numerous updates
This commit is contained in:
@@ -0,0 +1,65 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Purpose : System defaults adapted from Omarchy: SSH keepalives, a gentler
|
||||
# login lockout, faster shutdown, out-of-memory protection, faster
|
||||
# boot, and a PATH for commands run over SSH
|
||||
|
||||
set -e
|
||||
|
||||
# SSH client: notice a dropped connection within a minute instead of hanging
|
||||
# until TCP gives up. Settings in ~/.ssh/config still win per host.
|
||||
echo "Configuring SSH keepalives..."
|
||||
sudo install -d -m 755 /etc/ssh/ssh_config.d
|
||||
sudo tee /etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf > /dev/null << 'EOF'
|
||||
# CoreDesktop: notice dropped connections quickly instead of hanging until TCP
|
||||
# times out. Settings in ~/.ssh/config take precedence over these defaults.
|
||||
Host *
|
||||
ServerAliveInterval 15
|
||||
ServerAliveCountMax 3
|
||||
ConnectTimeout 10
|
||||
EOF
|
||||
|
||||
# Login lockout: Arch locks an account for 10 minutes after 3 wrong passwords.
|
||||
# Allow 10 tries and unlock after 2 minutes.
|
||||
echo "Relaxing the failed-login lockout..."
|
||||
sudo sed -i -E \
|
||||
-e 's/^#?[[:space:]]*deny[[:space:]]*=.*/deny = 10/' \
|
||||
-e 's/^#?[[:space:]]*unlock_time[[:space:]]*=.*/unlock_time = 120/' \
|
||||
/etc/security/faillock.conf
|
||||
|
||||
# Shutdown: don't wait 90 seconds on a service or app that won't stop
|
||||
echo "Shortening the shutdown timeout..."
|
||||
sudo install -d -m 755 /etc/systemd/system.conf.d /etc/systemd/user.conf.d
|
||||
printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
|
||||
| sudo tee /etc/systemd/system.conf.d/10-coredesktop-timeout.conf > /dev/null
|
||||
printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
|
||||
| sudo tee /etc/systemd/user.conf.d/10-coredesktop-timeout.conf > /dev/null
|
||||
|
||||
# Out of memory: let systemd-oomd kill the app causing memory pressure instead
|
||||
# of the whole session freezing. GNOME launches apps into app.slice, so GNOME
|
||||
# Shell itself is never a candidate.
|
||||
echo "Enabling out-of-memory protection..."
|
||||
sudo install -d -m 755 /etc/systemd/user/app.slice.d
|
||||
sudo tee /etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf > /dev/null << 'EOF'
|
||||
[Slice]
|
||||
ManagedOOMMemoryPressure=kill
|
||||
ManagedOOMSwap=kill
|
||||
EOF
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now systemd-oomd.service
|
||||
|
||||
# Boot: nothing on the desktop needs to wait for the network to come up
|
||||
echo "Masking NetworkManager-wait-online..."
|
||||
sudo systemctl mask NetworkManager-wait-online.service
|
||||
|
||||
# `ssh host command` runs without a login shell, so ~/.bashrc never sets PATH
|
||||
# and tools in ~/.local/bin or installed with mise aren't found. PAM sets the
|
||||
# environment for every login, including those. @{HOME} expands per user.
|
||||
if ! grep -qE '^PATH[[:space:]]' /etc/security/pam_env.conf; then
|
||||
echo "Adding user tool paths for SSH commands..."
|
||||
sudo tee -a /etc/security/pam_env.conf > /dev/null << 'EOF'
|
||||
|
||||
# CoreDesktop: give SSH commands and other non-shell logins the user-level tool paths
|
||||
PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
|
||||
EOF
|
||||
fi
|
||||
@@ -0,0 +1,31 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Purpose : Turn on the ufw firewall. Incoming connections are blocked except
|
||||
# for the services CoreDesktop runs, and ufw-docker stops ports
|
||||
# published by Docker containers from getting around the firewall.
|
||||
|
||||
set -e
|
||||
|
||||
source "$HOME/.local/share/coredesktop/utils.sh"
|
||||
|
||||
install_packages ufw ufw-docker
|
||||
|
||||
sudo ufw default deny incoming
|
||||
sudo ufw default allow outgoing
|
||||
|
||||
sudo ufw allow 22/tcp comment 'SSH'
|
||||
sudo ufw allow 5353/udp comment 'mDNS'
|
||||
sudo ufw allow 53317 comment 'LocalSend'
|
||||
sudo ufw allow in on tailscale0 comment 'Tailscale'
|
||||
|
||||
sudo ufw --force enable
|
||||
sudo systemctl enable ufw.service
|
||||
|
||||
# ufw-docker only installs its rules while ufw is active, and they take effect
|
||||
# once ufw restarts
|
||||
if ! sudo grep -q 'BEGIN UFW AND DOCKER' /etc/ufw/after.rules; then
|
||||
sudo ufw-docker install
|
||||
sudo systemctl restart ufw.service
|
||||
fi
|
||||
|
||||
sudo ufw status verbose
|
||||
@@ -0,0 +1,67 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Purpose : Install NVIDIA's driver when the machine has an NVIDIA GPU and no
|
||||
# NVIDIA driver yet (i.e. archinstall's proprietary option wasn't
|
||||
# picked). Turing (GTX 16xx / RTX 20xx) and newer get the open kernel
|
||||
# modules; Maxwell, Pascal and Volta get the 580xx legacy driver from
|
||||
# the AUR. Older cards stay on nouveau.
|
||||
#
|
||||
# Run from install.sh only, never from an update: silently moving a
|
||||
# working machine off nouveau is too risky to do mid-update.
|
||||
|
||||
set -e
|
||||
|
||||
source "$HOME/.local/share/coredesktop/utils.sh"
|
||||
|
||||
# Read device IDs from sysfs: lspci needs pciutils and wakes suspended GPUs.
|
||||
# Turing is the first generation with GSP firmware (open modules) and the first
|
||||
# with device IDs at 0x1e00 or above; Maxwell starts at 0x1340.
|
||||
GPU=none
|
||||
for device in /sys/bus/pci/devices/*; do
|
||||
[[ $(< "$device/vendor") == 0x10de && $(< "$device/class") == 0x03* ]] || continue
|
||||
id=$(( $(< "$device/device") ))
|
||||
if (( id >= 0x1e00 )); then
|
||||
GPU=open
|
||||
elif (( id >= 0x1340 )) && [ "$GPU" = none ]; then
|
||||
GPU=legacy
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$GPU" = none ]; then
|
||||
echo "No NVIDIA GPU supported by the current drivers found."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if is_installed nvidia-utils || is_installed nvidia-580xx-utils; then
|
||||
echo "NVIDIA driver already installed."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# DKMS builds the module for every installed kernel, so each needs its headers
|
||||
PACKAGES=()
|
||||
for kernel in linux linux-lts linux-zen linux-hardened; do
|
||||
if is_installed "$kernel"; then
|
||||
PACKAGES+=("$kernel-headers")
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$GPU" = open ]; then
|
||||
PACKAGES+=(nvidia-open-dkms nvidia-utils libva-nvidia-driver)
|
||||
else
|
||||
PACKAGES+=(nvidia-580xx-dkms nvidia-580xx-utils)
|
||||
fi
|
||||
|
||||
echo "Installing NVIDIA driver..."
|
||||
install_packages "${PACKAGES[@]}"
|
||||
|
||||
# Load the driver from the initramfs so the GPU is ready when GDM starts
|
||||
sudo install -d -m 755 /etc/mkinitcpio.conf.d
|
||||
echo 'MODULES+=(nvidia nvidia_modeset nvidia_uvm nvidia_drm)' \
|
||||
| sudo tee /etc/mkinitcpio.conf.d/nvidia.conf > /dev/null
|
||||
sudo mkinitcpio -P
|
||||
|
||||
# GDM only offers Wayland on NVIDIA when these are enabled, since without them
|
||||
# the GPU loses its memory contents across suspend
|
||||
sudo systemctl enable nvidia-suspend.service nvidia-hibernate.service nvidia-resume.service
|
||||
|
||||
echo "NVIDIA driver installed. Reboot to start using it."
|
||||
@@ -0,0 +1,54 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Purpose : Configure Snapper so update can snapshot / before each upgrade
|
||||
# (updates.d/09-snapshot.sh). Only applies when / is btrfs, which is
|
||||
# archinstall's default. /home is a separate subvolume and is not
|
||||
# included in the snapshots.
|
||||
|
||||
if [ "$(findmnt -no FSTYPE /)" != "btrfs" ]; then
|
||||
echo "/ is not btrfs; skipping Snapper setup."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
set -e
|
||||
|
||||
source "$HOME/.local/share/coredesktop/utils.sh"
|
||||
|
||||
install_packages snapper
|
||||
|
||||
if [ ! -f /etc/snapper/configs/root ]; then
|
||||
echo "Creating Snapper config for /..."
|
||||
|
||||
# create-config makes its own /.snapshots subvolume and fails if the path
|
||||
# already exists. archinstall mounts a separate @.snapshots subvolume there,
|
||||
# so follow the Arch wiki: unmount it, let snapper create its config, then
|
||||
# swap snapper's nested subvolume back out for the @.snapshots mount.
|
||||
if mountpoint -q /.snapshots; then
|
||||
sudo umount /.snapshots
|
||||
sudo rmdir /.snapshots
|
||||
sudo snapper -c root create-config /
|
||||
sudo btrfs subvolume delete /.snapshots
|
||||
sudo mkdir /.snapshots
|
||||
sudo mount /.snapshots
|
||||
else
|
||||
if [ -e /.snapshots ] && ! sudo rmdir /.snapshots 2>/dev/null; then
|
||||
echo "/.snapshots exists and isn't an empty directory. Move it aside and run this again."
|
||||
exit 1
|
||||
fi
|
||||
sudo snapper -c root create-config /
|
||||
fi
|
||||
|
||||
# Keep only the last 5 pre-update snapshots, and no hourly timeline. Only set
|
||||
# on a config we created, so a config you made yourself keeps its settings.
|
||||
sudo snapper -c root set-config \
|
||||
TIMELINE_CREATE=no \
|
||||
NUMBER_CLEANUP=yes \
|
||||
NUMBER_MIN_AGE=0 \
|
||||
NUMBER_LIMIT=5 \
|
||||
NUMBER_LIMIT_IMPORTANT=5
|
||||
sudo systemctl disable --now snapper-timeline.timer 2> /dev/null || true
|
||||
else
|
||||
echo "Snapper config for / already exists."
|
||||
fi
|
||||
|
||||
sudo systemctl enable --now snapper-cleanup.timer
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Purpose : Install the Vulkan driver for each Intel or AMD GPU in the machine.
|
||||
# NVIDIA's Vulkan driver comes with nvidia-utils (see nvidia.sh).
|
||||
|
||||
set -e
|
||||
|
||||
source "$HOME/.local/share/coredesktop/utils.sh"
|
||||
|
||||
# Read vendor IDs from sysfs: lspci needs pciutils and wakes suspended GPUs
|
||||
PACKAGES=()
|
||||
for device in /sys/bus/pci/devices/*; do
|
||||
[[ $(< "$device/class") == 0x03* ]] || continue
|
||||
case "$(< "$device/vendor")" in
|
||||
0x8086) PACKAGES+=(vulkan-intel) ;;
|
||||
0x1002) PACKAGES+=(vulkan-radeon) ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if (( ${#PACKAGES[@]} > 0 )); then
|
||||
mapfile -t PACKAGES < <(printf '%s\n' "${PACKAGES[@]}" | sort -u)
|
||||
install_packages "${PACKAGES[@]}"
|
||||
else
|
||||
echo "No Intel or AMD GPU found."
|
||||
fi
|
||||
Reference in New Issue
Block a user