107 lines
5.3 KiB
Markdown
107 lines
5.3 KiB
Markdown
---
|
|
title: "System"
|
|
description: "How Federated CoreDesktop sets up your system: tiling, the shell, the firewall, Snapper snapshots, GPU drivers, mDNS, printing, open-port audits and sensible defaults."
|
|
sections:
|
|
- type: hero
|
|
compact: true
|
|
eyebrow: "Sensible defaults, all of them explained"
|
|
title: "What CoreDesktop sets up for you."
|
|
subhead: "A flexible tiling GNOME desktop, a better shell, a firewall that's actually on, snapshots before every update, and a handful of small fixes that add up."
|
|
tiles: ["Tiling", "Firewall", "Snapshots"]
|
|
|
|
- type: text
|
|
kicker: "Tiling"
|
|
headline: "Flexible tiling, all from the keyboard."
|
|
body: |
|
|
You end up with a [GNOME](https://www.gnome.org) system with a flexible tiling setup that works on any screen and really shines on widescreens. Hold <kbd>Super</kbd> (the Windows key or equivalent) and use the arrow keys to move windows around the screen.
|
|
|
|
To change the tiling, use the icon in the top right of your screen. You can set it up however you want.
|
|
|
|
- type: text
|
|
kicker: "Shell"
|
|
headline: "A better terminal, without the setup."
|
|
body: |
|
|
Your `~/.bashrc` sources `~/.local/share/coredesktop/shell/bashrc`, which sets up:
|
|
|
|
- the **starship** prompt (your own `~/.config/starship.toml` wins if you have one)
|
|
- **zoxide**: `z {part of a path}` jumps to a directory you've used before
|
|
- **fzf** key bindings: <kbd>Ctrl</kbd>+<kbd>R</kbd> searches history, <kbd>Ctrl</kbd>+<kbd>T</kbd> inserts a file path
|
|
- **eza** for `ls`, `ll`, `la` and `lt`
|
|
- the aliases and functions in [shell/](https://gitea.federated.computer/Federated_Computer/coredesktop/src/branch/main/shell)
|
|
|
|
Anything you add to `~/.bashrc` after the CoreDesktop line overrides it.
|
|
|
|
- type: text
|
|
kicker: "Firewall"
|
|
headline: "ufw is on, and Docker can't get around it."
|
|
body: |
|
|
Incoming connections are blocked except SSH (22), mDNS (5353/udp), LocalSend (53317) and anything arriving over Tailscale.
|
|
|
|
Docker normally publishes container ports around ufw, so **ufw-docker** is installed too. To let a container's port through, or to open a port for something else, such as a dev server you want to reach from another machine:
|
|
|
|
```
|
|
sudo ufw-docker allow {container} {port}
|
|
sudo ufw allow {port}/tcp
|
|
sudo ufw status
|
|
```
|
|
|
|
To see every open port and who can reach it, run [audit](/utilities/#audit).
|
|
|
|
- type: text
|
|
id: snapshots
|
|
kicker: "Snapshots"
|
|
headline: "Roll back a bad update."
|
|
body: |
|
|
If `/` is btrfs (the archinstall default), Snapper takes a snapshot of `/` before every `update` and keeps the last 5. `/home` is a separate subvolume and isn't included, so rolling back never touches your files. `sudo snapper -c root list` shows the snapshots.
|
|
|
|
These snapshots can't be picked from the boot menu. To roll back, boot the [Arch ISO](https://archlinux.org/download/) and replace the `@` subvolume with a snapshot:
|
|
|
|
```
|
|
mount -o subvolid=5 /dev/{root partition} /mnt
|
|
mv /mnt/@ /mnt/@.broken
|
|
btrfs subvolume snapshot /mnt/@.snapshots/{number}/snapshot /mnt/@
|
|
reboot
|
|
```
|
|
|
|
If the disk is encrypted, open it with `cryptsetup open` first and mount the opened device. Once the system works again, free the space the broken root used:
|
|
|
|
```
|
|
sudo mount -o subvolid=5 /dev/{root partition} /mnt
|
|
sudo btrfs subvolume delete /mnt/@.broken
|
|
sudo umount /mnt
|
|
```
|
|
|
|
- type: features
|
|
kicker: "Hardware & network"
|
|
headline: "Drivers, printing and your LAN."
|
|
items:
|
|
- label: "GPU drivers"
|
|
body: "The Vulkan driver for Intel and AMD GPUs. For NVIDIA, if archinstall's proprietary driver wasn't chosen: the open kernel modules for GTX 16xx / RTX 20xx and newer, or the 580xx legacy driver back to the GTX 900 series. Reboot afterwards."
|
|
- label: "mDNS"
|
|
body: "Reach machines on your LAN as `machine.local`, e.g. `ssh machine.local`. Avahi and nss-mdns are set up ahead of systemd-resolved, so the two don't conflict."
|
|
- label: "Printing"
|
|
body: "The CUPS printing service is turned on. This may need more work to just work with other CoreDesktop machines."
|
|
|
|
- type: checklist
|
|
kicker: "System defaults"
|
|
headline: "Small fixes that add up."
|
|
items:
|
|
- "SSH connections notice a dropped link within a minute instead of hanging (override per host in `~/.ssh/config`)."
|
|
- "Logins allow 10 wrong passwords before locking the account for 2 minutes. Arch's default is 3 tries, then 10 minutes."
|
|
- "Shutdown waits at most 10 seconds for a service that won't stop, instead of 90."
|
|
- "If memory runs out, systemd-oomd closes the app causing it, instead of the whole desktop freezing."
|
|
- "Boot no longer waits for the network."
|
|
- "Commands run over SSH (`ssh {machine} {command}`) can find tools in `~/.local/bin` and mise."
|
|
|
|
- type: callout
|
|
text: "On a machine without systemd-resolved, set up mDNS yourself with `bash ~/.local/share/coredesktop/fixmdns.sh`. See the [Arch wiki](https://wiki.archlinux.org/title/Avahi#Hostname_resolution) for more."
|
|
|
|
- type: final-cta
|
|
headline: "Keep it all current with one command."
|
|
body: "`update` snapshots first, then updates everything, and tells you what failed."
|
|
ctas:
|
|
- label: "How updates work"
|
|
url: "/utilities/#update"
|
|
style: primary
|
|
---
|