Tow-Boot VS nordvpn

For the Pine family of SBCs I highly recommend installing Tow-Boot - https://tow-boot.org/ - on the SPI flash memory to allow yourself much better boot options, including booting directly from NVMe so you don't need to keep the MicroSD card plugged-in.

TL:DR: Install Tow-boot first, then install in Mobian image.

I opened a ticket on Two-Boot because I wasn't sure Tow-Boot was actually installed, and every information on the internet assume you don't use Tow-Boot (and so, Micro SD is booted if present).

Also the PinePhone and PinePhone Pro both can (and the PPP already does in postmarketOS) boot with UEFI nowadays. For that we use Tow-Boot currently but it could be any platform firmware really.

Also you should use Tow-boot which is more user-friendly than u-boot. you can download it here. Make sure you select the one for "pine64-pinephonePro" and not "pine64-pinephoneA64". You can find instructions for installing it here.

U-boot is quite the nice project. Any opinion on tow-boot as a tool for it?

This seems way overblown, from pretty much all perspectives.

1) Listening to community. People can suggest all kinds of conflicting things, and you just can't satisfy everyone. My experience is that many of my HW modification suggestions were listened to, even some I'd expect the Pine64 might have found a bit frivolous, like desire to have some GPIO exposed as easily accessible solderable pads on the Pinephone keyboard's PCB, so that I can mod the keyboard later on and add some buttons to the bottom side of it, etc. I got some help with aquiring of information about various chips, that I requested, etc. I didn't get everything I wanted. Life is hard I guess. OTOH, Pine64 probably did not listen to some other HW mod suggestions that I have participated in group thinking about in the chats.

I think those were the mods that would require more risky redesign, and would cause incompatibilities between Pinephone and the Pro, like sugestion to split DC-IN and USB-IN on the Original Pinephone PMIC to better support the keyboard, or suggestions to redesign battery charging circuitry in Pinebook Pro, so that drivers can limit input current to be able to follow the Type-C/PD specs more closly.

These are risky to follow from us randos on the internet. Even simple suggestions are risky to follow, even if they are correct! Take the addition of diode to prevent some issues with the pinephone keyboard's charging circuitry. The suggestion was followed, but mistakes were made in the long chain that engineering the change takes, and the diode was placed incorrectly and prevented charging the keyboard completely.

2) Bootloader/SPI thing. Yeah it's unpleasant for distros to have to include U-Boot as part of the distro image, especially when things are in flux and fixing bootloader is required for fixing things in general, too, and you have to track non-mainline patches, because Pro support can't be mainlined, yet.

So now there's Tow-Boot to come to the rescue as bit of a center of gravity for U-Boot development/support. Except that it's not really that maintained either with last patches added like 6 months ago https://github.com/Tow-Boot/Tow-Boot/tree/released/boards/pi... despite persistent issues with Pinephone Pro bootlooping, because bootloader allows boot when there's not enough energy in the battery. Some hack patches are available, but not included. Etc.

Also because things are in flux, allowing users to combine arbitrary U-Boot with arbitrary kernel version can lead to all kind of fun things, like hard to explain overheating of the phone, because kernel enabled cpuidle support, and U-Boot version in SPI lacks it and similar things.

3) Diversity/monoculture angle

Focing Tow-Boot can easily be construed as just another thing that Pine64 is forcing on users by default, too. Pinephone/pinephone pro has bootloader diversity, with alternative bootloaders being much better for users in several aspects (like not having charging or bootloop issues, or having multi-boot functionality or GUI) and maybe worse in others. So on one hand Drew is arguing that there's monoculture in distros, but wants to force monoculture in bootloader, barely maintained or developed one from Pine64 support perspective.

In the end, the most important thing is that there's not technical lockdown (secure boot not enabled). Pine64 has no say in what user can flash or not. Escaping the default bootloader is as easy as booting the preloaded Manjaro and erasing it from SPI and eMMC. The phone or pinebook will then boot whatever user wants to boot from SD card.

version: "3.8" services: nordlynx: image: ghcr.io/bubuntux/nordlynx cap_add: - NET_ADMIN # Required environment: # Review https://github.com/bubuntux/nordvpn#environment-variables - PRIVATE_KEY=mykey # Required - CONNECT=United_States - NET_LOCAL=10.20.30.40/24 # So it can be accessed within the local network - ALLOWED_IPS=10.20.30.40/24 ports: - "6881:6881" #qbittorent - "6881:6881/udp" #qbittorrent - "8080:8080" #qbittorrent - "7878:7878" #radarr - "8989:8989" #sonarr - "9696:9696" #prowlarr - "8097:8096" #jellyfin - "5055:5055" #jellyseer sysctls: - net.ipv6.conf.all.disable_ipv6=1 # Recomended if using ipv4 only qbittorrent: image: linuxserver/qbittorrent container_name: qbittorrent network_mode: service:nordlynx environment: volumes: - /path/to/qbittorrent/config:/config - /mnt/share_media:/data depends_on: - nordlynx restart: unless-stopped radarr: image: linuxserver/radarr container_name: radarr network_mode: service:nordlynx environment: volumes: - /path/to/radarr/config:/config - /mnt/share_media:/data depends_on: - nordlynx restart: unless-stopped sonarr: image: linuxserver/sonarr container_name: sonarr network_mode: service:nordlynx environment: volumes: - /path/to/sonarr/config:/config - /mnt/share_media:/data depends_on: - nordlynx restart: unless-stopped prowlarr: image: linuxserver/prowlarr container_name: prowlarr network_mode: service:nordlynx environment: volumes: - /path/to/prowlarr/config:/config depends_on: - nordlynx restart: unless-stopped jellyfin: image: linuxserver/jellyfin container_name: jellyfin network_mode: service:nordlynx environment: - JELLYFIN_PublishedServerUrl=http://10.20.30.184:8097/ volumes: - /path/to/jellyfin/config:/config - /path/to/jellyfin/cache:/cache - /mnt/share_media:/data depends_on: - nordlynx restart: unless-stopped jellyseer: image: fallenbagel/jellyseerr:latest container_name: jellyseer network_mode: service:nordlynx environment: volumes: - /path/to/jellyseer/config:/app/config depends_on: - nordlynx restart: unless-stopped

All the infos you need are on the github page > https://github.com/bubuntux/nordvpn

Issues · bubuntux/nordvpn (github.com)

On https://github.com/bubuntux/nordvpn it mentions that token login is also supported (Nord v3.15.0+). I've used the token login and it works well for me.

There has been an issue reported on github: https://github.com/bubuntux/nordvpn/issues/367

Two of the popular containers are https://github.com/qdm12/gluetun and https://github.com/bubuntux/nordvpn but it's not clear if either of them can use meshnet.

A ubuntu/debian vm with nordvpn official client, use iptables to forward this connection to the vm IP. I've seen a similar approach using docker here https://github.com/bubuntux/nordvpn but this only shares connection to other dockers ct's in the same setup