Replacing Kasm’s default self-signed certificates with **Let’s Encrypt** is a common task to remove browser “Insecure” warnings.

The process involves generating the certificates using `certbot` and then linking them to the Kasm proxy.

### Prerequisites

* A domain name pointed to your Kasm server’s IP.
* Ports **80** and **443** open on your firewall.
* `certbot` installed on your host system.

—

### Step 1: Generate the Let’s Encrypt Certificate

Since Kasm uses port 443, you should use Certbot’s **standalone** mode.

You must briefly stop the Kasm proxy so Certbot can use the port to verify your domain.

1. **Stop the Kasm Proxy:**

“`bash
sudo docker stop kasm_proxy
“`

2. **Run Certbot:**
Replace `yourdomain.com` with your actual domain.

“`bash
sudo certbot certonly –standalone -d yourdomain.com
“`

*This will save your certificates to `/etc/letsencrypt/live/yourdomain.com/`.*

3. **Verify:**
If the process was successful, you should see output like this:

“`bash
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/your.domain.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/your.domain.net/privkey.pem
This certificate expires on 2026-07-19.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
“`

—

### Step 2: Replace Kasm Certificates

Kasm looks for its certificates in `/opt/kasm/current/certs/`. Instead of copying the files, it is best practice to use **symbolic links** so that when Let’s Encrypt auto-renews, Kasm automatically sees the new files.

1. **Navigate to the Kasm cert directory:**

“`bash
cd /opt/kasm/current/certs/
“`

2. **Backup the original self-signed certs:**

“`bash
sudo mv kasm_nginx.crt{,.bak} && mv kasm_nginx.key{,.bak}
“`

3. **Create the symbolic links:**
Point Kasm’s expected filenames to your new Let’s Encrypt files:

“`bash
sudo ln -s /etc/letsencrypt/live/yourdomain.com/fullchain.pem kasm_nginx.crt
sudo ln -s /etc/letsencrypt/live/yourdomain.com/privkey.pem kasm_nginx.key
“`

—

### Step 3: Restart and Verify

Now, bring the proxy back up to apply the changes.

1. **Start the Kasm Proxy:**

“`bash
sudo docker start kasm_proxy
“`

2. **Verify:**
Open your browser and navigate to `https://yourdomain.com`. You should now see a valid lock icon without any security warnings.

—

### Step 4: Automating Renewal

Let’s Encrypt certificates expire every 90 days and need to be renewed.

Since we had to stop the kasm_proxy to issue the cert, the normal automatic renewal will fail as kasm_proxy is occupying those ports.

Luckily for us, Certbot has built in support for this as part of it’s renewal process, we just need to tell it what to do:

1. Open the renewal file for your domain:

“`bash
sudo nano /etc/letsencrypt/renewal/your.domain.net.conf
“`

2. Under **[renewalparams]** add two new lines to the bottom of the block:

“`bash
pre_hook = docker stop kasm_proxy
post_hook = docker start kasm_prox
“`

3. Now do a renewal `dry-run` to test everything is working:

“`bash
sudo certbot renew –dry-run –cert-name your.domain.net
“`

4. You should see the pre-hook & post-hook fire for kasm_proxy, confirming everything was successful:

“`bash
# sudo certbot renew –dry-run –cert-name your.domain.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Processing /etc/letsencrypt/renewal/your.domain.net.conf
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Account registered.
Hook ‘pre-hook’ ran with output:
kasm_proxy
Simulating renewal of an existing certificate for your.domain.net and kasm-direct.uo5.net

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/your.domain.net/fullchain.pem (success)
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Hook ‘post-hook’ ran with output:
kasm_proxy
“`

5. **Note:** If you prefer not to open port 80 or stop Kasm for renewals, consider using the **DNS-01 challenge** with Certbot (e.g., `certbot-dns-cloudflare`), which verifies ownership via DNS records rather than a web server.

---

If you want a lightweight, self-hosted seedbox, Deluge is a great option; it’s a Python-based BitTorrent client with a powerful Web UI and solid community support.

In this guide, we’ll move beyond a basic Deluge environment by securing remote access to the web interface by using Nginx as a reverse proxy and encrypting all traffic with HTTPS via Let’s Encrypt SSL.

This powerful combination not only secures your torrent client but also provides a method to manage your downloads remotely and view the finished files directly on the server via HTTPS or SFTP (FTP over SSH).

---

Requirements

• Server/VPS with at least 1 GB of Memory.
• Root (sudo) access.
• A compatible OS:
• Debian 13 (Trixie)
• Ubuntu 22 (Jammy)
• Ubuntu 24 (Noble)
•  Fully Qualified Domain Name (FQDN) pointed to the Server’s IP via A/AAAA record.
• ex. server.ts4.net has address 192.249.57.21

---

Step 1: Install Deluge

First, we’ll install the Deluge packages from the repository.

Debian 13

Debian 13, no adjustments are needed.

sudo apt-get update
sudo apt-get upgrade -yV
sudo apt-get install deluged deluge-web -y

Ubuntu

For Ubuntu, the official repositories often lag behind the latest Deluge releases. To ensure you get the newest stable version, add the official Deluge PPA.

sudo apt-get update
sudo apt-get upgrade -yV
sudo add-apt-repository -y ppa:deluge-team/stable
sudo apt-get install deluged deluge-web -y

If you get an error like:

add-apt-repository: command not found

Install the software-properties-common package first (older articles may reference python-software-properties).

---

After the Deluge package install is complete, confirm the versions:

deluged -V
deluge-web -V

You should see something like Deluge 2.2.0 rather than the outdated 2.1.x from the Ubuntu repos.

# deluged -V
deluged 2.2.0
libtorrent: 2.0.10.0
Python: 3.12.3
OS: Linux Ubuntu 24.04 noble

# deluge-web -V
deluge-web 2.2.0
libtorrent: 2.0.10.0
Python: 3.12.3
OS: Linux Ubuntu 24.04 noble

---

Step 2: Create a Dedicated Deluge User

For security, run Deluge under its own system account.

sudo adduser --system --gecos "Deluge Service" --disabled-password --group --home /var/lib/deluge deluge

If you want to manage downloads with another user (e.g., myftp), add them to the deluge group:

sudo adduser --ingroup deluge --gecos "Deluge Download User" myftp

Set Up the Downloads Directory

Now that both users have been created, we can configure Deluge’s default download directory and create a placeholder file:

sudo -u deluge mkdir /var/lib/deluge/Downloads
sudo -u deluge touch /var/lib/deluge/Downloads/first-file

In addition to accessing files over HTTP, you can also retrieve completed downloads via SFTP. To make SFTP access easier, create a symlink in the SFTP user’s home directory that points to Deluge’s download folder:

sudo -u myftp ln -s /var/lib/deluge/Downloads/ /home/myftp/files

---

Step 3: Set Up Systemd Services

Running Deluge as a service ensures that it starts automatically at boot, runs under a dedicated, non-root user for enhanced security and automatically restarts itself in the event of a crash, guaranteeing maximum uptime and reliability.

This is achieved by defining two specific systemd unit files: one for the deluged daemon (the core engine) and one for the deluge-web interface (the remote access component), with each service to write to its own dedicated log file.

Create Systemd Unit Files

Create these two unit files in your /etc/systemd/system/ folder:

/etc/systemd/system/deluged.service

[Unit]
Description=Deluge Bittorrent Daemon
After=network-online.target

[Service]
Type=simple
User=deluge
Group=deluge
ExecStart=/usr/bin/deluged -d -l /var/lib/deluge/deluged.log -L warning
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

/etc/systemd/system/deluge-web.service

[Unit]
Description=Deluge Bittorrent Web UI
After=network-online.target

[Service]
Type=simple
User=deluge
Group=deluge
ExecStart=/usr/bin/deluge-web -d -l /var/lib/deluge/deluge-web.log -L warning
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

After creating the new unit files, systemd must be reloaded:

sudo systemctl daemon-reload

Start Deluge Services

Now that systemd has been reloaded, it’s time to launch deluged & deluge-web:

sudo systemctl enable deluged deluge-web
sudo systemctl start deluged deluge-web

Once the services are launched, check the status to ensure both are “active“:

sudo systemctl status deluged deluge-web

---

Test Deluge

With both the deluged daemon and deluge-web interface running as services, your Deluge setup is now fully operational and ready to manage torrents.

To access the Deluge WebUI interface temporarily, open your web browser and navigate to Server IP address on port 8112 (e.g., http://your_server_ip:8112).

The default WebUI password is deluge; once logged in, you must connect to the local Deluge daemon running on 127.0.0.1.

Although this initial connection is unsecured HTTP, you may safely queue up your first downloads now.

The following steps will focus on permanently securing WebUI access by configuring Nginx as a reverse proxy and enabling HTTPS via Let’s Encrypt SSL.

---

Part 2 – Setup Nginx

Step 4: Install Nginx and Certbot

Now that the basics are setup, it’s time to make Deluge more user friendly by adding a Reverse Proxy to access Deluge-Web securely via HTTPS and adding a directory-based file browser to make downloading files from the server easier.

We’ll use Nginx as a reverse proxy to serve Deluge securely under HTTPS, and use CertBot to provide the SSL certificate.

Install Nginx

sudo apt-get install nginx  snapd -y 

Install CertBot

sudo snap install --classic certbot

Finally with Certbot installed, we can request a Let’s Encrypt certificate (replace my.domain.net with your (sub)domain):

sudo certbot --nginx -d my.domain.net --non-interactive --agree-tos  --email admin@my.domain.net

---

Step 5: Configure Nginx

Create your new Nginx config (e.g., /etc/nginx/sites-available/deluge.conf):

server {
    listen 80;
    listen [::]:80;
    server_name my.domain.net;

    # Redirect HTTP to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name my.domain.net;

    root /var/www/html;

    ssl_certificate /etc/letsencrypt/live/my.domain.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/my.domain.net/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    # Public file listing
    location /files {
        alias /var/lib/deluge/Downloads/;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
    }

    # Deluge Web UI
    location /deluge {
        proxy_pass http://localhost:8112/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Deluge-Base "/deluge/";
        add_header X-Frame-Options SAMEORIGIN;
    }
}

Replace all instances of my.domain.net with your actual (sub)domain.

Now we can disable the default site, and enable our new config file with a symlink:

rm -fv /etc/nginx/sites-enabled/default
sudo ln -s /etc/nginx/sites-available/deluge.conf /etc/nginx/sites-enabled/

Wipe the default nginx Index file:

sudo rm -fv  /var/www/html/index.nginx-debian.html
sudo echo > /var/www/html/index.htmltr

HTTP File Downloads

To enable HTTP-based file browsing and downloading, we’ll need to add the Nginx user to the Deluge user group, in order for Nginx to be able to read the Downloads directory.

The default username for Nginx on Ubuntu is www-data.

sudo usermod -aG deluge www-data

Reload Nginx

Now we can verify the config file, and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

If Nginx reloaded succcessfully, you can now access your Deluge Reverse-Proxy, and /files/ download directory via HTTPS.

• Deluge Web UI → https://my.domain.net/deluge/
• Download directory → https://my.domain.net/files/

SSL will be renewed automatically ever 65 days via the snapd job.

---

Step 6: Secure Deluge

At this point, the initial installation process is complete and we’re ready to secure Deluge.

Update the default Deluge WebUI password.

The default Deluge WebUI password is deluge; this should be changed immediately.

You can update the default password via Deluge WebUI > Preferences > Interface.

Restrict Access to Deluge Port

Although we have setup a Nginx reverse-proxy to allow secure HTTPS access to the Deluge WebUI via /deluge/, the original port 8112 backend is still pubicly accessible, and it should be blocked.

Blocking port 8112 ensures the only way to access Deluge WebUI is via the secure Nginx reverse-proxy.

Setup deluge-firewall service

We can block access to Port 8112 via IP Tables without the need for an additional firewall like UFW or Firewalld.

To setup the firewall rules, create a new file – /etc/systemd/system/deluge-firewall.service – and add the following content:

[Unit]
Description=Firewall rules for Deluge
Before=deluge-web.service
Wants=network.target

[Service]
Type=oneshot

# ------------------------------
# Add rules when starting service
# ------------------------------
ExecStart=/bin/sh -c 'iptables -C INPUT -i lo -p tcp --dport 8112 -j ACCEPT 2>/dev/null || iptables -A INPUT -i lo -p tcp --dport 8112 -j ACCEPT'
ExecStart=/bin/sh -c 'iptables -C INPUT -p tcp --dport 8112 -j DROP 2>/dev/null || iptables -A INPUT -p tcp --dport 8112 -j DROP'

# ------------------------------
# Remove rules when stopping service
# ------------------------------
ExecStop=/bin/sh -c 'iptables -C INPUT -i lo -p tcp --dport 8112 -j ACCEPT 2>/dev/null && iptables -D INPUT -i lo -p tcp --dport 8112 -j ACCEPT'
ExecStop=/bin/sh -c 'iptables -C INPUT -p tcp --dport 8112 -j DROP 2>/dev/null && iptables -D INPUT -p tcp --dport 8112 -j DROP'

RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Start deluge-firewall service

After the unit file has been created, we must reload the Systemd daemon in order to enable the deluge-firewall service.

Enabling deluge-firewall as a service ensures the necessary firewall rules are automatically re-created when the server reboots.

sudo systemctl daemon-reload
sudo systemctl enable deluge-firewall

Start the deluge-firewall service

sudo systemctl start deluge-firewall

Now the deluge-firewall has been started, the IP Tables will have been added to the firewall, and access to Port 8112 is restricted.

Test deluge-firewall

You can test this by accessing Port 8112 directly in your browser, (e.g., http://your_server_ip:8112), it should not load.

$ curl http://my.ip.addresss:8112/
curl: (28) Failed to connect to my.ip.address port 8112 after 133065 ms: Couldn't connect to server

Disable deluge-firewall

If for any reason you need to directly access the Deluge WebUI via Port 8112, you can stop the deluge-firewall service to temporarily deactivate it:

sudo systemctl stop deluge-firewall

Once stopped, Port 8112 will be directly accessible from the Internet.

To disable the deluge-firewall permanently, disable the service:

sudo systemctl disable deluge-firewall

---

Other Enhancements

Auto Select Deluge Daemon

Deluge can be configured to automatically select the localhost daemon in the WebUI.

To automatically connect to localhost, locate hostlist.conf within the Deluge .config directory.

Open the hostlist.conf find your ID, it’ll be the first entry in hostlist:

...
      "123459d5a5b414159caa1323f6e0c9b240c7abcd",
      "localhost",
      58846,
...

Once you have the ID, stop the Web UI in order to modify the web.conf file.

sudo systemctl stop deluge-web

Locate the "default_daemon" option inside of web.conf,  and set its value to the daemon id from hostlist.conf

"default_daemon": "123459d5a5b414159caa1323f6e0c9b240c7abcd",

Save your changes, and restart the Web UI.

sudo systemctl start deluge-web

Deluge will now automatically connect to the local Deluged daemon when you login to the WebUI, without being prompted to select a Server.

---

SSH

• Add your SSH key(s) to the root, and download users ~/.ssh/authorized_keys file
• Restrict SSH access to keys-only by updating /etc/ssh/sshd_config to include:
• PermitRootLogin without-password
• PasswordAuthentication no

# Force PermitRootLogin to 'without-password'
sudo sed -i.original_config -r '/^\s*PermitRootLogin\s+/d' /etc/ssh/sshd_config
sudo echo "PermitRootLogin without-password" | sudo tee -a /etc/ssh/sshd_config

# Force PasswordAuthentication to 'no'
sudo sed -i -r '/^\s*PasswordAuthentication\s+/d' /etc/ssh/sshd_config
sudo echo "PasswordAuthentication no" | sudo tee -a /etc/ssh/sshd_config

Now check the settings are properly set:

# Check that these new settings are correctly set
sudo grep -E '^\s*(PermitRootLogin|PasswordAuthentication)\s+' /etc/ssh/sshd_config

We should see the following:

~# sudo grep -E '^\s*(PermitRootLogin|PasswordAuthentication)\s+' /etc/ssh/sshd_config
PermitRootLogin without-password
PasswordAuthentication no

If everything looks right, restart the SSH daemon

# Restart the SSH daemon
sudo systemctl restart ssh

---

Server Time

It’s recommended to set the server’s timezone to your local timezone (or to UTC).

Setting the correct timezone ensures that file modification times and timestamps in logs align with your local machine, improving consistency when integrating with other tools and making log review and troubleshooting much easier.

To see a list of timezones, use timedatectl list-timezones:

sudo timedatectl list-timezones

Once you have determined the local time zone, you can set the server’s local time zone to match via timedatectl set-timezone.

To set the server time to UTC:

sudo timedatectl set-timezone UTC

Most servers will be configured to automatically sync the time via NTP; you can check the time sync status via timedatectl

# timedatectl
               Local time: Sat 2025-11-15 20:44:12 EST
           Universal time: Sun 2025-11-16 01:44:12 UTC
                 RTC time: Sun 2025-11-16 01:44:12
                Time zone: America/New_York (EST, -0500)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

If the NTP service is inactive or otherwise stopped, you can re-enable it via set-ntp true:

sudo timedatectl set-ntp true

---

Automatic OS Package Updates

Keep your system updated automatically with the unattended-upgrades package.

Install the unattended-upgrades package (if not already installed):

sudo apt update
sudo apt install -y unattended-upgrades

When prompted to Automatically download and install stable updates? – Select “Yes“.

If the package is already installed, use dpkg-reconfigure to re-configure the automatic update settings:

sudo dpkg-reconfigure unattended-upgrades

Enable Automatic Reboot [Optional]

Note that unattended-upgrades will not automatically reboot the VPS; you may want to enable this and configure a specific reboot time in the unattended-upgrades config:

# Set unattended-upgrades to automatically reboot if necessary
# This changes the line //Unattended-Upgrade::Automatic-Reboot "false"; to true
sudo sed -i 's/\/\/Unattended-Upgrade::Automatic-Reboot "false";/Unattended-Upgrade::Automatic-Reboot "true";/' /etc/apt/apt.conf.d/50unattended-upgrades

# Set the time for the reboot (e.g., 2 AM)
# This changes the line //Unattended-Upgrade::Automatic-Reboot-Time "02:00";
sudo sed -i 's/\/\/Unattended-Upgrade::Automatic-Reboot-Time "02:00";/Unattended-Upgrade::Automatic-Reboot-Time "04:00";/' /etc/apt/apt.conf.d/50unattended-upgrades

---

Troubleshooting

Nginx shows 502 Bad Gateway

• Check if the Deluge Web service is running:

systemctl status deluge-web

• If not, restart it:

sudo systemctl restart deluge-web

• Verify it’s listening on port 8112:

netstat -tulpn | grep 8112

Permission errors with downloads

• Ensure your user is part of the deluge group:

  sudo usermod -aG deluge yourusername

• Log out and back in for group changes to take effect.

Deluge Web UI not loading properly under /deluge/

• Make sure the proxy_set_header X-Deluge-Base "/deluge/"; line is included in your Nginx config.
• Clear browser cache or try incognito mode to rule out cached redirects.

SSL certificate issues

• Ensure your domain’s DNS points to your VPS before running Certbot.
• If renewal fails, you can manually renew:

  sudo certbot renew --dry-run

---

Conclusion

You now have a Deluge seedbox running behind Nginx with HTTPS. This setup is secure, easy to manage, and lets you remotely control your torrents while also serving completed downloads via the web.

I recently picked up a VK-162 USB GPS module from AliExpress for about $8. It’s a simple, plug-and-play GPS receiver that presents itself as a serial device (on Windows, it shows up as a COM port) as opposed to most cheap GPS units, which only offer a UART output.

This same device is also known as the “G-Mouse USB GPS dongle”

Surprisingly, when I went looking for examples on how to actually read and parse data from this module, I didn’t find much. So I put together a small script that works reliably, and I’m sharing it here in case it helps someone else.

---

Features

• Built in Ublox G6010 / G7020 GPS chipset.
• 50 channel GPS L1 frequency C/A Code.
• Superior sensitivity up to -162dBm.
• Built-in WAAS/EGNOS/MSAS Demodulator without any additional hardware.
• Low power consumption.
• Waterproof design.
• USB interface with a 2m long cable.
• Magnetic base.
• Compatible with Linux & Windows.

Specifications

• Tracking sensitivity: -160dBm
• Acquisition sensitivity: -146dBm
• Cold start time: 32s [average]
• Warm start time: 32s [average]
• Hot start time: 1s [average]
• Recapture Time: 0.1s [average]

---

How It Works

When you connect the VK-162 to your PC and open the COM port (e.g., with PuTTY), you’ll see NMEA sentences streaming in, such as:

$GPRMC,,V,,,,,,,,,,N*53
$GPVTG,,,,,,,,,N*30
$GPGGA,,,,,,0,00,99.99,,,,,,*48

Although that’s valid GPS data, it’s not very user-friendly and requires further processing to be human-readable.

NMEA definitions:

$GPVTG → Course and speed over ground.
$GPRMC → Recommended Minimum GPS data (time, status, lat/lon, speed, date).
$GPGGA → Fix data (quality, satellites, altitude).
$GPGSA → DOP (dilution of precision) and active satellites.
$GPGLL → Geographic position.

---

Parsing NEMA Sentences

With Python and a couple of libraries (pyserial and pynmea2), you can parse these NMEA sentences and present them in a more readable way.

Note: I added a simple configuration flag for RAW_OUTPUT so you can choose whether to display the raw NMEA data alongside the parsed output, in case it’s not working as expected.

Install dependencies before running:

pip install pyserial pynmea2

---

Python Script

The example Python script will parse the NEMA sentences into a human readable output.

Configuration

At the top of the script, in the Config section, there’s configuration variables to set the the PORT & if RAW_OUTPUT status:

# --- Config ---
PORT = "COM9"
RAW_OUTPUT = False   # Set True to show raw NMEA sentences
BAUDRATE = 9600
# ---------------

You MUST set the correct PORT prior to running the script.

In most cases, the device will be listed as a USB Serial Device in your Windows Device Manger.

Example Code

import serial
import pynmea2

# --- Config ---
PORT = "COM9"
RAW_OUTPUT = False   # Set True to show raw NMEA sentences
BAUDRATE = 9600
# ---------------

def main():
    ser = serial.Serial(PORT, baudrate=BAUDRATE, timeout=1)
    print(f"Listening to GPS on {PORT}... (Ctrl+C to stop)")

    while True:
        try:
            line = ser.readline().decode('ascii', errors='replace').strip()
            if not line.startswith('$'):
                continue

            if RAW_OUTPUT:
                print(f"RAW: {line}")

            try:
                msg = pynmea2.parse(line)

                if isinstance(msg, pynmea2.types.talker.RMC):
                    print(f"[RMC] Time: {msg.datestamp} {msg.timestamp}")
                    print(f"      Status: {'Active (fix)' if msg.status == 'A' else 'Void (no fix)'}")
                    print(f"      Lat/Lon: {msg.latitude}, {msg.longitude}")
                    print(f"      Speed (knots): {msg.spd_over_grnd}, Course: {msg.true_course}")
                    print("-" * 40)

                elif isinstance(msg, pynmea2.types.talker.GGA):
                    print(f"[GGA] Fix Quality: {msg.gps_qual}")
                    print(f"      Satellites: {msg.num_sats}")
                    print(f"      Altitude: {msg.altitude} {msg.altitude_units}")
                    print("-" * 40)

                elif isinstance(msg, pynmea2.types.talker.GSA):
                    print(f"[GSA] Mode: {msg.mode}, Fix Type: {msg.mode_fix_type}")
                    print(f"      PDOP: {msg.pdop}, HDOP: {msg.hdop}, VDOP: {msg.vdop}")
                    print("-" * 40)

            except pynmea2.nmea.ParseError:
                continue

        except KeyboardInterrupt:
            print("Exiting...")
            break

if __name__ == "__main__":
    main()

Example Output

Here’s what the script looks like in action.

Debug mode on (RAW_OUTPUT = True)

Listening to GPS on COM9... (Ctrl+C to stop)
RAW: $GPRMC,233029.00,A,3548.56817,N,08229.00148,W,0.045,,160925,,,A*68
[RMC] Time: 2025-09-16 23:30:29+00:00
      Status: Active (fix)
      Lat/Lon: 35.8094695, -82.483358
      Speed (knots): 0.045, Course: None
----------------------------------------
RAW: $GPVTG,,T,,M,0.045,N,0.084,K,A*2E
RAW: $GPGGA,233029.00,3548.56817,N,08229.00148,W,1,08,1.05,762.2,M,-32.5,M,,*68
[GGA] Fix Quality: 1
      Satellites: 08
      Altitude: 762.2 M
----------------------------------------
RAW: $GPGSA,A,3,31,26,16,03,09,27,04,08,,,,,1.95,1.05,1.64*0A
[GSA] Mode: A, Fix Type: 3
      PDOP: 1.95, HDOP: 1.05, VDOP: 1.64
----------------------------------------
RAW: $GPGSV,3,1,09,03,16,218,21,04,79,254,33,08,30,176,31,09,42,311,33*72
RAW: $GPGSV,3,2,09,16,71,030,14,26,32,051,26,27,49,139,34,28,01,100,*7D
RAW: $GPGSV,3,3,09,31,25,088,30*46
RAW: $GPGLL,3548.56817,N,08229.00148,W,233029.00,A,A*79
RAW: $GPRMC,233030.00,A,3548.56819,N,08229.00153,W,0.058,,160925,,,A*68
[RMC] Time: 2025-09-16 23:30:30+00:00
      Status: Active (fix)
      Lat/Lon: 35.80946983333333, -82.48335883333333
      Speed (knots): 0.058, Course: None
----------------------------------------

Debug mode off (RAW_OUTPUT = False)

Listening to GPS on COM9... (Ctrl+C to stop)
[RMC] Time: 2025-09-16 23:31:17+00:00
      Status: Active (fix)
      Lat/Lon: 35.80946866666667, -82.48338616666666
      Speed (knots): 0.112, Course: None
----------------------------------------
[GGA] Fix Quality: 1
      Satellites: 08
      Altitude: 757.2 M
----------------------------------------
[GSA] Mode: A, Fix Type: 3
      PDOP: 1.94, HDOP: 1.05, VDOP: 1.63
----------------------------------------

---

No GPS Fix

If your device has not yet completed the GPS fix, you will see Status: Void.
—————————————-
Raw: $GPGSV,1,1,01,16,,,25*78
Raw: $GPGLL,,,,,,V,N*64
Raw: $GPRMC,,V,,,,,,,,,,N*53
Time: None None
Status: Void (no fix)
Lat/Lon: 0.0, 0.0
Speed (knots): None, Course: None
—————————————-

It can take up to 180 seconds to achieve a fix from a cold boot; make sure the device is near a window and has a line of sight to the outside sky.

---

Conclusion

For less than $10, this little VK-162 USB GPS dongle works great with Python. By parsing the NMEA output with pynmea2, you can easily log your position, altitude, and satellite info, or even integrate it into larger projects like mapping or robotics.

Sometimes the cheap modules on AliExpress end up being surprisingly useful — and with a bit of code, you can unlock their potential.

---

Additional Resources

https://www.instructables.com/GPS-Raspberry-Pi

The T-Deck Plus is a great LoRa product made by Lillygo that includes all the necessary hardware to use the Meshtastic framework in an easy-to-use form factor.

The problem is the default UI is… awful. It’s designed for small OLED read-only devices, and thus does not take advantage of the Blackberry-eqsue nature of the T-Deck device.

The solution is the “FancyUI” firmware; a development work-in-progress build that offers a much more user friendly UI, and shows some of the potential what the device can become in the future.

You can easily build your own firmware image using GitPod, an online build environemtn. All you need is a free GitHub account to get started.

Create a new Work Space

Access GitPod, and allow GitPod to access your GitHub account to create your new Work Space:

https://gitpod.io/new#https://github.com/meshtastic/firmware

Build the Firmware

Now that the Work Space is up-to-date, we’re ready to build the latest Meshtastic Firmware for our T-Deck-Plus.

First make sure you have the latest files; if this is your first build, the files should be up to date already.

git pull

Next we’ll make a new branch to work with where we build our firmware

git switch tft-gui-work

Now we can init the sub modules that we need

git submodule update --init

And finally build our firmware binaries, this part will take a few minutes(more like 10)

pio run -e t-deck-tft 

Once the build is complete, you’re ready to download the firmware.bin from the path specified in the terminal – /workspace/firmware/.pio/build/t-deck-tft/firmware.bin

To access the files, use the file browser on the left-hand-bar. Right click on the file in the file browser, and click Download to download the firmware.bin to your local PC.

Once we have the firmware.bin on our PC, we’re ready to shut-down the Work Space and flash our T-Deck.

Build Command Summary:

git pull
git switch tft-gui-work
git submodule update --init
pio run -e t-deck-tft 

Flashing the T-Deck

Use the M5Stick Launcher to install the new firmware.bin – https://bmorcelli.github.io/M5Stick-Launcher

Proceed with the initial T-Deck install, then use the Web or SD flasher methods to update the device.

If you are using the Web based method; first login to your Access Point on the T-Deck, then navigate to the IP address provided, and login with the username & password shown.

Click on OTA Update and select the firmware.bin file downloaded from GitPod to install.

Wait for the update to complete and reboot the T-Deck.

Upon the next boot, you should be staring at the T-Deck “FancyUI”, where you’ll need to configure the Region & usual Meshtastic Settings.

Someone on LowEndTalk recently posted a great script to automatically configure IPv6 on Online.net’s dedicated servers.  Since I’ve recently been using one of their 2EUR Kidéchire specials as a Deluge & SABnzbd box I found this quite useful.

Script Usage:

This script is designed to be run on an Online.net Dedicated Server, it has been tested on:

• Debian 7
• Ubuntu 14.04
• CentOS 7
• Proxmox VE w/ OVZ (see Issue #1)

Updated 01-23-2017

wget www.sonicboxes.com/scripts/online_net_ipv6_dhclient_Jan17.tar.gz
tar -xf online_net_ipv6_dhclient_Jan17.tar.gz
cd ipv6-dhclient-script
chmod 755 ipv6_dhclient_online_net.sh
./ipv6-dhclient-script.sh <interface> <address block> <subnet> <duid>

Example:

All of the required information can be found on your Online.net Network configuration page (console.online.net >> Server >> Network configuration).  It should look like this:

In this example, we’ll be adding the subnet 2001:0bc7:5555:101::/64 to our dedicated server via the following command:

./ipv6-dhclient-script.sh eth0 2001:0bc7:5555:101:: 64 00:04:01:07:c7:b8:2f:13:d5:a8

Next we’ll want to add some addresses from the /64 block to the server:

/sbin/ifconfig eth0 inet6 add 2001:0bc7:5555:101::1
/sbin/ifconfig eth0 inet6 add 2001:0bc7:5555:101::2

Your server should now have outgoing IPv6 connectivity and you should be able to ping the assigned address, in this example – 2001:0bc7:5555:101::1, from an outside network.

Source: GitHub – LowEndTalk Thread

This is a little script I’ve been tinkering with for a bit now, it installs LXDE + NoMachine for remote desktop access.  It’s a minimalist script based around low ram usage (perfect for LEBs!), it just installs a bare desktop, a web browser(iceweasel) and a means to access it, any other programs i.e. VPN, torrent client, etc.. must be installed by the user.

Update 1/05/15: An Android/iOS client is now available for NoMachine, please see the links below for the APK/iOS store link.  I’ll be adding a configuration guide for the Android client shortly.

Update 3/24/14: Fixed an issue with package and client URLs not resolving, also fixed a bug in the libcairo section of the script.  Please continue to report your feedback.

Usage:

wget http://www.sonicboxes.com/nx/autolxde.sh
chmod 755 autolxde.sh
./autolxde.sh

At the end of the script you will be asked if you want to create a user,

You cannot login to NoMachine as root
If you already have a non-root user, you don’t have to add another.

Add a new user? (y/n)

If you have already created a user enter n, if you have not created a user and only have the root then you should enter y and create a user at this time.  You will be prompted you the username and desired password. (more…)