Guides
Every guide here comes out of something that was actually done on a real machine. The commands are the commands that were run, the output is the output they produced, and where a claim can be checked without taking this site's word for it, the link to check it is in the text.
tui-dc administers a Samba Active Directory domain from a terminal on the controller; Samba Conductor runs the same kind of domain from a browser, with single sign-on and Google Workspace sync. This page says which one fits which job.
A line in /etc/fstab that does not parse is a boot that stops in an emergency shell. tui-disk picks the device by UUID, checks the staged file with findmnt before you are asked, shows the one-line diff, and then reads the drive's health and the btrfs state back.
A service failed and you want to know why, fix it, make it restart on its own, start it at boot and give it a nightly timer. One walk through tui-systemd on a real machine, with every preview dialog as the tool showed it.
A local CA from tui-cert, Keycloak served over https with a certificate from it, and a Headscale control plane set up with tui-tailscale that admits only the members of one Keycloak group. Run end to end in the family lab and told through the screens it produced, including the login that was refused.
Certificates for an IP address or a name no public DNS carries, from a small certificate authority of your own. Create it, issue with DNS and IP names, copy it to another machine, trust it or stop trusting it, and read what each finding means.
A Headscale control plane with no public DNS name and no Let's Encrypt. tui-cert runs a local certificate authority, tui-tailscale serves its certificate and trusts it on each client, and machines join with pre-auth keys.
Many cloud images ship no ufw and no firewalld, just an iptables ruleset whose INPUT chain ends in a REJECT. A rule appended after it never matches. tui-firewall inserts in front of it, persists with a diff, and says when the running rules and the saved ones disagree.
One public host runs the Headscale control plane with a Let's Encrypt certificate, people log in with their Google account, and the same host serves its private network to every client. Every step is one key in tui-tailscale, previewed before it runs.
The upgrade runs inside a btrfs snapshot of the root; at reboot two renames swap it in, and rollback is the same two renames backwards. Built, measured and put through a 34-item acceptance list on a Secure Boot VM.
Three checks, with the real commands and the real output, that answer who built a tui-tools binary before you give it your root password.
The --report flag prints the block a maintainer needs to reproduce a bug, and leaves out your hostname, your user name and your home path by construction, not by asking you to trust it.
