gzip > ../rootfs.cpio.gz
+        </pre>
+
+        <p>Clean temporary directory;</p>
+
+        <pre>
+        cd ..
+        rm -r d/
+        </pre>
+
+        <p>Can be used C to create init program;</p>
+
+        <pre>
+        #include &lt;stdio.h&gt;
+        #include &lt;unistd.h&gt;
+
+        int main() {
+            printf("FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n");
+            sleep(0xFFFFFFFF);
+            return 0;
+        }
+        </pre>
+
+        <pre>
+        $ gcc -static init.c -o init
+        </pre>
+
+        <h2>Start Debugging</h2>
+
+        <p>Test qemu, kernel and simple init program, you
+        should see
+        "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR";</p>
+
+        <pre>
+        $ qemu-system-x86_64 -enable-kvm --kernel arch/x86_64/boot/bzImage \
+        --initrd rootfs.cpio.gz
+        </pre>
+
+        <p>If everything goes well you can start qemu without
+        starting the CPU (-S) and with gdb server on TCP port 1234 (-s).</p>
+
+        <pre>
+        $ qemu-system-x86_64 -enable-kvm --kernel arch/x86/boot/bzImage \
+                --initrd rootfs.cpio.gz \
+                -S -s
+        </pre>
+
+        <p>On another terminal start gdb;</p>
+
+        <pre>
+        gdb \
+            -ex "add-auto-load-safe-path $(pwd)" \
+            -ex "file vmlinux" \
+            -ex 'set arch i386:x86-64:intel' \
+            -ex 'target remote localhost:1234' \
+            -ex 'break start_kernel' \
+            -ex 'continue' \
+            -ex 'disconnect' \
+            -ex 'set arch i386:x86-64' \
+            -ex 'target remote localhost:1234'
+        </pre>
+
+        <pre>
+	(gdb) info thread
+	  Id   Target Id         Frame
+	* 1    Thread 1 (CPU#0 [running]) start_kernel () at init/main.c:480
+	</pre>
+
+	<pre>
+	(gdb) info frame
+	Stack level 0, frame at 0xffffffff81e03f90:
+	 rip = 0xffffffff81f4db2d in start_kernel (init/main.c:480); saved rip = 0xffffffff81f4d28e
+	 called by frame at 0xffffffff81e03fa0
+	 source language c.
+	 Arglist at 0xffffffff81e03f80, args:
+	 Locals at 0xffffffff81e03f80, Previous frame's sp is 0xffffffff81e03f90
+	 Saved registers:
+	  rip at 0xffffffff81e03f88
+	</pre>
+
+	<pre>
+	(gdb) print $rip
+	$2 = (void (*)()) 0xffffffff81f4db2d &lt;start_kernel&gt;
+	(gdb)
+	</pre>
+
+        <a href="../index.html">Development Index</a>
+        <p>
+        This is part of the c9-doc Manual.
+        Copyright (C) 2016
+        c9 team.
+        See the file <a href="../../fdl-1.3-standalone.html">Gnu Free Documentation License</a>
+        for copying conditions.</p>
+
+    </body>
+
+</html>
diff --git a/dev/index.html b/dev/index.html
index cb238d7..e463f6f 100644
--- a/dev/index.html
+++ b/dev/index.html
@@ -45,6 +45,7 @@
             <li><a href="">Control Flow</a></li>
             <li><a href="">Functions</a></li>
             <li><a href="">Input &amp; Output</a></li>
+            <li><a href="c/system.html">System Development</a></li>
         </ul>
 
         <ul>
diff --git a/index.html b/index.html
index bde784f..7645169 100644
--- a/index.html
+++ b/index.html
@@ -38,7 +38,7 @@
         <p>Version;</p>
 
         <pre>
-        rev 0.3.1
+        rev 0.3.2
         </pre>
 
         <p><a href="manifesto.html">Manifesto</a> helps to have general
diff --git a/tools/conf/etc/iptables/iptables-br.sh b/tools/conf/etc/iptables/iptables-br.sh
index 104e574..25a3331 100644
--- a/tools/conf/etc/iptables/iptables-br.sh
+++ b/tools/conf/etc/iptables/iptables-br.sh
@@ -147,16 +147,14 @@ IPT="/usr/sbin/iptables"
 SPAMLIST="blockedip"
 SPAMDROPMSG="BLOCKED IP DROP"
 # public interface to network/internet
-PUB_IF="wlp7s0"
-DHCP_SERV="192.168.1.1"
-PUB_IP="192.168.1.33"
-NET_ADDR="192.168.1.0/24"
+#PUB_IF="wlp7s0"
+PUB_IF="br0"
+PUB_IP="10.0.0.254"
+NET_ADDR="10.0.0.0/8"
+GW="10.0.0.1"
 # private interface for virtual/internal
-PRIV_IF="br0"
-PRIV_IP="10.0.0.1"
-
-modprobe ip_conntrack
-modprobe ip_conntrack_ftp
+PRIV_IF="wlp7s0"
+PRIV_IP="192.168.1.33"
 
 echo "Stopping ipv4 firewall and deny everyone..."
 
@@ -170,149 +168,214 @@ iptables -t raw -F
 iptables -t raw -X
 iptables -t security -F
 iptables -t security -X
+iptables -N blocker
 
-
-echo "Starting ipv4 firewall filter table..."
+iptables -N netconf_in
+iptables -N netconf_out
+iptables -N server_in
+iptables -N server_out
+iptables -N client_in
+iptables -N client_out
 
 # Set Default Rules
 iptables -P INPUT DROP
 iptables -P FORWARD DROP
 iptables -P OUTPUT DROP
 
-###### AP rules  ######
-echo 1 > /proc/sys/net/ipv4/ip_forward
-$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
-$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
-$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
-
-# Block sync
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
-$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
-
-# Block Fragments
-$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
-$IPT -A INPUT -f -j DROP
-
-# Block bad stuff
-$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
-$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
-$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
-
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
-$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
-
-$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-
-
-###### Input Chain ######
-
-# Unlimited on local
-$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
-#$IPT -A INPUT -i lo -s ${PRIV_IP} -j ACCEPT
-
+echo "Starting ipv4 firewall tables..."
 # Unlimited on loopback
 $IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
-$IPT -A INPUT -i lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT
-
-echo "Allow input from DNS Server"
-$IPT -A INPUT -i ${PUB_IF} -p udp --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from Https server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input to HTTPS Server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-#echo "Allow input from HTTP Server"
-#$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from IRC server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 6667 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from FTP server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 21 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from git server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from POP3S server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input from SMTPS server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-echo "Allow input to HTTP Server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-#echo "Allow input to DNS Server"
-#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
-
-echo "Allow input to SSH server"
-$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-###### Output Chain ######
-
-# Unlimited on loopback
 $IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
-$IPT -A OUTPUT -o lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT
-#$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT
-
-# Unlimited on local
-$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
-
-echo "Allow output to DNS server"
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 53 --sport 1024:65535 -j ACCEPT
-
-echo "Allow output to https server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443  -j ACCEPT
-
-echo "Allow output from https server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-#echo "Allow output from http server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
-
-#echo "Allow to HTTP server"
-#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to SSH server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to ftp server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to git server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-echo "Allow output to IRC  server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
 
-echo "Allow output to SMTPS server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+#modprobe ip_conntrack
+#modprobe ip_conntrack_ftp
+#echo 1 > /proc/sys/net/ipv4/ip_forward
+
+####### blocker Chain  ######
+## Block google dns
+$IPT -A blocker -s 8.8.0.0/24 -j LOG --log-level 7 --log-prefix "iptables: blocker google: "
+$IPT -A blocker -s 8.8.0.0/24 -j DROP
+## Block sync
+$IPT -A blocker -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
+$IPT -A blocker -p tcp ! --syn -m state --state NEW -j DROP
+## Block Fragments
+$IPT -A blocker -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
+$IPT -A blocker -f -j DROP
+
+$IPT -A blocker -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
+$IPT -A blocker -p tcp --tcp-flags ALL ALL -j DROP
+
+$IPT -A blocker -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
+$IPT -A blocker -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
+
+$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
+$IPT -A blocker -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+
+$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
+$IPT -A blocker -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
+
+$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
+$IPT -A blocker -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
+
+$IPT -A blocker -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
+## Return to caller
+$IPT -A blocker -j RETURN
+
+####### server input Chain  ######
+echo "server_in chain: Allow to SSH server"
+$IPT -A server_in -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow input to HTTPS Server"
+$IPT -A server_in -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+#echo "server_in chain: Allow input to HTTP Server"
+#$IPT -A server_in -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "server_in chain: Allow input to DNS Server"
+$IPT -A server_in -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A server_in -p tcp --dport 53 --sport 1024:65535  -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A server_in -j RETURN
+
+####### server output Chain  ######
+echo "server_out chain: Allow output from DNS server"
+$IPT -A server_out -p udp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+$IPT -A server_out -p tcp --sport 53 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from https server"
+$IPT -A server_out -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+#echo "server_out chain: Allow output from http server"
+#$IPT -A server_out -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+echo "server_out chain: Allow output from SSH server"
+$IPT -A server_out -p tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A server_out -j RETURN
+
+####### client input Chain  ######
+echo "client_in chain: Allow input from IRC server"
+$IPT -A client_in -p tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from FTP server"
+$IPT -A client_in -p tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from GIT server"
+$IPT -A client_in -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from POP3S server"
+$IPT -A client_in -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from SMTPS server"
+$IPT -A client_in -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+#echo "client_in chain: Allow input from HTTP Server"
+#$IPT -A client_in -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from HTTPS server"
+$IPT -A client_in -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+#$IPT -A client_in -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from DNS Server"
+$IPT -A client_in -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+echo "client_in chain: Allow input from SSH Server"
+$IPT -A client_in -p udp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A client_in -p udp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A client_in -j RETURN
+
+####### client output Chain  ######
+echo "client_out chain: Allow output to IRC  server"
+$IPT -A client_out -p tcp --dport 6667 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to FTP server"
+$IPT -A client_out -p tcp --dport 21 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to GIT server"
+$IPT -A client_out -p tcp --dport 9418 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to POP3S server"
+$IPT -A client_out -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to SMTPS server"
+$IPT -A client_out -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to HTTPS server"
+$IPT -A client_out -p tcp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+#$IPT -A client_out -p udp --dport 443 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+##echo "Allow to HTTP server"
+#$IPT -A client_out -p tcp --dport 80 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to DNS server"
+$IPT -A client_out -p udp --dport 53 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+echo "client_out chain: Allow output to SSH server"
+$IPT -A client_out -p tcp --dport 22 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A client_out -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## Return to caller
+$IPT -A client_out -j RETURN
+
+
+####### netconf input Chain  ######
+echo "netconf_in chain: Allow DHCP protocol"
+$IPT -A netconf_in -p udp --sport 68 --dport 67 -j ACCEPT
+echo "netconf_in chain: Allow RIP protocol for ${NET_ADDR}"
+$IPT -A netconf_in -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+#echo "netconf chain: Allow ICMP from ${NET_ADDR}"
+#$IPT -A netconf_in -p icmp -s ${NET_ADDR} -j ACCEPT
+echo "netconf_in chain: Allow ICMP from all"
+$IPT -A netconf_in -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_in ICMP: "
+$IPT -A netconf_in -p icmp -j ACCEPT
+
+## Return to caller
+$IPT -A netconf_in -j RETURN
+
+
+####### netconf output Chain  ######
+echo "netconf_out chain: Allow output from DHCP server"
+$IPT -A netconf_out -p udp --sport 67 --dport 68 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+echo "netconf_out chain: Allow RIP protocol for ${NET_ADDR}"
+$IPT -A netconf_out -p udp --sport 520 --dport 520 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+#echo "netconf chain: Allow ICMP output to ${NET_ADDR}"
+#$IPT -A netconf_out -p icmp -d ${NET_ADDR} -j ACCEPT
+echo "netconf chain: Allow ICMP output to all"
+$IPT -A netconf_out -p icmp -j LOG --log-level 7 --log-prefix "iptables: netconf_out ICMP: "
+$IPT -A netconf_out -p icmp -j ACCEPT
+
+## Return to caller
+$IPT -A netconf_out -j RETURN
+
+####### AP rules  ######
+$IPT -A FORWARD -j blocker
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR}  -j ACCEPT
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_in
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j netconf_out
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -d ${NET_ADDR} -j client_in
+$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -j client_out
+#$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
+
+####### Input Chain ######
+$IPT -A INPUT -j blocker
+$IPT -A INPUT -i ${PUB_IF} -j server_in
+$IPT -A INPUT -i ${PUB_IF} -j client_in
+$IPT -A INPUT -i ${PUB_IF} -j netconf_in
+
+####### Output Chain ######
+$IPT -A OUTPUT -j blocker
+$IPT -A OUTPUT -o ${PUB_IF} -j server_out
+$IPT -A OUTPUT -o ${PUB_IF} -j client_out
+$IPT -A OUTPUT -o ${PUB_IF} -j netconf_out
 
-echo "Allow output to POP3S server"
-$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-## less logs
-
-echo "Drop RIP protocol"
-$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s $NET_ADDR -j DROP
-
-$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT
 
 ## log everything else and drop
 $IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
 $IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
 $IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
-#
+
 exit 0
+
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -s ${NET_ADDR} -j ACCEPT
+#$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -d ${NET_ADDR} -j ACCEPT
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -p udp --sport 68 --dport 67 -j ACCEPT
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF}  -p udp --sport 520 --dport 520 -j ACCEPT
+#
+## You Dirty bitch
+#$IPT -A FORWARD -i ${PUB_IF} -o ${PUB_IF} -s ${NET_ADDR} -d ${NET_ADDR}  -j ACCEPT
+
+## Unlimited on loopback
+#$IPT -A OUTPUT -o lo -s ${PUB_IP} -d ${PUB_IP} -j ACCEPT
+##$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT
+#
+## Unlimited on local
+#$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
+#
+### less logs
+#
+
+#echo "Allow output DHCP protocol"
+#$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -s ${NET_ADDR} -d ${NET_ADDR} -j ACCEPT
+
diff --git a/tools/conf/etc/logrotate.conf b/tools/conf/etc/logrotate.conf
new file mode 100644
index 0000000..896b779
--- /dev/null
+++ b/tools/conf/etc/logrotate.conf
@@ -0,0 +1,133 @@
+# see "man logrotate" for details
+# rotate log files weekly
+weekly
+
+# keep 4 weeks worth of backlogs
+rotate 4
+
+# create new (empty) log files after rotating old ones
+create
+
+# uncomment this if you want your log files compressed
+compress
+
+olddir /var/log/old
+
+notifempty
+
+maxsize 5M
+
+# some packages can drop log rotation information into 
+# this directory
+include /etc/logrotate.d
+
+# few generic files to rotate
+/var/log/wtmp {
+    create 0644 root root
+    rotate 5
+}
+
+/var/log/btmp {
+    create 0600 root root
+    rotate 5
+}
+
+# system-specific logs may be also be configured here.
+/var/log/faillog {
+    maxsize 5M
+}
+
+/var/log/lastlog {
+    maxsize 5M
+}
+
+/var/log/auth {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/cron {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/debug {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/kernel {
+    rotate 5
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/daemon {
+    compress
+    rotate 5
+    create 644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
+
+/var/log/messages {
+    rotate 5
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/mail {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/user {
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
diff --git a/tools/conf/etc/logrotate.d/dnsmasq b/tools/conf/etc/logrotate.d/dnsmasq
new file mode 100644
index 0000000..3151ddc
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/dnsmasq
@@ -0,0 +1,11 @@
+/var/log/dnsmasq {
+    weekly
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/fail2ban b/tools/conf/etc/logrotate.d/fail2ban
new file mode 100644
index 0000000..c2dc4cd
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/fail2ban
@@ -0,0 +1,5 @@
+/var/log/fail2ban.log {
+    weekly
+    create 0644 root root
+    rotate 5
+ }
diff --git a/tools/conf/etc/logrotate.d/gitolite b/tools/conf/etc/logrotate.d/gitolite
new file mode 100644
index 0000000..547d6b6
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/gitolite
@@ -0,0 +1,12 @@
+/var/log/gitolite {
+    rotate 5
+    monthly
+    create 0644 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
diff --git a/tools/conf/etc/logrotate.d/lynis b/tools/conf/etc/logrotate.d/lynis
new file mode 100644
index 0000000..8cf9181
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/lynis
@@ -0,0 +1,10 @@
+/var/log/lynis.log {
+    rotate 5
+    monthly
+    create 0644 root root
+}
+/var/log/lynis-report.dat {
+    rotate 5
+    monthly
+    create 0644 root root
+}
diff --git a/tools/conf/etc/logrotate.d/nginx b/tools/conf/etc/logrotate.d/nginx
new file mode 100644
index 0000000..ae05445
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/nginx
@@ -0,0 +1,23 @@
+/var/log/nginx/access.log {
+    weekly
+    create 0664 root www
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
+
+/var/log/nginx/error.log {
+    weekly
+    create 0644 root root
+    rotate 5
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/ntp b/tools/conf/etc/logrotate.d/ntp
new file mode 100644
index 0000000..c46b590
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/ntp
@@ -0,0 +1,5 @@
+/var/log/ntp.log {
+    weekly
+    create 0644 root root
+    rotate 5
+}
diff --git a/tools/conf/etc/logrotate.d/php-fpm b/tools/conf/etc/logrotate.d/php-fpm
new file mode 100644
index 0000000..c778658
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/php-fpm
@@ -0,0 +1,5 @@
+/var/log/php-fpm.log {
+    rotate 5
+    monthly
+    create 0644 root root
+}
diff --git a/tools/conf/etc/logrotate.d/postgres b/tools/conf/etc/logrotate.d/postgres
new file mode 100644
index 0000000..fc59aad
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/postgres
@@ -0,0 +1,17 @@
+/var/log/pgsql {
+    weekly
+    compress
+    delaycompress
+    rotate 10
+    notifempty
+    create 660 postgres postgres
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+
+}
+
+
diff --git a/tools/conf/etc/logrotate.d/samhain b/tools/conf/etc/logrotate.d/samhain
new file mode 100644
index 0000000..d60f810
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/samhain
@@ -0,0 +1,24 @@
+/var/log/samhain.log {
+    weekly
+    rotate 52
+    nocreate
+    missingok
+    compress
+
+    prerotate
+        if test -f /var/run/samhain.pid; then \
+          PIN=`cat /var/run/samhain.pid`; \
+          /bin/kill -TTIN $PIN; \
+          sleep 1; \
+          AA=0; \
+          while test "x$AA" != "x120"; do \
+           AA=$(( AA + 1 )); \
+           if test -f /var/log/samhain.log.lock; then \
+             sleep 1; \
+           else \
+             break; \
+           fi \
+          done; \
+        fi
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/shorewall b/tools/conf/etc/logrotate.d/shorewall
new file mode 100644
index 0000000..a7dffdf
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/shorewall
@@ -0,0 +1,11 @@
+/var/log/shorewall-init.log {
+  missingok
+  notifempty
+  create 0600 root root
+    sharedscripts
+    postrotate
+    if [ -f /var/run/syslog-ng.pid ]; then \
+    	kill -HUP `cat /var/run/syslog-ng.pid`; \
+    fi;
+    endscript
+}
diff --git a/tools/conf/etc/logrotate.d/shorewall6 b/tools/conf/etc/logrotate.d/shorewall6
new file mode 100644
index 0000000..ee5e246
--- /dev/null
+++ b/tools/conf/etc/logrotate.d/shorewall6
@@ -0,0 +1,5 @@
+/var/log/shorewall6-init.log {
+  missingok
+  notifempty
+  create 0600 root root
+}
diff --git a/tools/conf/etc/syslog-ng.conf b/tools/conf/etc/syslog-ng.conf
new file mode 100644
index 0000000..5b5fc75
--- /dev/null
+++ b/tools/conf/etc/syslog-ng.conf
@@ -0,0 +1,181 @@
+#############################################################################
+# Simple syslog-ng.conf for crux.nu,
+#
+# Silvino Silva < silvino at bk dot ru >
+# Created: 1/12/2014
+#
+# Reference:
+# 	http://www.campin.net/syslog-ng/expanded-syslog-ng.con
+#
+# Notes:
+#	* f_error and f_console are not used
+# --------------------------------------------------------------------------
+@version: 3.5
+@include "scl.conf"
+
+options {
+	flush_lines(0);
+	time_reopen(10);
+	chain_hostnames(off);
+	create_dirs(no);
+	stats_freq(1200);
+	use_dns(no);
+	use_fqdn(no);
+	perm(0600);
+	log_fifo_size(2048);
+	log_msg_size(1024);
+	keep_hostname(yes);
+};
+
+#############################################
+# sources
+#
+source s_log { unix-dgram("/dev/log"); };
+source s_internal { internal(); };
+source s_kernel { file("/proc/kmsg" program_override("kernel")); };
+
+template t_debug { template("$DATE fac $FACILITY lvl $LEVEL prg $PROGRAM: $MSG\n"); };
+
+#############################################
+# common destinations
+#
+
+destination d_auth 	{ file("/var/log/auth"); };
+destination d_cron 	{ file("/var/log/cron"); };
+destination d_daemon	{ file("/var/log/daemon"); };
+destination d_kernel 	{ file("/var/log/kernel"); };
+destination d_lpr	{ file("/var/log/lpr"); };
+destination d_mail 	{ file("/var/log/mail"); };
+destination d_user	{ file("/var/log/user"); };
+destination d_syslog    { file("/val/log/syslog"); };
+
+destination d_debug 	{ file("/var/log/debug" template(t_debug)); };
+destination d_error	{ file("/var/log/error"); };
+destination d_messages	{ file("/var/log/messages"); };
+
+destination d_console	        { usertty("root"); };
+destination d_console_all	{ usertty("root"); };
+
+#############################################
+# custom destinations
+#
+
+destination d_shorewall_warn { file ("/var/log/shorewall/warn.log"); };
+destination d_shorewall_info { file ("/var/log/shorewall/info.log"); };
+destination d_dnsmasq	{ file("/var/log/dnsmasq"); };
+destination d_postgres  { file("/var/log/pgsql"); };
+destination d_sshd      { file("/var/log/sshd"); };
+destination d_gitolite  { file("/var/log/gitolite"); };
+destination d_nginx_access { file("/var/log/nginx/access.log" owner(root) group(www) perm(0644));  };
+destination d_nginx_error  { file("/var/log/nginx/error.log"); };
+
+#############################################
+# common filters
+#
+
+filter f_info 		{ level(info); };
+filter f_notice 	{ level(notice); };
+filter f_warn 		{ level(warn); };
+filter f_err 		{ level(err); };
+filter f_crit 		{ level(crit .. emerg); };
+
+filter f_emerg		{ level(emerg); };
+filter f_alert		{ level(alert); };
+
+filter f_debug 		{
+	level(debug)
+	and not facility(auth, authpriv, mail, news)
+};
+
+filter f_error   	{ level(err..emerg); };
+filter f_auth 		{ facility(auth, authpriv); };
+filter f_cron 		{ facility(cron); };
+filter f_daemon	        { facility(daemon); };
+filter f_kernel 	{ facility(kern); };
+filter f_lpr		{ facility(lpr); };
+
+filter f_local          { facility(
+    local0,
+    local1,
+    local2,
+    local3,
+    local4,
+    local5,
+    local6,
+    local7
+    );
+};
+
+filter f_mail 		{ facility(mail); };
+filter f_syslog 	{ facility(syslog); };
+filter f_user		{ facility(user); };
+filter f_console        { level(warn .. emerg); };
+
+#############################################
+# custom filters
+#
+
+filter f_messages 	{
+    level(info..warn)
+    and not facility(auth, authpriv, mail, cron)
+};
+
+filter f_dnsmasq { program("dnsmasq"); };
+filter f_postgres { facility(local0); };
+filter f_sshd { facility(local1); };
+
+filter f_shorewall_warn {
+        level (warn)
+        and match ("iptables" value("MESSAGE"));
+};
+
+filter f_shorewall_info {
+        level (info)
+        and match ("iptables" value("MESSAGE"));
+};
+
+filter f_gitolite { program("gitolite"); };
+
+filter f_nginx_access {
+        match("nginx_access:" value("MESSAGE"));
+};
+
+filter f_nginx_error {
+	match("nginx_error:" value("MESSAGE"));
+};
+
+
+log { source (s_kernel); filter (f_shorewall_warn); destination (d_shorewall_warn); flags(final);};
+log { source (s_kernel); filter (f_shorewall_info); destination (d_shorewall_info); flags(final);};
+log { source(s_log); filter(f_dnsmasq); destination(d_dnsmasq); flags(final); };
+log { source(s_log); filter(f_postgres); destination(d_postgres); flags(final); };
+log { source(s_log); filter(f_sshd); destination(d_sshd); flags(final); };
+log { source(s_log); filter(f_gitolite); destination(d_gitolite); flags(final); };
+log { source(s_log); filter(f_nginx_error); destination(d_nginx_error); flags(final); };
+log { source(s_log); filter(f_local); filter(f_nginx_access); destination(d_nginx_access); flags(final); };
+
+#############################################
+# connect filter and destination
+#
+
+log { source(s_log); filter(f_auth); destination(d_auth); };
+log { source(s_log); filter(f_cron); destination(d_cron); };
+log { source(s_log); filter(f_daemon); destination(d_daemon); };
+log { source(s_kernel); filter(f_kernel); destination(d_kernel); };
+log { source(s_log); filter(f_lpr); destination(d_lpr); };
+log { source(s_log); source(s_internal); filter(f_syslog); destination(d_syslog); };
+log { source(s_log); filter(f_user); destination(d_user); };
+
+log { source(s_log); filter(f_mail); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+log { source(s_log); filter(f_mail); filter(f_info); destination(d_mail); };
+
+log { source(s_log); filter(f_debug); destination(d_debug); };
+log { source(s_log); filter(f_error); destination(d_error); };
+
+#log { source(s_log); filter(f_console); destination(d_console_all); };
+log { source(s_log); filter(f_crit);    destination(d_console); };
+
+#default log
+log { source(s_log); filter(f_messages); destination(d_messages); };
diff --git a/tools/gitolite.html b/tools/gitolite.html
index a275c23..1fa8e5a 100644
--- a/tools/gitolite.html
+++ b/tools/gitolite.html
@@ -514,9 +514,9 @@
         #
 
         # this way it will log
-        # * * * * * /usr/share/gitolite/deployweb
+        # * * * * * /srv/gitolite/deploy/deploy.sh
         # without log
-        * * * * * /usr/share/gitolite/deployweb > /dev/null 2>&1
+        * * * * * /srv/gitolite/deploy/deploy.sh > /dev/null 2>&1
 
         @hourly   ID=sys.hourly   /usr/sbin/runjobs /etc/cron/hourly
         @daily    ID=sys.daily    /usr/sbin/runjobs /etc/cron/daily
diff --git a/tools/qemu.html b/tools/qemu.html
index fc0f15c..f79b955 100644
--- a/tools/qemu.html
+++ b/tools/qemu.html
@@ -43,7 +43,7 @@
         this describes how to create a qcow2 type;</p>
 
         <pre>
-        $ qemu-img create -f qcow2 crux-img.qcow2 20G
+        $ qemu-img create -f qcow2 crux-img.qcow2 2000M
         </pre>
 
         <p>Qemu disk images can be treated as regular disks using
@@ -61,13 +61,25 @@
         to use parted to create a gpt system table;</p>
 
         <pre>
-        # parted --script $DEV \
-            mklabel gpt \
-            mkpart ESP fat32 1MiB 120MiB \
-            mkpart primary ext4 120MiB 720MiB \
-            mkpart primary ext4 720MiB 2720MiB \
-            mkpart primary ext4 2720MiB 5000MiB \
-            set 1 boot on
+        parted --script ${DEV} \
+                mklabel gpt \
+                unit mib \
+                mkpart primary 1 3 \
+                set 1 bios_grub on \
+                name 1 grub \
+                mkpart ESP fat32 3 59 \
+                set 2 boot on \
+                name 2 efi \
+                mkpart primary ext4 103 200 \
+                name 3 boot \
+                mkpart primary linux-swap 200 456 \
+                name 4 swap \
+                mkpart primary ext4 456 3700 \
+                name 5 root \
+                mkpart primary ext4 3700 4000 \
+                name 6 var \
+                mkpart primary ext4 4000 100% \
+                name 7 home
         </pre>
 
         <pre>
@@ -77,22 +89,30 @@
         <p>Use /dev/mapper/$(name_of_device) to assign correct blocks;</p>
 
         <pre>
-        # mkfs.fat -F 32 $BLK_EFI
-        # mkfs.ext4 $BLK_BOOT
-        # mkfs.ext4 $BLK_ROOT
-        # mkfs.ext4 $BLK_VAR
+        mkfs.fat -F 32  /dev/mapper/${DEV_NAME}p2
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p3
+        mkswap          /dev/mapper/${DEV_NAME}p4
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p5
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p6
+        mkfs.ext4       /dev/mapper/${DEV_NAME}p7
         </pre>
 
         <p>Mount partition;</p>
 
         <pre>
-        # mount $BLK_ROOT $CHROOT
-        # mkdir -p $CHROOT/boot
-        # mount $BLK_BOOT $CHROOT/boot
-        # mkdir -p $CHROOT/boot/efi
-        # mount $BLK_EFI $CHROOT/boot/efi
-        # mkdir -p $CHROOT/var
-        # mount $BLK_VAR $CHROOT/var
+        mount /dev/mapper/${DEV_NAME}p5 $CHROOT
+        mkdir -p $CHROOT/proc
+        mkdir -p $CHROOT/sys
+        mkdir -p $CHROOT/dev
+
+        mkdir -p $CHROOT/boot
+        mount /dev/mapper/${DEV_NAME}p3 $CHROOT/boot
+        mkdir -p $CHROOT/boot/efi
+        mount /dev/mapper/${DEV_NAME}p2 $CHROOT/boot/efi
+        mkdir -p $CHROOT/var
+        mount /dev/mapper/${DEV_NAME}p6 $CHROOT/var
+        mkdir -p $CHROOT/home
+        mount /dev/mapper/${DEV_NAME}p7 $CHROOT/home
         </pre>
 
         <p>Before disconnecting image, clean dev mappings;</p>
@@ -200,41 +220,40 @@
 
         <p>runvm/profile/crux</p>
         <pre>
-        iso=iso/crux-3.2.iso
-        image=img/crux-img.qcow2
+        mac=$(rmac_addr)
+        memory=1024
+        boot=d
         tap="tap1"
+        iso=iso/crux-3.3.iso
+        image=img/crux-standard.qcow2
+        other="-vga std -display sdl"
         </pre>
 
         <p>runvm/runvm.sh</p>
-        <pre>
-        #!/bin/bash
 
+        <pre>
         function rmac_addr (){
         printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
         }
 
         source profile/$1
-        boot=$2
-
-        mac=$(rmac_addr)
 
         qemu-system-x86_64 \
             -enable-kvm \
-            -m 1024 \
+            -m ${memory} \
             -boot ${boot} \
             -cdrom ${iso} \
             -hda ${image} \
-            -vga std \
-            -display sdl \
             -device e1000,netdev=t0,mac=${mac} \
             -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
-            &amp;
+            ${other} \
+            &
         </pre>
 
         <p>Set guests machines to run under the total resolution provided
         by  host system configure grub on the guest with gfxmode;</p>
 
-        <h3 id="guest">Guest Graphics</h2>
+        <h3 id="guest">Guest Graphics</h3>
 
         <p>Get current resolution on host machine;</p>
 
@@ -270,53 +289,36 @@
 
         <pre>
         export QEMU_AUDIO_DRV=alsa
-        #export QEMU_AUDIO_DRV=sdl
-
-
-        #boot=$1
+        memory=1024
         boot=c
-
-        iso=iso/crux-3.2.iso
-        #iso=$2
-
-        #image=$3
-        image=img/crux-img.qcow2
-
-        #tap=$4
-        tap="tap1"
-
-        #mac=$(rmac_addr)
+        iso=iso/devuan_jessie_1.0.0_amd64_CD.iso
+        image=img/c12-dvd.qcow2
+        tap="tap2"
         mac="54:60:be:ef:5c:72"
-
-        other="-soundhw hda"
+        other="-soundhw hda -vga std -display sdl"
         </pre>
 
-        <p>runvm/runvm.sh</p>
+        <h3 id="sound">Guest USB</h3>
 
         <pre>
-        function rmac_addr (){
-        printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
-        }
-
-        source profile/$1
-        boot=$2
-
-        #mac=$(rmac_addr)
+        # lsusb
+        # ls /dev/v4l
+        </pre>
 
-        qemu-system-x86_64 \
-            -enable-kvm \
-            -m 1024 \
-            -boot ${boot} \
-            -cdrom ${iso} \
-            -hda ${image} \
-            -vga std \
-            -display sdl \
-            -device e1000,netdev=t0,mac=${mac} \
-            -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
-            ${other} \
-            &>
+        <pre>
+        # chown root:kvm /dev/bus/usb/003/004
         </pre>
 
+        <pre>
+        export QEMU_AUDIO_DRV=alsa
+        memory=1024
+        boot=c
+        iso=iso/devuan_jessie_1.0.0_amd64_CD.iso
+        image=img/c12-dvd.qcow2
+        tap="tap2"
+        mac="54:60:be:ef:5c:72"
+        other="-soundhw hda -vga std -display sdl -usb -device usb-host,vendorid=0x13d3,productid=0x5652"
+        </pre>
         <a href="index.html">Tools Index</a>
         <p>This is part of the c9 Manual.
         Copyright (C) 2016
diff --git a/tools/scripts/pkgmk-test.conf b/tools/scripts/pkgmk-test.conf
index 1ebdccb..3b0031d 100644
--- a/tools/scripts/pkgmk-test.conf
+++ b/tools/scripts/pkgmk-test.conf
@@ -2,32 +2,12 @@
 # /etc/pkgmk.conf: pkgmk(8) configuration
 #
 
-export CPPFLAGS="-D_FORTIFY_SOURCE=2"
-export CFLAGS="-O2 -march=native -mtune=native -pipe -fPIC -fPIE -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check"
-export CXXFLAGS="${CFLAGS}"
-export LDFLAGS="-fPIE -pie -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
-export MAKEFLAGS="-j4"
+source /etc/pkgmk.conf
 
-
-case ${PKGMK_ARCH} in
-	"64"|"")
-		;;
-	"32")
-		export CFLAGS="${CFLAGS} -m32"
-		export CXXFLAGS="${CXXFLAGS} -m32"
-		export LDFLAGS="${LDFLAGS} -m32"
-		export PKG_CONFIG_LIBDIR="/usr/lib32/pkgconfig"
-		;;
-	*)
-		echo "Unknown architecture selected! Exiting."
-		exit 1
-		;;
-esac
-
-PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/)
-# PKGMK_SOURCE_DIR="$PWD"
-# PKGMK_PACKAGE_DIR="$PWD"
-# PKGMK_WORK_DIR="$PWD/work"
+#PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/)
+PKGMK_SOURCE_DIR="$PWD"
+PKGMK_PACKAGE_DIR="$PWD"
+PKGMK_WORK_DIR="$PWD/work"
 # PKGMK_DOWNLOAD="no"
 # PKGMK_IGNORE_FOOTPRINT="no"
 # PKGMK_IGNORE_NEW="no"
diff --git a/tools/scripts/runvm/c12-dvd b/tools/scripts/runvm/c12-dvd
new file mode 100644
index 0000000..9cbf201
--- /dev/null
+++ b/tools/scripts/runvm/c12-dvd
@@ -0,0 +1,15 @@
+export QEMU_AUDIO_DRV=alsa
+
+memory=1024
+
+boot=c
+
+iso=iso/devuan_jessie_1.0.0_amd64_CD.iso
+
+image=img/c12-dvd.qcow2
+
+tap="tap2"
+
+mac="54:60:be:ef:5c:72"
+
+other="-soundhw hda -vga std -display sdl -usb -device usb-ehci  -device usb-host,vendorid=0x13d3,productid=0x5652"
diff --git a/tools/scripts/runvm/profile/crux b/tools/scripts/runvm/profile/crux
index eb2dc63..af33e1b 100644
--- a/tools/scripts/runvm/profile/crux
+++ b/tools/scripts/runvm/profile/crux
@@ -1,3 +1,7 @@
-iso=iso/crux-3.2.iso
-image=img/crux-img.qcow2
-tap="tap1"
+mac="54:60:be:ef:5c:64"
+memory=1024
+boot=$2
+tap="tap4"
+iso=iso/crux-3.3.iso
+image=img/c14.qcow2
+other="-vga std -display sdl"
diff --git a/tools/scripts/runvm/runvm.sh b/tools/scripts/runvm/runvm.sh
index db479cc..1e56a52 100644
--- a/tools/scripts/runvm/runvm.sh
+++ b/tools/scripts/runvm/runvm.sh
@@ -5,18 +5,22 @@ printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
 }
 
 source profile/$1
-boot=$2
 
-mac=$(rmac_addr)
+#mac=$(rmac_addr)
+#memory=1024
+#boot=d
+#tap="tap1"
+#iso=iso/crux-3.3.iso
+#image=img/crux-standard.qcow2
+#other="-soundhw hda -vga std -display sdl"
 
 qemu-system-x86_64 \
     -enable-kvm \
-    -m 1024 \
+    -m ${memory} \
     -boot ${boot} \
     -cdrom ${iso} \
     -hda ${image} \
-    -vga std \
-    -display sdl \
     -device e1000,netdev=t0,mac=${mac} \
     -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
+    ${other} \
     &
diff --git a/tools/syslog-ng.html b/tools/syslog-ng.html
index 5d6fd2d..e97b50d 100644
--- a/tools/syslog-ng.html
+++ b/tools/syslog-ng.html
@@ -5,6 +5,9 @@
         <title>1. Syslog-ng</title>
     </head>
     <body>
+
+        <a href="index.html">Tools Index</a>
+
         <h1>1. Syslog-ng</h1>
 
         <p>Syslog-ng offers more than sysklogd, for example, we
@@ -157,7 +160,7 @@
 
         <h3 id="syslog-conf">1.4. Syslog-ng configuration</h3>
 
-        <p>Example of <a href="../conf/etc/syslog-ng.conf">/etc/syslog-ng.conf</a>
+        <p>Example of <a href="conf/etc/syslog-ng.conf">/etc/syslog-ng.conf</a>
         that configures syslog-ng matching tools already installed in the system
         and some that are part of <a href="../tools/index.html">tools</a>.</p>
 
@@ -251,6 +254,8 @@
         $ sudo sh /etc/rc.d/sysklogd stop
         </pre>
 
+        <a href="index.html">Tools Index</a>
+
         <p>This is part of the c9-doc Manual.
 Copyright (C) 2016
 c9 team.