remake arch install as a PKGBUILD
parent
18b93f86ba
commit
328ed7e95f
|
|
@ -0,0 +1,230 @@
|
||||||
|
pkgname="ajh-setup"
|
||||||
|
pkgver="1.0.0"
|
||||||
|
pkgver="1"
|
||||||
|
pkgrel="1"
|
||||||
|
pkgdesc="Install my config for Arch based systems."
|
||||||
|
arch=("x86_64")
|
||||||
|
|
||||||
|
|
||||||
|
depends=(
|
||||||
|
#system core, provides core functionality like internet, sound, etc.
|
||||||
|
"pipewire"
|
||||||
|
"pipewire-alsa"
|
||||||
|
"pipewire-pulse"
|
||||||
|
"pipewire-jack"
|
||||||
|
"gst-plugin-pipewire"
|
||||||
|
"wireplumber"
|
||||||
|
"wireplumber-docs"
|
||||||
|
"alsa-utils"
|
||||||
|
"freetype2"
|
||||||
|
"gst-libav"
|
||||||
|
"btrfs-progs"
|
||||||
|
"fuse"
|
||||||
|
"mesa"
|
||||||
|
"libva-mesa-driver"
|
||||||
|
"connman"
|
||||||
|
"brightnessctl"
|
||||||
|
|
||||||
|
#system extra, extra programs that don't provide core functionality, but are still useful
|
||||||
|
"man-db"
|
||||||
|
"xdg-utils"
|
||||||
|
"xdg-user-dirs"
|
||||||
|
"pacman-contrib"
|
||||||
|
"python-urwid"
|
||||||
|
"ufw"
|
||||||
|
"wget"
|
||||||
|
"curl"
|
||||||
|
"zip"
|
||||||
|
"unzip"
|
||||||
|
"p7zip"
|
||||||
|
"dash"
|
||||||
|
"rsync"
|
||||||
|
"cronie"
|
||||||
|
"udisks2"
|
||||||
|
"udiskie"
|
||||||
|
"bc"
|
||||||
|
"opendoas"
|
||||||
|
"zsh"
|
||||||
|
"openssh"
|
||||||
|
"flatpak"
|
||||||
|
|
||||||
|
#devel
|
||||||
|
"clang"
|
||||||
|
"python-pip"
|
||||||
|
"shellcheck"
|
||||||
|
"fakeroot"
|
||||||
|
#"base-devel"
|
||||||
|
|
||||||
|
#multimedia
|
||||||
|
"pavucontrol"
|
||||||
|
"yt-dlp"
|
||||||
|
"mpd"
|
||||||
|
"mpv"
|
||||||
|
"imv"
|
||||||
|
|
||||||
|
#misc
|
||||||
|
"lynx"
|
||||||
|
"aria2" #optional dependency of ani-cli
|
||||||
|
|
||||||
|
#theming
|
||||||
|
"noto-fonts"
|
||||||
|
"noto-fonts-emoji"
|
||||||
|
"noto-fonts-cjk"
|
||||||
|
"lxappearance"
|
||||||
|
"qt5ct"
|
||||||
|
|
||||||
|
#tui, terminal programs and programs/libs used by them
|
||||||
|
"imagemagick"
|
||||||
|
"ffmpegthumbnailer"
|
||||||
|
"python-pdftotext"
|
||||||
|
"chafa"
|
||||||
|
"bat"
|
||||||
|
"ncmpcpp"
|
||||||
|
"bc"
|
||||||
|
"transmission-cli"
|
||||||
|
"neovim"
|
||||||
|
"libsixel"
|
||||||
|
|
||||||
|
#desktop, programs related to setting up a graphical user interface
|
||||||
|
"sway"
|
||||||
|
"swaybg"
|
||||||
|
"swayidle"
|
||||||
|
"swaylock"
|
||||||
|
"waybar"
|
||||||
|
"mako"
|
||||||
|
"wl-clipboard"
|
||||||
|
"grim"
|
||||||
|
"slurp"
|
||||||
|
"xorg-xwayland"
|
||||||
|
"gammastep"
|
||||||
|
"waylock"
|
||||||
|
"foot"
|
||||||
|
"foot-terminfo"
|
||||||
|
)
|
||||||
|
|
||||||
|
optdepends=()
|
||||||
|
|
||||||
|
license=("MIT")
|
||||||
|
#sha512sums=("SKIP")
|
||||||
|
|
||||||
|
systemd_setup() {
|
||||||
|
echo "setting up systemd services..."
|
||||||
|
sudo timedatectl set-ntp true
|
||||||
|
|
||||||
|
#system services
|
||||||
|
sudo systemctl enable connman.service
|
||||||
|
sudo systemctl enable ufw.service
|
||||||
|
sudo systemctl enable cronie.service
|
||||||
|
sudo systemctl enable systemd-timesyncd.service
|
||||||
|
#sudo systemctl enable nix-daemon.service
|
||||||
|
|
||||||
|
#user services
|
||||||
|
systemctl --user enable mako.service
|
||||||
|
systemctl --user enable mpd.service
|
||||||
|
systemctl --user enable pipewire.service
|
||||||
|
systemctl --user enable pipewire-pulse.service
|
||||||
|
systemctl --user enable wireplumber.service
|
||||||
|
|
||||||
|
echo "done setting up systemd services."
|
||||||
|
}
|
||||||
|
|
||||||
|
wireless() {
|
||||||
|
echo "Installing wireless programs..."
|
||||||
|
sudo pacman -S tlp iwd bluez bluez-utils
|
||||||
|
|
||||||
|
sudo systemctl enable tlp.service
|
||||||
|
sudo systemctl enable bluetooth.service
|
||||||
|
|
||||||
|
sudo systemctl enable connman.service
|
||||||
|
sudo systemctl enable iwd.service
|
||||||
|
|
||||||
|
echo "Done installing wireless programs."
|
||||||
|
}
|
||||||
|
|
||||||
|
configuration() {
|
||||||
|
echo "Starting installation configuration..."
|
||||||
|
#setup home directories
|
||||||
|
mkdir ~/docs/
|
||||||
|
mkdir ~/dl/
|
||||||
|
mkdir ~/media/
|
||||||
|
mkdir -p ~/.config/mpd/playlists
|
||||||
|
mkdir -p ~/.local/share/gnupg/
|
||||||
|
mkdir -p ~/.local/share/desktop
|
||||||
|
mkdir -p ~/.local/share/wineprefixes/default
|
||||||
|
mkdir -p ~/.local/share/templates
|
||||||
|
mkdir -p ~/.local/share/public
|
||||||
|
mkdir -p ~/media/audio
|
||||||
|
mkdir -p ~/media/img
|
||||||
|
mkdir -p ~/media/video
|
||||||
|
mkdir -p ~/.local/src/
|
||||||
|
|
||||||
|
#setup ufw
|
||||||
|
sudo ufw default deny incoming
|
||||||
|
sudo ufw default allow outgoing
|
||||||
|
sudo ufw allow http
|
||||||
|
sudo ufw allow https
|
||||||
|
#sudo ufw allow ssh
|
||||||
|
sudo ufw allow ntp
|
||||||
|
sudo ufw allow 67:68/tcp
|
||||||
|
sudo ufw allow 53
|
||||||
|
|
||||||
|
#allow torrent client traffic
|
||||||
|
sudo ufw allow 56881:56889/tcp
|
||||||
|
|
||||||
|
#rules to allow steam
|
||||||
|
sudo ufw allow 27000:27036/udp
|
||||||
|
sudo ufw allow 27036:27037/tcp
|
||||||
|
sudo ufw allow 4380/udp
|
||||||
|
|
||||||
|
sudo ufw enable
|
||||||
|
|
||||||
|
#zsh setup
|
||||||
|
chsh -s /bin/zsh "$USER"
|
||||||
|
|
||||||
|
#setup .zprofile and zsh history file
|
||||||
|
cd ~ || return
|
||||||
|
ln -s ~/.profile ~/.zprofile
|
||||||
|
mkdir -p ~/.cache/zsh
|
||||||
|
touch ~/.cache/zsh/history
|
||||||
|
|
||||||
|
#limits.conf configuration
|
||||||
|
#set limits for esync
|
||||||
|
sudo sh -c "echo '$USER hard nofile 524288' >> /etc/security/limits.conf"
|
||||||
|
|
||||||
|
#set limits for monero
|
||||||
|
sudo sh -c "echo '$USER hard memlock 2048' >> /etc/security/limits.conf"
|
||||||
|
sudo sh -c "echo '$USER hard memlock 2048' >> /etc/security/limits.conf"
|
||||||
|
|
||||||
|
#fixes
|
||||||
|
sudo sh -c 'echo "export _JAVA_AWT_WM_NONREPARENTING=1" >> /etc/profile.d/jre.sh'
|
||||||
|
|
||||||
|
#theming
|
||||||
|
sudo sh -c 'echo "FONT=Lat2-Terminus16" >> /etc/vconsole.conf'
|
||||||
|
ln -s /usr/share/backgrounds/archlinux/lone.jpg ~/.config/wall
|
||||||
|
ln -s ~/.config/Xresources ~/.Xdefaults
|
||||||
|
|
||||||
|
#download collapse OS if it is not already
|
||||||
|
if ! [ -f "$HOME/.local/src/collapseos-latest.tar.gz" ]; then
|
||||||
|
echo "downloading collapseOS"
|
||||||
|
cd "$HOME"/.local/src/
|
||||||
|
wget http://collapseos.org/files/collapseos-latest.tar.gz
|
||||||
|
cd -
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Done performing installation configuration."
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
package() {
|
||||||
|
#do any installation steps here
|
||||||
|
echo "installing..."
|
||||||
|
|
||||||
|
systemd_setup
|
||||||
|
clear
|
||||||
|
echo "Install wireless programs? (iwd bluez and tlp) (y/N)?"
|
||||||
|
read input
|
||||||
|
[ "$input" = "y" ] && wireless
|
||||||
|
|
||||||
|
echo "installation complete."
|
||||||
|
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
YAY_INSTALL_DIR="$HOME/.local/src/"
|
||||||
|
|
||||||
|
aurprogs="mutt-wizard
|
||||||
|
htim
|
||||||
|
jmtpfs
|
||||||
|
tremc-git
|
||||||
|
dashbinsh
|
||||||
|
pfetch
|
||||||
|
sysrq-enabler
|
||||||
|
wlr-randr
|
||||||
|
sfeed
|
||||||
|
udiskie
|
||||||
|
waylogout-git
|
||||||
|
ani-cli-git
|
||||||
|
connman-gtk
|
||||||
|
opendoas-sudo
|
||||||
|
shell-color-scripts
|
||||||
|
lf-sixel-git
|
||||||
|
nerd-fonts-mononoki
|
||||||
|
autotiling
|
||||||
|
cli-visualizer
|
||||||
|
wob
|
||||||
|
wayland-idle-inhibitor-git
|
||||||
|
tofi
|
||||||
|
librewolf-bin"
|
||||||
|
|
||||||
|
|
||||||
|
mkdir -p "$YAY_INSTALL_DIR"
|
||||||
|
git clone https://aur.archlinux.org/yay.git "$YAY_INSTALL_DIR"
|
||||||
|
cd "$YAY_INSTALL_DIR"
|
||||||
|
makepkg -si
|
||||||
|
|
||||||
|
for pkg in $aurprogs
|
||||||
|
do
|
||||||
|
yay -S "$pkg"
|
||||||
|
|
||||||
|
done
|
||||||
|
|
||||||
|
|
@ -0,0 +1,52 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
#enable multilib
|
||||||
|
if [ -z "$(grep "^\[multilib" /etc/pacman.conf)" ]; then
|
||||||
|
sudo sh -c "echo "[multilib]" >> /etc/pacman.conf"
|
||||||
|
sudo sh -c "echo "Include\ =\ /etc/pacman.d/mirrorlist" >> /etc/pacman.conf"
|
||||||
|
sudo sh -c "echo "" >> /etc/pacman.conf"
|
||||||
|
fi
|
||||||
|
|
||||||
|
for arg in "$@"
|
||||||
|
do
|
||||||
|
if [ "$arg" = "--nvidia" ]; then
|
||||||
|
NVIDIA_GPU="TRUE"
|
||||||
|
elif [ "$arg" = "--amd" ]; then
|
||||||
|
AMD_GPU="TRUE"
|
||||||
|
elif [ "$arg" = "--intel" ]; then
|
||||||
|
INTEL_GPU="TRUE"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ -z "$NVIDIA_GPU" ] && [ -z "$AMD_GPU" ] && [ -z "$INTEL_GPU" ]; then
|
||||||
|
echo "Enter GPU type (amd nvidia intel):"
|
||||||
|
read input
|
||||||
|
|
||||||
|
[ "$input" = "amd" ] && AMD_GPU="TRUE"
|
||||||
|
[ "$input" = "nvidia" ] && NVIDIA_GPU="TRUE"
|
||||||
|
[ "$input" = "intel" ] && INTEL_GPU="TRUE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Installing with:"
|
||||||
|
[ "$AMD_GPU" = "TRUE" ] && echo "AMD GPU"
|
||||||
|
[ "$NVIDIA_GPU" = "TRUE" ] && echo "NVIDIA GPU"
|
||||||
|
[ "$INTEL_GPU" = "TRUE" ] && echo "INTEL GPU"
|
||||||
|
echo "press enter to continue."
|
||||||
|
read input
|
||||||
|
|
||||||
|
|
||||||
|
[ -z "$(grep "^\[lib32" /etc/pacman.conf)" ] && [ -z "$NVIDIA_GPU" ] && [ -z "$AMD_GPU" ] && [ -z "$INTEL_GPU" ] && exit
|
||||||
|
|
||||||
|
[ "$NVIDIA_GPU" = "TRUE" ] && sudo pacman -S nvidia-utils lib32-nvidia-utils
|
||||||
|
[ "$AMD_GPU" = "TRUE" ] && sudo pacman -S vulkan-radeon lib32-vulkan-radeon
|
||||||
|
[ "$INTEL_GPU" = "TRUE" ] && sudo pacman -S vulkan-intel lib32-vulkan-intel
|
||||||
|
|
||||||
|
sudo pacman -S vulkan-mesa-layers lib32-vulkan-mesa-layers
|
||||||
|
|
||||||
|
sudo pacman -S wine winetricks
|
||||||
|
sudo pacman -S giflib lib32-giflib libpng lib32-libpng libldap lib32-libldap gnutls lib32-gnutls mpg123 lib32-mpg123 openal lib32-openal v4l-utils lib32-v4l-utils libpulse lib32-libpulse alsa-plugins lib32-alsa-plugins alsa-lib lib32-alsa-lib libjpeg-turbo lib32-libjpeg-turbo libxcomposite lib32-libxcomposite libxinerama lib32-libxinerama ncurses lib32-ncurses opencl-icd-loader lib32-opencl-icd-loader libxslt lib32-libxslt libva lib32-libva gtk3 lib32-gtk3 gst-plugins-base-libs lib32-gst-plugins-base-libs vulkan-icd-loader lib32-vulkan-icd-loader lib32-pipewire lib32-pipewire-v4l2 lib32-pipewire-jack cups samba dosbox
|
||||||
|
|
||||||
|
sudo pacman -S gamemode lib32-gamemode
|
||||||
|
sudo pacman -S lutris steam
|
||||||
|
|
||||||
|
yay -S protonup-git
|
||||||
|
|
@ -0,0 +1,34 @@
|
||||||
|
#!/bin/sh
|
||||||
|
#
|
||||||
|
#install required programs
|
||||||
|
sudo pacman -S apparmor firejail
|
||||||
|
|
||||||
|
#enable apparmor service
|
||||||
|
sudo systemctl enable apparmor.service
|
||||||
|
sudo systemctl start apparmor.service
|
||||||
|
|
||||||
|
#configure apparmor to use firejail and configure firejail to automatically run for supported programs
|
||||||
|
sudo apparmor_parser -r /etc/apparmor.d/firejail-default
|
||||||
|
sudo firecfg
|
||||||
|
|
||||||
|
add user to /etc/firejail/firejail.users if it is not already in the file
|
||||||
|
if [ -z "$(grep "$USER" /etc/firejail/firejail.users)" ]; then
|
||||||
|
sudo sh -c "echo '$USER' >> /etc/firejail/firejail.users"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Applying Hardening Configuration"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
echo "append this to your kernel params file:"
|
||||||
|
echo " lsm=landlock,lockdown,yama,integrity,apparmor,bpf"
|
||||||
|
echo " systemd-boot: /boot/loader/entries/*.conf, append to end of line beginning with \"options\""
|
||||||
|
echo " grub: /etc/default/grub"
|
||||||
|
echo ""
|
||||||
|
echo " run this script again after rebooting to ensure all settings are applied correctly."
|
||||||
|
echo " press enter to continue."
|
||||||
|
read input
|
||||||
|
|
||||||
|
#add any firejail configuration here
|
||||||
|
#fix mpv not being able to open some files, allows mmpv to play videos in the ~/media dir
|
||||||
|
sudo sh -c 'echo "whitelist $HOME/media" >> /etc/firejail/whitelist-player-common.local'
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
sudo pacman -S ungoogled-chromium
|
||||||
|
|
||||||
|
yay -S aur/chromium-extension-ublock-origin
|
||||||
|
|
||||||
|
yay -S aur/chromium-extension-web-store
|
||||||
|
yay -S aur/chromium-widevine
|
||||||
|
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
#!/bin/sh
|
||||||
|
echo "install virt-manager?(y/N)"
|
||||||
|
read -r input
|
||||||
|
if [ "$input" = "y" ] || [ "$input" = "Y" ]; then
|
||||||
|
sudo pacman -S --noconfirm sudo pacman -S libvirt qemu virt-manager lxsession
|
||||||
|
sudo pacman -S --noconfirm gst-plugins-good libvirt-runit
|
||||||
|
|
||||||
|
sudo usermod -G libvirt -a "$USER"
|
||||||
|
fi
|
||||||
|
|
||||||
|
#TODO need to enable systemd services
|
||||||
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
had to remove some pkgs from base.list
|
|
||||||
|
|
||||||
only had to enable multilib in pacman.conf
|
|
||||||
|
|
||||||
was prompted to replace jack2 which caused base.list install to not work
|
|
||||||
|
|
||||||
removed grub update since using systemd boot
|
|
||||||
|
|
||||||
commented out runit setup
|
|
||||||
|
|
||||||
dont need to install: chronie, cronie?(systemd timers)
|
|
||||||
|
|
||||||
#Remember for next install
|
|
||||||
*make sure to enter in the kernel image names correctly (especially if using zen kernel)
|
|
||||||
*for systemd boot for PARTUUID get this from blkid
|
|
||||||
*remember to generate locales (locale-gen)
|
|
||||||
|
|
||||||
|
|
@ -1,319 +0,0 @@
|
||||||
#!/bin/sh
|
|
||||||
|
|
||||||
|
|
||||||
. ./programs.sh
|
|
||||||
|
|
||||||
#$1 -> repo name to enable
|
|
||||||
#$2 -> mirror list file name in /etc/pacman.d/ (default: mirrorlist)
|
|
||||||
#ex: enable_repo lib32
|
|
||||||
#ex: enable_repo community mirrorlist-arch
|
|
||||||
enable_repo() {
|
|
||||||
REPO="$1"
|
|
||||||
MIRRORLIST="mirrorlist"
|
|
||||||
[ "$2" ] && MIRRORLIST="$2"
|
|
||||||
|
|
||||||
if [ $# -gt 0 ] && [ -z "$(grep "^\[$1" /etc/pacman.conf)" ]; then
|
|
||||||
sudo sh -c "echo "[$REPO]" >> /etc/pacman.conf"
|
|
||||||
sudo sh -c "echo "Include\ =\ /etc/pacman.d/$MIRRORLIST" >> /etc/pacman.conf"
|
|
||||||
sudo sh -c "echo "" >> /etc/pacman.conf"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
#TODO only needed to enable multilib for arch
|
|
||||||
enable_repos() {
|
|
||||||
sudo pacman -Sy
|
|
||||||
|
|
||||||
|
|
||||||
#commenting since this is done during archinstall
|
|
||||||
#enable multilib
|
|
||||||
#sudo sh -c "echo "[multilib]" >> /etc/pacman.conf"
|
|
||||||
#sudo sh -c "echo "Include\ =\ /etc/pacman.d/mirrorlist" >> /etc/pacman.conf"
|
|
||||||
#sudo sh -c "echo "" >> /etc/pacman.conf"
|
|
||||||
|
|
||||||
|
|
||||||
#add ungoogled chroimum OBS repo
|
|
||||||
curl -s 'https://download.opensuse.org/repositories/home:/ungoogled_chromium/Arch/x86_64/home_ungoogled_chromium_Arch.key' | sudo pacman-key -a -
|
|
||||||
echo '
|
|
||||||
[home_ungoogled_chromium_Arch]
|
|
||||||
SigLevel = Required TrustAll
|
|
||||||
Server = https://download.opensuse.org/repositories/home:/ungoogled_chromium/Arch/$arch' | sudo tee --append /etc/pacman.conf
|
|
||||||
sudo pacman -Sy
|
|
||||||
|
|
||||||
|
|
||||||
sudo pacman -Sy
|
|
||||||
|
|
||||||
#install yay for aur support
|
|
||||||
sudo pacman -S git fakeroot base-devel
|
|
||||||
|
|
||||||
mkdir -p ~/.local/src/
|
|
||||||
git clone https://aur.archlinux.org/yay.git ~/.local/src/yay/
|
|
||||||
cd ~/.local/src/yay || return
|
|
||||||
makepkg -si
|
|
||||||
cd -
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
init_setup() {
|
|
||||||
sudo timedatectl set-ntp true
|
|
||||||
|
|
||||||
#system services
|
|
||||||
sudo systemctl enable connman.service
|
|
||||||
sudo systemctl enable ufw.service
|
|
||||||
sudo systemctl enable cronie.service
|
|
||||||
sudo systemctl enable systemd-timesyncd.service
|
|
||||||
#sudo systemctl enable nix-daemon.service
|
|
||||||
|
|
||||||
|
|
||||||
#user services
|
|
||||||
systemctl --user enable mako.service
|
|
||||||
systemctl --user enable mpd.service
|
|
||||||
systemctl --user enable pipewire.service
|
|
||||||
systemctl --user enable pipewire-pulse.service
|
|
||||||
systemctl --user enable wireplumber.service
|
|
||||||
}
|
|
||||||
|
|
||||||
wireless() {
|
|
||||||
sudo pacman -S tlp iwd bluez bluez-utils
|
|
||||||
sudo pacman -S tp_smapi smartmontools ethtool #opts for tlp
|
|
||||||
|
|
||||||
sudo systemctl enable tlp.service
|
|
||||||
sudo systemctl enable bluetooth.service
|
|
||||||
|
|
||||||
sudo systemctl disable connman.service
|
|
||||||
sudo cp ./services/iwd.service /etc/systemd/system/iwd.service
|
|
||||||
sudo cp ./services/connman_iwd.service /etc/systemd/system/connman_iwd.service
|
|
||||||
sudo systemctl enable connman_iwd.service
|
|
||||||
}
|
|
||||||
|
|
||||||
harden() {
|
|
||||||
#install required programs
|
|
||||||
sudo pacman -S apparmor firejail
|
|
||||||
|
|
||||||
#enable apparmor service
|
|
||||||
sudo systemctl enable apparmor.service
|
|
||||||
sudo systemctl start apparmor.service
|
|
||||||
|
|
||||||
#configure apparmor to use firejail and configure firejail to automatically run for supported programs
|
|
||||||
sudo apparmor_parser -r /etc/apparmor.d/firejail-default
|
|
||||||
sudo firecfg
|
|
||||||
|
|
||||||
add user to /etc/firejail/firejail.users if it is not already in the file
|
|
||||||
if [ -z "$(grep "$USER" /etc/firejail/firejail.users)" ]; then
|
|
||||||
sudo sh -c "echo '$USER' >> /etc/firejail/firejail.users"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "============================================"
|
|
||||||
echo " Applying Hardening Configuration"
|
|
||||||
echo "============================================"
|
|
||||||
echo ""
|
|
||||||
echo "append this to your kernel params:"
|
|
||||||
echo " lsm=landlock,lockdown,yama,integrity,apparmor,bpf"
|
|
||||||
echo " systemd-boot: /boot/loader/entries/*.conf, append to end of line beginning with \"options\""
|
|
||||||
echo " grub: /etc/default/grub"
|
|
||||||
echo ""
|
|
||||||
echo " run this script with the --harden flag again after rebooting to ensure all settings are applied correctly."
|
|
||||||
echo " press enter to continue."
|
|
||||||
read input
|
|
||||||
|
|
||||||
#add any firejail configuration here
|
|
||||||
#fix mpv not being able to open some files, allows mmpv to play videos in the ~/media dir
|
|
||||||
sudo sh -c 'echo "whitelist $HOME/media" >> /etc/firejail/whitelist-player-common.local'
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
configure() {
|
|
||||||
#setup home directories
|
|
||||||
mkdir ~/docs/
|
|
||||||
mkdir ~/dl/
|
|
||||||
mkdir ~/media/
|
|
||||||
mkdir -p ~/.config/mpd/playlists
|
|
||||||
mkdir -p ~/.local/share/gnupg/
|
|
||||||
mkdir -p ~/.local/share/desktop
|
|
||||||
mkdir -p ~/.local/share/wineprefixes/default
|
|
||||||
mkdir -p ~/.local/share/templates
|
|
||||||
mkdir -p ~/.local/share/public
|
|
||||||
mkdir -p ~/media/audio
|
|
||||||
mkdir -p ~/media/img
|
|
||||||
mkdir -p ~/media/video
|
|
||||||
|
|
||||||
#setup ufw
|
|
||||||
sudo ufw default deny incoming
|
|
||||||
sudo ufw default allow outgoing
|
|
||||||
sudo ufw allow http
|
|
||||||
sudo ufw allow https
|
|
||||||
#sudo ufw allow ssh
|
|
||||||
sudo ufw allow ntp
|
|
||||||
sudo ufw allow 67:68/tcp
|
|
||||||
sudo ufw allow 53
|
|
||||||
|
|
||||||
#allow torrent client traffic
|
|
||||||
sudo ufw allow 56881:56889/tcp
|
|
||||||
|
|
||||||
#rules to allow steam
|
|
||||||
sudo ufw allow 27000:27036/udp
|
|
||||||
sudo ufw allow 27036:27037/tcp
|
|
||||||
sudo ufw allow 4380/udp
|
|
||||||
|
|
||||||
sudo ufw enable
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#install zsh shell
|
|
||||||
chsh -s /bin/zsh "$USER"
|
|
||||||
|
|
||||||
#setup .zprofile and zsh history file
|
|
||||||
cd ~ || return
|
|
||||||
ln -s ~/.profile ~/.zprofile
|
|
||||||
mkdir -p ~/.cache/zsh
|
|
||||||
touch ~/.cache/zsh/history
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#replace sudo with doas
|
|
||||||
echo "installing doas, symlinking to sudo, and UNINSTALLING SUDO. sudo is uninstalled using doas so permissions should be setup right if you are able to uninstall. (y/N)"
|
|
||||||
|
|
||||||
read input
|
|
||||||
if [ "$input" = "y" ]; then
|
|
||||||
echo "permit persist $USER as root" > ~/.cache/doas.conf
|
|
||||||
echo "permit nopass :wheel as root cmd /sbin/poweroff" >> ~/.cache/doas.conf
|
|
||||||
echo "permit nopass :wheel as root cmd /sbin/reboot" >> ~/.cache/doas.conf
|
|
||||||
sudo cp ~/.cache/doas.conf /etc/doas.conf
|
|
||||||
rm ~/.cache/doas.conf
|
|
||||||
doas pacman -R sudo #&& doas ln -s /bin/doas /bin/sudo #TODO ARCH SPECIFIC
|
|
||||||
fi
|
|
||||||
|
|
||||||
|
|
||||||
#set limits for esync
|
|
||||||
sudo sh -c "echo '$USER hard nofile 524288' >> /etc/security/limits.conf"
|
|
||||||
|
|
||||||
#set limits for monero
|
|
||||||
sudo sh -c "echo '$USER hard memlock 2048' >> /etc/security/limits.conf"
|
|
||||||
sudo sh -c "echo '$USER hard memlock 2048' >> /etc/security/limits.conf"
|
|
||||||
|
|
||||||
#fix issue with arduino ide and tiling wms
|
|
||||||
sudo sh -c 'echo "export _JAVA_AWT_WM_NONREPARENTING=1" >> /etc/profile.d/jre.sh'
|
|
||||||
|
|
||||||
#set console terminal font
|
|
||||||
sudo sh -c 'echo "FONT=Lat2-Terminus16" >> /etc/vconsole.conf'
|
|
||||||
|
|
||||||
#set grub theme
|
|
||||||
#sudo sed -i 's/#GRUB_COLOR_NORMAL/GRUB_COLOR_NORMAL/g' /etc/default/grub
|
|
||||||
#sudo sed -i 's/#GRUB_COLOR_HIGHLIGHT/GRUB_COLOR_HIGHLIGHT/g' /etc/default/grub
|
|
||||||
|
|
||||||
#nix configuration
|
|
||||||
#add user to nix-users group
|
|
||||||
#sudo adduser -a -G nix-users "$USER"
|
|
||||||
#add nix unstable channel
|
|
||||||
#nix-channel --add https://nixos.org/channels/nixpkgs-unstable
|
|
||||||
#nix-channel --update
|
|
||||||
|
|
||||||
#download collapse OS
|
|
||||||
mkdir -p "$HOME"/.local/src/
|
|
||||||
cd "$HOME"/.local/src/
|
|
||||||
wget http://collapseos.org/files/collapseos-latest.tar.gz
|
|
||||||
cd -
|
|
||||||
|
|
||||||
#set wallpaper
|
|
||||||
#ln -s ~/media/img/wallpapers/alena-aenami-eclipse-1k.jpg ~/.config/wall
|
|
||||||
ln -s /usr/share/backgrounds/archlinux/lone.jpg ~/.config/wall
|
|
||||||
|
|
||||||
#link Xresources for xwayland
|
|
||||||
ln -s ~/.config/Xresources ~/.Xdefaults
|
|
||||||
|
|
||||||
#set /tmp to tmpfs
|
|
||||||
if [ -z "$(grep "/tmp" /etc/fstab)" ]; then
|
|
||||||
sudo sh -c 'echo "tmpfs /tmp tmpfs rw,nodev,nosuid,size=2G 0 0" >> /etc/fstab'
|
|
||||||
fi
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
base() {
|
|
||||||
|
|
||||||
#enable repos (lib32, community, and universe) and install yay
|
|
||||||
enable_repos
|
|
||||||
|
|
||||||
#install all packages in $PKGS
|
|
||||||
sudo pacman --noconfirm --needed -S - < ./pkgs/base.list
|
|
||||||
|
|
||||||
#install all packages in $AUR_PKGS
|
|
||||||
yay --needed -S - < ./pkgs/aur.list
|
|
||||||
|
|
||||||
#setup local git repos defined in $GIT_REPOS to $GIT_REPOS_DIR
|
|
||||||
sh ~/.local/scripts/install.sh add-repos ./pkgs/repos.list
|
|
||||||
|
|
||||||
#link rofi themes directory so that theming works
|
|
||||||
mkdir -p "$HOME"/.local/share/rofi/
|
|
||||||
ln -s "$HOME"/.local/src/base16-rofi/themes/ "$HOME"/.local/share/rofi/themes
|
|
||||||
|
|
||||||
init_setup
|
|
||||||
|
|
||||||
#configure programs, directories, change shell, etc
|
|
||||||
configure
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#install microcode for CPU
|
|
||||||
#echo "enter CPU type to install microcode for (amd intel)"
|
|
||||||
#read input
|
|
||||||
#if [ "$input" = "amd" ]; then
|
|
||||||
# sudo pacman -S amd-ucode
|
|
||||||
#elif [ "$input" = "intel" ]; then
|
|
||||||
# sudo pacman -S intel-ucode
|
|
||||||
#fi
|
|
||||||
|
|
||||||
#rebuild kernel after install for microcode
|
|
||||||
sudo mkinitcpio -P #rebuild kernel
|
|
||||||
#sudo grub-mkconfig -o /boot/grub/grub.cfg #update grub
|
|
||||||
|
|
||||||
echo "installation finished"
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
help() {
|
|
||||||
echo " artix-install.sh"
|
|
||||||
echo " --base perform basic install. Enable repos, install programs"
|
|
||||||
echo ""
|
|
||||||
echo " --gaming install steam and lutris. Use flags --amd, --nvidia, --intel to install"
|
|
||||||
echo " with corresponding graphics drivers. Otherwise you will be prompted"
|
|
||||||
echo ""
|
|
||||||
echo " --virt-manager install virt-manager"
|
|
||||||
echo ""
|
|
||||||
echo " --wireless install/setup programs for wifi/bluetooth"
|
|
||||||
echo ""
|
|
||||||
echo " --ungoogled-chromium install ungoogled-chromium. also installs chrome-web-store and ublock origin"
|
|
||||||
echo ""
|
|
||||||
echo " --harden enable extra security settings (apparmor, firejail), THIS NEEDS TO BE RUN"
|
|
||||||
echo " AGAIN AFTER INSTALL AND REBOOT, to ensure settings are applied correctly."
|
|
||||||
echo " make sure to follow on screen instructions to set kernel params"
|
|
||||||
}
|
|
||||||
|
|
||||||
BASE=""
|
|
||||||
GAMING=""
|
|
||||||
WIRELESS=""
|
|
||||||
UNGOOGLED_CHROMIUM=""
|
|
||||||
VIRT_MANAGER=""
|
|
||||||
HARDEN=""
|
|
||||||
|
|
||||||
for arg in "$@"
|
|
||||||
do
|
|
||||||
[ "$arg" = "--base" ] && BASE="true"
|
|
||||||
[ "$arg" = "--gaming" ] && GAMING="true"
|
|
||||||
[ "$arg" = "--virt-manager" ] && VIRTMGR="true"
|
|
||||||
[ "$arg" = "--wireless" ] && WIRELESS="true"
|
|
||||||
[ "$arg" = "--ungoogled-chromium" ] && UNGOOGLED_CHROMIUM="true"
|
|
||||||
[ "$arg" = "--harden" ] && HARDEN="true"
|
|
||||||
[ "$arg" = "--help" ] && help && exit
|
|
||||||
|
|
||||||
done
|
|
||||||
|
|
||||||
[ "$#" = "0" ] && help && exit
|
|
||||||
|
|
||||||
[ "$BASE" ] && base
|
|
||||||
[ "$GAMING" ] && gaming "$@"
|
|
||||||
[ "$WIRELESS" ] && wireless
|
|
||||||
[ "$UNGOOGLED_CHROMIUM" ] && ungoogled_chromium "$@"
|
|
||||||
[ "$VIRT_MANAGER" ] && virt_manager
|
|
||||||
[ "$HARDEN" ] && harden
|
|
||||||
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
mutt-wizard
|
|
||||||
htim
|
|
||||||
jmtpfs
|
|
||||||
tremc-git
|
|
||||||
dashbinsh
|
|
||||||
pfetch
|
|
||||||
sysrq-enabler
|
|
||||||
wlr-randr
|
|
||||||
sfeed
|
|
||||||
kjv-apocrypha
|
|
||||||
yt-watch
|
|
||||||
yt-dlp-drop-in
|
|
||||||
udiskie
|
|
||||||
waylogout-git
|
|
||||||
ani-cli-git
|
|
||||||
rofi-lbonn-wayland-git
|
|
||||||
pipe-viewer-git
|
|
||||||
connman-gtk
|
|
||||||
opendoas-sudo
|
|
||||||
shell-color-scripts
|
|
||||||
lf-sixel-git
|
|
||||||
swhkd-git
|
|
||||||
nerd-fonts-mononoki
|
|
||||||
autotiling
|
|
||||||
cli-visualizer
|
|
||||||
wob
|
|
||||||
wayland-idle-inhibitor-git
|
|
||||||
tofi
|
|
||||||
|
|
@ -1,89 +0,0 @@
|
||||||
pipewire
|
|
||||||
pipewire-alsa
|
|
||||||
pipewire-pulse
|
|
||||||
pipewire-jack
|
|
||||||
gst-plugin-pipewire
|
|
||||||
wireplumber
|
|
||||||
wireplumber-docs
|
|
||||||
alsa-utils
|
|
||||||
pacman-contrib
|
|
||||||
man-db
|
|
||||||
freetype2
|
|
||||||
gst-libav
|
|
||||||
xdg-utils
|
|
||||||
xdg-user-dirs
|
|
||||||
fuse
|
|
||||||
python-urwid
|
|
||||||
btrfs-progs
|
|
||||||
reiserfsprogs
|
|
||||||
ufw
|
|
||||||
wget
|
|
||||||
curl
|
|
||||||
zip
|
|
||||||
unzip
|
|
||||||
p7zip
|
|
||||||
dash
|
|
||||||
mesa
|
|
||||||
rsync
|
|
||||||
cronie
|
|
||||||
connman
|
|
||||||
fakeroot
|
|
||||||
python-pip
|
|
||||||
udisks2
|
|
||||||
pavucontrol
|
|
||||||
yt-dlp
|
|
||||||
transmission-cli
|
|
||||||
neovim
|
|
||||||
mpd
|
|
||||||
mpv
|
|
||||||
opendoas
|
|
||||||
zsh
|
|
||||||
clang
|
|
||||||
lynx
|
|
||||||
shellcheck
|
|
||||||
noto-fonts
|
|
||||||
noto-fonts-emoji
|
|
||||||
noto-fonts-cjk
|
|
||||||
lxappearance
|
|
||||||
qt5ct
|
|
||||||
qt5-wayland
|
|
||||||
imagemagick
|
|
||||||
ffmpegthumbnailer
|
|
||||||
python-pywal
|
|
||||||
pulsemixer
|
|
||||||
pamixer
|
|
||||||
papirus-icon-theme
|
|
||||||
python-pdftotext
|
|
||||||
chafa
|
|
||||||
bat
|
|
||||||
imv
|
|
||||||
ncmpcpp
|
|
||||||
zathura
|
|
||||||
zathura-cb
|
|
||||||
zathura-djvu
|
|
||||||
zathura-pdf-mupdf
|
|
||||||
sway
|
|
||||||
swaybg
|
|
||||||
swayidle
|
|
||||||
swaylock
|
|
||||||
waybar
|
|
||||||
mako
|
|
||||||
wl-clipboard
|
|
||||||
grim
|
|
||||||
slurp
|
|
||||||
xorg-xwayland
|
|
||||||
alacritty
|
|
||||||
gammastep
|
|
||||||
openssh
|
|
||||||
aria2
|
|
||||||
libva-mesa-driver
|
|
||||||
bc
|
|
||||||
firefox
|
|
||||||
ungoogled-chromium
|
|
||||||
flatpak
|
|
||||||
waylock
|
|
||||||
foot
|
|
||||||
foot-terminfo
|
|
||||||
libsixel
|
|
||||||
brightnessctl
|
|
||||||
xdg-desktop-portal-wlr
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
https://github.com/aarowill/base16-alacritty.git
|
|
||||||
https://github.com/rkubosz/base16-sway.git
|
|
||||||
https://gitlab.com/jordiorlando/base16-rofi.git
|
|
||||||
|
|
@ -1,107 +0,0 @@
|
||||||
#!/bin/sh
|
|
||||||
##############################################################################
|
|
||||||
# This script provides functions to install/configure certain programs
|
|
||||||
# that are more complicated ( more than just pacman -S program ) to install/setup.
|
|
||||||
#
|
|
||||||
# These programs assume that yay, lib32, and arch's community repo has been enabled.
|
|
||||||
# If you get an error during installation try running ./artix-install.sh --base
|
|
||||||
##############################################################################
|
|
||||||
|
|
||||||
repo_check() {
|
|
||||||
if [ -z "$(grep "^\[multilib" /etc/pacman.conf)" ] ||
|
|
||||||
[ -z "$(grep "^\[community" /etc/pacman.conf)" ] ||
|
|
||||||
echo "repo check"
|
|
||||||
[ ! -f "/usr/bin/yay" ]; then
|
|
||||||
echo "either yay, or the lib32 or community repos have not been setup correctly. Exiting"
|
|
||||||
exit
|
|
||||||
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
ungoogled_chromium() {
|
|
||||||
#repo_check
|
|
||||||
#echo "after repo check"
|
|
||||||
|
|
||||||
CMD=" -S "
|
|
||||||
|
|
||||||
[ "$1" = "-R" ] && CMD=" -Rs "
|
|
||||||
|
|
||||||
|
|
||||||
#sudo pacman -S chromium
|
|
||||||
sudo pacman -S ungoogled-chromium
|
|
||||||
|
|
||||||
#yay "$CMD" aur/ungoogled-chromium-binary
|
|
||||||
yay -S aur/chromium-extension-ublock-origin
|
|
||||||
|
|
||||||
yay -S aur/chromium-extension-web-store
|
|
||||||
yay -S aur/chromium-widevine
|
|
||||||
}
|
|
||||||
|
|
||||||
virt_manager() {
|
|
||||||
repo_check
|
|
||||||
|
|
||||||
echo "install virt-manager?(y/N)"
|
|
||||||
read -r input
|
|
||||||
if [ "$input" = "y" ] || [ "$input" = "Y" ]; then
|
|
||||||
sudo pacman -S --noconfirm sudo pacman -S libvirt qemu virt-manager lxsession
|
|
||||||
sudo pacman -S --noconfirm gst-plugins-good libvirt-runit
|
|
||||||
|
|
||||||
#TODO move this to runit_setup
|
|
||||||
sudo usermod -G libvirt -a "$USER"
|
|
||||||
fi
|
|
||||||
|
|
||||||
runit_setup --virt-manager
|
|
||||||
}
|
|
||||||
|
|
||||||
gaming() {
|
|
||||||
repo_check
|
|
||||||
|
|
||||||
CMD=" -S --noconfirm "
|
|
||||||
|
|
||||||
for arg in "$@"
|
|
||||||
do
|
|
||||||
if [ "$arg" = "--nvidia" ]; then
|
|
||||||
NVIDIA_GPU="TRUE"
|
|
||||||
elif [ "$arg" = "--amd" ]; then
|
|
||||||
AMD_GPU="TRUE"
|
|
||||||
elif [ "$arg" = "--intel" ]; then
|
|
||||||
INTEL_GPU="TRUE"
|
|
||||||
elif [ "$arg" = "-R" ]; then
|
|
||||||
CMD=" -Rs "
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ -z "$NVIDIA_GPU" ] && [ -z "$AMD_GPU" ] && [ -z "$INTEL_GPU" ]; then
|
|
||||||
echo "Enter GPU type (amd nvidia intel):"
|
|
||||||
read input
|
|
||||||
|
|
||||||
[ "$input" = "amd" ] && AMD_GPU="TRUE"
|
|
||||||
[ "$input" = "nvidia" ] && NVIDIA_GPU="TRUE"
|
|
||||||
[ "$input" = "intel" ] && INTEL_GPU="TRUE"
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Installing with:"
|
|
||||||
[ "$AMD_GPU" = "TRUE" ] && echo "AMD GPU"
|
|
||||||
[ "$NVIDIA_GPU" = "TRUE" ] && echo "NVIDIA GPU"
|
|
||||||
[ "$INTEL_GPU" = "TRUE" ] && echo "INTEL GPU"
|
|
||||||
echo "press enter to continue."
|
|
||||||
read input
|
|
||||||
|
|
||||||
|
|
||||||
[ -z "$(grep "^\[lib32" /etc/pacman.conf)" ] && [ -z "$NVIDIA_GPU" ] && [ -z "$AMD_GPU" ] && [ -z "$INTEL_GPU" ] && help && exit
|
|
||||||
|
|
||||||
[ "$NVIDIA_GPU" = "TRUE" ] && sudo pacman $CMD nvidia-utils lib32-nvidia-utils
|
|
||||||
[ "$AMD_GPU" = "TRUE" ] && sudo pacman $CMD vulkan-radeon lib32-vulkan-radeon
|
|
||||||
[ "$INTEL_GPU" = "TRUE" ] && sudo pacman $CMD vulkan-intel lib32-vulkan-intel
|
|
||||||
|
|
||||||
sudo pacman $CMD vulkan-mesa-layers lib32-vulkan-mesa-layers
|
|
||||||
|
|
||||||
sudo pacman $CMD wine winetricks #wine-staging
|
|
||||||
sudo pacman $CMD giflib lib32-giflib libpng lib32-libpng libldap lib32-libldap gnutls lib32-gnutls mpg123 lib32-mpg123 openal lib32-openal v4l-utils lib32-v4l-utils libpulse lib32-libpulse alsa-plugins lib32-alsa-plugins alsa-lib lib32-alsa-lib libjpeg-turbo lib32-libjpeg-turbo libxcomposite lib32-libxcomposite libxinerama lib32-libxinerama ncurses lib32-ncurses opencl-icd-loader lib32-opencl-icd-loader libxslt lib32-libxslt libva lib32-libva gtk3 lib32-gtk3 gst-plugins-base-libs lib32-gst-plugins-base-libs vulkan-icd-loader lib32-vulkan-icd-loader lib32-pipewire lib32-pipewire-v4l2 lib32-pipewire-jack cups samba dosbox
|
|
||||||
|
|
||||||
sudo pacman $CMD gamemode lib32-gamemode
|
|
||||||
sudo pacman $CMD lutris steam
|
|
||||||
|
|
||||||
yay -S protonup-git
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Connection service
|
|
||||||
DefaultDependencies=false
|
|
||||||
Conflicts=shutdown.target
|
|
||||||
RequiresMountsFor=/var/lib/connman
|
|
||||||
After=dbus.service network-pre.target systemd-sysusers.service iwd.service
|
|
||||||
Before=network.target multi-user.target shutdown.target
|
|
||||||
Wants=network.target
|
|
||||||
Requires=iwd.service
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=dbus
|
|
||||||
BusName=net.connman
|
|
||||||
Restart=on-failure
|
|
||||||
ExecStart=/usr/bin/connmand --wifi=iwd_agent -n
|
|
||||||
StandardOutput=null
|
|
||||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SYS_TIME CAP_SYS_MODULE
|
|
||||||
ProtectHome=true
|
|
||||||
ProtectSystem=true
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
|
|
@ -1,10 +0,0 @@
|
||||||
[Unit]
|
|
||||||
Description=Internet Wireless Daemon (IWD)
|
|
||||||
Before=network.target
|
|
||||||
Wants=network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
ExecStart=/usr/lib/iwd/iwd
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
Alias=multi-user.target.wants/iwd.service
|
|
||||||
Loading…
Reference in New Issue