fix the fail2ban issues and other things
shellcheck / shellcheck (push) Successful in 11s

This commit is contained in:
2026-10-31 08:10:05 -06:00
parent 17c1ba10f7
commit 6770150b11
19 changed files with 580 additions and 51 deletions
+29 -7
View File
@@ -72,7 +72,7 @@ You will end up with a Gnome system with a three-tile set up (again, great for w
The scripts are installed in ~/.local/share/coredesktop/
The scripts install lots of useful software. There are (4) main ways software is installed: pacman, AUR, Flathub, and mise.
The scripts install lots of useful software. There are (3) main ways software is installed: pacman, AUR and Flathub. mise installs other languages if you want them (see Mise below).
### Pacman
@@ -90,15 +90,27 @@ The file "install-flatpaks.sh" file for Flatpaks.
Flatpaks installed include: Chrome, Chromium, Firefox, Brave, Zen, Vivaldi (browsers), Signal, Telegram, Discord, Revolt, FluffyChat (messaging), Thunderbird and Evolution (email), VS Code and VSCodium (VS Code without the Microsoft telemetry), Obsidian and Logseq (notes), Apostrophe (markdown writer), Kdenlive (video editing), OBS (video recording), Audacity (audio editing), Inkscape (vector graphics), Scribus (page layout), Spotify, Jellyfin (media client), Zoom, Remmina and RustDesk (remote desktop), Postman, DBeaver and Beekeeper Studio (database clients), Alpaca and LM Studio (local AI), LocalSend (send files to other devices), Boxes (virtual machines), Impression (write ISOs to USB sticks), Trayscale (Tailscale), Warehouse (manage Flatpaks), Extension Manager (GNOME extensions), RetroArch and more. See [install-flatpaks.sh](install-flatpaks.sh) for the full list.
If you want to install more software from Flathub, simple visit https://flathub.org.
If you want to install more software from Flathub, simply visit https://flathub.org.
### Don't want something CoreDesktop installs?
Uninstall it, then add its name to ~/.config/coredesktop/skip-packages, one per line: the pacman package name (e.g. `libreoffice-fresh`) or the Flatpak's ID (e.g. `us.zoom.Zoom`, shown by `flatpak list`). Otherwise `update` installs it again. For example:
```
sudo flatpak uninstall us.zoom.Zoom
echo us.zoom.Zoom >> ~/.config/coredesktop/skip-packages
```
### Mise
Ruby and Rails are installed using Mise from the file "install-mise-ruby-rails.sh".
Go, Rust, Node.js, Python, Bun and Zig come from pacman, and Arch keeps them current. [mise](https://mise.jdx.dev) is installed for everything else:
- **Other languages.** `configure languages` installs Ruby on Rails, or any tool mise knows (`mise registry` lists them), such as `java@21` or `deno@latest`. `update` keeps them up to date within the version you chose: `latest` moves to each new release, `21` stays on 21. To remove one, run `mise unuse -g <tool>`.
- **The version a project needs.** Put a mise.toml in the project, e.g. `mise use node@20` in its folder, and inside that folder `node` is version 20, while everywhere else it's pacman's.
### Development Tools
Lots of development tools including herdr, neovim, tmux, go, hugo, python, rust, rails, ruby, docker and docker compose, etc. Three terminals: console, kitty, ghostty.
Lots of development tools including herdr, neovim, tmux, go, hugo, python, rust, docker and docker compose, etc. Three terminals: console, kitty, ghostty.
### Printing and Networking
@@ -164,7 +176,7 @@ Besides installing software, CoreDesktop changes these settings. They're listed
- **Services turned on**: Avahi, Bluetooth, CUPS (printing), fwupd, GDM, NetworkManager, sshd, Docker, Tailscale, ufw and systemd-oomd. Your user is added to the docker group.
- **Snapper** (btrfs only): a config for / in /etc/snapper/configs/root.
- **NVIDIA** (only if it installs the driver): /etc/mkinitcpio.conf.d/nvidia.conf and NVIDIA's suspend services.
- **Your home folder**: lines in ~/.bashrc (CoreDesktop's shell setup, ~/.local/bin on PATH, the Bitwarden SSH agent), the commands in ~/.local/bin (update, refresh, sibling, version, configure, audit), GNOME extensions and their settings, Claude Code's ~/.claude/settings.json if you had none, and a user timer that checks for updates.
- **Your home folder**: lines in ~/.bashrc (CoreDesktop's shell setup, ~/.local/bin on PATH, the Bitwarden SSH agent), the commands in ~/.local/bin (update, refresh, sibling, version, configure, audit), GNOME extensions and their settings, Claude Code's ~/.claude/settings.json if you had none, a user timer that checks for updates, and a user service that pauses your Core's email if its password stops working (see Configure).
- **configure** adds more, only for what you set up: your Nextcloud files mount in /etc/fstab, GNOME Online Accounts, passwords in your GNOME keyring, and the backup timer.
## Keep your System Up-to-date
@@ -181,7 +193,7 @@ The script pulls the latest CoreDesktop, then runs each step in ~/.local/share/c
- stops if there's less than 10 GiB free on / (run `UPDATE_FORCE=1 update` to skip the check)
- snapshots / first, if Snapper is set up (see Snapshots above)
- updates the Arch keyring, then Arch and GNOME, then AUR packages, Flatpaks, Ruby, the pipx apps CoreDesktop installs, GNOME extensions and firmware
- updates the Arch keyring, then Arch and GNOME, then AUR packages, Flatpaks, the languages you installed with mise, the pipx apps CoreDesktop installs, GNOME extensions and firmware
- warns you not to reboot if the initramfs failed to rebuild
- runs any one-time migrations, the way existing machines pick up new CoreDesktop setup
- lists packages that were installed only because something else needed them, and are no longer needed by anything, and asks before removing them. Packages CoreDesktop installs are never on this list. To keep one you use directly off the list, run `sudo pacman -D --asexplicit <package>`
@@ -247,10 +259,20 @@ It covers:
- **Your Federated Computer Core.** Give it your Superpanel's address (e.g. https://superpanel.example.com), your Core email, name and password, and it adds Superpanel to your applications, adds your Nextcloud (calendar, contacts and files) and email to GNOME's Online Accounts, and mounts your Nextcloud files at /mnt/example.com ("example.com" in the Files sidebar), and points Element at your Core's Matrix server. For Nextcloud and the files it creates a Nextcloud app password, which you can revoke in Nextcloud under Settings > Security. You can add more Cores: run `configure core` again and choose "Add a Core". Each gets its own Superpanel, Nextcloud, email and files; Element, Tailscale and backups use your main Core (the first one, unless you choose another). "Remove a Core" takes it off this computer and revokes its app password, and leaves everything on the Core itself as it is. If you change your Core password (e.g. in Superpanel), run `configure core` and choose "Your Core password changed": email keeps your Core password, so it saves the new one there, and it signs in to Nextcloud with it, which turns the app passwords for Nextcloud, files and backups back on (Nextcloud turns them off when your password changes), then checks each of them. To check that a Core still works from this computer, run `configure core` and choose "Test a Core": it signs in to Superpanel, Nextcloud, email, your files, Element's Matrix server and backups the way this computer does, says which work, and offers to fix those that don't (asking for your Core password if a fix needs it, e.g. to make a new app password for one that was revoked), then tests again.
- **Your Core's Tailscale network.** Joins this computer to it through headscale.example.com, so you can reach your other machines on it. Set up your Core first. You sign in through a link it shows you; if this computer is on another Tailscale network, it moves it to your Core's. To leave your Core's network, run `configure tailscale` again.
- **Daily backups of your home folder** to your Nextcloud files, in a .backup-{machine name} folder, with restic. Set up your Core first. The backup is encrypted with a passphrase that `configure` shows you once: save it somewhere other than this computer, such as Bitwarden. It keeps 7 daily, 4 weekly and 6 monthly backups, and leaves out caches, things that can be reinstalled, and WinBoat's Windows VM (~/winboat). To leave out more, list paths in ~/.config/coredesktop/backup-exclude, one per line. restic reaches Nextcloud directly through rclone with its own Nextcloud app password, so the backup doesn't depend on the /mnt mount. See "Restoring from a backup" below. To turn backups off, run `configure backup` again; it also offers to delete the backups from your Nextcloud files (they go to Nextcloud's trash bin).
- **Tally for Plausible**, if your main Core runs Plausible Analytics: it's pointed at plausible.example.com.
- Signing in to Claude Code, opencode and Hermes Agent and choosing their model providers.
- **Languages** to install with mise, such as Ruby on Rails (see Mise above).
To set up one thing, name it, e.g. `configure hermes`; `configure --list` shows the names.
### When your Core password changes
Your email in Online Accounts keeps your Core password, so after you change it (e.g. in Superpanel), the mail server starts refusing the old one. GNOME tries it again each time your network changes, and Evolution each time it fetches mail, and after a few wrong passwords the mail server blocks this computer for a while.
So CoreDesktop watches for it, without ever trying the password on the mail server. When your password changes, Nextcloud stops accepting the app passwords this computer uses, and Online Accounts notices. CoreDesktop then checks the password your email has with Nextcloud, once. If Nextcloud says it's wrong, CoreDesktop pauses your email: this computer stops trying the old password, and you get a notification. Click it, choose "Your Core password changed" and enter your new password; that ends the pause. Or remove the Core, or just the email account in Settings > Online Accounts. `configure core` > "Test a Core" shows a paused email too, and checks email's password with Nextcloud before trying it on the mail server.
This needs your Core's Nextcloud in Online Accounts, which `configure core` sets up along with email.
### Restoring from a backup
To see the backups and get files back:
@@ -312,7 +334,7 @@ CoreDesktop doesn't have an uninstaller, but you can undo it by hand. If you set
Then remove CoreDesktop's own files:
```
systemctl --user disable --now coredesktop-update-check.timer coredesktop-backup.timer
systemctl --user disable --now coredesktop-update-check.timer coredesktop-backup.timer coredesktop-email-watch.service
rm -f ~/.config/systemd/user/coredesktop-*
rm -f ~/.local/bin/{update,refresh,sibling,version,configure,audit}
rm -rf ~/.local/share/coredesktop ~/.local/share/siblings ~/.local/state/coredesktop ~/.config/coredesktop