various updates

active/os_fedora/fedora-server.md

@@ -4,6 +4,7 @@
   - [Installation](#installation)
   - [Setup SSH](#setup-ssh)
   - [DNF](#dnf)
+    - [Version lock](#version-lock)
   - [Power Profiles with Tuned](#power-profiles-with-tuned)
   - [Fail2Ban](#fail2ban)
   - [BTRFS Parent Volumes](#btrfs-parent-volumes)
@@ -84,6 +85,7 @@
   - [Sound Devices](#sound-devices)
   - [Install ffmpegthumbnailer, remove totem](#install-ffmpegthumbnailer-remove-totem)
   - [Add compatibility for HEIC to mogrify](#add-compatibility-for-heic-to-mogrify)
+  - [Redirecting ports for rootless services](#redirecting-ports-for-rootless-services)
 
 <https://docs.fedoraproject.org/en-US/fedora-server/installation/postinstallation-tasks/#_manage_system_updates>
 
@@ -127,6 +129,16 @@ dnf update --refresh -y
 dnf install -y git glances tmux vim python3-libdnf5 borgbackup tpm2-tools
 ```
 
+### Version lock
+
+```bash
+sudo dnf install dnf-plugin-versionlock
+sudo dnf list <package> --showduplicates
+sudo dnf versionlock add <package_name>-<version>.x86_64
+sudo dnf versionlock list
+sudo dnf versionlock delete <package_name>
+```
+
 ## Power Profiles with Tuned
 
 1. `dnf install tuned`
@@ -1486,3 +1498,29 @@ sudo dnf install ffmpegthumbnailer
 ```bash
 sudo dnf install libheic-freeworld
 ```
+
+## Redirecting ports for rootless services
+
+```bash
+# ipv4
+sudo firewall-cmd \
+--permanent \
+--add-forward-port=port=80:proto=tcp:toport=8080
+
+sudo firewall-cmd --add-rich-rule='forward-port port=80 protocol=tcp to-port=8080
+```
+
+Or in ansible
+
+```yaml
+- name: Forward ports
+    ansible.posix.firewalld:
+    port_forward:
+    - port: "{{ item.from }}"
+        proto: tcp
+        toport: "{{ item.to }}"
+    permanent: true
+    state: enabled
+    immediate: true
+    loop: "{{ forward_ports }}"
+```