Here is a basic NFTables ruleset, stored here for future reference. It'll probably get updated over time as new knowledge and ideas turn up — if I remember.

...

There is more to sed(1) than s///

There are books written about sed(1), a stream editor which can filter and transform streams of text, because it can do a lot more than many suspect. It actually uses a very simple and compact language which, though limited, is concise. I used sed(1) for ages and ages without exploring more of what it can do. It's most often used only with the s/// substitution, but it also has other capabilities.

• selecting or deleting lines
• alternate

...

The utility sudo(8) runs programs as another user. Frequently, that other user is root, but it does not have to be, the utility can also be used to downgrade privileges. Often it is mis-used to provide full root access to a group of users in place of su(1). However, sudo(8) was developed to give selective access to machines, following the principle of least privilege. It can achieve a very fine granularity of access, even allowing just specific programs or specific options for specific programs....

In a multi-user environment, group permissions are the way to allow more than one user write access to the web server's document root. Just pick a name for the new group and apply it. It could go something like this:

That...