docker save -o app.tar app:v1; k3s ctr images import app.tar on every node; imagePullPolicy: Never. For several nodes, /var/lib/rancher/k3s/agent/images/ or –embedded-registry. Cleanup: k3s crictl rmi –prune.

iLO 1 (1.96), iLO 2 (2.33), iLO 3 (1.94) and iLO 4 (2.82) will not change again; iLO 5, 6 and 7 are still alive. Direct links, how to extract the .bin, and the intermediate steps.

No header, no data, passphrase or not: back it up off the disk and back it up again after every key change, because the old backup keeps the old keys.

First pvs/vgs/lvs -a: is a PV missing or did the thin pool fail? vgchange -ay –activationmode degraded for LVM RAID; partial only to copy data read-only; lvconvert –repair for thin pools; vgcfgrestore if the metadata is broken.

–add brings the disk in as a spare; –grow –raid-devices=N starts the reshape (hours). Backup file off the array, touch nothing until /proc/mdstat finishes, then resize2fs or xfs_growfs.

pfctl -sT lists tables; pfctl -t -T show|add|delete|test|flush|replace -f. On pfSense aliases are tables, sshguard is the failed-login lockout, and manual changes vanish on the next rules reload.

LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.

pkg-static does not depend on libssl and keeps working. certctl rehash, pkg-static install -fy pkg, pkg-static install -xfy pfSense-repo pfSense-upgrade, then the upgrade through System > Update, never with pkg upgrade.

Cloudflare token with Zone:Read + DNS:Edit on the zone, DNS-Cloudflare method with Token/Account ID/Zone ID, staging first, and a ‘Restart Local Service: haproxy’ action on the certificate so HAProxy reloads the new cert.

Edit the CRL under System > Certificates > Certificate Revocation, set Lifetime 730 and save: it is regenerated with valid dates. On old versions, apply the ‘Fix for CRL expiration lifetime’ patch with System Patches first.