Search the Community

Full root filesystem encryption on an Armbian system (new, fully rewritten, replaces my earlier tutorial on this topic) MMGen (https://github.com/mmgen) This tutorial provides detailed, step-by-step instructions for setting up full root filesystem encryption on an Armbian system. The disk can be unlocked remotely via SSH or the serial console, permitting unattended bootup. An automated script that performs the same steps, saving you much time and effort, can be found at https://github.com/mmgen/mmgen-geek-tools Note that unlike my earlier tutorial all steps are performed within a running Armbian system. The tutorial is known to work with the following board/image combinations: Orange Pi PC2 Debian Buster mainline / Ubuntu Bionic and Focal legacy RockPi 4 Debian Buster mainline / Ubuntu Bionic and Focal legacy RockPro 64 Ubuntu Focal mainline Odroid HC4 Debian Buster mainline / Ubuntu Focal mainline You may have success with other boards/images too. If so, please post the details below (or open an issue in the mmgen-geek-tools Github repository), and I’ll add your board to the list. Requirements: A SoC with a running, upgradeable and Internet-connected Armbian system A blank Micro-SD card and USB card reader, or, alternatively, an eMMC installed on the board The ability to edit text files and do simple administrative tasks on the Linux command line Step 1 - Preliminaries All steps in this tutorial are performed as root user on a running Armbian system (the “host”). The encrypted system (the “target”) will be created on a blank micro-SD card (the “target device”). If the board has an eMMC, it may be used as the target device instead of an SD card. Depending on your platform, you may need to run “armbian-config” and select “Install to internal storage” -> “Install/Update the bootloader on eMMC” to enable booting from the eMMC. Architecture of host and target (e.g. 64-bit or 32-bit ARM) must be the same. For best results, the host and target hardware should also be identical or similar. Building on a host with more memory than the target, for example, may lead to disk unlocking failure on the target. If you’re building the target system for the currently running board and with the currently running image, which is the recommended approach, the two preceding points will be a non-issue. Packages will be installed using APT, so the host machine must be Internet-connected and its clock correctly set. Step 2 - Upgrade your system and install the cryptsetup package # apt update && apt upgrade # apt install cryptsetup Step 3 - Get and unpack the latest Armbian image for your board Create your build directory: # mkdir armbenc-build && cd armbenc-build Download the Armbian image of your choice for your board, place it in this directory and unpack: # xz -dv *.img.xz Step 4 - Create mount directories and set up the loop mount Create the mount directories: # mkdir -p mnt boot root Determine your first free loop device: # losetup -f Associate the image file with the loop device name displayed by the previous command. This will be '/dev/loop0' in most cases, but if your output was different, substitute that for '/dev/loop0' in the following steps. # losetup -P /dev/loop0 *.img Examine the disk image using fdisk on the loop device: # fdisk -l /dev/loop0 The output should look something like this: Device Boot Start End Sectors Size Id Type /dev/loop0p1 32768 3489791 3457024 1.7G 83 Linux Make a note of the start sector (32768 in this case). You’ll need this value in the steps below. Now mount the loop device: # mount /dev/loop0p1 mnt Step 5 - Copy the boot loader to the target device If applicable, insert a blank micro-SD card and card reader into a USB port. Determine the target device name using 'dmesg' or 'lsblk'. We’ll assume it to be '/dev/sda', since that’s the most likely case. If your device name is different, substitute it for '/dev/sda' in the the following steps. For an eMMC, the device name will be something like '/dev/mmcblk1'. WARNING: if '/dev/sda' refers to some other storage device, running the following commands unchanged will destroy data on that device, so always remember to substitute the correct device name!!! The best way to eliminate this danger is to disconnect all unused storage devices on the board before proceeding further. Copy the image’s boot loader to the target device, using the Start sector value from Step 4 as the argument for 'count': # dd if=$(echo *.img) of=/dev/sda bs=512 count=32768 Step 6 - Partition the target device # fdisk /dev/sda At the fdisk prompt, create a new DOS disk label with the 'o' command. Use the 'n' command to create a primary partition of size +200M beginning at the same Start sector as the disk image. Type 'p' to view the partition table, which should now look something like this: Device Boot Start End Sectors Size Id Type /dev/sda1 32768 442367 409600 200M 83 Linux Use 'n' again to create another primary partition beginning one sector after the first partition’s end sector and filling the remainder of the card. Type 'p' once more to view the partition table: Device Boot Start End Sectors Size Id Type /dev/sda1 32768 442367 409600 200M 83 Linux /dev/sda2 442368 30636031 30193664 14.4G 83 Linux Ensure that the first partition’s Start sector matches that of the disk image (32768 in this example) and that the second partition’s Start sector is one greater than the End sector of the first (442368 and 442367, respectively, in this example). If you’ve made a mistake, use 'd' to delete a partition and start again. Once everything looks correct, type 'w' to write the partition table to disk. Step 7 - Copy the system to the target device The following commands will create a filesystem on the target device’s boot partition and copy the boot partition data from the image file to it. Don’t forget to substitute the correct device name if necessary. If you’re building the system on an eMMC, the boot partition device will be something like '/dev/mmcblk1p1' instead of '/dev/sda1'. # mkfs.ext4 /dev/sda1 # or '/dev/mmcblk1p1', for an eMMC target # e2label /dev/sda1 CRYPTO_BOOT # mount /dev/sda1 boot # cp -av mnt/boot/* boot # (cd boot; ln -s . boot) Create the encrypted root partition. When prompted for a passphrase, it’s advisable to choose an easy one like 'abc' for now. The passphrase can be changed later with the 'cryptsetup luksChangeKey' command (type 'man cryptsetup' for details) once your encrypted system is up and running. # cryptsetup luksFormat /dev/sda2 # or '/dev/mmcblk1p2', for an eMMC target Activate the encrypted root partition and create a filesystem on it: # cryptsetup luksOpen /dev/sda2 rootfs # enter your passphrase from above # mkfs.ext4 /dev/mapper/rootfs Mount the encrypted root partition and copy the system to it: # mount /dev/mapper/rootfs root # (cd mnt && rsync -a --info=progress2 --exclude=boot * ../root) # sync # be patient, this could take a while # mkdir root/boot # touch root/root/.no_rootfs_resize Unmount the boot partition and image and free the loop device: # umount mnt boot # losetup -d /dev/loop0 Step 8 - Prepare the target system chroot # BOOT_PART=($(lsblk -l -o NAME,LABEL | grep CRYPTO_BOOT)) # ROOT_PART=${BOOT_PART%1}2 # ROOT_UUID="$(lsblk --nodeps --noheadings --output=UUID /dev/$ROOT_PART)" # BOOT_UUID="$(lsblk --noheadings --output=UUID /dev/$BOOT_PART)" # cd root # mount /dev/$BOOT_PART boot # mount -o rbind /dev dev # mount -t proc proc proc # mount -t sysfs sys sys Copy '/etc/resolv.conf' and '/etc/hosts' so you’ll have a working Internet connection within the chroot: # cat /etc/resolv.conf > etc/resolv.conf # cat /etc/hosts > etc/hosts If you’re using non-default APT repositories, you may need to copy their configuration files as well so that 'apt update' and 'apt install' will use them inside the chroot. Note that you can only do this if the host and target systems have the same distro/version. If that’s not the case, you’ll have to edit the target files by hand. # cat /etc/apt/sources.list > etc/apt/sources.list # cat /etc/apt/sources.list.d/armbian.list > etc/apt/sources.list.d/armbian.list If you’re using an apt proxy, then copy its configuration file too: # cp /etc/apt/apt.conf.d/*proxy etc/apt/apt.conf.d/ Step 9 - Edit or create required configuration files in the target system Perform the editing steps below using a text editor of your choice: If the file 'boot/armbianEnv.txt' exists, edit it so that the 'rootdev', 'console' and 'bootlogo' lines read as follows. If you’ll be unlocking the disk via the serial console, then use 'console=serial' instead of 'console=display'. Note that enabling the serial console will make it impossible to unlock the disk from the keyboard and monitor, though unlocking via SSH will still work: rootdev=/dev/mapper/rootfs console=display bootlogo=false If your image lacks an 'armbianEnv.txt' file, you’ll need to edit the file 'boot/extlinux/extlinux.conf' instead. All changes will be made to the line beginning with “append”. Alter the argument beginning with “root=” so that it reads “root=/dev/mapper/rootfs”. If you’ll be unlocking the disk via the serial console, remove the “console=tty1” argument. If not, remove the argument beginning with “console=ttyS...”. Replace the “splash plymouth...” argument with “splash=verbose”. Make sure to read the note about unlocking via serial console in the previous step. Edit 'etc/initramfs-tools/initramfs.conf'. If your board will have a statically configured IP, add the following line to the end of the file, substituting the correct IP in place of 192.168.0.88: IP=192.168.0.88:::255.255.255.0::end0:off If the board will be configured via DHCP, then edit the DEVICE line as follows: DEVICE=end0 If your default network device is eth0, use that instead of end0. If host and target systems are both Debian buster, you may wish add some key modules to the initramfs to avoid a blank display at bootup time. The easiest way to do this is to add all currently loaded modules as follows: # lsmod | cut -d ' ' -f1 | tail -n+2 > etc/initramfs-tools/modules Retrieve the SSH public key from the remote unlocking host and copy it to the target: # mkdir -p etc/dropbear/initramfs # rsync yourusername@remote_machine:.ssh/id_*.pub etc/dropbear/initramfs/authorized_keys If you want to unlock the disk from more than one host, then edit the authorized_keys file by hand, adding the required additional keys. Create 'etc/crypttab': # echo "rootfs UUID=$ROOT_UUID none initramfs,luks" > etc/crypttab Create 'etc/fstab': # echo '/dev/mapper/rootfs / ext4 defaults,noatime,nodiratime,commit=600,errors=remount-ro 0 1' > etc/fstab # echo "UUID=$BOOT_UUID /boot ext4 defaults,noatime,nodiratime,commit=600,errors=remount-ro 0 2" >> etc/fstab # echo 'tmpfs /tmp tmpfs defaults,nosuid 0 0' >> etc/fstab Create the dropbear configuration file: # echo 'DROPBEAR_OPTIONS="-p 2222"' > etc/dropbear/initramfs/dropbear.conf # echo 'DROPBEAR=y' >> etc/dropbear/initramfs/dropbear.conf If the target is Ubuntu bionic, then a deprecated environment variable must be set as follows: # echo 'export CRYPTSETUP=y' > etc/initramfs-tools/conf.d/cryptsetup Set up automatic disk unlock prompt. Performing this optional step will cause the disk password prompt to appear automatically when you log in remotely via SSH to unlock the disk. Using your text editor, create the file 'etc/initramfs-tools/hooks/cryptroot-unlock.sh' with the following contents: #!/bin/sh if [ "$1" = 'prereqs' ]; then echo 'dropbear-initramfs'; exit 0; fi . /usr/share/initramfs-tools/hook-functions source='/tmp/cryptroot-unlock-profile' root_home=$(echo $DESTDIR/root-*) root_home=${root_home#$DESTDIR} echo 'if [ "$SSH_CLIENT" ]; then /usr/bin/cryptroot-unlock; fi' > $source copy_file ssh_login_profile $source $root_home/.profile exit 0 Save the file and execute the command: chmod 755 'etc/initramfs-tools/hooks/cryptroot-unlock.sh' Step 10 - Chroot into the target system, install packages and configure Now chroot into the encrypted system. All remaining steps will be performed inside the chroot: # chroot . Install the cryptsetup package and the dropbear SSH server: # apt update # echo 'force-confdef' > /root/.dpkg.cfg # apt --yes install cryptsetup-initramfs dropbear-initramfs # for a buster or focal image # apt --yes install cryptsetup dropbear-initramfs # for a bionic image # rm /root/.dpkg.cfg Make sure everything was included in the initramfs (all three commands should produce output): # lsinitramfs /boot/initrd.img-* | grep 'usr.*cryptsetup' # lsinitramfs /boot/initrd.img-* | grep dropbear # lsinitramfs /boot/initrd.img-* | grep authorized_keys Now regenerate your SSH host keys: # ssh-keygen -A Your work is finished! Exit the chroot and shut down the board: # exit # halt -p Insert your freshly written SD card into the board’s main SD slot (or, if the target is an eMMC, just remove the SD card from that slot) and reboot. Unlock the disk by executing the following command on your remote unlocking machine, substituting the correct IP address if necessary: $ ssh -p 2222 root@192.168.0.88 If you performed step 9.10 above, the disk password prompt should appear automatically after login. If not, you must enter the command 'cryptroot-unlock'. You may also unlock the disk from the target board’s console if you wish. Note, however, that certain disk images (RockPi 4 buster mainline, for example) might give you a blank display at startup, so you’ll have to enter your disk password “blindly”. This bug will hopefully be fixed in the future. If all went well, your root-filesystem encrypted Armbian system is now up and running!

Hello, this quick tutorial is to introduce an experimental Debian and Ubuntu APT repository to install ffmpeg and mpv compiled with v4l2request and v4l2drmprime patches developed by Linux kernel, LIbreELEC and Kodi folks to allow hardware video decoding on stateless decoders like those implemented in Rockchip and Allwinner SoCs for h.264, h.265, vp8 and vp9 codecs. The repository introduces a new package ffmpeg-v4l2request that integrates and substitues the base ffmpeg package and its related packages. Also provides mpv 0.35.1 for Ubuntu Jammy, which has an overrall better support for hardware video decoders. Preconditions: Kernel should be 6.1 or more recent armhf or arm64 architecture Supported operating systems are Debian Bookworm and Ubuntu Jammy Rockchip and Allwinner have already been tested, but this should work on other platforms with stateless decoders supported in kernel APT REPOSITORY SETUP To install the repository, just copy and paste the lines for your operating system in a terminal For Debian Bookworm: $ sudo wget http://apt.undo.it:7241/apt.undo.it.asc -O /etc/apt/trusted.gpg.d/apt.undo.it.asc $ echo "deb http://apt.undo.it:7241/debian bookworm main" | sudo tee /etc/apt/sources.list.d/apt.undo.it.list For Ubuntu Jammy: $ sudo wget http://apt.undo.it:7241/apt.undo.it.asc -O /etc/apt/trusted.gpg.d/apt.undo.it.asc $ echo "deb http://apt.undo.it:7241/ubuntu jammy main" | sudo tee /etc/apt/sources.list.d/apt.undo.it.list INSTALL FFMPEG AND MPV PACKAGES $ sudo apt update $ sudo apt install ffmpeg-v4l2request mpv SETUP MPV CONFIG FILE $ sudo mkdir -p /etc/mpv $ echo -e "hwdec=drm\ndrm-drmprime-video-plane=primary\ndrm-draw-plane=overlay" | sudo tee /etc/mpv/mpv.conf You can now play your videos using mpv and they should run with hardware decoding if supported, either in virtual terminals or in X11/Wayland windows! Enjoy! Notes: your mileage may vary a lot: the more recent is the kernel version, the better is support (you may need edge kernel) bug: when rendered in X11/Wayland window, video may show scattered tiles during frames bug: Lima driver (Mali 400/450) shows a red/pink tint when video is played in X11/Wayland (see https://github.com/mpv-player/mpv/issues/12968) (workaround below: https://forum.armbian.com/topic/32449-repository-for-v4l2request-hardware-video-decoding-rockchip-allwinner/?do=findComment&comment=177968) Panfrost driver should work flawlessy 10 bit HEVC are generally supported on all Rockchip devices (rk322x, rk3288, rk33x8, rk3399), but Allwinner H3 have no hardware support for that

Hi all. In this video I show how to use armbian-gamingX86. A script to install Steam, PPSSPP, Retropie and Xonotic on Armbian Jammy/Noble X86. Here link to armbian-gamingX86 : https://github.com/NicoD-SBC/armbian-gamingX86 Here my video about it. Cheers, NicoD

The original discussion thread is this Reposting this below just in case it may be useful ---- how i set it up https://gist.github.com/ag88/de02933ba65500376d1ff48e504b1bf3 --- Imho for WiFi purposes nmcli (network manager cli) is not very different from hostapd, just that hostapd possibly has more configuration options. To setup an access point, there are quite a few pieces of network configuration that needs to be setup: The WiFi AP itself (e.g. using network manager or hostapd) if you are able to connect and verify that in the log, that is probably solved. e.g. journalctl -u NetworkManager or for hostapd journalctl -u hostapd hostapd tends to have log entries for every host that connects, I'm not sure about NetworkManager. DHCP (issuing IP address to connected hosts) this is particularly true for IPv4 hosts on dynamic IP. DHCP would likely also need to distribute the DNS server, so configure that if it isn't done. e.g. https://ubuntu.com/server/docs/how-to-install-and-configure-isc-dhcp-server For IPv6 you may need to setup radvd (router advertisement daemon) https://en.wikipedia.org/wiki/Radvd so that the connected hosts can setup their own IPv6 address quite often IPV6 requires its own /64 address range / network (* note below dnsmasq does this as well) e.g. apt install radvd https://wiki.archlinux.org/title/IPv6#For_gateways Configure the WiFi AP as a router or bridge. Router: note that if you are using hostapd and not using a network bridge and there are no DHCP servers, you would need to configure the wlan0 interface with an ip address and network using say ip commands e.g. (ref: https://wiki.debian.org/NetworkConfiguration) /etc/network/interfaces source /etc/network/interfaces.d/* # Network is managed by Network manager auto lo iface lo inet loopback # added the following auto wlan0 iface wlan0 inet static address 192.168.1.1 netmask 255.255.255.0 To run it as a router, you would need to do DHCP (and RADV) for your WiFi hosts as above For such reasons, I tend to use isc-dhcp-daemon so that I can configure the dhcpd precisely as I needed. But I'd guess it may be possible with Network manager. (* note below dnsmasq does this as well) e.g. https://ubuntu.com/server/docs/how-to-install-and-configure-isc-dhcp-server apt install isc-dhcp-server Configure routing and/or IP NAT (e.g. IP masquerading). I've tried IP NAT and that sometimes it is easier as up stream normally only a single IP address is needed. Routing would need a subnet to be setup, that is normally ok but that you would need to configure your main gateway router as well for the overall network setup so that it knows where/how to forward packets. many consumer getway/routers simply used NAT, that is ok as well. But that your main gateway/router may need a static route to say that for that subnet, send it to your OPi Zero 3 Wifi AP. Bridging: To run it as a bridge you would need to setup the zero 3 WiFi AP as a bridge. This can be done using nmcli (network manager). In fact, this is my own personal preference for a small network. e.g. https://www.cyberciti.biz/faq/how-to-add-network-bridge-with-nmcli-networkmanager-on-linux/ https://gist.github.com/ag88/de02933ba65500376d1ff48e504b1bf3 DHCP (and RADV) can be done from the main gateway/router so long as the bridged packets reaches the WiFi hosts. Similarly, the DNS server likely needs to be distributed this way as well I've not done it completely from within nmcli for this setup as I used hostapd for the WiFi AP. But that I used nmcli (network manager) for the bridge. But that those notes above remains similar whether you used network manager or hostapd. take note that with hostapd for WiFi AP, you probably need to un-manage the Wifi interface in Network Manager configs so that it doesn't conflict with hostapd. https://gist.github.com/ag88/de02933ba65500376d1ff48e504b1bf3 oh and when messing with network interfaces use a debug usb-uart serial dongle or you may get 'locked out' from your zero 3 Apparently, dnsmasq does all three: DNS, DHCP, RADV https://thekelleys.org.uk/dnsmasq/doc.html but that there may be some configurations that are needed for it to work correctly https://docs.fedoraproject.org/en-US/fedora-server/administration/dnsmasq/ https://wiki.archlinux.org/title/Dnsmasq

I was working on blog article for our site about usage of Armbian extensions and I would be glad if it could be useful for the community It is on https://github.com/pavlot-scriptec/scriptec-blog/blob/main/customize_armbian_image_using_extensions.md Also I have created extension to enable Waveshare 3.5 TFT displays for RPi (and maybe other platforms). Any feedback is wellcome

Step 1 - Install the Armbian PGP key and update your APT sources Install armbian.gpg to /usr/share/keyrings/armbian.gpg (mode 644) You can use a copy from another one of your SBCs, or... ... you can download and install like below (thanks @BrewNinja for the example) touch /usr/share/keyrings/armbian.gpg chmod 644 /usr/share/keyrings/armbian.gpg wget https://apt.armbian.com/armbian.key -O - | gpg --dearmor >/usr/share/keyrings/armbian.gpg Edit /etc/apt/sources.list Replace all instances of bullseye with bookworm Edit /etc/apt/sources.list.d/armbian.list deb [signed-by=/usr/share/keyrings/armbian.gpg] http://apt.armbian.com bookworm main bookworm-utils bookworm-desktop Edit any other files in /etc/apt/sources.list.d as appropriate, to replace bullseye with bookworm Step 2 apt update Step 3 NOTE - WHEN RUNNING THE BELOW COMMANDS, DO NOT ACCEPT ANY INTERACTIVE PROMPTS FOR CHANGING /etc/initramfs-tools/initramfs.conf The default is not to accept the changes anyway - but I am noting this here to be extra careful I've checked - the changes may differ from what armbian has in the latest images apt upgrade --no-new-pkgs apt full-upgrade apt dist-upgrade

Hello, I apologize in advance if I haven't put the topic in the right section. I want to share my experience with NanoPC-T6 and two NVMe m.2 disk. I use my NanoPC-T6 for a small server. In the beginning I had 2 SSDs and an M.2 to 2 SATA adapter. But I never found the right solution to power both the NanoPC-T6 and the SSDs from 1 place. After some internet searching I was able to find a solution on how to put 2 NVMe drives on my NanoPC-T6 As you know NanoPC-T6 has 1 M.2 M-Key connector with PCIe 3.0 x4 There is also one PCIe which is M.2 E-key connector with PCIe 2.1 x1 With this adapter: https://www.aliexpress.com/item/1005004762924052.html I am using M.2 E-key to M.2 M-Key. The version of the kernel I use is 6.1.43-vendor-rk35xx. The speed that the NVMe disk on the adapter board can reach is about 400MB per second, which is quite good for my needs. I am attaching some pictures. I hope this is useful for you. If there are any questions, I'm at the meeting to answer them. Regards,

Hello im new and im Italian so i hope you will not hate me if i write not perfectly (Who said Google Translate?? No No No) This Guide is for a "client to client" setup of the box, we will internally switch Wifi to Eth, so a working computer can access internet from its eth port even if the router signal source is wireless. Router AP -----> ARM BOX [WIFI internal or usb dongle] ===>> internal eth0 ------> ethernet cable --> client eth port Make sure WiFi in arm box is connected using nmtui command FROM NOW ON <WIFI CARD> is the wifi adapter name es: replace "<WIFI CARD>" with "wlx0013eff301ee" Execute: sudo apt-get update && sudo apt-get install dnsmasq iptables iptables-persistent -y say no to save actual iptables rules (we dont have any yet) Edit /etc/network/interfaces comment if exist the part of eth0 "iface eth0" to "#iface eth0" add those lines allow-hotplug eth0 iface eth0 inet static address 172.24.1.1 netmask 255.255.255.0 network 172.24.1.0 broadcast 172.24.1.255 dns-nameservers 1.1.1.1 1.0.0.1 #########{Static}########### up ip addr add 172.24.0.1/24 dev eth0 execute those commands REMEMBER TO REPLACE <WIFI CARD> ip addr add 172.24.0.1/24 dev eth0 iptables -A FORWARD -o <WIFI CARD> -i eth0 -s 172.24.0.0/24 -m conntrack --ctstate NEW -j ACCEPT iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -t nat -F POSTROUTING iptables -t nat -A POSTROUTING -o <WIFI CARD> -j MASQUERADE sh -c "iptables-save > /etc/iptables.ipv4.nat" sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward" /etc/init.d/dnsmasq stop cp /etc/dnsmasq.conf /etc/dnsmasq.conf-backup Edit /etc/dnsmasq.conf inserting interface=eth0 listen-address=172.24.1.1 bind-interfaces server=1.1.1.1 domain-needed bogus-priv dhcp-range=172.24.0.100,172.24.0.250,72h Edit /etc/sysctl.conf inserting net.ipv4.conf.default.forwarding=1 net.ipv4.conf.all.forwarding=1 Edit /etc/rc.local inserting before "exit 0" iptables-restore < /etc/iptables.ipv4.nat execute those commands systemctl enable dnsmasq systemctl enable iptables Explainations: We set static net to eht0 then we set routing in iptables [forward and back] wlan<->eth then we make this setup persistent so that will persist after reboot. Working on my RK3318 Armbian bullseye 5.15 minimal and USB3 dongle RTL8814AU (also tested with a 8812au)

Hi all. I made a video about KDE Neon on the Raspberry Pi 5. I love it, I'll be switching from ubuntu-desktop to this. Greetings, NicoD

Building Armbian using Ubuntu (jammy) in a systemd-nspawn container https://gist.github.com/ag88/05245121cce37cb8f029424a20752e35 Special thanks goes to @Gunjan Gupta for the tip on PREFER_DOCKER=no

Sharing is caring. Did finally manage to get this working. So lets make it simple clever. Actually i did this on a 64bit raspian light kernel 6.1 but it must be the same on Armbian 10 jan 24 Sharing the Raspberry Pi's WiFi over the ethernet port sudo apt get update && sudo apt install dnsmasq iptables iptables-persistent dhcpcd5 sudo vim /etc/dhcpcd.conf interface eth0 static ip_address=192.168.4.1/24 ------- sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bk sudo nano /etc/dnsmasq.conf - interface=eth0 dhcp-range=192.168.4.8,192.168.4.250,255.255.255.0,12h server=8.8.8.8 bogus-priv ------ sudo systemctl restart dnsmasq.service ------ sudo vim /etc/sysctl.conf net.ipv4.ip_forward=1 ------- sudo systemctl start dnsmasq ------- sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward" ------- sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE sudo iptables -A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT ------- sudo iptables -L -n -v ---------- sudo sh -c "iptables-save > /etc/iptables.ipv4.nat" --------- sudo vim /etc/rc.local iptables-restore < /etc/iptables.ipv4.nat exit0 --------- sudo reboot -------- Did get a perfect internet connection on odroid n2+ through eth0 - so the rpi4b is now supplying wifi for that board and providing petitboot with netbooting images through netboot_default after exit to shell.

!! DEPRECATED !! Instructions in this thread are oudated and superseded by the new experimental APT repository for hardware video decoding ffmpeg. Please refer to this thread from now on! Hello, recent upgrades to armbian are regarding kernel 5.15. I noticed that many v4l2 fixes and enhancements went into this release, so I decided to compile ffmpeg using LibreELEC patched version and mpv over it. mpv turns out to be statically linked with ffmpeg, so I propose it here for people who is interested in cutting edge kernel and wants to do some tests. This has been tested on Debian Bullseye and Ubuntu Hirsute on following platforms: Rockchip RK3228/9 (kernel 5.10, 5.14) Rockchip RK3288 (kernel 5.14) Rockchip RK3318/28 (kernel 5.15) It should work on allwinner platforms too, but I didn't test it there. Binaries are built by me on developing boards. The binary for armhf is available here The binary for arm64 is available here Copy the binary into /usr/local/bin directory of your system (mpv-armhf for 32 bit systems, mpv-arm64 for 64 bit systems): sudo cp mpv-armhf /usr/local/bin/mpv Install dependencies for Debian Bullseye and Ubuntu Hirsute: apt install libass9 libbluray2 librubberband2 libsdl2-2.0-0 libva-drm2 libva-wayland2 libva-x11-2 libva2 libvdpau1 libx264-160 libx265-192 libxss1 libxv1 libfdk-aac2 I have had issues with dependencies on Debian Buster/Ubuntu Focal, in particular libx264-160 and libx265-192 are not available there. I Solved the issue downloading the packages from Debian Bullseye web page and manually installing them. There may be the need for some other dependency depending upon your actual installation. Run mpv in a virtual terminal (videos up to 4K) with this CLI: mpv --vo=gpu --hwdec=drm --gpu-hwdec-interop=drmprime-drm --drm-draw-plane=overlay --drm-drmprime-video-plane=primary <video.mp4> Mpv can be run in X11 with this other CLI, but due to buffer copying it requires a good CPU - rk3228 and rk3328 won't even play 720p, rk3288 do 720p fine: mpv --vo=gpu --hwdec=auto-copy --gpu-context=x11egl --gpu-hwdec-interop=drmprime-drm <video.mp4> This is an experiment and your mileage may vary a lot: H.264 codec should be well supported around the boards; H.265 has more limited support VP8 should be generally supported VP9 seems to still require some work.

Hi all. I made a new video on how to build Armbian images. These days you can use your ARM64 SBC to do this. For Windows users there's WSL2 you can use. Here my video about that. Greetings, NicoD

Hi, after having a hard time getting the ILI9341 touchscreen working with the NanoPi Neo (Allwinner H3) it seems to work now. To have more GPIOs available for other stuff the touch and display need to share SPI0 I would like to upload it to github because there is basically nothing out of the box available but I'm a total noob with NanoPi, Armbian and overlays so maybe someone could look at it. root@nanopineo:~# uname -a Linux nanopineo 5.15.93-sunxi #23.02.2 SMP Fri Feb 17 00:00:00 UTC 2023 armv7l armv7l armv7l GNU/Linux This is the wiring between ILI9341 and NanoPi Neo: /* 3.3v <--> VCC & LED GND <--> GND PC2 <--> SCK & T_CLK PC1 <--> SDO<MISO> & T_DO PC0 <--> SDI<MOSI> & T_DIN PA1 <--> DC PG8 <--> RESET PC3 <--> CS PA3 <--> T_CS PG9 <--> T_IRG */ This is the overlay: /dts-v1/; /plugin/; / { compatible = "allwinner,sun8i-h3"; fragment@0 { target = <&pio>; __overlay__ { spi0_cs1: spi0_cs1 { pins = "PC3"; function = "gpio_out"; output-high; }; spi1_cs1: spi1_cs1 { pins = "PA3"; function = "gpio_out"; output-high; }; opiz_display_pins: opiz_display_pins { pins = "PA1", "PG8", "PA6"; function = "gpio_out"; }; ads7846_pins: ads7846_pins { pins = "PG9"; function = "irq"; }; }; }; fragment@1 { target = <&spi1>; __overlay__ { pinctrl-names = "default", "default"; pinctrl-1 = <&spi1_cs1>; cs-gpios = <0>, <&pio 0 3 0>; /* PA3 */ }; }; fragment@2 { target = <&spi0>; __overlay__ { #address-cells = <1>; #size-cells = <0>; status = "okay"; pinctrl-names = "default", "default"; cs-gpios= <&pio 2 3 0>, <&pio 0 3 1>; opizdisplay: opiz-display@0 { pinctrl-1 = <&spi0_cs1>; reg = <0>; /* Chip Select 0 */ compatible = "ilitek,ili9341"; spi-max-frequency = <1000000>; status = "okay"; pinctrl-names = "default"; pinctrl-0 = <&opiz_display_pins>; rotate = <90>; bgr = <0>; fps = <33>; buswidth = <8>; dc-gpios = <&pio 0 1 0>; /* PIN_22 GPIOA1 > */ reset-gpios = <&pio 6 8 1 >; /* GPIOG8> */ /*led-gpios=<&pio 0 6 0>; PIN_12 GPIOA6 > */ debug=<4>; }; ads7846: ads7846@1 { reg = <1>; /* Chip Select 1 */ compatible = "ti,ads7846"; spi-max-frequency = <1000000>; status = "okay"; pinctrl-2=<&spi1_cs1 &spi1_cs1>; pinctrl-names = "default"; pinctrl-3 = <&ads7846_pins>; interrupt-parent = <&pio>; interrupts = <6 9 2>; /* PG9 IRQ_TYPE_EDGE_FALLING */ pendown-gpio = <&pio 6 9 0>; /* PG9 */ /* driver defaults, optional */ ti,x-min = /bits/ 16 <0>; ti,y-min = /bits/ 16 <0>; ti,x-max = /bits/ 16 <0x0FFF>; ti,y-max = /bits/ 16 <0x0FFF>; ti,pressure-min = /bits/ 16 <0>; ti,pressure-max = /bits/ 16 <0xFFFF>; ti,x-plate-ohms = /bits/ 16 <400>; }; }; }; }; This is the /boot/armbianEnv.txt verbosity=1 bootlogo=false console=serial disp_mode=1920x1080p60 overlay_prefix=sun8i-h3 overlays=usbhost1 usbhost2 spi0 param_spidev_spi_bus=0 param_spidev_spi_cs=1 param_spidev_spi_cs=0 rootdev=UUID=XYZ-LONG-UUID-IS-LONG rootfstype=ext4 user_overlays=ili-touch-spi usbstoragequirks=0x2537:0x1066:u,0x2537:0x1068:u After connecting via ssh and starting evtest it shows this when touched ( not sure if it shows the correct coordinates yet ) Event: time 1682020476.763295, -------------- SYN_REPORT ------------ Event: time 1682020476.775286, type 3 (EV_ABS), code 0 (ABS_X), value 535 Event: time 1682020476.775286, type 3 (EV_ABS), code 1 (ABS_Y), value 3553 Event: time 1682020476.775286, type 3 (EV_ABS), code 24 (ABS_PRESSURE), value 65169 So it looks like everything is working but to be on the safe side I would like to wait until some pro reviewed the overlay. Thanks.

Hi all. I just made a video where I show how to build your own Armbian images on Windows. It used to be that you needed a virtualMachine running Linux but these days you can use WSL2. Here the video : Greetings, NicoD

If you want to do a complete headless install of Armbian OS on an Orange Pi 5, and connect with Windows Remote Desktop, I put together what has worked for me. I pieced this tutorial together using an Orange Pi 5, installing Armbian 23.02 Jammy Gnome Desktop, and connecting via a Windows 11 PC using Windows Remote Desktop client. Keep in mind, your Orange Pi OS needs to be a full Desktop edition, otherwise, if you're using CLI editions, you will not have a Graphical User Interface installed, which Windows Remote Desktop needs to connect. ArmbianOS Download Link Putty Download Link Start PUTTY and enter your Orange Pi's IP address or host name (orangepi5) into PUTTY's Host Name field, hit enter. Accept any certificate popup screens. Login with Armbian's default user and pass. USER(logon): root PASSWORD: 1234 You'll be prompted with your Orange Pi's IP address. Take note of that, you might want to use it to remote connect, though you can also use the Orange Pi default hostname (orangepi5). Next, you'll be prompted to complete the following...create a root password, select bash or zsh, create a user and user password, enter real name, select timezone, and select locale. Take note of the User Name and Password you created since you will use that to logon with the Windows Remote Desktop Client. After completing account setup, you should be at a blank command prompt. DO NOT RUN ANY UPDATE COMMANDS enter the following commands... sudo apt install xrdp xorgxrdp sudo systemctl enable xrdp sudo systemctl status xrdp After entering the systemctl status xrdp command , you should see a listing showing "Active: active (running)". If Active shows "failed" then you will not be capable of connecting via Remote Desktop. **See below to try and resolve this issue. If you get a successful status list then, press the Ctrl key and C key simultaneously to get back to the command prompt. Reboot your Orange Pi by entering sudo reboot You should now be capable of accessing your OrangePi remotely by using Windows Remote Desktop. Open your Windows Remote Desktop client. You can adjust the size of the Remote Desktop screen session by clicking the "Show Options" located at the lower left corner of the Remote Desktop logon windows, then click the "Display" tab to set your preferred screen size, among other options. In the Computer field, enter your Orange Pi's IP address or host name (orangepi5), hit Connect. You should now be prompted with an XRDP logon screen. Enter the username and password you created when setting up Armbian during the PUTYY session. **INSTRUCTION TO ATTEMPT TO RESOLVE A FAILED SYSTEMCTL STATUS. If you haven't rebooted, and need to get back to the command prompt, then press the Ctrl key and C key simultaneously to get back to the command prompt. Enter the following commands to uninstall xrdp... sudo apt remove xrdp sudo apt purge xrdp Reinstall xrdp by following the same instructions at the start of this tutorial. Check the status again by entering the following command... sudo systemctl status xrdp Hopefully, this time it will show as "Active: active (running)". Hope this helps.