ٱلْحَمْدُ لِلّٰهِ رَبِّ ٱلْعَالَمِينَ، وَٱلصَّلَاةُ وَٱلسَّلَامُ عَلىٰ خَاتَمُ ٱلْأَنْبِيَاءِ وَٱلْمُرْسَلِينَ
A practical, community-shareable reference compiled and reorganized from personal daily notes. Commands are grouped by task, with short explanations and safety notes.
>
Scope: Commands are retained where they are broadly useful; repeated history, terminal output, personal contact details, credentials, device identifiers, and potentially harmful wireless attack commands are not reproduced. Replace example paths, interfaces, addresses, and filenames with your own.
1. Linux essentials
2. Package management and maintenance
3. Processes, logs, services, and boot
4. Files, storage, and search
5. Networking and Wi-Fi diagnostics
6. SSH and firewall basics
7. Docker and Compose
8. Git workflow
9. Python environments and package installation
10. ESPHome and inverter monitoring
11. ESP-IDF, esptool, and firmware flashing
12. MicroPython, ESP-NOW, and display wiring notes
13. STM32 and board sensors
14. SDR, OpenWebRX, ACARS, and ADS-B
15. Video, audio, and stream inspection
16. Webcam controls
17. Desktop, fonts, and sleep troubleshooting
18. Image and icon conversion
19. Local LLMs and llama.cpp
20. Ecommerce research and scraping notes
21. Electronics calculations and component notes
22. Home Assistant dashboard snippets
23. Sensitive information and safe sharing
24. Useful reference details
Quick commands for identifying the system, checking devices, and inspecting hardware.
Copy
# Show kernel and architecture
uname -a
uname -r
# Show distribution and version
cat /etc/os-release
# Show memory usage in human-readable units
free -h
# Show PCI devices; useful for graphics, Wi-Fi, and other internal hardware
lspci -nn
lspci -nn | grep -Ei 'wireless|network|VGA|3D'
# List USB devices
lsusb
# Show network interfaces and addresses
ip link show
ip addr
# Show the current shell history
history
# Search past commands for a keyword
history | grep -i docker
Tip: cat prints a file; head -n 10 file.txt prints its first ten lines; tail -n 10 file.txt prints its last ten lines; tail -f logfile follows new log entries.
Debian package commands for updates, cleanup, and installing common tools.
Copy
# Refresh package lists
sudo apt update
# Install available upgrades, handling dependency changes when required
sudo apt full-upgrade
# Remove packages no longer needed, including their system configuration
sudo apt autoremove --purge
# Clear obsolete package archives
sudo apt autoclean
# Install useful diagnostics and development utilities
sudo apt install curl git jq rsync unzip tmux htop ncdu dnsutils iw
Check before confirming upgrades or removals. full-upgrade and autoremove --purge can remove packages; read the proposed changes before accepting.
Copy
# Interactive process and resource viewer (install htop if needed)
htop
# Show processes matching a name
ps aux | grep -i huion
# Show open TCP sockets and associated process information
sudo ss -tpn
# Show connections to a particular destination IP
sudo ss -tpn dst 203.0.113.10
Copy
# Check a service's current status
sudo systemctl status docker
# Start, stop, restart, or enable a service at boot
sudo systemctl start docker
sudo systemctl stop docker
sudo systemctl restart docker
sudo systemctl enable docker
# Follow a service's logs live
sudo journalctl -fu NetworkManager
# Show logs from the current boot
sudo journalctl -b
# Show previous-boot messages (if persistent journal data exists)
sudo journalctl -b -1
# Filter log output for a keyword
sudo journalctl -b | grep -i suspend
Copy
# Overall systemd startup timing
systemd-analyze
# Services sorted by startup duration
systemd-analyze blame
# Critical path through startup dependencies
systemd-analyze critical-chain
Use systemctl mask only when you deliberately want to prevent a unit from starting. Masking a system service can have side effects; understand how to undo it with sudo systemctl unmask SERVICE.
Copy
# Show current directory
pwd
# List files, including hidden files, with details
ls -lah
# Show the size of a directory
du -sh ~/adockers/*
# Show disk space by mounted filesystem
df -h
# Find a named file under your home directory
find ~ -name 'docker-compose.yml' 2>/dev/null
# Search text recursively, showing filenames and line numbers
grep -Rni 'keyword' ~/projects 2>/dev/null
# Search files for a literal string containing punctuation
grep -RFn -- 'setRotation(2);' .
# Show the first ten lines of a file
head -n 10 notes.txt
# Show the last 50 lines of a log
tail -n 50 app.log
# Follow a log as it grows
tail -f app.log
Notes
Use grep -F when the search string should be treated literally rather than as a regular expression.
Use -- before a search pattern beginning with -, so it is not mistaken for an option.
Be careful with sudo rm -rf; it deletes recursively without an interactive safety net.
Copy
# List active NetworkManager connections
nmcli connection show --active
# Summarize devices and their states
nmcli device status
# Display detailed device properties
nmcli device show
# Show the current Wi-Fi link, signal, and access-point details
iw dev wlp3s0 link
# List wireless interfaces
iw dev
# Scan for nearby Wi-Fi networks (may require suitable permissions)
sudo iw dev wlp3s0 scan
# Watch NetworkManager events in real time
sudo journalctl -fu NetworkManager
Replace wlp3s0 with the wireless interface shown by iw dev or ip link.
Copy
# PCI Wi-Fi/network adapters
lspci -nn | grep -Ei 'wireless|network'
# USB adapters
lsusb
# Detailed network hardware and driver information
sudo lshw -class network
# Check loaded modules for a particular driver
lsmod | grep -i 8821ce
Copy
# Show TCP sockets with process names and PIDs
sudo ss -tpn
# Filter for a destination address
sudo ss -tpn dst 203.0.113.10
203.0.113.10 is a documentation-only example IP; substitute the address you are investigating.
Typical hardening settings for /etc/ssh/sshd_config:
Copy
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Before disabling password authentication, confirm that key-based login works in a separate session and that you have recovery access.
Copy
# Validate SSH configuration syntax before reloading
sudo sshd -t
# Apply configuration without a full reboot
sudo systemctl reload ssh
Copy
# Show firewall state and numbered rules
sudo ufw status numbered
# Block traffic from a specific source IP
sudo ufw deny from 203.0.113.10
# Delete a rule by its displayed number
sudo ufw delete RULE_NUMBER
Check the rule list before deleting. Avoid locking yourself out of a remote machine by blocking your own current address or SSH port.
Run these from the directory containing the Compose file.
Copy
# Start services in the foreground
docker compose up
# Start services in the background
docker compose up -d
# Show services in this Compose project
docker compose ps
# Stop and remove the project's containers and networks
docker compose down
# Reconcile containers and remove orphaned services
docker compose up -d --remove-orphans
# Edit the Compose configuration
nano docker-compose.yml
Important: docker compose down -v also removes Compose-managed volumes and can delete persistent databases, settings, and other data. Use it only when you explicitly intend to erase those volumes.
Copy
# List running containers
docker ps
# List all containers, including stopped ones
docker ps -a
# Compact table of names, state, and published ports
docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
# List downloaded images
docker images
# List volumes
docker volume ls
# View a container's logs
docker logs CONTAINER_NAME
# Follow logs live
docker logs -f CONTAINER_NAME
# Show Docker's data directory
docker info | grep 'Docker Root Dir'
# Estimate Docker storage use
sudo du -sh /var/lib/docker
# Estimate per-container log sizes
sudo du -sh /var/lib/docker/containers/*/*.log
Copy
docker stop openwebrx
docker start openwebrx
docker restart openwebrx
docker exec -it openwebrx sh
docker exec runs a command inside an existing container. Use sh or bash depending on what the image includes.
Copy
# Remove unused Docker objects (review the scope first)
docker system prune
# Show sizes of project directories
du -sh ~/adockers/*
Avoid docker system prune -a --volumes, deleting Docker's overlay2 directory manually, or truncating all container logs as routine maintenance. These actions can remove images, volumes, application data, or useful diagnostic history. If logs are too large, configure Docker log rotation instead.
Copy
# Enter your project directory
cd ~/projects/my-project
# Confirm the current directory
pwd
# Check modified, staged, and untracked files
git status
# Show configured remotes
git remote -v
# Show Git configuration
git config --list
Copy
# Stage all changes in the current repository
git add .
# Create a commit
git commit -m "Describe the change"
# Push the current branch to origin
git push origin HEAD
# Push a named branch
git push origin my-feature-branch
Review git status and the staged diff before committing. git add . may include files you did not intend to share; never commit credentials, tokens, private keys, or .env files.
Copy
# Add a remote for your own fork
git remote add origin https://github.com/OWNER/REPOSITORY.git
# Add the original project as an upstream remote
git remote add upstream https://github.com/ORIGINAL_OWNER/REPOSITORY.git
# Change an existing remote URL
git remote set-url origin git@github.com:OWNER/REPOSITORY.git
# Remove a remote (does not delete the remote repository)
git remote remove origin
Use your own repository URL and account. SSH remotes require a working SSH key.
Copy
# Create a virtual environment
python3 -m venv .venv
# Activate it in Bash
source .venv/bin/activate
# Upgrade pip in the active environment
python -m pip install --upgrade pip
# Install a package
python -m pip install PACKAGE_NAME
# Leave the virtual environment
deactivate
For ESPHome or other tools installed in a dedicated environment, activate that environment first, then run the tool. Prefer python -m pip so package installation targets the Python interpreter currently in use.
Copy
# Compile, upload, and run the ESPHome workflow over USB/serial
esphome run esp32.yaml --device /dev/ttyUSB0
# Connect to a device by IP address
esphome run esp32.yaml --device 192.168.1.50
# Follow device logs over the network
esphome logs esp32.yaml --device 192.168.1.50
# Edit the device configuration and secrets
nano esp32.yaml
nano secrets.yaml
Change the configuration filename, serial device, and IP to match your setup. Keep Wi-Fi passwords and API keys in secrets.yaml; do not publish that file.
Copy
# Activate the environment where mppsolar is installed
source ~/venv/mppsolar/bin/activate
# Query general inverter status over a serial adapter
mppsolar --port /dev/ttyUSB0 --protocol PI30 --command QPIGS
The serial port and protocol must match the inverter and adapter. If the port is missing, check ls /dev/ttyUSB /dev/ttyACM and lsusb.
This example illustrates the structure of a scheduled action. Verify component names and priority values against your installed ESPHome component/version before using it.
Copy
time:
- platform: sntp
id: sntp_time
timezone: "PKT-5"
number:
- platform: template
name: "Utility Priority Hour"
id: utility_hour
min_value: 0
max_value: 23
step: 1
initial_value: 10
restore_value: true
mode: box
interval:
- interval: 1min
then:
- if:
condition:
lambda: |-
auto time = id(sntp_time).now();
return time.is_valid() &&
time.hour == id(utility_hour).state &&
time.minute == 0;
then:
- pipsolar.set_output_source_priority:
pipsolar_id: inverter0
priority: UTILITY
- logger.log: "Switched to Utility Priority"
The original notes also contained a second hour selector for battery priority (SBU). Add a separate selector and condition if that is needed in your own configuration.
Run from the ESP-IDF project directory after loading the ESP-IDF environment.
Copy
# Select the target chip (examples: esp32, esp32c3, esp32s3)
idf.py set-target esp32c3
# Open interactive configuration
idf.py menuconfig
# Build firmware
idf.py build
# Save a minimal configuration
idf.py save-defconfig
# Remove intermediate build output
idf.py clean
# Remove the full build directory/configured build state
idf.py fullclean
Copy
# Flash a project to a board connected over serial
idf.py -p /dev/ttyACM0 flash
# Open the serial monitor
idf.py -p /dev/ttyACM0 monitor
# Exit the ESP-IDF monitor
# Press Ctrl+]
Copy
# Confirm ESP-IDF location
echo "$IDF_PATH"
# Check that the path exists
ls -la "$IDF_PATH"
# Find esptool.py under the ESP-IDF installation
find ~/.espressif -name 'esptool.py' 2>/dev/null
# List serial devices
ls /dev/ttyUSB* /dev/ttyACM* 2>/dev/null
Warning: Erasing or writing flash replaces firmware and may erase device settings. Confirm the chip type, port, image, flash layout, and offsets for the exact board before running commands.
Copy
# Example: write a single firmware image at offset 0
esptool --chip esp32s3 --port /dev/ttyACM0 write-flash 0x0 firmware.bin
# Erase the chip (destructive)
esptool --chip esp32s3 --port /dev/ttyACM0 erase-flash
Some older notes use esptool.py and write_flash; newer versions may use esptool and write-flash. Check esptool --help for the installed version. Multi-image firmware bundles need the exact offsets supplied by their build instructions.
This MicroPython example sends a short message to a peer. A WLAN interface must be active, and the peer must be added before sending.
Copy
import network
import espnow
sta = network.WLAN(network.WLAN.IF_STA)
sta.active(True)
# Disconnect from an access point if the application requires it
sta.disconnect()
e = espnow.ESPNow()
e.active(True)
peer = b"\x1c\xdb\xd4\x35\x38\x64" # Replace with the peer's Wi-Fi MAC
e.add_peer(peer)
e.send(peer, b"Starting...")
e.send(peer, b"alive")
e.send(peer, b"end")
Copy
import network
import espnow
sta = network.WLAN(network.WLAN.IF_STA)
sta.active(True)
sta.disconnect()
e = espnow.ESPNow()
e.active(True)
while True:
host, msg = e.recv()
if msg is not None:
print(host, msg)
if msg == b"end":
break
API details can differ by MicroPython port/version. Check the documentation for your board's build.
These are saved project-specific pin maps, not universal defaults. Check the exact board and wiring before powering the display.
| Signal | Wiring set A | Wiring set B |
|---|---:|---:|
| TFT ground control | GPIO 35 | GPIO 4 |
| TFT VCC control | GPIO 36 | GPIO 5 |
| SPI SCK | GPIO 37 | GPIO 6 |
| SPI MOSI | GPIO 38 | GPIO 7 |
| TFT control pins (as passed to constructor) | 40, 39, 41 | 16, 15, 17 |
| Backlight control | GPIO 42 | GPIO 18 |
The original notes initialize SPI at 100 kHz with polarity 0 and phase 0. Confirm voltage/current requirements; powering a module from GPIO pins is only appropriate when the module's current draw is within the board's limits.
Copy
# Detect connected ST-Link hardware
sudo st-info --probe
# Erase the target (destructive)
sudo st-flash erase
# If normal connection fails, attempt connection under reset
sudo st-flash --connect-under-reset erase
# Write an Intel HEX image (confirm target and file first)
sudo st-flash --format ihex write firmware.hex
The following address mapping was recorded for one STM32 IoT board. I²C addresses and device presence depend on the board, wiring, and firmware.
| 7-bit decimal | 7-bit hex | Recorded device |
|---:|---:|---|
| 30 | 0x1E | LIS3MDL magnetometer |
| 41 | 0x29 | VL53L0X time-of-flight sensor |
| 86 | 0x56 | EEPROM / expansion device (board-dependent) |
| 93 | 0x5D | LPS22HB pressure sensor |
| 95 | 0x5F | HTS221 humidity/temperature sensor |
| 106 | 0x6A | LSM6DSL accelerometer/gyroscope |
Some datasheets show an 8-bit read/write address byte rather than a 7-bit I²C address. Those values differ by the read/write bit; do not mix the two formats.
Copy
# Inspect the OpenWebRX container
docker ps -a | grep -i openwebrx
# View its logs
docker logs -f openwebrx
# Check active TCP connections inside the container
docker exec openwebrx ss -tn
# Inspect connections to a known service port inside the container
docker exec openwebrx ss -tnp | grep ':8073'
# Search likely OpenWebRX configuration paths for logging settings
docker exec openwebrx sh -c \
'grep -RniE "log|logging|logfile|logdir" /etc/openwebrx /var/lib/openwebrx 2>/dev/null'
Container paths vary by image. If a command returns no output, inspect the image's actual filesystem and service configuration.
Copy
# Check readsb service status
sudo systemctl status readsb
# Follow an ACARS log inside the OpenWebRX container (if this path exists)
docker exec -it openwebrx tail -f /var/log/acars.json
# Search installed OpenWebRX files for ACARS-related options
docker exec openwebrx sh -c \
'grep -RniE "acarsdec|sndfile|subtype 6" /usr/lib/python3/dist-packages/owrx /etc/openwebrx 2>/dev/null'
Copy
# Show audio and stream variant metadata in an HLS playlist
grep -Ei 'EXT-X-MEDIA|AUDIO|CODECS' stream.m3u8
grep 'EXT-X-STREAM-INF' stream.m3u8
# Download a playlist from a stream you are authorized to inspect
curl -L 'https://example.org/master.m3u8' -o master.m3u8
# Inspect a downloaded media segment
file test.ts
ffprobe test.ts
Use only streams you are authorized to access. Avoid publishing signed URLs, session identifiers, or tokenized media links.
The notes recorded the Debian package repository setup below. Check Cloudflare's current official instructions before using it, because repository keys and installation procedures can change.
Copy
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg \
| sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
sudo apt update
sudo apt install cloudflared
A public tunnel can expose a service to the internet. Review authentication, access policies, and origin-service configuration before publishing a dashboard or receiver.
Download selected playlist items at up to 480p and merge video/audio into MKV:
Copy
yt-dlp \
-f 'bestvideo[height<=480]+bestaudio/best[height<=480]' \
--merge-output-format mkv \
-o '%(playlist_index)02d - %(title)s.%(ext)s' \
'PLAYLIST_URL'
For browser-authenticated content, yt-dlp supports options such as --cookies-from-browser chrome. Use them only for content you are entitled to download, and do not share cookie files or authenticated URLs. Add --playlist-items 1,2,5 to select specific playlist entries.
Copy
# Identify codecs, duration, streams, and container format
ffprobe input.ts
ffprobe input.mkv
Use v4l2-ctl to inspect and change supported webcam controls.
Copy
# List controls and current values for a camera
v4l2-ctl -d /dev/video2 -L
# Set gain (only if this control is supported)
v4l2-ctl -d /dev/video2 --set-ctrl=gain=10
# Set exposure
v4l2-ctl -d /dev/video2 --set-ctrl=exposure=100
# Read a control's current value
v4l2-ctl -d /dev/video2 --get-ctrl=gain
v4l2-ctl -d /dev/video2 --get-ctrl=exposure
# Open the Qt V4L2 control application, if installed
qv4l2
Control ranges vary by camera and driver. Start with -L and use values within the reported minimum and maximum.
Copy
# Identify the session type (e.g. wayland or x11)
echo "$XDG_SESSION_TYPE"
# Identify the desktop environment
echo "$XDG_CURRENT_DESKTOP"
# Show GNOME Shell version
gnome-shell --version
# Find installed GNOME session packages
apt list --installed 2>/dev/null | grep gnome-session
Copy
# See the selected font for Urdu sans-serif and serif families
fc-match 'sans-serif:lang=ur'
fc-match 'serif:lang=ur'
# List candidate fonts for Urdu
fc-match -s ':lang=ur' | head -10
# Inspect Fontconfig configuration
fc-conflist | grep -i urdu
ls -l ~/.config/fontconfig/conf.d/
cat ~/.config/fontconfig/conf.d/45-urdu-nastaliq.xml
# Rebuild the user's font cache
fc-cache -f
# Set GNOME interface/document fonts (if installed)
gsettings set org.gnome.desktop.interface font-name 'Noto Nastaliq Urdu 13'
gsettings set org.gnome.desktop.interface document-font-name 'Noto Nastaliq Urdu 13'
Font family names must match what Fontconfig knows. fc-match is the quickest way to verify which font is actually selected.
Copy
# Show supported sleep modes
cat /sys/power/mem_sleep
# Identify the laptop model
cat /sys/devices/virtual/dmi/id/product_name
# Inspect sleep-related messages from the previous boot
sudo journalctl -b -1 | grep -iE 'suspend|hibernate|sleep|resume'
# Show systemd sleep target state
systemctl status sleep.target suspend.target hibernate.target
The notes recorded an experiment with mem_sleep_default=deep in /etc/default/grub. This is hardware- and firmware-dependent: keep a recovery route, edit GRUB carefully, run sudo update-grub after a change, and test before relying on the machine for unattended work.
Copy
sudo systemctl poweroff # Shut down
sudo systemctl reboot # Reboot
sudo systemctl suspend # Suspend to RAM
sudo systemctl hibernate # Hibernate, if configured
sudo systemctl hybrid-sleep # Hybrid sleep, if supported
sudo systemctl suspend-then-hibernate # Suspend, then hibernate, if configured
Copy
# Resize an image to 32×32 pixels using ImageMagick
magick input.png -resize 32x32 output.png
# Export to SVG using Inkscape (PNG input remains raster content in an SVG wrapper)
inkscape --export-type=svg output.png
# Compress a file with gzip
gzip output.png
# Encode a file as one line of Base64 text
base64 -w 0 output.svg > output.txt
Base64 is an encoding, not encryption. Do not use it to protect secrets. SVG made from a PNG may simply embed the raster image rather than vectorize it.
Copy
# Search a model cache for a specific GGUF file
find ~/.cache/huggingface/hub -name 'MODEL_NAME.gguf' 2>/dev/null
Copy
# Run a local GGUF model with a prompt
./llama-cli -m MODEL.gguf -p 'Write a short explanation of Linux processes.'
# Start a local inference server
./llama-server -m MODEL.gguf -c 2048
Run these from the directory containing the compiled binaries, or provide their full paths. Model names and options vary by llama.cpp version; use llama-cli --help and llama-server --help.
Copy
CMAKE_ARGS='-DGGML_NATIVE=ON -DGGML_OPENMP=ON' \
pip install llama-cpp-python --force-reinstall --no-cache-dir
Run inside the intended virtual environment. A source build can take time and may require C/C++ build tools.
The original notes include product-page examples and scraper requirements. The following is a cleaned checklist suitable for designing a crawler.
| Field | Meaning |
|---|---|
| store | Store/domain being crawled |
| product_id | Store's SKU or product identifier |
| product_name | Product title |
| brand_name | Brand label, if present |
| brand_address | Brand/store link, if present |
| categories | Category path or breadcrumb |
| new_price | Current selling price |
| old_price | Previous/list price, if available |
| stock_availability | In-stock/out-of-stock indicator, if available |
| stock_count | Quantity, only when explicitly exposed |
| product_image | First suitable product image URL |
| product_url | Canonical product page URL |
Normalize URLs before comparing them; remove fragments and handle query parameters deliberately.
Keep a persistent visited-URL set so already-visited pages are not crawled again.
Batch writes to the visited file (the original notes suggested writing every 1,000 entries) to reduce disk I/O.
Stop extracting navigation links once a page has been classified as a product page.
Support breadth-first search (BFS) and depth-first search (DFS); use BFS as a sensible default.
Save output incrementally so a crash does not lose the entire crawl.
Respect the site's terms, robots instructions, rate limits, and applicable law. Do not bypass authentication or access controls.
Product pages may expose SKU, title, price, and image in HTML metadata or JSON-LD. Prefer structured data where available, and verify extracted values against the rendered product page. The notes contain store URLs for research; check current availability and policies before crawling.
The resonant frequency of an ideal LC circuit is:
\[ f = \frac{1}{2\pi\sqrt{LC}} \]
where \(L\) is inductance in henries and \(C\) is capacitance in farads.
Recorded example component values:
Antenna coil: approximately 0.30 mH (300 µH)
Oscillator coil: approximately 0.37 mH (370 µH)
Antenna tuning capacitor: up to 90 pF
Oscillator tuning capacitor: up to 60 pF
Example minimum capacitance used in the notes: approximately 15 pF
Approximate frequency range depends on the actual minimum/maximum capacitance, coil tolerance, parasitic capacitance, and circuit layout. Treat saved frequency calculations as estimates, not calibrated measurements.
This YAML fragment shows four inverter battery sensors in a vertical stack. Entity IDs must exist in your Home Assistant instance.
Copy
type: grid
cards:
- type: vertical-stack
cards:
- type: heading
heading: Battery
heading_style: title
icon: mdi:battery-50
- type: entities
entities:
- entity: sensor.esphome_inverter_battery_capacity
- entity: sensor.esphome_inverter_battery_charging_a
- entity: sensor.esphome_inverter_battery_discharge_a
- entity: sensor.esphome_inverter_battery_volts
The source notes contained live-looking credentials, access tokens, Wi-Fi passwords, API keys, device secrets, private-network details, personal phone numbers, and contact/address information. Those values are intentionally omitted from this shareable edition. Do not paste them into a public repository or community post.
Wi-Fi SSIDs/passwords and router/ONT administrator credentials
Home Assistant long-lived access tokens and backup tokens
Sinric Pro app keys, app secrets, device IDs, and similar service credentials
ThingSpeak write API keys and other API tokens
Device serials/secrets, signed stream URLs, session cookies, and authentication headers
Personal phone numbers, postal addresses, and private contact details
Private hostnames, internal IP/MAC mappings, and detailed network topology when they could identify or expose a private system
Rotate/revoke exposed credentials that are still valid: Home Assistant tokens, Wi-Fi/router passwords, API keys, and service secrets.
Replace secrets in code with environment variables or a secrets file excluded from version control.
Add .env, secrets.yaml, token files, and private key files to .gitignore.
Review Git history if a secret was committed; deleting it from the latest file alone does not remove it from history.
Keep a separate private vault or encrypted copy for values you genuinely need to retain.
Example .gitignore entries:
Copy
.env
.env.*
secrets.yaml
*.token
*.secret
*.pem
*.key
These patterns are examples; adapt them to the repository. Do not commit actual passwords or tokens in this cheatsheet.
| Device path | Typical use |
|---|---|
| /dev/ttyUSB0 | USB-to-serial adapter; device number may vary |
| /dev/ttyACM0 | USB CDC serial device; device number may vary |
| /dev/video2 | V4L2 camera device; number may vary |
| /dev/hidraw* | Raw HID devices, such as some tablets/controllers |
List the available paths after connecting hardware; never assume the same device number will persist across reboots.
| Tool | Typical purpose |
|---|---|
| htop, btop | Process and resource monitoring |
| iotop | Disk I/O by process |
| ncdu | Interactive disk-usage inspection |
| tmux | Persistent terminal sessions |
| curl | HTTP requests and downloads |
| jq | Parse and query JSON |
| rsync | Efficient file synchronization |
| iw, nmcli | Wireless/network diagnostics |
| tcpdump | Packet capture for authorized troubleshooting |
| nmap | Network discovery and service auditing on systems you own or are authorized to test |
| ffprobe | Inspect media files and streams |
| v4l2-ctl | Inspect and configure V4L2 devices |
| esptool | ESP-family firmware flashing |
| idf.py | ESP-IDF project configuration/build/flash |