trim down install, tighten sshd
This commit is contained in:
@@ -12,19 +12,26 @@ Additionally, CoreDesktop includes a lot of useful software mostly for work at F
|
||||
|
||||
These scripts are based on the initial work of [Typecraft](https://www.youtube.com/@typecraft_dev).
|
||||
|
||||
## Requirements
|
||||
|
||||
- A 64-bit PC (x86_64) that can run Arch Linux, with an internet connection.
|
||||
- At least 100 GB for / (the root partition). CoreDesktop installs a lot of software, about 50 GB, and `update` needs at least 10 GB free.
|
||||
- A fresh Arch Linux install with GNOME (see below). CoreDesktop changes system settings, so it's best not to run it on a machine you've already set up the way you like (see "What CoreDesktop changes on your system").
|
||||
- A Federated Computer Core is optional. Without one, everything works except what `configure core` sets up: your Core's apps, files, calendars and email, its Tailscale network, and backups.
|
||||
|
||||
## Installing Arch
|
||||
|
||||
1) Download the ISO for Arch from [this link](https://archlinux.org/download/). You may need to scroll down to find the download links.
|
||||
2) Write the ISO file to a USB stick.
|
||||
3) Boot from the Arch ISO USB stick. When the ISO has booted, type `archinstall` to get to the simple installer.
|
||||
|
||||
(Note: if you're on a laptop and/or don't have a wired internet connection, you'll need to set up the wifi card, etc. Here's [the great article](https://wiki.archlinux.org/title/Network_configuration/Wireless) how to do this. But it really boils down to five steps: at the prompt type "iwctl"; then "device list"; then "station wlan0 scan" where "wlan0" is your wifi device; then "station wlan0 get-networks"; then "station wlan0 connect SSID" where you replace "SSID" with the name of your network.)
|
||||
(Note: if you're on a laptop and/or don't have a wired internet connection, set up Wi-Fi first. See "A Note About Networking in Arch" below.)
|
||||
|
||||
4) You will go through the different options. Mostly choose the defaults.
|
||||
5) Video cards: IF YOU HAVE AN NVIDIA GPU, CHOOSE THE PROPRIETARY NVIDIA OPTION. Choose the AMD option for AMD cards. Just works better. We've found Arch is very good maintaining compatability with Nvidia and AMD options.
|
||||
6) When asked what type of system your want, the correct choice is "desktop" and the correct desktop environment is "Gnome".
|
||||
5) Video cards: IF YOU HAVE AN NVIDIA GPU, CHOOSE THE PROPRIETARY NVIDIA OPTION. Choose the AMD option for AMD cards. Just works better. We've found Arch is very good at maintaining compatibility with Nvidia and AMD options.
|
||||
6) When asked what type of system you want, the correct choice is "desktop" and the correct desktop environment is "Gnome".
|
||||
7) For sound, "pipewire" is strongly recommended for the sound system choice during install. This is known to work really well with Jitsi, Element, and the other Federated Core SaaS applications, if you're using those. This may no longer be required in the newest installations of Arch Linux.
|
||||
8) Reboot the system and log in. You should have a working Arch system at this point but without the Coredesktop configurations.
|
||||
8) Reboot the system and log in. You should have a working Arch system at this point but without the CoreDesktop configurations.
|
||||
|
||||
You will likely screw up the installation of Arch the first or second time. Don't despair. Keep trying! The logic of the install will ultimately become clear and, frankly, efficient for you. And, besides, you get to know the base Arch install better and better over time.
|
||||
|
||||
@@ -32,11 +39,11 @@ You will likely screw up the installation of Arch the first or second time. Don'
|
||||
|
||||
You'll need a connection to the internet to successfully install Arch.
|
||||
|
||||
If you have a wired connection, then your network should "just work" and you can use that to configure your Arch network installation. But if you do not have a wired connection and you have a wifi chip installed in your computer, before installing Arch you'll want to set up the wifi network. You can do that using the too `iwctl`.
|
||||
If you have a wired connection, then your network should "just work" and you can use that to configure your Arch network installation. But if you do not have a wired connection and you have a wifi chip installed in your computer, before installing Arch you'll want to set up the wifi network. You can do that using the tool `iwctl`. Here's [the great article](https://wiki.archlinux.org/title/Network_configuration/Wireless) on how to do this.
|
||||
|
||||
Type `iwctl` and that will put you into the utility `iwd`.
|
||||
|
||||
To list the wireless adapters type: `device list`. If your wireless device is "wlan0" (for example) you next type: `station wlan0 scan` to put the wireless chip into scan mode then `station wlan0 get-networks` to find the wireless networks available. The join your wireless network with the command `station wlan0 connect SSID` where SSID is the wireless network name. You can test your network with a ping to some server, etc.
|
||||
To list the wireless adapters type: `device list`. If your wireless device is "wlan0" (for example) you next type: `station wlan0 scan` to put the wireless chip into scan mode then `station wlan0 get-networks` to find the wireless networks available. Then join your wireless network with the command `station wlan0 connect SSID` where SSID is the wireless network name. You can test your network with a ping to some server, etc.
|
||||
|
||||
When you have the wireless network working (check by doing "ping google.com"), then you can proceed to install Arch.
|
||||
|
||||
@@ -69,7 +76,7 @@ The scripts install lots of useful software. There are (4) main ways software is
|
||||
|
||||
### Pacman
|
||||
|
||||
Pacman installs software from the "packages.conf" file. It installs software such as neovim, tmux, Go, Rust, Docker, Tailscale, Element, LibreOffice, etc. Tell me if you want other tools or submit a pull request.
|
||||
Pacman installs software from the "packages.conf" file. It installs software such as neovim, tmux, Go, Rust, Docker, Tailscale, Element, LibreOffice, etc. If you'd like other tools, open an issue or send a pull request.
|
||||
|
||||
Federated Computer's own packages, such as Federated Calendar, come from the `[federated]` repository on Federated Computer's Gitea. CoreDesktop adds it to /etc/pacman.conf and trusts its signing key (fingerprint `6AB7C080D87C74BEE3925A026329376994F18B4E`), so they install and update like any other pacman package. Federated Calendar is installed alongside GNOME Calendar and can invite people to events on your Core's Nextcloud calendars.
|
||||
|
||||
@@ -81,7 +88,7 @@ Yay is installed as is the way AUR packages are installed and maintained. Exampl
|
||||
|
||||
The file "install-flatpaks.sh" file for Flatpaks.
|
||||
|
||||
Flatpaks installed include: Chrome, Chromium, Firefox, Brave, Zen, Vivaldi (browsers), Signal, Telegram, Discord, Revolt, FluffyChat (messaging), Thunderbird and Evolution (email), VS Code and VSCodium (VS Code without the Microsoft telemetry), Obsidian and Logseq (notes), Apostrophe (markdown writer), Kdenlive (video editing), OBS (video recording), Audacity (audio editing), Inkscape (vector graphics), Scribus (page layout), Spotify, Jellyfin (media client), Zoom, Remmina and RustDesk (remote desktop), Postman, DBeaver and Beekeeper Studio (database clients), Alpaca and LM Studio (local AI), LocalSend (send files to other devices), Boxes (virtual machines), Impression (write ISOs to USB sticks), Trayscale (Tailscale), Warehouse (manage Flatpaks), Extension Manager (GNOME extensions), qBittorrent, RetroArch and more. See [install-flatpaks.sh](install-flatpaks.sh) for the full list.
|
||||
Flatpaks installed include: Chrome, Chromium, Firefox, Brave, Zen, Vivaldi (browsers), Signal, Telegram, Discord, Revolt, FluffyChat (messaging), Thunderbird and Evolution (email), VS Code and VSCodium (VS Code without the Microsoft telemetry), Obsidian and Logseq (notes), Apostrophe (markdown writer), Kdenlive (video editing), OBS (video recording), Audacity (audio editing), Inkscape (vector graphics), Scribus (page layout), Spotify, Jellyfin (media client), Zoom, Remmina and RustDesk (remote desktop), Postman, DBeaver and Beekeeper Studio (database clients), Alpaca and LM Studio (local AI), LocalSend (send files to other devices), Boxes (virtual machines), Impression (write ISOs to USB sticks), Trayscale (Tailscale), Warehouse (manage Flatpaks), Extension Manager (GNOME extensions), RetroArch and more. See [install-flatpaks.sh](install-flatpaks.sh) for the full list.
|
||||
|
||||
If you want to install more software from Flathub, simple visit https://flathub.org.
|
||||
|
||||
@@ -97,11 +104,11 @@ Lots of development tools including herdr, neovim, tmux, go, hugo, python, rust,
|
||||
|
||||
The printing service (cups) is turned on. This may need more work to "just work" with other "coredesktop" machines.
|
||||
|
||||
mDNS is installed and enabled so the your can find and SSH to your machine on your LAN using {machinename}.local.
|
||||
mDNS is installed and enabled so you can find and SSH to your machine on your LAN using {machinename}.local.
|
||||
|
||||
### Firewall
|
||||
|
||||
The ufw firewall is on. It blocks incoming connections except SSH (22), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale. ufw-docker is installed too, because ports published by Docker containers otherwise get around ufw. To let a container's port through, use `sudo ufw-docker allow {container} {port}`. To open a port for something else, e.g. a dev server you want to reach from another machine, use `sudo ufw allow {port}/tcp`. `sudo ufw status` shows the current rules.
|
||||
The ufw firewall is on. It blocks incoming connections except SSH (22, keys only: see System defaults), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale. ufw-docker is installed too, because ports published by Docker containers otherwise get around ufw. To let a container's port through, use `sudo ufw-docker allow {container} {port}`. To open a port for something else, e.g. a dev server you want to reach from another machine, use `sudo ufw allow {port}/tcp`. `sudo ufw status` shows the current rules.
|
||||
|
||||
### Shell
|
||||
|
||||
@@ -140,6 +147,25 @@ The installer adds the Vulkan driver for Intel and AMD GPUs. If there's an NVIDI
|
||||
- If memory runs out, systemd-oomd closes the app causing it instead of the whole desktop freezing.
|
||||
- Boot no longer waits for the network.
|
||||
- Commands run over SSH (`ssh {machine} {command}`) can find tools in ~/.local/bin and mise.
|
||||
- You log in to this machine over SSH with a key, not a password, so nobody on the same network can try to guess your password. Put your public key in ~/.ssh/authorized_keys on this machine (`ssh-copy-id` does this from the other machine). To allow passwords again, delete /etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf and run `sudo systemctl reload sshd`. Machines installed earlier, where someone has logged in over SSH with a password, keep accepting passwords until you run `bash ~/.local/share/coredesktop/system/sshd.sh`.
|
||||
- ssh uses Bitwarden's SSH agent while Bitwarden is running it (turn it on in Bitwarden's settings), and GNOME's otherwise. A terminal opened before Bitwarden started uses GNOME's; open a new one.
|
||||
|
||||
### What CoreDesktop changes on your system
|
||||
|
||||
Besides installing software, CoreDesktop changes these settings. They're listed so you know what you're running, and so you can undo them (see "Uninstalling").
|
||||
|
||||
- **/etc/pacman.conf**: adds the `[federated]` repository and trusts its signing key (see Pacman above).
|
||||
- **SSH**: sshd is on, with key login only (/etc/ssh/sshd_config.d/10-coredesktop-keys-only.conf). The SSH client keepalives are in /etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf.
|
||||
- **Firewall**: ufw is on, with the rules under Firewall above, and ufw-docker's rules in /etc/ufw/after.rules.
|
||||
- **Login lockout**: deny and unlock_time in /etc/security/faillock.conf.
|
||||
- **systemd**: a 10-second stop timeout (/etc/systemd/system.conf.d/ and /etc/systemd/user.conf.d/10-coredesktop-timeout.conf), systemd-oomd for apps (/etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf), and NetworkManager-wait-online is masked.
|
||||
- **/etc/security/pam_env.conf**: a PATH line, so SSH commands find ~/.local/bin and mise.
|
||||
- **mDNS**: Avahi is on, nss-mdns is added to /etc/nsswitch.conf, and SSH is advertised in /etc/avahi/services/ssh.service.
|
||||
- **Services turned on**: Avahi, Bluetooth, CUPS (printing), fwupd, GDM, NetworkManager, sshd, Docker, Tailscale, ufw and systemd-oomd. Your user is added to the docker group.
|
||||
- **Snapper** (btrfs only): a config for / in /etc/snapper/configs/root.
|
||||
- **NVIDIA** (only if it installs the driver): /etc/mkinitcpio.conf.d/nvidia.conf and NVIDIA's suspend services.
|
||||
- **Your home folder**: lines in ~/.bashrc (CoreDesktop's shell setup, ~/.local/bin on PATH, the Bitwarden SSH agent), the commands in ~/.local/bin (update, refresh, sibling, version, configure, audit), GNOME extensions and their settings, Claude Code's ~/.claude/settings.json if you had none, and a user timer that checks for updates.
|
||||
- **configure** adds more, only for what you set up: your Nextcloud files mount in /etc/fstab, GNOME Online Accounts, passwords in your GNOME keyring, and the backup timer.
|
||||
|
||||
## Keep your System Up-to-date
|
||||
|
||||
@@ -158,7 +184,7 @@ The script pulls the latest CoreDesktop, then runs each step in ~/.local/share/c
|
||||
- updates the Arch keyring, then Arch and GNOME, then AUR packages, Flatpaks, Ruby, the pipx apps CoreDesktop installs, GNOME extensions and firmware
|
||||
- warns you not to reboot if the initramfs failed to rebuild
|
||||
- runs any one-time migrations, the way existing machines pick up new CoreDesktop setup
|
||||
- removes packages that were installed only because something else needed them, and are no longer needed by anything. It lists what it removed. Packages CoreDesktop installs are never removed this way. To stop another package you use directly from being removed, run `sudo pacman -D --asexplicit <package>`
|
||||
- lists packages that were installed only because something else needed them, and are no longer needed by anything, and asks before removing them. Packages CoreDesktop installs are never on this list. To keep one you use directly off the list, run `sudo pacman -D --asexplicit <package>`
|
||||
|
||||
If a step fails, the other steps still run, and the failed ones are listed at the end.
|
||||
|
||||
@@ -279,10 +305,29 @@ You can stop a service from there, which also keeps it from starting at boot, or
|
||||
|
||||
mDNS lets you reach other machines on your LAN as "machine.local", e.g. `ssh machine.local`. When systemd-resolved is enabled, the installer sets it up with [fixmdns.sh](fixmdns.sh): it turns on Avahi and adds nss-mdns to /etc/nsswitch.conf ahead of systemd-resolved, so the two don't conflict. On a machine without systemd-resolved, run `bash ~/.local/share/coredesktop/fixmdns.sh` yourself. See the [Arch wiki](https://wiki.archlinux.org/title/Avahi#Hostname_resolution) for more.
|
||||
|
||||
## Uninstalling
|
||||
|
||||
CoreDesktop doesn't have an uninstaller, but you can undo it by hand. If you set up a Core, do this first, while `configure` is still installed, so your app passwords are revoked: `configure backup` (turn backups off), `configure tailscale` (leave the network), then `configure core` and "Remove a Core" for each Core.
|
||||
|
||||
Then remove CoreDesktop's own files:
|
||||
|
||||
```
|
||||
systemctl --user disable --now coredesktop-update-check.timer coredesktop-backup.timer
|
||||
rm -f ~/.config/systemd/user/coredesktop-*
|
||||
rm -f ~/.local/bin/{update,refresh,sibling,version,configure,audit}
|
||||
rm -rf ~/.local/share/coredesktop ~/.local/share/siblings ~/.local/state/coredesktop ~/.config/coredesktop
|
||||
```
|
||||
|
||||
Delete the CoreDesktop lines from ~/.bashrc, and undo the system settings you don't want from "What CoreDesktop changes on your system". The software stays installed: remove what you don't want with `sudo pacman -Rns <package>` and `flatpak uninstall <app>`.
|
||||
|
||||
## Contributing
|
||||
|
||||
This whole "project" is licensed under the MIT License. Want to help make CoreDesktop better? Awesome! We welcome any and all help. Just contribute a PR and we're off to a better CoreDesktop.
|
||||
|
||||
Found a bug or have an idea? [Open an issue](https://gitea.federated.computer/Federated_Computer/coredesktop/issues).
|
||||
|
||||
Every push is checked with [shellcheck](https://www.shellcheck.net) (settings in .shellcheckrc). Run `shellcheck` on the scripts you change before sending a PR.
|
||||
|
||||
Changes to install.sh only reach new installs. If existing machines need the change too, also add a migration: a script named `migrations/$(date +%s).sh` that `update` runs once on each machine. It may also run on fresh installs, so make it safe to repeat.
|
||||
|
||||
## Bonus
|
||||
|
||||
Reference in New Issue
Block a user