Start with the Seed-Compiler from freepascal.org. The currently active Version is 3.0.4. You can compile a newer version using this one later on, but it’s not necessary (currently).

The “official” guides to install FPC + Lazaurs on Linux (and therefore the Raspberry Pi) are in the Wiki, for Linux and the Raspberry Pi. However, as IDE and compiler ar getting bigger, a little extra settings are required.

Download, Extract and install:

wget ftp://freepascal.stack.nl/pub/mirrors/fpc/dist/3.0.4/arm-linux/fpc-3.0.4.arm-linux-eabihf-raspberry.tar
tar -xf fpc-3.0.4.arm-linux-eabihf-raspberry.tar
sudo ./fpc-3.0.4.arm-linux/install.sh

Afterwards, you should have FreePascal available as text-mode, command line compiler:

pi@raspberrypi:~/Download/fpc-3.0.4.arm-linux $ fpc
Free Pascal Compiler version 3.0.4 [2017/10/11] for arm
Copyright (c) 1993-2017 by Florian Klaempfl and others

Now, download Lazarus. You might create a new directory for this, and you will probably need to install subversion, too:

sudo apt-get install subversion
svn co http://svn.freepascal.org/svn/lazarus/branches/fixes_1_8 fixes_1_8_5

To compile Lazarus, a few lot of dependencies are required, on a fresh install of Raspbian it’s something like

sudo apt-get install build-essential libgtk2.0-dev libgdk-pixbuf2.0-dev

This little line pulls > 200MB to the Pi, which might take a while. Before we can start to compile the lot, we need to increase available swap-space on the pi. Otherwise, linking Lazarus 1.8 will fail on the Pi Zero at least.

sudo su -c 'echo "CONF_SWAPSIZE=1024" > /etc/dphys-swapfile'
sudo dphys-swapfile setup
sudo dphys-swapfile swapon

Then, building Lazarus is as simple as that (however, it might take 1 hour to complete….):

make all
sudo make install

Sometimes, “make bigide” is recommended. It will almost certainly not work, and compile a lot of packages that you probably don’t need. You can then install Lazarus by invoking “sudo make install”, or start it using “startlazarus”.

But: as we used the binary distribution of the compiler, Lazarus will not be able to find the compiler sources; specifically, those of the runtime library. You can probably ignore this; it’s better, however, to get those sources:

wget ftp://freepascal.stack.nl/pub/mirrors/fpc/dist/3.0.4/source/fpc-3.0.4.source.tar.gz
tar -xf fpc-3.0.4.source.tar.gz
cd fpc-3.0.4
sudo make fpc_sourceinstall

You might want to delete the extracted directory before starting Lazarus, to prevent it from finding this directory while searching for the Freepascal sources. If it does not find the directory on it’s own, you can point it to “/usr/local/share/src/fpc-3.0.4/fpc”.

Other variants:

An older version of FPC and Lazarus is allways available in the standard packages of your system. Also, fpxdeluxe does a very goot job in pulling and installing FPC and Lazarus of any desired revision; however, the armhf6 Version required for the Raspberry Pi Zero (and A…) does not currently work.

Let’s encrypt issues SSL-Certificates for free – meanwhile most Systems trust their CA. Let’s Encrypt features a CLI to request, update and install certificates – which work’s nicely as long as your server’s setup is compatible. A Plesk based setup, however, is not.

Luckily, Plesk features it’s own CLI – so let’s make a short script to renew and update certificates. Here’s the script, I’ll explain later. It requires Let’s Encrypt’s “certbot” to be installed in $HOME.

#!/bin/sh

IP="your.ip.v4.address"
IP6="your:ip:v6:address"

#Domains, format: domain.tld sub1.domain.tld sub2.domain.tld"
Domains=("domain.tld sub1.domain.tld sub2.domain.tld" "domain2.tld2")
#"Main" domain - the name of the certificate that will be associated to the IPs above...
MainDomain="domain.tld"

echo "Certificates will be renewed and installed in Plesk:"
for dom in "${Domains[@]}"; do
  echo " $dom"
done
if [ -n "$1" ]; then
  echo "Renew will be issued for all, however only domain $1 will be updated in Plesk!"
fi
echo;
echo " IPv4: $IP"
echo " IPv6: $IP6"

#"MonthName" should be something that is unique between subsequent calles of the script
# date +%B should give the name of the current month, for more frequent calls use e.g.
# date +%Y-%M-%d_%H-%m-%S
MonthName="$(date +%Y-%m-%d_%H-%M-%S)"
echo " Unique part for each certificate's name: $MonthName"

echo;

read -p "This might brake your setup. Type YES to continue: " Keypress

if [ "$Keypress" != "YES" ]; then
  echo "I asked for \"YES\", you gave me \"$Keypress\". Exiting..." 
  exit 1
fi

echo;

read -p "Call letsencrypt-auto ? [y/N] " Keypress

if [ "$Keypress" = "y" ]; then
  ~/certbot/letsencrypt-auto renew
  echo;
  echo "Done."
fi
echo;

function installcert {
  Certname="LetsEncrypt-Auto_($MonthName)_$1"
  echo;
  echo "Installing certifikate \"$Certname\" to domain repository..."
  key_file="/etc/letsencrypt/live/$1/privkey.pem"
  cert_file="/etc/letsencrypt/live/$1/cert.pem"
  cacert_file="/etc/letsencrypt/live/$1/fullchain.pem"
  /opt/psa/bin/certificate -c $Certname -domain $1 -key-file $key_file -cert-file $cert_file -cacert-file $cacert_file
}

function installcert_admin {
        Certname="LetsEncrypt-Auto_($MonthName)_admin_$1"
        echo;
        echo "Installing certifikate \"$Certname\" to admin's repository..."
        key_file="/etc/letsencrypt/live/$1/privkey.pem"
        cert_file="/etc/letsencrypt/live/$1/cert.pem"
        cacert_file="/etc/letsencrypt/live/$1/fullchain.pem"
        /opt/psa/bin/certificate -c $Certname -admin -key-file $key_file -cert-file $cert_file -cacert-file $cacert_file
}


function assigncert {
  Certname="LetsEncrypt-Auto_($MonthName)_$1"
  /opt/psa/bin/subscription -u $2 -certificate-name $Certname
}

read -p "Install certificates in Plesk? [y/N] " Keypress

if [ "$Keypress" = "y" ]; then
  for domain in "${Domains[@]}"; do
    #Split into another array
    subs=($domain)
    main="${subs[0]}"
    echo "Working on domain $main..."
    #Domain $domain will only been updated if either no arguments are given, or the one and only argument matches $domain
    if ( [ "$1" == "$main" ] ) || ( [ -z "$1" ] ); then
      installcert "$main"
      #Then assign all certificates
      for sub in "${subs[@]}"; do
        assigncert "$main" "$sub"
      done
    else
      echo "==> Skipped."
    fi
  done

  echo;
  echo "Done."
  echo;
fi

read -p "Install & Assign SSL-Certificate of $MainDomain for IPs (Admin's repository)? [y/N] " Keypress

if [ "$Keypress" = "y" ]; then
  installcert_admin "$MainDomain"
  /opt/psa/bin/certificate -ac "LetsEncrypt-Auto_($MonthName)_admin_$MainDomain" -admin -ip $IP
  /opt/psa/bin/certificate -ac "LetsEncrypt-Auto_($MonthName)_admin_$MainDomain" -admin -ip $IP6 
fi

function mailcert {
  Uhr="$(date +%Y-%m-%d_%H-%M-%S)"
  key_file="/etc/letsencrypt/live/$1/privkey.pem"
        cert_file="/etc/letsencrypt/live/$1/cert.pem"
        cacert_file="/etc/letsencrypt/live/$1/fullchain.pem"
        tar -chjf Cert-Backup-$Uhr.tar.bz2 /etc/postfix/postfix_default.pem /usr/share/imapd.pem /usr/share/pop3d.pem
        #Concat certificate for eMail...
  cat $key_file >/tmp/newcert.pem
  cat $cert_file >>/tmp/newcert.pem
  cat $cacert_file >>/tmp/newcert.pem
  cp /tmp/newcert.pem /etc/postfix/postfix_default.pem
  cp /tmp/newcert.pem /usr/share/imapd.pem
  cp /tmp/newcert.pem /usr/share/pop3d.pem
  chmod 400 /usr/share/imapd.pem
  chmod 400 /usr/share/pop3d.pem
  chmod 600 /etc/postfix/postfix_default.pem
  rm /tmp/newcert.pem
  /usr/local/psa/admin/sbin/mailmng --restart-service
}

read -p "Install certificate of $MainDomain to Postfix/IMAP/POP ? [y/N] "

if [ "$Keypress" = "y" ]; then
  mailcert "$MainDomain"
fi

The script has a short configuration section at the top, most notably the domains you want to work on. They are give in a string array, containing the domain name given first when registering a certificate with LetsEncrypt as the first token, and all sub domains you want to secure with the same certificate separated with spaces. More precisely: Let’s encrypt stores your certificates into /etc/letsencrypt/live/<domain>, the first token is used to generate this path. I recommend using your domain without any subdomain for this purpose, i.e. “domain.tld sub.domain.tld sub2.domain.tld”. To achieve this, when calling lestencrypt-auto, give this domain as the first one, i.e.

./letsencrypt-auto certonly --webroot -w /var/www/httpdocs -d domain.tld -d sub.domain.tld

This, of course, requires your domains to be set up in Plesk the same way, i.e. in Plesk, domains with the names “domain.tld”, “sub.domain.tld” and “sub2.domain.tld” must exist. The Plesk-CLI commands used to register and setup are:

• /opt/psa/bin/certificate -c <certname> -domain <domaine> -key-file <key_file> -cert-file <cert_file> -cacert-file <cacert_file>
• /opt/psa/bin/subscription -u <domain> -certificate-name <certname>

If you want your IP-Adresses given a default certificate, you should set both IP-Adress variables AND the “main domain” setting. The script will look for a certificate issued for this domain, register it in the admin’s repositiry and the assign it to both addresses. The respective commands issued are:

• /opt/psa/bin/certificate -c <certname> -admin -key-file <key_file> -cert-file <cert_file> -cacert-file <cacert_file>
• /opt/psa/bin/certificate -ac <certname> -admin -ip <IP>

If you want your email communication to be secured with your Lets Encrypt certificates, you have to request a certificate for your “main domain” that includes your MX subdomain. For example, if “main domain” is set to “example.com” and MX for this domain is “mail.example.com”, your certificate must include this subdomain. Securing a Plesk-based system’s email with your own SSL-Certificates has been described by Jay Versluis on wpguru.co.uk, and I simply scripted his approach.

Multiple Computers at the same Keyboard, Video and Mouse – no problem when using a KVM Switch. Unfortunately, mine (DLink DKVM-2KU) does not seem to route the IDx-Pins of the VGA connector correctly, my system was not able to get the required EDID data to know which timings and resolutions are supported by the monitor.

This resulted in a max. resolution of 1360×768 pixels – way below the native 1920×1080 (which I could easily set when connecting the display directly via DVI or VGA). Most guides to add additional resolutions suggest asking gtf or cvt to calculate the respective timings (where for TFT-Displays CVT-based timings should be used, see e.g. http://www.uruk.org/~erich/projects/cvt/) and pasting these to xrandr to set the required mode. However, this does not work if xrandr thinks the monitor cannot take the requested frequencies.

A call to cvt may produce this:

X@Y ~ $ cvt 1920 1080
# 1920x1080 59.96 Hz (CVT 2.07M9) hsync: 67.16 kHz; pclk: 173.00 MHz
Modeline "1920x1080_60.00"  173.00  1920 2048 2248 2576  1080 1083 1088 1120 -hsync +vsync

The printed “modeline” contains all the timings needed for the card to drive the monitor at the requested resolution, however – in my case – adding the requested resolution resulted in an error, basically telling me that one of the parameters was not in a range supported by some device in the chain (DAC or Monitor for example):

X@Y ~ $ xrandr --newmode "1920x1080_60.00"  172.80  1920 2040 2248 2576  1080 1081 1084 1118  -HSync +Vsync
X@Y ~ $ xrandr --addmode VGA-0 "1920x1080_60.00"
X Error of failed request:  BadMatch (invalid parameter attributes)
  Major opcode of failed request:  140 (RANDR)
  Minor opcode of failed request:  18 (RRAddOutputMode)
  Serial number of failed request:  29
  Current serial number in output stream:  30

Most forum-threads, guides and Wiki-entires break at this point and say “Well, your monitor simply cannot do this”. Mine does, however the system doesn’t know. The source of the problem was in the X-Org config-file /usr/share/X11/xorg.conf.d/90-monitor.conf (in this case of Linux Mint 17.1, although I don’t know where this file came from – it doesn’t seem to be part of the standard system packages), which contained:

Section "Monitor"
    Identifier     "Monitor0"
    VendorName     "Unknown"
    ModelName      "Unknown"
    HorizSync       30.0 - 63.0
    VertRefresh     55.0 - 75.0
    Option         "DPMS"
EndSection

When I2C and therefore EDID is working correctly, the file seems to get overruled by the information provided by the monitor – in my case, EDID didn’t get past the KVM switch. The modeline calculated by cvt stated a pixel-clock of 172.80 MHz, together with a total virtual display width of 2576 points. This results in a horizontal refresh-rate of 67 kHz – which is higher than the maximum of 63 kHz given in the file.

Once I fixed this (I set it to 200, which is way to high, but doesn’t matter here…), xrandr accepted the mode. If you want this to be permanent, you might configure your X-Server according to this guide – but don’t forget to add the HorizSync and VertRefresh parameters!

But, for haven’s sake, be careful! Setting really wrong values will at least leave you without a picture (or an “Out of Range” message) for TFT screens, CRTs might get damaged!

Update: There’s annother error that I came accross when reinstalling the machine recently:

X Error of failed request:  BadName (named color or font does not exist)

This time, I simply had to change the name of the mode from “1920x1080_60.00” to “1080p” – problem solved. Possibly my Xsession-script did not fail completely and blocked the name for future use…