OpenWrt on Ubiquiti EdgeRouter X SFP with working SFP module

ER-X-SFP OpenWRT21 DSA Distributed Network Switch

The EdgeRouter X-SFP is a quite powerful dualcore (880Mhz, 256MB RAM, 256MB flash) device powered by a MediaTek MT7621AT SoC. OpenWrt 21 (snapshot) comes with support for the SFP slot (attached to the switch port eth5 via RGMII). Note: it won’t work with OpenWrt 19! Custom build# As of April 2021 it requires a custom […]

MikroTik CRS112 Basic switching setup

CRS112-8G-4S-IN CRS112-8P-4S-IN

The MikroTik CRS switches are absolutely awesome! You get a full featured, managed, wire speed switch combined with a SoC running RouterOS.But on the “downside” the configuration can be very complex and requires some deeper knowledge about switching and linux networking in general – as a linux user you will love it ;) Step 1 […]

Hetzner Cloud: Predictable Network Interface Names

ens3 ens10 ens11 ens12 enp1s0 enp7s0 enp8s0 enp9s0

With the release of the new AMD EPYC based cloud servers (CPX), Hetzner has applied some changes to their virtualization platform (QEMU). The network interface names have changed due to the modern virtio_net network adapter 0x1041 including different pcie bus addresses. All Hetzner standard images are now using the net.ifnames=0 setting to enforce the kernel […]

gnugp is very useful to encrypt files using a public key – this allows you to create backups without sharing a keyfile. But it’s a bit tricky to explicitly use a public-keyfile instead of the global keyring via fingerprint. Directory Structure# This script creates a custom .gnupg directory (gpg home) in the current working directory […]

Traefik: tls private key does not match public key

self signed certificates, combined pem

In case you’re using self-signed x509 certificates you may see this error message within the traefik logs – the solution is quite easy: the first certificate of your combined pem file (ca+intermediate+server) has to be the server certificate!

These days, some cloud hosting environments still didn’t offer dhcp6 services (for example Hetzner Cloud) – therefore it’s impossible to use an automated ipv6 configuration with iPXE. But a static configuration can still be used: File: config.ipxe#

BusyBox: fancy cli color prompt via PS1

busybox ps1 profile colors

PS1 magic# The default prompt of BusyBox ash shell looks a bit old fashioned . But thanks to nearly full support of the PS1 environment variable you can customize the prompt to match your needs. Customizing the PS1 variable is quite simple: just add /etc/profile which is read automatically by ash when it’s used as […]

Install Debian Stretch 10 on HPE Microserver GEN10 | Update

microserver, amd, opteron, x3216 x3418 x3421

Pure DEBIAN :)#

The HPE Microserver GEN10 is an impressive piece of rock-solid hardware. Of course… ILO is missing compared to GEN8 but for most use-cases thats not a real issue.

Debian buster runs nearly out-of-the-box using the netinstall image via USB Stick or network boot. The following tweaks are required to run it flawlessly:

No Graphics after running the installer#

The firmware package firmware-linux-nonfree is required for the AMD APU. Adding “nomodeset” to kernel command line may also work as mentioned on

IOMMU Error#

You may notice a iommu error on boot: the iommu is disabled by default – to enable it add the following parameters to your grub config:

File: /etc/default/grub

GRUB_CMDLINE_LINUX="amd_iommo=on iommu=pt"

Run update-grub2 to apply the changes and reboot the system – press F2 within the boot menu and to open the BIOS/UEFI menu. The iommu has to be enabled in Chipset -> GFX Configuration -> IOMMU.

In case you didn’t run any VMs on the maschine consider to keep iommu disabled – otherwise the SATA ports (Marvell 88SE9230) on the front become unusable!


Just FYI

 # cat /proc/cpuinfo 
processor	: 0
vendor_id	: AuthenticAMD
cpu family	: 21
model		: 96
model name	: AMD Opteron(tm) X3418 APU
stepping	: 1
microcode	: 0x600611a
cpu MHz		: 1300.000
cache size	: 1024 KB
physical id	: 0
siblings	: 4
core id		: 0
cpu cores	: 2
apicid		: 16
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good acc_power nopl nonstop_tsc extd_apicid aperfmperf pni pclmulqdq monitor ssse3 fma cx16 sse4_1 sse4_2 movbe popcnt aes xsave avx f16c rdrand lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs xop skinit wdt lwp fma4 tce nodeid_msr tbm topoext perfctr_core perfctr_nb bpext ptsc mwaitx cpb hw_pstate ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 xsaveopt amd_ibpb arat npt lbrv svm_lock nrip_save tsc_scale vmcb_clean flushbyasid decodeassists pausefilter pfthreshold avic overflow_recov
bugs		: fxsave_leak sysret_ss_attrs null_seg spectre_v1 spectre_v2 spec_store_bypass
bogomips	: 3593.06
TLB size	: 1536 4K pages
clflush size	: 64
cache_alignment	: 64
address sizes	: 48 bits physical, 48 bits virtual
power management: ts ttp tm 100mhzsteps hwpstate cpb eff_freq_ro acc_power [13]

Power consumption#

  • IDLE: about 15Watt with a weak powerfactor of ~0.41 (sata boot ssd; no hdd)

Cryptsetup benchmark#

# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1       798003 iterations per second for 256-bit key
PBKDF2-sha256    1126290 iterations per second for 256-bit key
PBKDF2-sha512    1038194 iterations per second for 256-bit key
PBKDF2-ripemd160  529049 iterations per second for 256-bit key
PBKDF2-whirlpool  373424 iterations per second for 256-bit key
argon2i       4 iterations, 638239 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
argon2id      4 iterations, 639177 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
#     Algorithm |       Key |      Encryption |      Decryption
        aes-cbc        128b       532.4 MiB/s      1417.2 MiB/s
    serpent-cbc        128b        68.2 MiB/s       231.7 MiB/s
    twofish-cbc        128b       128.6 MiB/s       203.6 MiB/s
        aes-cbc        256b       429.0 MiB/s      1177.7 MiB/s
    serpent-cbc        256b        78.3 MiB/s       234.3 MiB/s
    twofish-cbc        256b       138.3 MiB/s       204.9 MiB/s
        aes-xts        256b       848.9 MiB/s       853.7 MiB/s
    serpent-xts        256b       246.4 MiB/s       227.9 MiB/s
    twofish-xts        256b       195.3 MiB/s       202.2 MiB/s
        aes-xts        512b       760.8 MiB/s       769.9 MiB/s
    serpent-xts        512b       247.6 MiB/s       227.3 MiB/s
    twofish-xts        512b       193.9 MiB/s       201.1 MiB/s

Gitea 1.5 on MariaDB 10.1

utf8mb4_general_ci; specified key was too long; max key length is 767 bytes

Error Messages#

In case you’ve tried to upgrade to Gitea 1.4 or 1.5 on Debian 9 with MariaDB 10.1 the following error messages will thrown to your log and the service won’t start:

[...itea/routers/init.go:60 GlobalInit()] [E] Failed to initialize ORM engine: migrate: 
do migrate: Sync2: Error 1071: Specified key was too long; max key length is 767 bytes


The issue is caused by the newly introduced charset utf8mb4_general_ci which is set to default in Gitea >=1.4. This charset requires 4 bytes per character and the indexes on utf8mb4_general_ci fields (varchar 255) won’t fit into the InnoDB scheme.


The only reliable solution is an upgrade to MariaDB 10.2 or 10.3. Just changing settings like innodb_large_prefix=1 or innodb_file_format=Barracuda as mentioned on several sites won’t have any effect to existing tables.


I’ve used a legacy version of Gitea (1.2.3) for a long time which was created initially as utf8_general_ci scheme. Therefore i’ve decided to alter the table + field charsets manually via phpmyadmin and set them to utf8_general_ci.

You have to run the upgrade procedure (start gitea executable) a several time because new tables are not created at once (repeat it 3..5 times).

Finally it works but i’m not sure if there will be any side effects in the future..

Netgear GS108Ev3 Firmware Upgrade failed

switch stocks in bootloader mode, timeout, linux, debian, ubuntu

Upgrading a Netgear switch can be very annoying…i’ve recently bought a second GS108Ev3 and wanted to upgrade the firmware initially but the switch stocks in bootloader mode (still web accessible on By running the upgrade via Firefox or Chromium on Debian the firmware upload stops at ~7% with a timeout error. Same issue with tftp.


Use a Windows Machine (Win 10) + Google Chrome Browser and run the firmware upgrade procedure via web interface on – this will even work in case the Netgear ProSAFE Configuration utility throws a timeout error. VERY WEIRD!

Overall the (first) switch performs very well over the last few years and draws very low power – a great SOHO product with VLAN capabilities (PVID/Tagged/Untagged) but the firmware needs a makeover..