66 lines
2.8 KiB
Bash
66 lines
2.8 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Purpose : System defaults adapted from Omarchy: SSH keepalives, a gentler
|
|
# login lockout, faster shutdown, out-of-memory protection, faster
|
|
# boot, and a PATH for commands run over SSH
|
|
|
|
set -e
|
|
|
|
# SSH client: notice a dropped connection within a minute instead of hanging
|
|
# until TCP gives up. Settings in ~/.ssh/config still win per host.
|
|
echo "Configuring SSH keepalives..."
|
|
sudo install -d -m 755 /etc/ssh/ssh_config.d
|
|
sudo tee /etc/ssh/ssh_config.d/20-coredesktop-keepalive.conf > /dev/null << 'EOF'
|
|
# CoreDesktop: notice dropped connections quickly instead of hanging until TCP
|
|
# times out. Settings in ~/.ssh/config take precedence over these defaults.
|
|
Host *
|
|
ServerAliveInterval 15
|
|
ServerAliveCountMax 3
|
|
ConnectTimeout 10
|
|
EOF
|
|
|
|
# Login lockout: Arch locks an account for 10 minutes after 3 wrong passwords.
|
|
# Allow 10 tries and unlock after 2 minutes.
|
|
echo "Relaxing the failed-login lockout..."
|
|
sudo sed -i -E \
|
|
-e 's/^#?[[:space:]]*deny[[:space:]]*=.*/deny = 10/' \
|
|
-e 's/^#?[[:space:]]*unlock_time[[:space:]]*=.*/unlock_time = 120/' \
|
|
/etc/security/faillock.conf
|
|
|
|
# Shutdown: don't wait 90 seconds on a service or app that won't stop
|
|
echo "Shortening the shutdown timeout..."
|
|
sudo install -d -m 755 /etc/systemd/system.conf.d /etc/systemd/user.conf.d
|
|
printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
|
|
| sudo tee /etc/systemd/system.conf.d/10-coredesktop-timeout.conf > /dev/null
|
|
printf '[Manager]\nDefaultTimeoutStopSec=10s\n' \
|
|
| sudo tee /etc/systemd/user.conf.d/10-coredesktop-timeout.conf > /dev/null
|
|
|
|
# Out of memory: let systemd-oomd kill the app causing memory pressure instead
|
|
# of the whole session freezing. GNOME launches apps into app.slice, so GNOME
|
|
# Shell itself is never a candidate.
|
|
echo "Enabling out-of-memory protection..."
|
|
sudo install -d -m 755 /etc/systemd/user/app.slice.d
|
|
sudo tee /etc/systemd/user/app.slice.d/10-coredesktop-oomd.conf > /dev/null << 'EOF'
|
|
[Slice]
|
|
ManagedOOMMemoryPressure=kill
|
|
ManagedOOMSwap=kill
|
|
EOF
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now systemd-oomd.service
|
|
|
|
# Boot: nothing on the desktop needs to wait for the network to come up
|
|
echo "Masking NetworkManager-wait-online..."
|
|
sudo systemctl mask NetworkManager-wait-online.service
|
|
|
|
# `ssh host command` runs without a login shell, so ~/.bashrc never sets PATH
|
|
# and tools in ~/.local/bin or installed with mise aren't found. PAM sets the
|
|
# environment for every login, including those. @{HOME} expands per user.
|
|
if ! grep -qE '^PATH[[:space:]]' /etc/security/pam_env.conf; then
|
|
echo "Adding user tool paths for SSH commands..."
|
|
sudo tee -a /etc/security/pam_env.conf > /dev/null << 'EOF'
|
|
|
|
# CoreDesktop: give SSH commands and other non-shell logins the user-level tool paths
|
|
PATH DEFAULT=/usr/local/sbin:/usr/local/bin:/usr/bin:@{HOME}/.local/share/mise/shims:@{HOME}/.local/bin
|
|
EOF
|
|
fi
|