The problem

On Fedora Silverblue or Bluefin, /usr is immutable. That's great — until you want a small tool that isn't a Flatpak and isn't worth layering a package (and rebooting) for. A CLI helper, a GNOME extension, a firewall daemon with a settings app… you end up with a pile of git clone && ./install.sh and nothing that keeps it updated.

The idea

An app is just a git repo with two files in its root: a kiwi.manifest describing it and an install.sh that installs it. A catalog is just a git repo with a list of app URLs. kiwi reads the catalogs, clones an app, checks out its latest release tag, runs the installer — and then keeps it updated in the background, itself included.

No accounts, no store, no vendor. A catalog is something you can read, fork and send a pull request to.

Getting started

# recommended on a desktop: user scope + root-owned system scope, one password prompt
curl -fsSL https://raw.githubusercontent.com/derlocke-ng/kiwi-updater/main/get-kiwi.sh | bash -s -- --with-system

kiwi catalog add https://github.com/derlocke-ng/kiwi-catalog.git
kiwi list
kiwi install kiwi-killswitch

Don't want anything outside your home directory? Drop --with-system: the minimal install is 100 % ~/.local, no root, no password, ever. That covers every app that is only files in your home. Prefer clicking? Kiwi Apps shows up in your app grid: search, filter and inspect everything in your catalogs.

Apps with a root half

Some apps are a binary in ~/.local/bin. Others — like kiwi-killswitch — are a root firewall daemon and a desktop app and a GNOME extension. The manifest simply says so:

COMPONENTS=daemon cli gui gnome-extension
SCOPES=user system
ROOT_REASON=installs a root firewall daemon, its D-Bus policy and two systemd units

kiwi installs each half where it belongs: user parts in ~/.local, system parts cloned as root into /var/lib, because root must never execute a file the user can write. Before it asks for your password, it tells you what the password is for — that's the ROOT_REASON line. Updating a system app afterwards needs no password at all: a single polkit-gated helper only updates apps the administrator already installed.

You decide what runs

Installing an app runs its install.sh, as root if it has a system half. Catalogs are curated, not audited, so kiwi gives you the tools to look first:

kiwi info --installer <app>  # the exact script an install would run
kiwi diff <app>              # what an update would change, installer included
kiwi pin <app> v1.2.0        # stay on a version until you say otherwise
kiwi install <app> --dry-run # show what would happen, do nothing
kiwi doctor                  # stale locks, version skew, broken lists, timers

Releases are git tags shaped like v1.2.3, so a pre-release or a scratch tag is never picked up by accident.

What's in the catalog

Building something open source that works without an account, a subscription or a tracker? Add a kiwi.manifest and an install.sh, tag a release and send a PR to kiwi-catalog.

Where it stands

kiwi-updater is at 1.7.2. Three full audits went into the 1.x releases, and the changelog documents what each one found and fixed. Still on the roadmap: a registry of trusted catalogs, and signature verification of release tags.

Everything is GPL-3.0-or-later and on GitHub. Issues, ideas and catalog PRs are very welcome. 🥝

Choosing a Distro

Don't overthink it. Here's my recommendation:

• Complete beginner? → Linux Mint or Ubuntu
• Want to learn? → Fedora or openSUSE
• Already comfortable? → Arch, Debian, or whatever you want

First Steps After Install

# Update everything first
sudo apt update && sudo apt upgrade -y  # Debian/Ubuntu
sudo dnf upgrade -y                      # Fedora
sudo pacman -Syu                         # Arch

# Install essential tools
sudo apt install git curl vim htop neofetch

Learn the Terminal

The terminal is your friend. Start with these:

Resources

• ArchWiki — Best documentation, works for any distro
• Linux Journey — Interactive learning
• /r/linux4noobs — Friendly community

"The best way to learn Linux is to break things and fix them." — Every sysadmin ever

More tutorials coming soon. Happy hacking! 🐧

Why Proxmox?

• Free and open source
• Type 1 hypervisor (runs on bare metal)
• Supports VMs and LXC containers
• Web-based management
• Great community

Hardware Requirements

You don't need fancy hardware. I started with:

- Old Dell Optiplex (i5-4590)
- 32GB RAM (upgraded from 8GB)
- 256GB SSD for OS
- 2TB HDD for storage

Any x86_64 machine with VT-x/AMD-V support works.

Installation

1. Download ISO from proxmox.com
2. Flash to USB with dd or Balena Etcher
3. Boot and follow the installer
4. Access web UI at https://your-ip:8006

# After install, fix the enterprise repo nag
# Edit /etc/apt/sources.list.d/pve-enterprise.list
# Comment out the enterprise repo, add:
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

My Current VMs/Containers

Tips

• Backups: Use Proxmox Backup Server or simple vzdump
• Networking: Set up a bridge, consider VLANs
• Storage: ZFS is great if you have the RAM
• Templates: Create LXC templates for quick deployments

Resources

• Proxmox Wiki
• r/homelab
• Techno Tim on YouTube

Happy homelabbing! 🖥️

The Background

Life's been... interesting. Without going into too much detail, the past few years have been rough. Health issues, job changes, the usual chaos that comes with existing in this world.

But here's the thing — through it all, a few things kept me sane:

1. Tinkering with tech — Nothing clears my head like debugging a server at 2 AM
2. Growing plants — There's something meditative about watching things grow
3. Writing — Even if nobody reads it, getting thoughts out helps

Why This Blog?

I've consumed so much free knowledge from random blogs and forums over the years. Time to give back.

Plus, I needed a project. Something to focus on that isn't doom-scrolling or worrying about things I can't control.

What to Expect

• Tutorials when I figure something out
• Rants when things don't work
• Personal updates occasionally
• No schedule, no pressure

A Note on "Shitty Life"

Yeah, I mentioned that in the blog description. Life can be hard. Mental health is a real thing. If you're struggling, you're not alone.

I'm not here to give advice I'm not qualified to give. But I will say: find your thing. Whether it's tech, gardening, gaming, whatever — having something to focus on helps.

Anyway, that's enough feelings for one post. Back to technical stuff next time.

Stay safe out there. 🤙

Why WireGuard?

• Fast — Much better performance than OpenVPN
• Simple — Minimal codebase, easy to audit
• Modern crypto — ChaCha20, Curve25519, etc.
• Cross-platform — Linux, Windows, macOS, iOS, Android

Server Setup (Debian/Ubuntu)

# Install WireGuard
sudo apt install wireguard

# Generate keys
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
chmod 600 /etc/wireguard/privatekey

# Create config
sudo nano /etc/wireguard/wg0.conf

Server Config (/etc/wireguard/wg0.conf)

[Interface]
PrivateKey = <server-private-key>
Address = 10.0.0.1/24
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# Client 1
PublicKey = <client-public-key>
AllowedIPs = 10.0.0.2/32

Enable IP Forwarding

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Start WireGuard

sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0

Client Config

[Interface]
PrivateKey = <client-private-key>
Address = 10.0.0.2/24
DNS = 10.0.0.1  # Use your Pi-hole!

[Peer]
PublicKey = <server-public-key>
Endpoint = your-domain.com:51820
AllowedIPs = 0.0.0.0/0  # Route all traffic through VPN
PersistentKeepalive = 25

Tips

• Port forwarding: Open UDP 51820 on your router
• Dynamic DNS: Use DuckDNS or similar if you don't have a static IP
• Multiple devices: Just add more [Peer] sections

My Setup

I run WireGuard in an LXC container on Proxmox. Works perfectly. I can access my home network from anywhere, securely.

On a Silverblue or Bluefin laptop, pair the client side with kiwi-killswitch: a fail-closed firewall that only lets traffic out through your WireGuard tunnel, so nothing leaks when the VPN drops.

Questions? Hit me up. Stay secure! 🔐