10 files changed, 140 insertions, 26 deletions
diff --git a/etc/myconf/cfgl_meta b/etc/myconf/cfgl_meta
index f1057d90..cabc5185 100644
--- a/etc/myconf/cfgl_meta
+++ b/etc/myconf/cfgl_meta
@@ -29,8 +29,7 @@
 777 root root //etc/resolv.conf
 644 root root //etc/services
 755 root root //etc/ssh
-755 root root //etc/ssh/ssh_config.d
-644 root root //etc/ssh/ssh_config.d/my_ssh_config.conf
+644 root root //etc/ssh/sshd_config
 440 root root //etc/sudoers
 755 root root //etc/systemd
 755 root root //etc/systemd/system
diff --git a/etc/nftables.conf b/etc/nftables.conf
index c26ae020..480298a3 100644
--- a/etc/nftables.conf
+++ b/etc/nftables.conf
@@ -20,7 +20,7 @@ table inet my_table {
 		ip protocol icmp accept
 		meta l4proto ipv6-icmp accept
 
-		#tcp dport ssh accept
+		iifname wg_* tcp dport ssh accept
 		#tcp dport qbt-nox accept
 		#tcp dport searx accept
 		tcp dport qrcp accept
diff --git a/etc/services b/etc/services
index 84b829e6..57bd667f 100644
--- a/etc/services
+++ b/etc/services
@@ -11525,9 +11525,6 @@ ai-webui        7860/tcp
 monerod-p2p     18080/tcp
 qrcp            49153/tcp
 wireguard       49432/udp
-# My ISP verizon block incomming to gateway port 22. So I need to use another port to ssh into my home server.
-# https://www.reddit.com/r/verizon/comments/to1q43/verizon_5g_home_internet_blocking_ssh_service_port/
-ssh-isp         49812/tcp
 iperf3          53497/tcp
 # qemu port forward guest windows virtual machine ssh
 qemu-win-ssh    53683/tcp
diff --git a/etc/ssh/ssh_config.d/my_ssh_config.conf b/etc/ssh/ssh_config.d/my_ssh_config.conf
deleted file mode 100644
index a5f1fca3..00000000
--- a/etc/ssh/ssh_config.d/my_ssh_config.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-Host flylightning.xyz
-	Port ssh-isp
diff --git a/etc/ssh/sshd_config b/etc/ssh/sshd_config
new file mode 100644
index 00000000..6a9a4670
--- /dev/null
+++ b/etc/ssh/sshd_config
@@ -0,0 +1,131 @@
+# `man sshd_config` says "for each keyword, the first obtained value will be used". So I decided to put my configs before all others to override them all.
+# Based on manpage, setting PasswordAuthentication no, and Arch Linux default KbdInteractiveAuthentication no, with other defaults seems already equivalent to AuthenticationMethods publickey, but I still put it here for redundancy.
+# https://wiki.archlinux.org/title/OpenSSH#Force_public_key_authentication
+AuthenticationMethods publickey
+PermitRootLogin no
+PasswordAuthentication no
+# KbdInteractiveAuthentication no and UsePAM yes are Arch Linux default settings see /etc/ssh/sshd_config.d/00-archlinux.conf, I need these configs, I put them here just in case Arch Linux change the defaults in the future.
+KbdInteractiveAuthentication no
+UsePAM yes
+# when ssh into this remote server, client if use alacritty need `SendEnv COLORTERM` to send the env to server, so server ls can default output color, more see comments in my alacritty.toml config
+AcceptEnv COLORTERM
+
+# Include drop-in configurations
+Include /etc/ssh/sshd_config.d/*.conf
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to "no" here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+
+# Change to "no" to disable keyboard-interactive authentication.  Depending on
+# the system's configuration, this may involve passwords, challenge-response,
+# one-time passwords or some combination of these and other methods.
+#KbdInteractiveAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the KbdInteractiveAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via KbdInteractiveAuthentication may bypass
+# the setting of "PermitRootLogin prohibit-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and KbdInteractiveAuthentication to 'no'.
+#UsePAM no
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/ssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server
diff --git a/home/xyz/.bashrc b/home/xyz/.bashrc
index a0079d19..4a0ec27d 100644
--- a/home/xyz/.bashrc
+++ b/home/xyz/.bashrc
@@ -100,9 +100,6 @@ alias se='sudo -E '
 alias sp='ssh pp'
 alias spd='speedtest; librespeed-cli'
 alias sst='ssh studio'
-# \" to consider $HOME contain space, need \ else " will be expanded locally, need \$ else $HOME will expand locally
-# can test with: alias mytest='ssh studio for i in \"\$SSH_CONNECTION\"\; do echo \$i\; echo a\; done'
-alias sstm='ssh -t -- studio mpra -c \"\$HOME/programs/repos/fly/any/fsh-git\"'
 # can test this mess with `alias tt='echo "\$haha \"lala\""'`
 alias sun='printf "set \$Longitude \"-121.89\"\nset \$Latitude \"37.34\"\nrem [sunrise()] msg sunrise\nrem [sunset()] msg sunset" | remind -n -'
 # another way:
diff --git a/home/xyz/.config/myconf/pacman_Qqne b/home/xyz/.config/myconf/pacman_Qqne
index 24a258ba..df68d1c5 100644
--- a/home/xyz/.config/myconf/pacman_Qqne
+++ b/home/xyz/.config/myconf/pacman_Qqne
@@ -58,6 +58,7 @@ gimp
 git
 git-filter-repo
 git-lfs
+gitolite
 glib2-devel
 glib2-docs
 glmark2
@@ -85,6 +86,8 @@ isync
 java-commons-lang
 jdk-openjdk
 jq
+kicad
+kicad-library
 krita
 ladspa
 lf
diff --git a/home/xyz/.config/qrcp/config.json b/home/xyz/.config/qrcp/config.json
index 171909ef..63955990 100644
--- a/home/xyz/.config/qrcp/config.json
+++ b/home/xyz/.config/qrcp/config.json
@@ -1,6 +1,6 @@
 {
   "fqdn": "",
-  "interface": "enp3s0",
+  "interface": "wlp2s0",
   "keepalive": false,
   "output": "",
   "path": "",
@@ -8,4 +8,4 @@
   "secure": false,
   "tls-cert": "",
   "tls-key": ""
-}
-\ No newline at end of file
+}
diff --git a/home/xyz/.config/redshift/redshift.conf b/home/xyz/.config/redshift/redshift.conf
index fe035733..da9ff5ed 100644
--- a/home/xyz/.config/redshift/redshift.conf
+++ b/home/xyz/.config/redshift/redshift.conf
@@ -57,8 +57,8 @@ adjustment-method=randr
 ; Keep in mind that longitudes west of Greenwich (e.g. the Americas)
 ; are negative numbers.
 [manual]
-lat=31.322
-lon=120.985
+lat=31.38
+lon=120.95
 
 ; Configuration of the adjustment-method
 ; type 'redshift -m METHOD:help' to see the settings.
diff --git a/home/xyz/.ssh/config b/home/xyz/.ssh/config
index 00cc0198..e05aa8b0 100644
--- a/home/xyz/.ssh/config
+++ b/home/xyz/.ssh/config
@@ -6,13 +6,6 @@ AddKeysToAgent yes
 # more see alacritty.toml config
 SendEnv COLORTERM
 
-# tabs and empty only for readability, without also works, not sure about newline
-Host studio
-	Hostname flylightning.xyz
-	Port ssh-isp
-	User xyz
-	AddressFamily inet
-
 Host pp
 	Hostname xyzpp
 	User xyz
@@ -45,10 +38,6 @@ Host ib
 	User xyz
 	AddressFamily inet6
 
-Host ru
-	Hostname ru.flylightning.xyz
-	User xyz
-
 Host ba
 	Hostname ba.flylightning.xyz
 	User xyz