[Nexus 7 (2013) LTE Android Development] espionage724:
Initial Instructions:

Wipe device (TWRP -> Wipe all partitions and Format Data)

Flash ROM (copy the zip over to the Internal Storage of the N7 over USB)

Format Data and Cache to F2FS (optional; need a supporting TWRP (TODO: add link to 3rd-party TWRP if needed) and if used, a custom kernel; note the encryption compatibility note in the first post)

Flash GApps (optional; DO NOT do this if wanting to use microG)

Flash a custom Kernel (optional; the included kernel is default Lineage with forced encryption, I use (TODO: find a custom kernel to vouch for if needed))

Flash Magisk (optional)

Reboot to System

Update Instructions:

Boot to TWRP

Flash updated ROM zip

Flash custom kernel (optional; but if you've used a custom kernel before, it'll be replaced with the default LineageOS one when you update; I recommend using the same kernel or an updated version of it)

Flash Magisk (optional; but it may need re-flashed if you've flashed it previously and either update the ROM, or a custom kernel)

Reboot to System

microG Application Descriptions:

microG Services Core: Core services and UnifiedNlp (required)

microG Services Framework Proxy: Google Cloud Messaging support

microG DroidGuard Helper: SafetyNet support

UnifiedNlp Application Descriptions:

NominatimNlpBackend: Looks up location based on geo-data (required)

LocalGsmNlpBackend: Notes cellular towers you connect to and refers to a local database (created from online sources) to determine location

LocalWifiNlpBackend: Scans nearby WiFi APs, links them to GPS coordinates, and stores them in a local database to determine location

Apple UnifiedNlp: Scans nearby WiFi APs and uses Apple's database to determine location

MozillaNlpBackend: Scans nearby WiFi APs and uses Mozilla's database to determine location (less work to set-up than LocalGSM and LocalWifi)

microG + UnifiedNlp Instructions:

Install F-Droid

Enable Unstable Updates (F-Droid Settings -> Expert mode -> Unstable updates; it's currently required to install the latest unstable microG Services Core)

Add the microG repository (visit https://microg.org/download.html)

Install the following: microG Services Core, NominatimNlpBackend, location backend(s) of choice, and other microG applications of choice for additional features (see the above list)

Enable Signature Spoofing for microG Services Core (Settings -> Apps -> ⚙ -> App permissions -> Spoof package signature)

Grant all permissions available for microG Services Core and location backend(s) of choice Settings -> Apps -> (application) -> Permissions)

Open microG Settings and enable desired features (if using Google SafetyNet, you must do ⋮ -> Advanced -> Use official server)

Configure UnifiedNlp Settings (check Nominatim from address lookup backends, and check desired location backend(s) under location backends)

Verify Self-Check has confirmation on all checks (UnifiedNlp being registered in system may require a reboot to start working)

Recommended microG + UnifiedNlp Packages:

Install microG Services Core, microG Services Framework Proxy, microG DroidGuard Helper, NominatimNlpBackend, and MozillaNlpBackend

If you want to run location resolution locally, install LocalGsmNlpBackend and LocalWifiNlpBackend instead of MozillaNlpBackend, or alternatively, install all three and keep MozillaNlpBackend disabled until required

App Store Notes:

You'll likely either want Yalp Store and FakeStore, or legitimate Google Play Store

If you're trying to avoid Google services, Yalp Store + FakeStore is what you'll want

Play Store will likely be wanted if you want a higher chance at being able to use paid apps and IAP (no guarantees; untested)

Play Store needs to be installed as a privileged application to work properly, and also assigns itself high permissions

You can also choose to install Play Store and Yalp Store; note that FakeStore should not be installed at the same time as Play Store though

You can also use any other app store(s) instead of Play Store or Yalp Store or even choose to not install a store at all, but any apps you install that depend on Play Store will need FakeStore installed still

Yalp Store Application Descriptions:

FakeStore: Fakes the presence of Google Play Store for applications that require it

Yalp Store: Allows downloading and updating of apps from Google Play Store, serves as an alternative to official Google Play Store, and if signed-in with your real Google account, allows for paid-apps to be downloaded; apps that do license checks post-install will fail, and IAP isn't possible currently

Yalp Store Instructions:

Open F-Droid

Install FakeStore and Yalp Store

Enable Signature Spoofing for FakeStore (Settings -> Apps -> ⚙ -> App permissions -> Spoof package signature)

Configure Yalp Store (⋮ -> Settings -> Pretend to be a Nexus 7 2013 (TODO: Fix the name for this) ; this is potentially required to avoid this)

Download desired applications

Enable only updating of applications acquired through Yalp Store (optional; sometimes versions differ from Play Store and F-Droid; ⋮ -> Settings -> Change app white list -> (select apps), and also set the Black or white list of apps for update to Only the chosen apps will be checked for updates)

Play Store Application Description:

Phonesky.apk: This is the name of the Play Store apk; allows for traditional Play Store behavior; apps that do post-install license checks and IAP are personally untested (feedback from anyone who tests this would be awesome)

Play Store Instructions:

Download the latest open_gapps-arm-7.1-pico archive (GitHub or the main site)

Extract it somewhere temporary

Go into the Core folder and find vending-all.tar.lz

Extract its contents

Go into the vending-all/240-320-480/priv-app/Phonesky folder

Take Phonesky.apk and move it somewhere temporary or just note its location

Reboot your device to Recovery

Mount /system on the Android device and use adb push to copy Phonesky.apk from local storage to /system/priv-app/Phonesky.apk

Reboot to System