about summary refs log tree commit diff stats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--core/conf/pkgmk.conf9
-rw-r--r--core/conf/prt-get.conf19
-rw-r--r--core/conf/sysctl.conf2
-rw-r--r--core/network.html6
-rw-r--r--core/scripts/act-chroot.sh18
-rwxr-xr-x[-rw-r--r--]core/scripts/setup-install.sh217
-rwxr-xr-x[-rw-r--r--]core/scripts/setup-target.sh229
-rw-r--r--dev/c/index.html90
-rw-r--r--tools/conf/etc/fonts/local.conf1542
-rw-r--r--tools/conf/etc/iptables/iptables-br.sh318
-rw-r--r--tools/conf/etc/iptables/vlan.v4228
-rw-r--r--tools/conf/etc/nginx/sites-enabled/default.conf86
-rw-r--r--tools/conf/etc/ssh/sshd_config30
-rw-r--r--tools/nginx.html8
-rw-r--r--tools/qemu.html80
-rw-r--r--tools/scripts/pkgmk-test.conf8
-rw-r--r--tools/scripts/pkgmk-test.sh2
17 files changed, 2499 insertions, 393 deletions
diff --git a/core/conf/pkgmk.conf b/core/conf/pkgmk.conf
index 4ef372e..6949fa7 100644
--- a/core/conf/pkgmk.conf
+++ b/core/conf/pkgmk.conf
@@ -2,9 +2,10 @@
 # /etc/pkgmk.conf: pkgmk(8) configuration
 #
 
-export CFLAGS="-O2 -march=native -mtune=native"
+export CPPFLAGS="-D_FORTIFY_SOURCE=2"
+export CFLAGS="-O2 -march=native -mtune=native -pipe -fPIC -fPIE -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check"
 export CXXFLAGS="${CFLAGS}"
-
+export LDFLAGS="-fPIE -pie -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
 export MAKEFLAGS="-j4"
 
 case ${PKGMK_ARCH} in
@@ -22,7 +23,9 @@ case ${PKGMK_ARCH} in
 		;;
 esac
 
-#PKGMK_SOURCE_MIRRORS=(http://crux.nu/distfiles/)
+PKGMK_SOURCE_MIRRORS=(https://crux.nu/distfiles/)
+#PKGMK_SOURCE_MIRRORS=(https://crux.ster.zone/distfiles/)
+#PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/)
 PKGMK_SOURCE_DIR="/usr/ports/distfiles"
 PKGMK_PACKAGE_DIR="/usr/ports/packages"
 PKGMK_WORK_DIR="/usr/ports/work/$name"
diff --git a/core/conf/prt-get.conf b/core/conf/prt-get.conf
index 0504d3e..e210ca8 100644
--- a/core/conf/prt-get.conf
+++ b/core/conf/prt-get.conf
@@ -5,20 +5,19 @@
 # note: the order matters: the package found first is used
 prtdir /usr/ports/core
 prtdir /usr/ports/opt
+prtdir /usr/ports/contrib
+prtdir /usr/ports/c9-ports
 prtdir /usr/ports/xorg
 
+# 6c37 team provides a collection with freetype-iu, fontconfig-iu
+# and cairo-iu ports.
+
 # the following line enables the multilib compat-32 collection
 #prtdir /usr/ports/compat-32
 
 # the following line enables the user maintained contrib collection
-prtdir /usr/ports/contrib
-
-# ports described on this documentation
-#prtdir /usr/ports/c9-ports
-
-# 6c37 team provides a collection with freetype-iu, fontconfig-iu
-# and cairo-iu ports.
-#prtdir /usr/ports/6c37
+prtdir /usr/ports/6c37-dropin
+prtdir /usr/ports/6c37
 
 ### use mypackage form local directory
 # prtdir /home/packages/build:mypackage
@@ -38,7 +37,7 @@ logfile  /usr/ports/pkgbuild/%n-%v-%r.log
 readme verbose           # (verbose|compact|disabled)
 
 ### prefer higher versions in sysup / diff
-#preferhigher yes      # (yes|no)
+preferhigher no     # (yes|no)
 
 ### use regexp search
 # useregex no        # (yes|no)
@@ -51,7 +50,7 @@ runscripts yes            # (no|yes)
 ### EXPERT SECTION ###
 
 ### alternative commands
-makecommand      sudo -H -u pkgmk -g pkgmk fakeroot pkgmk
+makecommand      sudo -H -u pkgmk -g users fakeroot pkgmk
 addcommand       sudo pkgadd
 removecommand    sudo pkgrm
 runscriptcommand sudo sh
diff --git a/core/conf/sysctl.conf b/core/conf/sysctl.conf
index c421e59..4606791 100644
--- a/core/conf/sysctl.conf
+++ b/core/conf/sysctl.conf
@@ -374,7 +374,7 @@ kernel.grsecurity.tpe_gid = 100
 #  users on the system.  If the sysctl option is enabled, a sysctl option
 #  with name "tpe_invert" is created.  Unlike other sysctl options, this
 #  entry will default to on for backward-compatibility.
-kernel.grsecurity.tpe_invert = 1
+kernel.grsecurity.tpe_invert = 0
 
 #  If you say Y here, all non-root users will be covered under
 #  a weaker TPE restriction.  This is separate from, and in addition to,
diff --git a/core/network.html b/core/network.html
index 4f1f20a..92f0e1e 100644
--- a/core/network.html
+++ b/core/network.html
@@ -138,6 +138,12 @@
         # sh /etc/rc.d/iptables start
         </pre>
 
+        <p>See current rules and packets;</p>
+
+        <pre>
+        # iptables -L -n -v | less
+        </pre>
+
         <p>Copy init script, edit if you dont like to
         let drop when you call stop.</p>
 
diff --git a/core/scripts/act-chroot.sh b/core/scripts/act-chroot.sh
index f8ae571..5411bc5 100644
--- a/core/scripts/act-chroot.sh
+++ b/core/scripts/act-chroot.sh
@@ -21,15 +21,15 @@ BLK_HOME="${DEV}8"
 #read CHROOT
 CHROOT="/mnt"
 
-mount $BLK_ROOT $CHROOT
-
-mount $BLK_BOOT $CHROOT/boot
-mount $BLK_EFI $CHROOT/boot/efi
-
-mount $BLK_VAR $CHROOT/var
-mount $BLK_USR $CHROOT/usr
-mount $BLK_PRT $CHROOT/usr/ports
-mount $BLK_HOME $CHROOT/home
+#mount $BLK_ROOT $CHROOT
+#
+#mount $BLK_BOOT $CHROOT/boot
+#mount $BLK_EFI $CHROOT/boot/efi
+#
+#mount $BLK_VAR $CHROOT/var
+#mount $BLK_USR $CHROOT/usr
+#mount $BLK_PRT $CHROOT/usr/ports
+#mount $BLK_HOME $CHROOT/home
 
 #mount -vt devpts devpts $CHROOT/dev/pts
 #mount -vt tmpfs shm $CHROOT/dev/shm
diff --git a/core/scripts/setup-install.sh b/core/scripts/setup-install.sh
index 0e0a720..c1d2765 100644..100755
--- a/core/scripts/setup-install.sh
+++ b/core/scripts/setup-install.sh
@@ -1,24 +1,9 @@
-#!/bin/sh
+#!/bin/bash
 
 # Set Global Vars
 ADMIN_USER=c9admin
 DEV=$1
-
-CHROOT="/mnt"
-##read BLK_EFI
-BLK_EFI="${DEV}2"
-##read BLK_BOOT
-BLK_BOOT="${DEV}3"
-##read BLK_ROOT
-BLK_ROOT="${DEV}4"
-##read BLK_VAR
-BLK_VAR="${DEV}5"
-##read BLK_USR
-BLK_USR="${DEV}6"
-##read BLK_SWP
-BLK_SWP="${DEV}7"
-##read BLK_HOME
-BLK_HOME="${DEV}8"
+CHROOT=$2
 
 # Absolute path to this script,
 # e.g. /home/user/c9-doc/core/scripts/foo.sh
@@ -57,133 +42,37 @@ ConfirmOrExit ()
 }
 
 
-setup_target () {
-    echo "1.1.2 Creating File System on $BLK_EFI with fat32:"
-    mkfs.fat -F 32 $BLK_EFI
-    echo "1.1.2 Creating File System on $BLK_BOOT with ext4:"
-    mkfs.ext4 $BLK_BOOT
-    echo "1.1.2 Creating File System on $BLK_ROOT with ext4:"
-    mkfs.ext4 $BLK_ROOT
-    echo "1.1.2 Creating File System on $BLK_VAR with ext4:"
-    mkfs.ext4 $BLK_VAR
-    echo "1.1.2 Creating File System on $BLK_USR with ext4:"
-    mkfs.ext4 $BLK_USR
-    echo "1.1.2 Creating Swap File System on $BLK_SWP:"
-    mkswap $BLK_SWP
-    echo "1.1.2 Creating File System on $BLK_HOME with ext4:"
-    mkfs.ext4 $BLK_HOME
-
-    echo "1.1.3 mount point to chroot (/mnt):\n"
-    mount $BLK_ROOT $CHROOT
-
-    mkdir -p $CHROOT/boot
-    mount $BLK_BOOT $CHROOT/boot
-    mkdir -p $CHROOT/boot/efi
-    mount $BLK_EFI $CHROOT/boot/efi
-    mkdir -p $CHROOT/var
-    mount $BLK_VAR $CHROOT/var
-    mkdir -p $CHROOT/usr
-    mount $BLK_USR $CHROOT/usr
-    mkdir -p $CHROOT/home
-    mount $BLK_HOME $CHROOT/home
-
-
-    mkdir -p $CHROOT/dev
-    mkdir -p $CHROOT/tmp
-    mkdir -p $CHROOT/proc
-    mkdir -p $CHROOT/sys
-
-    mkdir -p $CHROOT/var/lib/pkg
-    mkdir -p $CHROOT/usr/ports
-
-    mkdir -p $CHROOT/media
-
-    mount --bind /dev $CHROOT/dev
-    mount -vt devpts devpts $CHROOT/dev/pts
-    mount -vt tmpfs shm $CHROOT/dev/shm
-    mount -vt proc proc $CHROOT/proc
-    mount -vt sysfs sysfs $CHROOT/sys
-
-    modprobe isofs
-    modprobe loop
-    mount -o loop $ISO_FILE $CHROOT/media
-}
-
-install_packages() {
+install_core() {
 
     echo "1.1.4 Create core.lst and install pkgadd"
-    for p in $CHROOT/media/crux/core/*; do echo $p >> $CHROOT/core.lst; done
+    for p in ${CHROOT}mnt/media/crux/core/*; do echo $p >> ${CHROOT}core.lst; done
 
-    tar xf "$CHROOT/media/crux/core/pkgutils#5.40-1.pkg.tar.xz" usr/bin/pkgadd -O > $CHROOT/pkgadd
+    tar xf "${CHROOT}mnt/media/crux/core/pkgutils#5.40-1.pkg.tar.xz" usr/bin/pkgadd -O > ${CHROOT}pkgadd
 
-    chmod +x $CHROOT/pkgadd
+    chmod +x ${CHROOT}pkgadd
 
     echo "1.1.4 File core.lst complete, review list of packages before continue..."
     read PAUSE
-    vim $CHROOT/core.lst
+    vim ${CHROOT}core.lst
 
     echo "1.1.4 Starting install"
-    touch $CHROOT/var/lib/pkg/db
+    touch ${CHROOT}/var/lib/pkg/db
 
     cd $CHROOT
     while read line; do
         echo "Installing $line;\n"
-        $CHROOT/pkgadd -f -r $CHROOT $line
-    done < core.lst
+        ${CHROOT}pkgadd -u -f -r ${CHROOT} ${line}
+    done < ${CHROOT}core.lst
 
-    rm $CHROOT/pkgadd
-    rm $CHROOT/core.lst
+    rm ${CHROOT}pkgadd
+    rm ${CHROOT}core.lst
 
-   echo "1.1.5. Install extra packages;"
-
-    mkdir $CHROOT/usr/ports/packages
-    cp $CHROOT/media/crux/core/* $CHROOT/usr/ports/packages
-    cp $CHROOT/media/crux/opt/* $CHROOT/usr/ports/packages
-    cp $CHROOT/media/crux/xorg/* $CHROOT/usr/ports/packages
+    mkdir ${CHROOT}usr/ports/packages
+    cp ${CHROOT}media/crux/core/* ${CHROOT}usr/ports/packages
 
-    echo "Installing $CHROOT/usr/ports/packages/fakeroot"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/fakeroot#*
-    echo "Installing $CHROOT/usr/ports/packages/dbus"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/dbus#*
-    echo "Installing $CHROOT/usr/ports/packages/expat"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/expat#*
-    echo "Installing $CHROOT/usr/ports/packages/libnl"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/libnl#*
-    echo "Installing $CHROOT/usr/ports/packages/libpng"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/libpng#*
-    echo "Installing $CHROOT/usr/ports/packages/freetype"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/freetype#*
-    echo "Installing $CHROOT/usr/ports/packages/libffi"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/libffi#*
-    echo "Installing $CHROOT/usr/ports/packages/sqlite3"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/sqlite3#*
-    echo "Installing $CHROOT/usr/ports/packages/python"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/python#*
-    echo "Installing $CHROOT/usr/ports/packages/glib"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/glib#*
-    echo "Installing $CHROOT/usr/ports/packages/grub2"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/grub2#*
-    echo "Installing $CHROOT/usr/ports/packages/grub2-efi"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/grub2-efi#*
-    echo "Installing $CHROOT/usr/ports/packages/wireless-tools"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/wireless-tools#*
-    echo "Installing $CHROOT/usr/ports/packages/wpa_supplicant"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/wpa_supplicant#*
-    echo "Installing $CHROOT/usr/ports/packages/lvm2"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/lvm2#*
-    echo "Installing $CHROOT/usr/ports/packages/mdadm"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/mdadm#*
-    echo "Installing $CHROOT/usr/ports/packages/efivar"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/efivar#*
-    echo "Installing $CHROOT/usr/ports/packages/efibootmgr"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/efibootmgr#*
-    echo "Installing $CHROOT/usr/ports/packages/dosfstools"
-    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/dosfstools#*
-
-    echo "1.1.6. Install extra ports;\n"
+}
 
-    mkdir $CHROOT/usr/ports/c9-ports
-    cp -r $DIR_PRT/* $CHROOT/usr/ports/c9-ports/
+setup_core() {
 
     echo "1.1.7. dns resolver, copy resolv.conf;\n"
     cp /etc/resolv.conf $CHROOT/etc
@@ -193,9 +82,6 @@ install_packages() {
 
     echo "1.1.9. Install Skeletons\n"
     cp -r $DIR_CONF/skel $CHROOT/etc/
-}
-
-host_metadata() {
 
     echo "1.2.1. Set hostname and hosts;"
     cp $DIR_CONF/hosts $CHROOT/etc/
@@ -229,9 +115,6 @@ host_metadata() {
     cp $DIR_CONF/rc.conf $CHROOT/etc/
     vim $CHROOT/etc/rc.conf
 
-}
-
-setup_ports() {
     echo "1.3.1. Build as unprivileged user;"
 
     chroot $CHROOT /usr/bin/env -i \
@@ -284,18 +167,59 @@ setup_ports() {
     #vim $CHROOT/etc/prt-get.conf
 }
 
-echo "SCRIPT=$SCRIPT";
-echo "SCRIPTPATH=$SCRIPTPATH";
+install_packages() {
 
-echo "Device: $DEV\n"
+    echo "1.1.5. Install extra packages;"
+    cp $CHROOT/media/crux/opt/* $CHROOT/usr/ports/packages
+    cp $CHROOT/media/crux/xorg/* $CHROOT/usr/ports/packages
 
-echo "1.1.2 EFI block; ($BLK_EFI)"
-echo "1.1.2 boot block; ($BLK_BOOT)"
-echo "1.1.2 root block; ($BLK_ROOT)"
-echo "1.1.2 var block; ($BLK_VAR)"
-echo "1.1.2 usr block; ($BLK_USR)"
-echo "1.1.2 swap block; ($BLK_SWP)"
-echo "1.1.2 home block; ($BLK_HOME)\n"
+    echo "Installing $CHROOT/usr/ports/packages/fakeroot"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/fakeroot#*
+    echo "Installing $CHROOT/usr/ports/packages/dbus"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/dbus#*
+    echo "Installing $CHROOT/usr/ports/packages/expat"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/expat#*
+    echo "Installing $CHROOT/usr/ports/packages/libnl"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/libnl#*
+    echo "Installing $CHROOT/usr/ports/packages/libpng"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/libpng#*
+    echo "Installing $CHROOT/usr/ports/packages/freetype"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/freetype#*
+    echo "Installing $CHROOT/usr/ports/packages/libffi"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/libffi#*
+    echo "Installing $CHROOT/usr/ports/packages/sqlite3"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/sqlite3#*
+    echo "Installing $CHROOT/usr/ports/packages/python"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/python#*
+    echo "Installing $CHROOT/usr/ports/packages/glib"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/glib#*
+    echo "Installing $CHROOT/usr/ports/packages/grub2"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/grub2#*
+    echo "Installing $CHROOT/usr/ports/packages/grub2-efi"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/grub2-efi#*
+    echo "Installing $CHROOT/usr/ports/packages/wireless-tools"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/wireless-tools#*
+    echo "Installing $CHROOT/usr/ports/packages/wpa_supplicant"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/wpa_supplicant#*
+    echo "Installing $CHROOT/usr/ports/packages/lvm2"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/lvm2#*
+    echo "Installing $CHROOT/usr/ports/packages/mdadm"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/mdadm#*
+    echo "Installing $CHROOT/usr/ports/packages/efivar"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/efivar#*
+    echo "Installing $CHROOT/usr/ports/packages/efibootmgr"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/efibootmgr#*
+    echo "Installing $CHROOT/usr/ports/packages/dosfstools"
+    $CHROOT/usr/bin/pkgadd -f -r $CHROOT $CHROOT/usr/ports/packages/dosfstools#*
+
+    echo "1.1.6. Install extra ports;\n"
+
+    mkdir $CHROOT/usr/ports/c9-ports
+    cp -r $DIR_PRT/* $CHROOT/usr/ports/c9-ports/
+
+}
+echo "SCRIPT=$SCRIPT";
+echo "SCRIPTPATH=$SCRIPTPATH";
 
 echo "ADMIN_USER="$ADMIN_USER"\n"
 echo "CHROOT=$CHROOT";
@@ -307,9 +231,8 @@ echo "ISO_FILE=$ISO_FILE";
 ConfirmOrExit
 echo "press enter to continue"
 read
-setup_target
-install_packages
-host_metadata
-setup_ports
+install_core
+#setup_core
+#install_packages
 
 echo "Ready to chroot $CHROOT /bin/bash \n"
diff --git a/core/scripts/setup-target.sh b/core/scripts/setup-target.sh
index 6931fe9..d46d4bb 100644..100755
--- a/core/scripts/setup-target.sh
+++ b/core/scripts/setup-target.sh
@@ -1,5 +1,36 @@
 #!/bin/sh
 
+DEV=/dev
+
+SETUP_TARGET="print"
+CHROOT="/mnt"
+
+# Absolute path to this script, e.g. /home/user/bin/foo.sh
+SCRIPT=$(readlink -f "$0")
+# Absolute path this script is in, thus /home/user/bin
+SCRIPTPATH=$(dirname "$SCRIPT")
+
+DIR=$(dirname "$SCRIPTPATH");
+DIR_LOCAL="$(dirname $(dirname ${DIR}))/local";
+
+ISO_FILE="${DIR_LOCAL}/crux-3.3.iso"
+
+##read BLK_EFI
+BLK_EFI="${DEV}2"
+##read BLK_BOOT
+BLK_BOOT="${DEV}3"
+##read BLK_ROOT
+BLK_ROOT="${DEV}4"
+##read BLK_VAR
+BLK_VAR="${DEV}5"
+##read BLK_USR
+BLK_USR="${DEV}6"
+##read BLK_SWP
+BLK_SWP="${DEV}7"
+##read BLK_HOME
+BLK_HOME="${DEV}8"
+
+
 # First we define the function
 ConfirmOrExit ()
 {
@@ -19,31 +50,173 @@ ConfirmOrExit ()
     echo "You entered $CONFIRM. Continuing ..."
 }
 
-DEV=$1
-
-echo "Device: $DEV\n"
-ConfirmOrExit
-
-parted --script $DEV \
-    mklabel gpt \
-    unit mib \
-    mkpart primary 1 3 \
-    name 1 grub \
-    set 1 bios_grub on \
-    mkpart ESP fat32 3 125 \
-    name 2 efi \
-    set 2 boot on \
-    mkpart primary ext4 125 1128 \
-    name 3 boot \
-    mkpart primary ext4 1128 5128 \
-    name 4 root \
-    mkpart primary ext4 5128 6128 \
-    name 5 var \
-    mkpart primary ext4 6128 14128 \
-    name 6 usr \
-    mkpart primary linux-swap 14128 18128 \
-    name 7 swap \
-    mkpart primary ext4 18128 100% \
-    name 8 home
-
-exit 0;
+
+partition_target () {
+
+    parted --script $DEV \
+        mklabel gpt \
+        unit mib \
+        mkpart primary 1 3 \
+        name 1 grub \
+        set 1 bios_grub on \
+        mkpart ESP fat32 3 125 \
+        name 2 efi \
+        set 2 boot on \
+        mkpart primary ext4 125 1128 \
+        name 3 boot \
+        mkpart primary ext4 1128 5128 \
+        name 4 root \
+        mkpart primary ext4 5128 6128 \
+        name 5 var \
+        mkpart primary ext4 6128 14128 \
+        name 6 usr \
+        mkpart primary linux-swap 14128 18128 \
+        name 7 swap \
+        mkpart primary ext4 18128 100% \
+        name 8 home
+}
+
+mount_target () {
+    echo "1.1.2 Creating File System on $BLK_EFI with fat32:"
+    mkfs.fat -F 32 $BLK_EFI
+    echo "1.1.2 Creating File System on $BLK_BOOT with ext4:"
+    mkfs.ext4 $BLK_BOOT
+    echo "1.1.2 Creating File System on $BLK_ROOT with ext4:"
+    mkfs.ext4 $BLK_ROOT
+    echo "1.1.2 Creating File System on $BLK_VAR with ext4:"
+    mkfs.ext4 $BLK_VAR
+    echo "1.1.2 Creating File System on $BLK_USR with ext4:"
+    mkfs.ext4 $BLK_USR
+    echo "1.1.2 Creating Swap File System on $BLK_SWP:"
+    mkswap $BLK_SWP
+    echo "1.1.2 Creating File System on $BLK_HOME with ext4:"
+    mkfs.ext4 $BLK_HOME
+
+    echo "1.1.3 mount point to chroot (/mnt):\n"
+    mount $BLK_ROOT $CHROOT
+
+    mkdir -p $CHROOT/boot
+    mount $BLK_BOOT $CHROOT/boot
+
+    mkdir -p $CHROOT/boot/efi
+    mount $BLK_EFI $CHROOT/boot/efi
+
+    mkdir -p $CHROOT/var
+    mount $BLK_VAR $CHROOT/var
+
+    mkdir -p $CHROOT/usr
+    mount $BLK_USR $CHROOT/usr
+
+    mkdir -p $CHROOT/home
+    mount $BLK_HOME $CHROOT/home
+
+    mkdir -p $CHROOT/var/lib/pkg
+    mkdir -p $CHROOT/usr/ports
+
+    mkdir -p $CHROOT/media
+
+    mkdir -p $CHROOT/dev
+    mkdir -p $CHROOT/tmp
+    mkdir -p $CHROOT/proc
+    mkdir -p $CHROOT/sys
+
+}
+
+directory_target () {
+
+    mkdir -p $CHROOT/home
+    mkdir -p $CHROOT/boot/efi
+    mkdir -p $CHROOT/var/lib/pkg
+    mkdir -p $CHROOT/usr/ports
+
+    mkdir -p $CHROOT/media
+
+    mkdir -p $CHROOT/dev
+    mkdir -p $CHROOT/tmp
+    mkdir -p $CHROOT/proc
+    mkdir -p $CHROOT/sys
+
+}
+
+
+enable_target () {
+
+    mount --bind /dev $CHROOT/dev
+    mount -vt devpts devpts $CHROOT/dev/pts
+    mount -vt tmpfs shm $CHROOT/dev/shm
+    mount -vt proc proc $CHROOT/proc
+    mount -vt sysfs sysfs $CHROOT/sys
+
+    modprobe isofs
+    modprobe loop
+    mount -o loop $ISO_FILE $CHROOT/media
+}
+
+print_target() {
+    echo "Device: $DEV"
+    echo "CHROOT: $CHROOT"
+    echo "ISO_FILE: $ISO_FILE"
+    echo "Option Selected: $SETUP_TARGET\n"
+
+    echo "1.1.2 EFI block; ($BLK_EFI)"
+    echo "1.1.2 boot block; ($BLK_BOOT)"
+    echo "1.1.2 root block; ($BLK_ROOT)"
+    echo "1.1.2 var block; ($BLK_VAR)"
+    echo "1.1.2 usr block; ($BLK_USR)"
+    echo "1.1.2 swap block; ($BLK_SWP)"
+    echo "1.1.2 home block; ($BLK_HOME)\n"
+
+
+}
+
+print_help() {
+	echo "usage: setup_target [options]"
+	echo "options:"
+	echo "  -p,   --partition           create partitions and file systems"
+	echo "  -m,   --mount               mount partitions on chroot"
+	echo "  -d,   --directory           keep temporary working directory"
+        echo "  -e,   --enable              enable chroot (proc,dev, sys...)"
+	echo "  -v,   --view                view environment vars and exit"
+	echo "  -h,   --help                print help and exit"
+}
+
+
+while [ "$1" ]; do
+            case $1 in
+                    -p|--partition)
+                            SETUP_TARGET="partition"
+                            print_target
+                            ConfirmOrExit
+                            partition_target
+                            exit 0 ;;
+                    -m|--mount)
+                            SETUP_TARGET="mount"
+                            print_target
+                            ConfirmOrExit
+                            mount_target
+                            exit 0 ;;
+                    -d|--directory)
+                            SETUP_TARGET="directory"
+                            print_target
+                            ConfirmOrExit
+                            directory_target
+                            exit 0 ;;
+                    -e|--enable)
+                            SETUP_TARGET="enable"
+                            print_target
+                            ConfirmOrExit
+                            enable_target
+                            exit 0 ;;
+                    -v|--view)
+                            SETUP_TARGET="view"
+                            print_target
+                            exit 0 ;;
+                    -h|--help)
+                            print_help
+                            exit 0 ;;
+                    *)
+                            echo "setup-target: invalid option $1"
+                            exit 1 ;;
+            esac
+            shift
+done
diff --git a/dev/c/index.html b/dev/c/index.html
index 09374c6..684c7d2 100644
--- a/dev/c/index.html
+++ b/dev/c/index.html
@@ -7,6 +7,92 @@
     <body>
         <a href="../index.html">Development Index</a>
 
+        <h1>System Development</h1>
+
+        <p>System development requires debug kernel know how,
+        in this example will be used qemu and gdb. A simple init
+        program is created. Create init.S;</p>
+
+        <pre>
+	.global _start
+	_start:
+	    mov $1, %rax
+	    mov $1, %rdi
+	    mov $message, %rsi
+	    mov $message_len, %rdx
+	    syscall
+	    jmp .
+	    message: .ascii "FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n"
+	    .equ message_len, . - message
+	</pre>
+
+	<p>Assemble, link and create simple initial ram disk;</p>
+
+	<pre>
+	mkdir d
+	as --64 -o init.o init.S # assemble
+	ld -o d/init init.o      # link
+	cd d
+	find . | cpio -o -H newc | gzip > ../rootfs.cpio.gz
+	</pre>
+
+	<p>Clean temporary directory;</p>
+
+	<pre>
+	cd ..
+	rm -r d/
+	</pre>
+
+	<p>Can be used C to create init program;</p>
+
+	<pre>
+	#include &lt;stdio.h&gt;
+	#include &lt;unistd.h&gt;
+
+	int main() {
+	    printf("FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR\n");
+	    sleep(0xFFFFFFFF);
+	    return 0;
+	}
+	</pre>
+
+	<pre>
+	$ gcc -static init.c -o init
+	</pre>
+
+	<p>Test qemu, kernel and simple init program, you should see
+	"FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR FOOBAR";</p>
+
+	<pre>
+	$ qemu-system-x86_64 -enable-kvm --kernel arch/x86_64/boot/bzImage \
+    	--initrd rootfs.cpio.gz
+	</pre>
+
+	<p>If everything goes well you can start qemu without start CPU at
+	startup (-S) and with gdb server on TCP port 1234 (-s).</p>
+
+	<pre>
+	$ qemu-system-x86_64 -enable-kvm --kernel arch/x86/boot/bzImage \
+                --initrd rootfs.cpio.gz \
+		-S -s
+	</pre>
+
+	<p>On another terminal start gdb;</p>
+
+	<pre>
+	gdb \
+	    -ex "add-auto-load-safe-path $(pwd)" \
+	    -ex "file vmlinux" \
+	    -ex 'set arch i386:x86-64:intel' \
+	    -ex 'target remote localhost:1234' \
+	    -ex 'break start_kernel' \
+	    -ex 'continue' \
+	    -ex 'disconnect' \
+	    -ex 'set arch i386:x86-64' \
+	    -ex 'target remote localhost:1234'
+	</pre>
+
+	
         <h1>C &amp; GDB</h1>
 
         <p><a href="http://blog.fourthbit.com/2013/06/18/creating-an-open-source-program-in-c-with-autotools-part-1-of-2/">C program with autotools</a>
@@ -74,7 +160,7 @@
         thread 1
         </pre>
 
-        <p><a href=" http://ftp.gnu.org/old-gnu/Manuals/gdb/html_node/gdb_39.html#SEC40">Stopping and Starting</a>
+        <p><a href="http://ftp.gnu.org/old-gnu/Manuals/gdb/html_node/gdb_39.html#SEC40">Stopping and Starting</a>
         multi-thread programs</p>
 
         <pre>
@@ -86,8 +172,6 @@
         <pre>
         strace -c ./program
         </pre>
-
-
         <a href="../index.html">Development Index</a>
         <p>
         This is part of the c9-doc Manual.
diff --git a/tools/conf/etc/fonts/local.conf b/tools/conf/etc/fonts/local.conf
new file mode 100644
index 0000000..64dc276
--- /dev/null
+++ b/tools/conf/etc/fonts/local.conf
@@ -0,0 +1,1542 @@
+<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+<fontconfig>
+
+	<!--
+		Documented at
+		http://linux.die.net/man/5/fonts-conf
+			
+		To check font mapping run the command at terminal
+		$ fc-match 'helvetica Neue'
+		
+		WARNING :: Droid Sans font with autohinter becomes bad, without autohinter looks great, but becomes smallish, cant help
+		even the smallish is so good, that i am using it on desktop
+		
+		but cannot be used as a substitution for arial, since 12px (which is very common on websites) becomes small as if tahoma 10px
+		
+		Noto sans does better in this case, can be used as arial substitution without loss of size
+		noto sans is slightly fatter than droid sans
+		
+		Open sans is much fat, and open sans bold looks bad, hence we choose noto sans as the replacement for arial
+		
+		
+		Download the following fonts
+		Droid fonts whole sets
+		
+		
+		Download from google web fonts
+		open sans all styles
+		noto sans all styles
+		noto serif all styles
+	-->
+
+	<!--
+		.fonts.conf
+		release 6.3.23
+		Licensed under GNU GPL
+		================================
+		LCD optimized 96 dpi
+		"Sharp'N'Clear" font settings
+		with emphasis on 'msttcorefonts'
+
+		tested on Ubuntu GNU/Linux 5.10
+		================================
+		by Obi Bok
+		Gmail: obibok
+		http://linuxtuneup.blogspot.com
+		================================
+		Why was this conceived?
+
+		- some font families look better hinted by Byte Code Interpreter (BCI)
+		while other fonts look better hinted by Auto-Hinter
+		- hinting type affects italic and bold fonts differently
+		- antialiasing needs to be adjusted according to font families and sizes
+		
+		Essentially, there is no one single rule that works for all fonts.
+
+		NOTE:
+		- Verdana @ 8pt doesn't render '2' and '6' right
+		- Arial shows 'Z' distorted in Firefox 1.5
+	-->
+
+	<!--
+		Make font sizes match the dpi set in Xorg.
+
+		Increase or decrease this value if fonts are too small or too large
+		for your screen resolution.
+
+		FIXME: this only affects QT-based apps?
+	-->
+	<match target="pattern">
+		<edit name="dpi" mode="assign">
+			<double>96</double>
+		</edit>
+	</match>
+
+	<!--
+		Enable anti-aliasing.
+
+		This only works for outline and scalable fonts.
+		Bitmap and PostScript fonts do not get anti-aliased.
+
+		FIXME: is this correct?
+	-->
+	<match target="font">
+	<edit name="antialias" mode="assign">
+	<bool>true</bool>
+	</edit>
+	</match>
+
+	<!--
+		Set sub-pixel order if not detected.
+
+		"X knows the sub pixel order already, and if this is enabled as well,
+		Freetype produces some very strange results. However, if you do still
+		have problems, consider (...) 'rgb' (the standard for LCD monitors),
+		'bgr' (unusual), 'vrgb' (vertical rgb, if you have a monitor that
+		has been rotated by 90 degrees[1]), 'vgbr' (as vrgb, but very rare)."
+		<http://www.linuxquestions.org/linux/answers/Hardware/\
+		LCD_TFT_Monitor_Configuration_in_X_Org>
+
+		Find out your LCD's sub-pixel order:
+		<http://grc.com/image/cleartype2c.gif>
+	-->
+	<match target="font">
+	<test qual="all" name="rgba" compare="eq">
+	<const>unknown</const>
+	</test>
+	<edit name="rgba" mode="assign">
+	<const>rgb</const>
+	</edit>
+	</match>
+
+	<!--
+		Sub-pixel hinting via BCI enabled by default if compiled in.
+
+		"Whole-pixel anti-aliasing does not represent a useful solution for
+		improving small point-size type. (...) By 'borrowing' sub-pixels from
+		adjacent whole pixels, we can fine-tune the placement and width of typeface
+		features with three times more horizontal accuracy then ever before!"
+		<http://grc.com/ctwhat.htm>
+	-->
+
+	<!--
+		Disable anti-aliasing for select fonts based on size and style.
+
+		| font                  | WinXP | Linux |
+		=========================================
+		Andale Mono IPA            14      13
+		Arial                      12      13
+		Arial Black                12      -
+		Arial Narrow               14      13
+		Berling Antiqua            12      13
+		Book Antiqua               12      13
+		Bookdings                  0       ?
+		Bookman Old Style          22      13
+		Century Gothic             16      16
+		Comic Sans MS              11      9/11
+		Courier New                26      22
+		Franklin Gothic Medium     12      10/12
+		Frutiger Linotype          12      10/12
+		Garamond                   18      13/19
+		Georgia                    12      12/13
+		Impact                     16      0
+		Kartika                    12      16
+		Lucida Console             12      13
+		Lucida Sans Typewriter     12      12
+		Lucida Sans Unicode        12      10/13
+		Marlett                    ?       ?
+		Microsoft Sans Serif       12      12/13
+		Palatino Linotype          12      13
+		SylfaenARM                 -       13
+		Symbol                     12      ?
+		Tahoma                     12      12/13
+		Times New Roman            12      13
+		Trebuchet MS               12      12
+		Verdana                    12      12
+		Vrinda                     12      17
+		Webdings                   20      ?
+		Wingdings                  20      ?
+		=========================================
+
+		"The relationship of pixels to points depends on the number of pixels
+		per inch, which is typically some 'standard' value corresponding to
+		default screen fonts. For example, MS Windows has two standard sets of
+		screen fonts initially designed for IBM display systems: 'small' (VGA)
+		and 'large' (8514/A). 'Small' fonts are 96 pixels per inch, 'large' are
+		120. Macintosh systems render type at a nominal 72 pixels per inch, i.e.
+		one pixel = one point. Some display systems using scalable screen fonts
+		allow fine tuning of pixels per inch to suit user preferences."
+		<http://www.hpaa.com/css1/pxnpts.asp>
+
+		X pt * 96 dpi / 72 dpi = Y px
+	-->
+
+	<!--
+		font group #1: normal roman anti-aliased above 10pt/13.4px
+	-->
+	<match target="font">
+		
+		<test qual="any" name="family" compare="eq">
+			<string>Franklin Gothic Medium</string>
+			<string>Frutiger Linotype</string>
+			<!-- Lucida Sans Unicode has no italic and uses artificial oblique -->
+			<string>Lucida Sans Unicode</string>
+		</test>
+		
+		<test qual="any" name="pixelsize" compare="less_eq">
+			<double>13.4</double>
+		</test>
+		
+		<test qual="any" name="weight" compare="less_eq">
+			<const>medium</const>
+		</test>
+		
+		<test qual="any" name="slant" compare="eq">
+			<const>roman</const>
+		</test>
+		
+		<edit name="antialias" mode="assign">
+			<bool>false</bool>
+		</edit>
+
+	</match>
+
+	<!--
+		font group #2: normal roman anti-aliased above 11pt/14.7px
+
+		Must use 15px instead of 14.7px for this to work in QT-based apps
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<!-- Comic Sans MS has no italic and uses artificial oblique -->
+	<string>Comic Sans MS</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>15</double>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #3: normal roman anti-aliased above 12pt/16px
+		
+		Must use at least 16.1px instead of 16px for this to work in Firefox
+		Does not work in Chrome properly
+		In chrome 13px evalutes to 17.4px pixelsize test, funny!
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>Georgia</string>
+			<string>Lucida Sans</string>
+			<string>Lucida Sans Typewriter</string>
+			<!-- Microsoft Sans Serif has no italic and uses artificial oblique -->
+			<string>Microsoft Sans Serif</string>
+			<!-- Tahoma has no italic and uses artificial oblique -->
+			<string>Tahoma</string>
+			<string>Trebuchet MS</string>
+			<string>Verdana</string>
+		</test>
+		<test qual="any" name="pixelsize" compare="less_eq">
+			<double>16.1</double>
+		</test>
+		<test qual="any" name="weight" compare="less_eq">
+			<const>medium</const>
+		</test>
+		<test qual="any" name="slant" compare="eq">
+			<const>roman</const>
+		</test>
+		
+		<edit name="antialias" mode="assign">
+			<bool>false</bool>
+		</edit>
+	</match>
+
+	<!--
+		font group #4: normal roman anti-aliased above 13pt/17.4px
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>Arial</string>
+			<string>Arial Narrow</string>
+			<string>Berling Antiqua</string>
+			<string>Book Antiqua</string>
+			<string>Bookman Old Style</string>
+			<string>Garamond</string>
+			<!-- Lucida Console has no italic and uses artificial oblique -->
+			<string>Lucida Console</string>
+			<string>Palatino Linotype</string>
+			<string>SylfaenARM</string>
+			<string>Times New Roman</string>
+		</test>
+		<test qual="any" name="pixelsize" compare="less_eq">
+			<double>17.4</double>
+		</test>
+		<test qual="any" name="weight" compare="less_eq">
+			<const>medium</const>
+		</test>
+		<test qual="any" name="slant" compare="eq">
+			<const>roman</const>
+		</test>
+		<edit name="antialias" mode="assign">
+			<bool>false</bool>
+		</edit>
+	</match>
+
+	<!--
+		font group #5: normal roman anti-aliased above 16pt/21.4px
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Century Gothic</string>
+	<string>Kartika</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>21.4</double>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #6: normal roman anti-aliased above 17pt/23px
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Vrinda</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>23</double>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #7: normal roman anti-aliased above 22pt/29.4px
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Courier New</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>29.4</double>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #8: bold roman anti-aliased above 9pt/12px
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Georgia</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>12</double>
+	</test>
+	<test qual="any" name="weight" compare="more">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #9: bold roman anti-aliased above 10pt/13.4px
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Tahoma</string>
+	<string>Verdana</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>13.4</double>
+	</test>
+	<test qual="any" name="weight" compare="more">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #10: bold roman anti-aliased above 12pt/16px
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Courier New</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>16</double>
+	</test>
+	<test qual="any" name="weight" compare="more">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="eq">
+	<const>roman</const>
+	</test>
+	<edit name="antialias" mode="assign">
+	<bool>false</bool>
+	</edit>
+	</match>
+
+	<!--
+		Enable FreeType Auto-Hinter for select fonts.
+
+		Auto-Hinter is disabled by default if Bytecode Interpreter was compiled in.
+		Some Linux "native" fonts look better hinted by Auto-Hinter,
+		usually in sizes 11pt-13pt; others look better hinted by BCI.
+	-->
+
+	<!--
+		Set Auto-Hinter to full hinting style.
+
+		'slight' and 'medium' hinting often produce pixel discoloration.
+		
+		hintfull for all fonts by default
+	-->
+	<match target="font">
+		<edit name="hintstyle" mode="assign">
+			<const>hintfull</const>
+		</edit>
+	</match>
+
+	<!--
+		font group #11: hinted via Auto-Hinter
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>Bitstream Charter</string>
+			<string>Courier 10 Pitch</string>
+			<string>DejaVu Sans Condensed</string>
+			<string>DejaVu Serif Condensed</string>
+			<string>FreeMono</string>
+			<string>FreeSans</string>
+			<string>FreeSerif</string>
+			<string>Luxi Mono</string>
+			<string>Luxi Sans</string>
+			<string>Luxi Serif</string>
+			<string>MgOpen Canonica</string>
+			<string>MgOpen Cosmetica</string>
+			<string>MgOpen Modata</string>
+			<string>MgOpen Moderna</string>
+			<string>URW Bookman L</string>
+			<string>URW Chancery L</string>
+			<string>URW Gothic L</string>
+			<string>URW Palladio L</string>
+		</test>
+		
+		<edit name="autohint" mode="assign">
+			<bool>true</bool>
+		</edit>
+	</match>
+
+	<!--
+		font group #12: normal italic hinted via Auto-Hinter at 9-10pt
+
+		Arial hinted via BCI at 9pt has distorted 'y', at 10pt - '2'
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Arial</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="more_eq">
+	<double>12</double>
+	</test>
+	<test qual="any" name="pixelsize" compare="less_eq">
+	<double>13.4</double>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="not_eq">
+	<const>roman</const>
+	</test>
+	<edit name="autohint" mode="assign">
+	<bool>true</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #13: normal italic hinted via Auto-Hinter at 12pt
+
+		This fixes distorted 'K'
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Book Antiqua</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="eq">
+	<double>16</double>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="not_eq">
+	<const>roman</const>
+	</test>
+	<edit name="autohint" mode="assign">
+	<bool>true</bool>
+	</edit>
+	</match>
+
+	<!--
+		font group #14: normal italic hinted via Auto-Hinter at all sizes
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<!-- 10, 11, 12 -->
+	<string>Frutiger Linotype</string>
+	<!--  8-9: 'z', '2'; 10-15, 17, 19: 'z' -->
+	<string>Times New Roman</string>
+	<!-- 9-10: 'N' 'Q'; 12: 'w', 'C', 'D', 'O', 'Q', 'R', '2', '9', '0' -->
+	<string>Verdana</string>
+	</test>
+	<test qual="any" name="weight" compare="less_eq">
+	<const>medium</const>
+	</test>
+	<test qual="any" name="slant" compare="not_eq">
+	<const>roman</const>
+	</test>
+	<edit name="autohint" mode="assign">
+	<bool>true</bool>
+	</edit>
+	</match>
+
+	<!--
+		Set minimum allowed size to avoid illegible fonts.
+	-->
+	<!-- 7pt in QT-based apps -->
+	<match target="pattern">
+	<test qual="any" name="size" compare="less">
+	<double>7</double>
+	</test>
+	<edit name="size" mode="assign">
+	<double>7</double>
+	</edit>
+	</match>
+
+	<!-- 9.4px (7pt) in GTK-based apps -->
+	<match target="pattern">
+	<test qual="any" name="pixelsize" compare="less">
+	<double>9.4</double>
+	</test>
+	<edit name="pixelsize" mode="assign">
+	<double>9.4</double>
+	</edit>
+	</match>
+
+	<!--
+		TODO: Create rules limiting minimum sizes for these *bold* fonts:
+
+		Andale Mono | Andale Mono IPA
+		Arial
+		Arial Narrow
+		Berling Antiqua
+		Book Antiqua
+		Bookman Old Style
+		Century Gothic
+		Comic Sans MS
+		Courier New
+		Franklin Gothic Medium
+		Frutiger Linotype
+		Garamond
+		Georgia
+		Kartika
+		Lucida Console
+		Lucida Sans Typewriter
+		Lucida Sans Unicode
+		Microsoft Sans Serif
+		Palatino | Palatino Linotype
+		SylfaenARM
+		Tahoma
+		Times New Roman
+		Trebuchet MS
+		Verdana
+		Vrinda
+	-->
+
+	<!--
+		font group #15: bold fonts no smaller than 10.7px (8pt)
+
+		FIXME: for Firefox and other GTK-based apps?
+	-->
+	<match target="font">
+	<test qual="any" name="family" compare="eq">
+	<string>Arial</string>
+	</test>
+	<test qual="any" name="pixelsize" compare="less">
+	<double>10.7</double>
+	</test>
+	<test qual="any" name="weight" compare="more">
+	<const>medium</const>
+	</test>
+	<edit name="pixelsize" mode="assign">
+	<double>10.7</double>
+	</edit>
+	</match>
+
+	<!--
+		Anti-alias fonts with "fake" styles.
+
+		FIXME: QT only? GTK? Firefox?
+	-->
+	<!-- FIXME: dirty_hack(tm) - fontconfig reports syntax errors -->
+	<match target="font">
+	<test qual="any" name="matrix" compare="not_eq">
+	<double>0</double>
+	</test>
+	<!-- another approach - no errors but freezes Firefox 1.5 -->
+	<!--
+	<match target="font">
+	<test qual="any" name="matrix" compare="eq">
+	<name>matrix</name>
+	</test>
+	-->
+	<edit name="antialias" mode="assign">
+	<bool>true</bool>
+	</edit>
+	</match>
+
+	<!--
+		Substitute unavailable and/or unwanted fonts.
+
+		Aliases will not work if the actual fonts are installed.
+		Replacing font family works in Firefox (FIXME: and other GTK-based apps?)
+		QT-based apps also need font foundry replaced.
+		Grouping fonts for substitution doesn't work in Firefox, so we need each
+		font family replaced individually.
+	-->
+
+	<!--
+		sans-serif
+		
+		"If the font still has no generic name, add sans-serif"
+		/etc/fonts.conf
+
+		Therefore, we only substitute what we need.
+	-->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Bitstream Charter</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>serif</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Bitstream Vera Sans</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>sans</string>
+		</edit>
+	</match>
+	
+	
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>DejaVu Sans</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>sans</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>DejaVu Sans Condensed</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<!-- 
+		Dont do this, overriding freesans will cause utf fonts to be come rubbish in chrome
+	-->
+	<!--
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>FreeSans</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+	-->
+	<!--
+		ON web pages if font family is like this
+		
+		font-family: 'Helvetica Neue', arial, sans-serif;
+		
+		google chrome will immediately move to next font, if it does not find the first, even if there are append entries
+		But firefox will take the append entry if the font does not exist :)
+	-->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Helvetica</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>Sans</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Helvetica Neue</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>Sans</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Lucida</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Arial</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<!-- FIXME: may need to use "Lucida Bright" instead -->
+	<string>LucidaBright</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Lucida Bright</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Luxi Sans</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>MgOpen Cosmetica</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>MgOpen Modata</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>MgOpen Moderna</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>System</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>URW Gothic L</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Arial</string>
+	</edit>
+	</match>
+
+	<!--
+		FIXME: Verdana renders characters '2' and '6' slightly distorted
+				so it will be substituted with Arial.
+				
+		EDIT Silver Moon : not replacing verdana with arial.
+		hey verdana is slightly fatty, how about replacing it with open sans or noto sans
+		open sans is fattier compared to droid sans
+		
+		BAH, it looks good
+		
+		Open Sans is cramped at 11px with autohint = true 
+		'sa' the s and a will stick badly
+		'50' the 5 and 0 will stick badly
+		
+		But 12px onwards Open Sans is better than Noto Sans
+		
+		But the vote goes to noto sans for verdana replaced to maintain beauty at 11px
+		
+		Another note
+		noto sans has single stroke small g , open sans has the 2 round style g
+		noto sans p is thin, open sans p is better looking
+	-->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Verdana</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Noto Sans</string>
+		</edit>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Open Sans</string>
+		</edit>
+	</match>
+	
+	<!--
+		serif
+	-->
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Bitstream Vera Serif</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>DejaVu Serif</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>DejaVu Serif Condensed</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Luxi Serif</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>MgOpen Canonica</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>New Century Schoolbook</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>New York</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Palatino</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Times</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>URW Bookman L</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>URW Palladio L</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Georgia</string>
+	</edit>
+	</match>
+
+	<!--
+		monospace
+	-->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Andale Mono</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>monospace</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Bitstream Vera Sans Mono</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Courier New</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Courier</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>monospace</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>DejaVu Sans Mono</string>
+		</test>
+		<edit name="family" mode="append" binding="same">
+			<string>monospace</string>
+		</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Fixedsys</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Courier New</string>
+	</edit>
+	</match>
+
+	
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<!-- FIXME: Ubuntu Wiki uses "Lucida Typewriter" instead -->
+	<string>LucidaTypewriter</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Courier New</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Lucida Typewriter</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Courier New</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Luxi Mono</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Courier New</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Monaco</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Courier New</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Terminal</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Courier New</string>
+	</edit>
+	</match>
+
+	<!--
+		cursive
+	-->
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Apple Chancery</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Comic Sans MS</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Lucida Handwriting</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Comic Sans MS</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>URW Chancery L</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Comic Sans MS</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Zapf Chancery</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Comic Sans MS</string>
+	</edit>
+	</match>
+
+	<!--
+		fantasy
+	-->
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Copperplate</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Impact</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Desdemona</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Impact</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Kino</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Impact</string>
+	</edit>
+	</match>
+
+	<match target="pattern">
+	<test qual="any" name="family" compare="eq">
+	<string>Techno</string>
+	</test>
+	<edit name="family" mode="prepend" binding="same">
+	<string>Impact</string>
+	</edit>
+	</match>
+
+	<!--
+		Provide required aliases for standard names.
+	-->
+	<!--
+	<alias>
+	<family>sans-serif</family>
+	<prefer>
+	<family>Arial</family>
+	</prefer>
+	</alias>
+
+	<alias>
+	<family>serif</family>
+	<prefer>
+	<family>Georgia</family>
+	</prefer>
+	</alias>
+	-->
+	<!--
+	<alias>
+	<family>monospace</family>
+	<prefer>
+	<family>Courier New</family>
+	</prefer>
+	</alias>
+	-->
+	<alias>
+	<family>cursive</family>
+	<prefer>
+	<family>Comic Sans MS</family>
+	</prefer>
+	</alias>
+
+	<alias>
+	<family>fantasy</family>
+	<prefer>
+	<family>Impact</family>
+	</prefer>
+	</alias>
+
+	<!-- 
+		Added by Silver Moon (m00n.silv3r@gmail.com) 
+		Changes focussing on Droid Sans, replacing windows old fonts like arial, courier
+		and fixing some fonts like lucida grande bold, and hindi fonts
+	-->
+
+	<!-- 
+		Replace arial fonts larger than 12px by droid sans 
+		Works only in firefox, not in chrome
+	-->
+	
+	
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Arial</string>
+		</test>
+		<test qual="any" name="pixelsize" compare="more">
+			<double>12.0</double>
+		</test>
+		<edit name="family" mode="assign" binding="strong">
+			<string>droid sans</string>
+		</edit>
+	</match>
+	
+	
+	
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Arial</string>
+		</test>
+		<test qual="any" name="pixelsize" compare="less">
+			<double>13.0</double>
+		</test>
+		<edit name="family" mode="assign" binding="same">
+			<string>noto sans</string>
+		</edit>
+	</match>
+	
+	
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Arial</string>
+		</test>
+		<edit name="family" mode="assign" binding="same">
+			<string>noto sans</string>
+		</edit>
+	</match>
+	
+	<!-- 
+		Replace Georgia by Noto Serif
+	-->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Georgia</string>
+		</test>
+		<edit name="family" mode="assign" binding="same">
+			<string>Noto Serif</string>
+		</edit>
+	</match>
+	
+	
+	<!-- 
+		
+		Behavioug is similar to droid sans,
+	
+		WITHOUT AUTOHINTER
+		
+		1. becomes smallish, like droid sans, very small on desktop , 
+		2. DESKTOP - HIGHLY PROPORTIONATE, HIGHLY CLEAR
+		2. WEBPAGES - less clearer - vertical stands become hazy 
+		3. slightly less STRETCHED
+		
+		WITH AUTOHINTER :
+		
+		1. very slightly STRETCHED
+		2. CRYSTAL CLARITY on webpages,  
+		3. lesser proportionate on desktop, CLARITY KIND OF OK OK
+		3. bold font ugly with hintfull, good with hintslight
+		
+		
+		Since we are using noto sans as arial replacement, hint it fully with autohinter.
+		
+		hintslight will compromise clarity
+		
+		thought of doing this, above 12px autohint = false
+		below 13px authint = true
+		but autohint false leads to loss of clarity, but makes width correct
+		moreover chrome does not obey pixelsize correctly
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>noto sans</string>
+		</test>
+		<edit mode="assign" name="autohint">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintfull</const>
+		</edit>
+	</match>
+	
+	
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>ubuntu</string>
+		</test>
+		<edit mode="assign" name="autohint">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintfull</const>
+		</edit>
+	</match>
+	
+	<!--
+		DROID SANS
+		
+		WITHOUT AUTOHINTER
+		1.CLEARER 13px onwards
+		2. 12px on webpages very small
+		3. super clear at 12px
+		4. 9pt desktop super clear, super PROPORTIONATE
+		
+		
+		AUTOHINT = TRUE
+		1. LESS CLEARER
+		2. 'n' is cramped
+		3. 9pt desktop, slightly distorted
+		4. 12px webpage is normal sized, but not great as noto sans with autohint = true. but better than arial
+		
+		
+		
+		droid sans with autohinter, becomes more disproportionate on gnome, this is lesser with noto sans
+		
+		in browser there is not much difference between autohint true/false
+		true leads to clarity loss
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>Droid Sans</string>
+			<string>Droid Sans Mono</string>
+		</test>
+		<edit mode="assign" name="autohint">
+			<bool>false</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintfull</const>
+		</edit>
+	</match>
+
+	
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>liberation mono</string>
+		</test>
+		<edit mode="assign" name="autohint">
+			<bool>false</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintmedium</const>
+		</edit>
+	</match>
+	
+	
+
+	
+	
+	
+	<!-- time for stupid tricks for 2 stupid browsers, namely firefox and chrome -->
+	<!-- stupid trick for firefox 
+		firefox obeys pixelsize but not size
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>noto sans</string>
+		</test>
+		<test qual="any" name="pixelsize" compare="less">
+			<double>16</double>
+		</test>
+		<test qual="any" name="weight" compare="more">
+			<const>medium</const>
+		</test>
+		<edit mode="assign" name="autohint">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle" binding="weak">
+			<const>hintslight</const>
+		</edit>
+	</match>
+	
+	<!-- 
+		stupid trick for chrome 
+		chrome obeys size, but not pixelsize below 17.4 pixel
+	-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>noto sans</string>
+		</test>
+		<test qual="any" name="size" compare="less">
+			<double>16</double>
+		</test>
+		<test qual="any" name="weight" compare="more">
+			<const>medium</const>
+		</test>
+		<edit mode="assign" name="antialias">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="autohint">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle" binding="weak">
+			<const>hintslight</const>
+		</edit>
+	</match>
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+
+	<!-- use droid sans mono for monospace -->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>monospace</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Droid Sans Mono</string>
+		</edit>
+	</match>
+
+	<!-- use droid sans mono for sans-serif -->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>sans-serif</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Noto Sans</string>
+		</edit>
+	</match>
+
+	<!-- use droid sans mono for Courier New -->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Courier New</string>
+		</test>
+		<edit name="family" mode="prepend" binding="same">
+			<string>Droid Sans Mono</string>
+		</edit>
+	</match>
+
+
+
+
+
+
+	<!-- replace times new roman with droid serif -->
+	<match target="pattern">
+		<test qual="any" name="family" compare="eq">
+			<string>Times New Roman</string>
+			<string>serif</string>
+		</test>
+		
+		<edit name="family" mode="prepend" binding="same">
+			<string>Noto Serif</string>
+		</edit>
+	</match>
+	
+	
+	<!-- lucida grande bold, with hintfull, becomes stiff looking, with 1 part of a letter more fat than the other, therefor hintslight-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>Lucida Grande</string>
+		</test>
+		<test qual="any" name="weight" compare="more">
+			<const>medium</const>
+		</test>
+		<edit mode="assign" name="hintstyle">
+			<const>hintslight</const>
+		</edit>
+	</match>
+
+	
+	<!-- lucida grande bold, with hintfull, becomes stiff looking, with 1 part of a letter more fat than the other, therefor hintslight-->
+	<match target="font">
+		<test qual="any" name="family" compare="eq">
+			<string>Lucida Console</string>
+		</test>
+		<edit name="antialias" mode="assign">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="autohint">
+			<bool>false</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintfull</const>
+		</edit>
+	</match>
+	
+	<!--
+		Open sans WITHOUT autohint, becomes fattish in chrome/firefox
+		WITH autohint, becomes crytalline, very good
+		but like noto sans, the bold version is not beautiful
+		need to fix : TODO
+	-->
+	<match target="font">
+		<test compare="eq" name="family" qual="any">
+			<string>Open Sans</string>
+		</test>
+		<edit mode="assign" name="autohint">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintfull</const>
+		</edit>
+	</match>
+
+	
+
+	
+	<!-- 
+		Styling for hindi fonts
+		Hindi (hi) 
+	-->
+	<!-- force Lohit Hindi for hindi font -->
+	<match target="pattern">
+		<test compare="eq" name="lang">
+			<string>hi</string>
+		</test>
+		<edit binding="strong" mode="prepend" name="family">
+			<string>Lohit Hindi</string>
+		</edit>
+	</match>
+
+	<!-- do some antialiasing tweak for gargi and lohit hindi font -->
+	<match target="font">
+		<test compare="eq" name="family" qual="any">
+			<string>gargi</string>
+			<string>Lohit Hindi</string>
+		</test>
+		<edit mode="assign" name="antialias">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="autohint">
+			<bool>true</bool>
+		</edit>
+		<edit mode="assign" name="hintstyle">
+			<const>hintslight</const>
+		</edit>
+	</match>
+
+	<!-- Replace mangal with lohit hindi, mangal is a stupid font -->
+	<match target="pattern">
+		<test compare="eq" name="family" qual="any">
+			<string>mangal</string>
+		</test>
+		<edit binding="strong" mode="assign" name="family">
+			<string>Lohit Hindi</string>
+		</edit>
+	</match> 
+	<!-- Hindi (hi) ends -->
+
+</fontconfig>
+ 
diff --git a/tools/conf/etc/iptables/iptables-br.sh b/tools/conf/etc/iptables/iptables-br.sh
new file mode 100644
index 0000000..104e574
--- /dev/null
+++ b/tools/conf/etc/iptables/iptables-br.sh
@@ -0,0 +1,318 @@
+#!/bin/sh
+
+#
+#                                XXXXXXXXXXXXXXXXX
+#                                XXXX Network XXXX
+#                                XXXXXXXXXXXXXXXXX
+#                                        +
+#                                        |
+#                                        v
+#  +-------------+              +------------------+
+#  |table: filter| <---+        | table: nat       |
+#  |chain: INPUT |     |        | chain: PREROUTING|
+#  +-----+-------+     |        +--------+---------+
+#        |             |                 |
+#        v             |                 v
+#  [local process]     |           ****************          +--------------+
+#        |             +---------+ Routing decision +------> |table: filter |
+#        v                         ****************          |chain: FORWARD|
+# ****************                                           +------+-------+
+# Routing decision                                                  |
+# ****************                                                  |
+#        |                                                          |
+#        v                        ****************                  |
+# +-------------+       +------>  Routing decision  <---------------+
+# |table: nat   |       |         ****************
+# |chain: OUTPUT|       |               +
+# +-----+-------+       |               |
+#       |               |               v
+#       v               |      +-------------------+
+# +--------------+      |      | table: nat        |
+# |table: filter | +----+      | chain: POSTROUTING|
+# |chain: OUTPUT |             +--------+----------+
+# +--------------+                      |
+#                                       v
+#                               XXXXXXXXXXXXXXXXX
+#                               XXXX Network XXXX
+#                               XXXXXXXXXXXXXXXXX
+#
+# iptables [-t table] {-A|-C|-D} chain rule-specification
+#
+# iptables [-t table] {-A|-C|-D} chain  rule-specification
+#
+# iptables  [-t table] -I chain [rulenum] rule-specification
+#
+# iptables [-t table] -R chain rulenum  rule-specification
+#
+# iptables [-t table] -D chain rulenum
+#
+# iptables [-t table] -S [chain [rulenum]]
+#
+# iptables  [-t  table]  {-F|-L|-Z} [chain [rulenum]] [options...]
+#
+# iptables [-t table] -N chain
+#
+# iptables [-t table] -X [chain]
+#
+# iptables [-t table] -P chain target
+#
+# iptables [-t table]  -E  old-chain-name  new-chain-name
+#
+# rule-specification = [matches...] [target]
+#
+# match = -m matchname [per-match-options]
+#
+#
+# Targets
+#
+# can be a user defined chain
+#
+# ACCEPT - accepts the packet
+# DROP   - drop the packet on the floor
+# QUEUE  - packet will be stent to queue
+# RETURN - stop traversing this chain and
+#          resume ate the next rule in the
+#          previeus (calling) chain.
+#
+# if packet reach the end of the chain or
+# a target RETURN, default policy for that
+# chain is applayed.
+#
+# Target Extensions
+#
+# AUDIT
+# CHECKSUM
+# CLASSIFY
+# DNAT
+# DSCP
+# LOG
+#     Torn on kernel logging, will print some
+#     some information on all matching packets.
+#     Log data can be read with dmesg or syslogd.
+#     This is a non-terminating target and a rule
+#     should be created with matching criteria.
+#
+#     --log-level level
+#           Level of logging (numeric or see sys-
+#           log.conf(5)
+#
+#     --log-prefix prefix
+#           Prefix log messages with specified prefix
+#           up to 29 chars log
+#
+#     --log-uid
+#           Log the userid of the process with gener-
+#           ated the packet
+# NFLOG
+#     This target pass the packet to loaded logging
+#     backend to log the packet. One or more userspace
+#     processes may subscribe to the group to receive
+#     the packets.
+#
+# ULOG
+#     This target provides userspace logging of maching
+#     packets. One or more userspace processes may then
+#     then subscribe to various multicast groups and
+#     then receive the packets.
+#
+#
+# Commands
+#
+# -A, --append chain rule-specification
+# -C, --check chain rule-specification
+# -D, --delete chain rule-specification
+# -D, --delete chain rulenum
+# -I, --insert chain [rulenum] rule-specification
+# -R, --replace chain rulenum rule-specification
+# -L, --list [chain]
+# -P, --policy chain target
+#
+# Parameters
+#
+# -p, --protocol protocol
+#       tcp, udp, udplite, icmp, esp, ah, sctp, all
+# -s, --source address[/mask][,...]
+# -d, --destination address[/mask][,...]
+# -j, --jump target
+# -g, --goto chain
+# -i, --in-interface name
+# -o, --out-interface name
+# -f, --fragment
+# -m, --match options module-name
+#       iptables can use extended packet matching
+#       modules.
+# -c, --set-counters packets bytes
+
+IPT="/usr/sbin/iptables"
+SPAMLIST="blockedip"
+SPAMDROPMSG="BLOCKED IP DROP"
+# public interface to network/internet
+PUB_IF="wlp7s0"
+DHCP_SERV="192.168.1.1"
+PUB_IP="192.168.1.33"
+NET_ADDR="192.168.1.0/24"
+# private interface for virtual/internal
+PRIV_IF="br0"
+PRIV_IP="10.0.0.1"
+
+modprobe ip_conntrack
+modprobe ip_conntrack_ftp
+
+echo "Stopping ipv4 firewall and deny everyone..."
+
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+iptables -t raw -F
+iptables -t raw -X
+iptables -t security -F
+iptables -t security -X
+
+
+echo "Starting ipv4 firewall filter table..."
+
+# Set Default Rules
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT DROP
+
+###### AP rules  ######
+echo 1 > /proc/sys/net/ipv4/ip_forward
+$IPT -A FORWARD -i ${PRIV_IF} -o ${PUB_IF} -j ACCEPT
+$IPT -A FORWARD -i ${PUB_IF} -o ${PRIV_IF} -j ACCEPT
+$IPT -t nat -A POSTROUTING -o ${PUB_IF} -j SNAT --to ${PUB_IP}
+
+# Block sync
+$IPT -A INPUT -p tcp ! --syn -m state --state NEW -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 7 --log-prefix "iptables: drop sync: "
+$IPT -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
+
+# Block Fragments
+$IPT -A INPUT -f -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop frag: "
+$IPT -A INPUT -f -j DROP
+
+# Block bad stuff
+$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
+$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
+
+$IPT -A INPUT -p tcp --tcp-flags ALL NONE -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop null: "
+$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # NULL packets
+
+$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop syn rst syn rst: "
+$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
+
+$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop xmas: "
+$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP #XMAS
+
+$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/m --limit-burst 7 -j LOG --log-level 4 --log-prefix "iptables: drop fin scan: "
+$IPT -A INPUT -p tcp --tcp-flags FIN,ACK FIN -j DROP # FIN packet scans
+
+$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
+
+
+###### Input Chain ######
+
+# Unlimited on local
+$IPT -A INPUT -i ${PRIV_IF} -j ACCEPT
+#$IPT -A INPUT -i lo -s ${PRIV_IP} -j ACCEPT
+
+# Unlimited on loopback
+$IPT -A INPUT -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
+$IPT -A INPUT -i lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT
+
+echo "Allow input from DNS Server"
+$IPT -A INPUT -i ${PUB_IF} -p udp --dport 1024:65535 --sport 53 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input from Https server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input to HTTPS Server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+#echo "Allow input from HTTP Server"
+#$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input from IRC server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 6667 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input from FTP server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 1024:65535 --sport 21 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input from git server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 9418 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input from POP3S server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input from SMTPS server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
+
+echo "Allow input to HTTP Server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+#echo "Allow input to DNS Server"
+#$IPT -A INPUT -i ${PUB_IF} -p udp --sport 1024:65535 --dport 53  -m state --state NEW,ESTABLISHED -s 192.168.0.0/16 -j ACCEPT
+
+echo "Allow input to SSH server"
+$IPT -A INPUT -i ${PUB_IF} -p tcp --dport 2222 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+###### Output Chain ######
+
+# Unlimited on loopback
+$IPT -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
+$IPT -A OUTPUT -o lo -s 192.168.1.33 -d 192.168.1.33 -j ACCEPT
+#$IPT -A OUTPUT -o lo -d ${PRIV_IP} -j ACCEPT
+
+# Unlimited on local
+$IPT -A OUTPUT -o ${PRIV_IF} -j ACCEPT
+
+echo "Allow output to DNS server"
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --dport 53 --sport 1024:65535 -j ACCEPT
+
+echo "Allow output to https server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 1024:65535 --dport 443  -j ACCEPT
+
+echo "Allow output from https server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 443 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+#echo "Allow output from http server"
+#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 80 --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+#echo "Allow to HTTP server"
+#$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow output to SSH server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow output to ftp server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow output to git server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 9418 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow output to IRC  server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow output to SMTPS server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 465 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+echo "Allow output to POP3S server"
+$IPT -A OUTPUT -o ${PUB_IF} -p tcp --dport 995 --sport 1024:65535 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+## less logs
+
+echo "Drop RIP protocol"
+$IPT -A INPUT -i ${PUB_IF} -p udp --sport 520 --dport 520 -s $NET_ADDR -j DROP
+
+$IPT -A OUTPUT -o ${PUB_IF} -p udp --sport 68 --dport 67 -d $DHCP_SERV -j ACCEPT
+
+## log everything else and drop
+$IPT -A INPUT -j LOG --log-level 7 --log-prefix "iptables: INPUT: "
+$IPT -A OUTPUT -j LOG --log-level 7 --log-prefix "iptables: OUTPUT: "
+$IPT -A FORWARD -j LOG --log-level 7 --log-prefix "iptables: FORWARD: "
+#
+exit 0
diff --git a/tools/conf/etc/iptables/vlan.v4 b/tools/conf/etc/iptables/vlan.v4
index 9248630..7954521 100644
--- a/tools/conf/etc/iptables/vlan.v4
+++ b/tools/conf/etc/iptables/vlan.v4
@@ -1,170 +1,112 @@
-# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+# Generated by iptables-save v1.6.1 on Wed Mar 15 20:53:45 2017
 *security
-:INPUT ACCEPT [6:2056]
+:INPUT ACCEPT [85:6694]
 :FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [6:2056]
+:OUTPUT ACCEPT [3:179]
 COMMIT
-# Completed on Sat Oct 15 17:20:41 2016
-# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+# Completed on Wed Mar 15 20:53:45 2017
+# Generated by iptables-save v1.6.1 on Wed Mar 15 20:53:45 2017
 *raw
-:PREROUTING ACCEPT [7:2092]
-:OUTPUT ACCEPT [6:2056]
+:PREROUTING ACCEPT [97:7863]
+:OUTPUT ACCEPT [3:179]
 COMMIT
-# Completed on Sat Oct 15 17:20:41 2016
-# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+# Completed on Wed Mar 15 20:53:45 2017
+# Generated by iptables-save v1.6.1 on Wed Mar 15 20:53:45 2017
+*nat
+:PREROUTING ACCEPT [6:683]
+:INPUT ACCEPT [2:138]
+:OUTPUT ACCEPT [2:131]
+:POSTROUTING ACCEPT [2:131]
+COMMIT
+# Completed on Wed Mar 15 20:53:45 2017
+# Generated by iptables-save v1.6.1 on Wed Mar 15 20:53:45 2017
 *mangle
-:PREROUTING ACCEPT [7:2092]
-:INPUT ACCEPT [6:2056]
+:PREROUTING ACCEPT [8:624]
+:INPUT ACCEPT [8:624]
 :FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [6:2056]
-:POSTROUTING ACCEPT [6:2056]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
 COMMIT
-# Completed on Sat Oct 15 17:20:41 2016
-# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
+# Completed on Wed Mar 15 20:53:45 2017
+# Generated by iptables-save v1.6.1 on Wed Mar 15 20:53:45 2017
 *filter
 :INPUT DROP [0:0]
-:FORWARD ACCEPT [0:0]
+:FORWARD DROP [0:0]
 :OUTPUT DROP [0:0]
+:ACCEPTLOG - [0:0]
+:DROPLOG - [0:0]
+:REJECTLOG - [0:0]
+:RELATED_ICMP - [0:0]
+:SYN_FLOOD - [0:0]
 -A INPUT -i lo -j ACCEPT
--A INPUT -i br0 -j ACCEPT
--A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop sync: " --log-level 7
--A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
--A INPUT -f -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop frag: "
--A INPUT -f -j DROP
+-A INPUT -p icmp -m limit --limit 1/sec --limit-burst 2 -j ACCEPT
+-A INPUT -p icmp -m limit --limit 1/sec --limit-burst 2 -j LOG --log-prefix "PING-DROP:"
+-A INPUT -p icmp -j DROP
+-A INPUT -p icmp -f -j DROPLOG
+-A INPUT -p icmp -m state --state ESTABLISHED -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
+-A INPUT -p icmp -m state --state RELATED -m limit --limit 3/sec --limit-burst 8 -j RELATED_ICMP
+-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
+-A INPUT -p icmp -j DROPLOG
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -p tcp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
+-A INPUT -p udp -m multiport --dports 135,137,138,139,445,1433,1434 -j DROP
+-A INPUT -m state --state INVALID -j DROP
+-A INPUT -p tcp -m state --state NEW -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
+-A INPUT -p tcp -m state --state NEW -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
 -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop null: "
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
--A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop syn rst syn rs"
 -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop xmas: "
 -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
--A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -m limit --limit 5/min --limit-burst 7 -j LOG --log-prefix "iptables: drop fin scan: "
--A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-#################################################################################
-#	INPUT
-#	Established connections and passive
-#
-
-# Allow established from dns server
-#-A INPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# INPUT accept passive
--A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
--A INPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED -j ACCEPT
-
-
-# Allow irc
--A INPUT -p tcp -m tcp --sport 6667 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow xmmp
--A INPUT -p tcp -m tcp --sport 5222 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
-# Allow established from https server
--A INPUT -p tcp -m tcp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
--A INPUT -p udp -m udp --sport 443 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-# Allow established from http server
--A INPUT -p tcp -m tcp --sport 80 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow established from rsync server
--A INPUT -p tcp -m tcp --sport 873 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow established from pop3s server
--A INPUT -p tcp -m tcp --sport 995 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow established from smtps server
--A INPUT -p tcp -m tcp --sport 465 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow established from ntp server
--A INPUT -p udp -m udp --sport 123 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow established from whois server
--A INPUT -p tcp -m tcp --sport 43 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-# Allow established from ftp server
--A INPUT -p tcp -m tcp --sport 20 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
--A INPUT -p tcp -m tcp --sport 21 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
--A INPUT -p tcp -m tcp --sport 22 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-##################################################################################
-#	INPUT
-#	New and established connections to local servers
-#
-
-# allow ping
--A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
--A INPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-# INPUT accept to dns server
--A INPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-# INPUT accept from wlp7s0 to https server
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROPLOG
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j SYN_FLOOD
+-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROPLOG
+-A INPUT -f -j DROPLOG
 -A INPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-# INPUT accept from wlp7s0 to ssh server
--A INPUT -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state ESTABLISHED -j ACCEPT
--A INPUT -p tcp -m tcp --sport 1024:65535 --dport 2222 -m state --state NEW -m limit --limit 6/min --limit-burst 3 -j ACCEPT
-
--A FORWARD -i br0 -j ACCEPT
-
--A INPUT -j LOG --log-prefix "iptables: INPUT: " --log-level 7
--A FORWARD -j LOG --log-prefix "iptables: FORWARD: " --log-level 7
-
-##################################################################################
-#	Output
-#	Connections to remote servers
-#
+-A INPUT -j DROPLOG
+-A FORWARD -p icmp -f -j DROPLOG
+-A FORWARD -p icmp -j DROPLOG
+-A FORWARD -m state --state INVALID -j DROP
+-A FORWARD -j REJECTLOG
 -A OUTPUT -o lo -j ACCEPT
--A OUTPUT -o br0 -j ACCEPT
-
-# Allow ping
--A OUTPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-# Allow to ssh clients
+-A OUTPUT -p icmp -j ACCEPT
+-A OUTPUT -p icmp -f -j DROPLOG
+-A OUTPUT -p icmp -m state --state ESTABLISHED -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
+-A OUTPUT -p icmp -m state --state RELATED -m limit --limit 3/sec --limit-burst 8 -j RELATED_ICMP
+-A OUTPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 3/sec --limit-burst 8 -j ACCEPT
+-A OUTPUT -p icmp -j DROPLOG
+-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
+-A OUTPUT -m state --state INVALID -j DROP
+-A OUTPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 -A OUTPUT -p tcp -m tcp --sport 2222 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-# Allow to dns
-#-A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow from dns server
--A OUTPUT -p udp -m udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
-
-# Allow irc
+-A OUTPUT -p udp -m udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 6667 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow xmmp
--A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 5222 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-
-
-# Allow to rsync server
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 5222 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 873 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow to pop3s server
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 995 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow to smtps server
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 465 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow to ntp server
 -A OUTPUT -p udp -m udp --sport 1024:65535 --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow to ftp server
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow to https server
--A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
--A OUTPUT -p udp -m udp --sport 1024:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-# Allow to http server
+-A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 443 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
 -A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-
-##################################################################################
-#	Output
-#	Connections from local servers
-#
-
-
--A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
--A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state RELATED -j ACCEPT
--A OUTPUT -p tcp -m tcp --sport 1024:65535 --dport 1024:65535 -m state --state NEW -j ACCEPT
-
-
--A OUTPUT -j LOG --log-prefix "iptables: OUTPUT: " --log-level 7
-COMMIT
-# Completed on Sat Oct 15 17:20:41 2016
-# Generated by iptables-save v1.6.0 on Sat Oct 15 17:20:41 2016
-*nat
-:PREROUTING ACCEPT [1:36]
-:INPUT ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
-:POSTROUTING ACCEPT [0:0]
-
--A POSTROUTING -s 10.0.0.0/24 -d 10.0.0.0/24 -j ACCEPT
--A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE
-#-A POSTROUTING -o wlp7s0 -j MASQUERADE
-
+-A OUTPUT -j DROPLOG
+-A ACCEPTLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "iptables: ACCEPT " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
+-A ACCEPTLOG -j ACCEPT
+-A DROPLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "iptables: DROP " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
+-A DROPLOG -j DROP
+-A REJECTLOG -m limit --limit 3/sec --limit-burst 8 -j LOG --log-prefix "iptables: REJECT " --log-level 7 --log-tcp-sequence --log-tcp-options --log-ip-options
+-A REJECTLOG -p tcp -j REJECT --reject-with tcp-reset
+-A REJECTLOG -j REJECT --reject-with icmp-port-unreachable
+-A RELATED_ICMP -p icmp -m icmp --icmp-type 3 -j ACCEPT
+-A RELATED_ICMP -p icmp -m icmp --icmp-type 11 -j ACCEPT
+-A RELATED_ICMP -p icmp -m icmp --icmp-type 12 -j ACCEPT
+-A RELATED_ICMP -j DROPLOG
+-A SYN_FLOOD -m limit --limit 2/sec --limit-burst 6 -j RETURN
+-A SYN_FLOOD -j DROP
 COMMIT
-# Completed on Sat Oct 15 17:20:41 2016
+# Completed on Wed Mar 15 20:53:45 2017
diff --git a/tools/conf/etc/nginx/sites-enabled/default.conf b/tools/conf/etc/nginx/sites-enabled/default.conf
index 4e01b88..f7c3484 100644
--- a/tools/conf/etc/nginx/sites-enabled/default.conf
+++ b/tools/conf/etc/nginx/sites-enabled/default.conf
@@ -1,49 +1,103 @@
-
 server {
+
+#listen 443 ssl http2;
     listen 443 ssl;
-    # listen [::]:443 ssl;
 
+#    listen 80;
     server_name c9.core;
 
-    root /srv/www/default;
+#  listen [::]:443 ssl http2;
+    ssl_certificate /etc/letsencrypt/live/c9.core/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/c9.core/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/c9.core/chain.pem;
+    ssl_session_timeout 1d;
+    ssl_session_cache shared:SSL:50m;
+    ssl_session_tickets off;
+    ssl_protocols TLSv1.2;
+    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+    ssl_prefer_server_ciphers on;
+    add_header Strict-Transport-Security max-age=15768000;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    access_log /var/log/nginx/access.log;
+    error_log  /var/log/nginx/error.log;
+
+
+    root /srv/www;
+
+    location /ports/distfiles {
+        alias /usr/ports/distfiles;
+    }
+
+    location /ports/packages {
+        alias /usr/ports/distfiles;
+    }
+
+    location /doc {
+        alias /srv/www/c9-doc;
+        index index.html;
+    }
 
-    location /distfiles {
-    	alias /usr/ports/distfiles;
+    location /git/static {
+# static files (png/css) served from /usr/share/gitweb/static
+        alias /srv/www/gitweb/static;
+        expires 30d;
     }
 
+    location /git {
+        alias /srv/www/gitweb;
+        index gitweb.cgi;
+        fastcgi_split_path_info      ^/git()(/?.+)$;
+        fastcgi_param GITWEB_CONFIG  /etc/gitweb.conf;
+        fastcgi_param DOCUMENT_ROOT  /srv/www/gitweb;
+        fastcgi_param SCRIPT_NAME    /gitweb.cgi$fastcgi_path_info;
 
-    location /bug {
+        include fastcgi_params;
+        fastcgi_pass unix:/var/run/fcgiwrap.sock;
+    }
+
+    location /task {
         index index.php;
-    	alias /srv/www/default/flyspray;
+        alias /srv/www/c9-flyspray;
         try_files $uri $uri/ index.php$is_args$args;
     }
 
-    location ~  ^/bug(.+\.php)$ { ### This location block was the solution
-    	alias /srv/www/default/flyspray;
-
-	fastcgi_split_path_info ^(.+\.php)(/.+)$;
+    location ~  ^/task(.+\.php)$ { ### This location block was the solution
+        alias /srv/www/c9-flyspray;
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
         fastcgi_index index.php;
         try_files $uri /index.php =404;	
         include /etc/nginx/fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$1;
-        # fastcgi_pass unix:/var/run/php5-fpm.sock;
+# fastcgi_pass unix:/var/run/php5-fpm.sock;
         fastcgi_pass 127.0.0.1:9000;
     }
 
     location / {
-    	alias /srv/www/default/pmwiki/;
-	index pmwiki.php
+        alias /srv/www/c9-pmwiki/;
+        index pmwiki.php;
         try_files $uri $uri/ /pmwiki.php$is_args$args;
     }
 
+# ACME challenge
+    location ^~ /.well-known {
+        allow all;
+        alias /srv/www/c9-pmwiki/pub/cert/.well-known/;
+        default_type "text/plain";
+        try_files $uri =404;
+    }
+
+
     location ~ \.php$ {
-    	alias /srv/www/default/pmwiki;
+        alias /srv/www/c9-pmwiki;
+        index pmwiki.php;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;
         fastcgi_index pmwiki.php;
         try_files $uri /pmwiki.php =404;
         include /etc/nginx/fastcgi_params;
         fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        # fastcgi_pass unix:/var/run/php5-fpm.sock;
+# fastcgi_pass unix:/var/run/php5-fpm.sock;
         fastcgi_pass 127.0.0.1:9000;
     }
 }
diff --git a/tools/conf/etc/ssh/sshd_config b/tools/conf/etc/ssh/sshd_config
index f0619fe..cba9be5 100644
--- a/tools/conf/etc/ssh/sshd_config
+++ b/tools/conf/etc/ssh/sshd_config
@@ -1,4 +1,4 @@
-#	$OpenBSD: sshd_config,v 1.98 2016/02/17 05:29:04 djm Exp $
+#	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
 
 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -16,45 +16,28 @@ AddressFamily inet
 #ListenAddress 0.0.0.0
 #ListenAddress ::
 
-# The default requires explicit activation of protocol 1
-Protocol 2
-
-# HostKey for protocol version 1
-#HostKey /etc/ssh/ssh_host_key
-# HostKeys for protocol version 2
 #HostKey /etc/ssh/ssh_host_rsa_key
 #HostKey /etc/ssh/ssh_host_dsa_key
 #HostKey /etc/ssh/ssh_host_ecdsa_key
 #HostKey /etc/ssh/ssh_host_ed25519_key
 
-# Lifetime and size of ephemeral version 1 server key
-#KeyRegenerationInterval 1h
-#ServerKeyBits 1024
-
 # Ciphers and keying
 #RekeyLimit default none
-Ciphers aes256-ctr,aes192-ctr,aes128-ctr
 
 # Logging
-# obsoletes QuietMode and FascistLogging
 #SyslogFacility AUTH
 #LogLevel INFO
 LogLevel VERBOSE
 
 # Authentication:
 
-LoginGraceTime 1m
+#LoginGraceTime 2m
 #PermitRootLogin prohibit-password
-PermitRootLogin no
 #StrictModes yes
 #MaxAuthTries 6
-MaxAuthTries 3
 #MaxSessions 10
 
-#RSAAuthentication yes
-PubkeyAuthentication yes
-
-AllowGroups admin users gitolite
+#PubkeyAuthentication yes
 
 # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
 # but this is overridden so installations will only check .ssh/authorized_keys
@@ -66,23 +49,19 @@ AuthorizedKeysFile	.ssh/authorized_keys
 #AuthorizedKeysCommandUser nobody
 
 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
-#RhostsRSAAuthentication no
-# similar for protocol version 2
 #HostbasedAuthentication no
 # Change to yes if you don't trust ~/.ssh/known_hosts for
-# RhostsRSAAuthentication and HostbasedAuthentication
+# HostbasedAuthentication
 #IgnoreUserKnownHosts no
 # Don't read the user's ~/.rhosts and ~/.shosts files
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
 #PasswordAuthentication yes
-PasswordAuthentication no
 #PermitEmptyPasswords no
 
 # Change to no to disable s/key passwords
 #ChallengeResponseAuthentication yes
-ChallengeResponseAuthentication no
 
 # Kerberos options
 #KerberosAuthentication no
@@ -116,7 +95,6 @@ ChallengeResponseAuthentication no
 #PrintLastLog yes
 #TCPKeepAlive yes
 #UseLogin no
-UsePrivilegeSeparation sandbox
 #PermitUserEnvironment no
 #Compression delayed
 #ClientAliveInterval 0
diff --git a/tools/nginx.html b/tools/nginx.html
index a85cf0e..ef78ecb 100644
--- a/tools/nginx.html
+++ b/tools/nginx.html
@@ -43,7 +43,7 @@
 
         <h2 id="certs">2. Certificates</h2>
 
-        <h3 id="letsencrypt">2.1. Lets encrypt</h2>
+        <h3 id="letsencrypt">2.1. Lets encrypt</h3>
 
         <p>Example of nginx location block on public pmwiki setup;</p>
 
@@ -57,6 +57,12 @@
         }
         </pre>
 
+        <p>First run dryrun to test if everything is ok;</p>
+
+        <pre>
+        # certbot certonly --dry-run --email user@mail.org --webroot -w /srv/www/c9-pmwiki/pub/cert/-d c9.root.sx
+        </pre>
+
         <pre>
         # certbot certonly --email user@mail.org --webroot -w /srv/www/c9-pmwiki/pub/cert/-d c9.root.sx
         </pre>
diff --git a/tools/qemu.html b/tools/qemu.html
index c914d74..fc0f15c 100644
--- a/tools/qemu.html
+++ b/tools/qemu.html
@@ -234,11 +234,89 @@
         <p>Set guests machines to run under the total resolution provided
         by  host system configure grub on the guest with gfxmode;</p>
 
+        <h3 id="guest">Guest Graphics</h2>
+
+        <p>Get current resolution on host machine;</p>
+
         <pre>
-        GRUB_GFXMODE=640x480
+        $ xrandr --current | fgrep '*'
+            1366x768      60.00*+
+        </pre>
+
+        <p>Set grub gfxmod on guest machine, edit /etc/default/grub;</p>
+
+        <pre>
+        GRUB_GFXMODE=1366x768
         GRUB_GFXPAYLOAD_LINUX=keep
         </pre>
 
+        <p>Update grub configuration on guest machine;</p>
+
+        <pre>
+        # update-grub
+        </pre>
+
+        <h3 id="sound">Guest Sound</h3>
+
+        <p>Check if DMAR is enable on kernel configuration,
+        Intel and AMD uses different technology. To check on
+        Inter machine run;</p>
+
+        <pre>
+	# grep -e DMAR -e IOMMU
+	</pre>
+
+        <p>runvm/profile/crux</p>
+
+        <pre>
+        export QEMU_AUDIO_DRV=alsa
+        #export QEMU_AUDIO_DRV=sdl
+
+
+        #boot=$1
+        boot=c
+
+        iso=iso/crux-3.2.iso
+        #iso=$2
+
+        #image=$3
+        image=img/crux-img.qcow2
+
+        #tap=$4
+        tap="tap1"
+
+        #mac=$(rmac_addr)
+        mac="54:60:be:ef:5c:72"
+
+        other="-soundhw hda"
+        </pre>
+
+        <p>runvm/runvm.sh</p>
+
+        <pre>
+        function rmac_addr (){
+        printf '54:60:BE:EF:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256))
+        }
+
+        source profile/$1
+        boot=$2
+
+        #mac=$(rmac_addr)
+
+        qemu-system-x86_64 \
+            -enable-kvm \
+            -m 1024 \
+            -boot ${boot} \
+            -cdrom ${iso} \
+            -hda ${image} \
+            -vga std \
+            -display sdl \
+            -device e1000,netdev=t0,mac=${mac} \
+            -netdev tap,id=t0,ifname=${tap},script=no,downscript=no \
+            ${other} \
+            &>
+        </pre>
+
         <a href="index.html">Tools Index</a>
         <p>This is part of the c9 Manual.
         Copyright (C) 2016
diff --git a/tools/scripts/pkgmk-test.conf b/tools/scripts/pkgmk-test.conf
index db9978d..1ebdccb 100644
--- a/tools/scripts/pkgmk-test.conf
+++ b/tools/scripts/pkgmk-test.conf
@@ -2,11 +2,13 @@
 # /etc/pkgmk.conf: pkgmk(8) configuration
 #
 
-export CFLAGS="-O2 -march=x86-64"
+export CPPFLAGS="-D_FORTIFY_SOURCE=2"
+export CFLAGS="-O2 -march=native -mtune=native -pipe -fPIC -fPIE -fstack-protector-strong --param=ssp-buffer-size=4 -fno-plt -fstack-check"
 export CXXFLAGS="${CFLAGS}"
-
+export LDFLAGS="-fPIE -pie -Wl,-O1,--sort-common,--as-needed,-z,relro,-z,now"
 export MAKEFLAGS="-j4"
 
+
 case ${PKGMK_ARCH} in
 	"64"|"")
 		;;
@@ -34,5 +36,3 @@ PKGMK_SOURCE_MIRRORS=(https://c9.root.sx/ports/distfiles/)
 # PKGMK_WGET_OPTS=""
 # PKGMK_CURL_OPTS=""
 # PKGMK_COMPRESSION_MODE="gz"
-
-
diff --git a/tools/scripts/pkgmk-test.sh b/tools/scripts/pkgmk-test.sh
index 5509ac2..a279967 100644
--- a/tools/scripts/pkgmk-test.sh
+++ b/tools/scripts/pkgmk-test.sh
@@ -2,4 +2,4 @@
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 CONF=${DIR}/pkgmk-test.conf
 
-fakeroot pkgmk -cf $CONF -d $1
+fakeroot pkgmk -cf $CONF -d -is $1
generated by cgit-pink 1.4.1-2-gfad0 (git 2.36.2.497.gbbea4dcf42) at 2025-05-23 13:09:37 +0000