Short, evergreen reference notes — cheatsheets, snippets, and gotchas I want to keep around.
Before you can trust the Zscaler root CA anywhere, you need the actual certificate file in PEM form. Three routes: ask the admin, pull it from the ZIA Admin Console, or export it from the Windows trust store, plus how to tell whether you need Zscaler's root or your own organization's.
Windows trusting the Zscaler root CA does nothing for a WSL distro or a Hyper-V Linux guest: each is a separate OS with its own CA bundle. Drop the PEM into /usr/local/share/ca-certificates/ as a .crt and run update-ca-certificates, minding the .crt-only glob, the PEM-vs-DER trap and the file mode.
Zscaler does TLS interception, re-signing HTTPS with its own root CA that MSYS2 doesn't trust — so pacman, curl, wget, git and friends all fail with certificate verification errors. Export the Zscaler root from the Windows cert store and add it to MSYS2's CA trust to fix them all at once.
Quick `sed` recipes to bump Debian to the next major release — 10 → 11, 11 → 12, 12 → 13 — by rewriting apt sources and running a full-upgrade.
Copy-pasteable Watchtower deploys — the one-line docker run, an equivalent docker-compose.yml, and the handful of flags I actually use (interval, cleanup, label scoping, notifications).
Prune old vPostgres WAL archives so a VCSA patch or upgrade isn't blocked by a /storage/archive precheck warning.
When a VCSA stage-and-install dies with FileNotFoundError on patching_backup_config.json, the real cause is almost always an expired or unentitled Broadcom download token. Refresh the token, clean partial staging state, retry.
What this Public Knowledge Base is for, and a quick smoke-test of code-block syntax highlighting.