12 Commits
0.2 ... chronyd

15 changed files with 248 additions and 92 deletions

View File

@@ -9,19 +9,17 @@
#
# Author: DarkFeather <darkfeather@aninix.net>
# seconds=10
# echo "This will sync your /etc files with the AniNIX defaults and add the AniNIX
# GPG key for pacman."
# echo "Proceeding in $seconds seconds. Is this OK? [YES/no] "
# timeout $seconds cat | read answer
# if [[ "${answer,,}" =~ ^n ]]; then
# exit 0;
# fi
seconds=10
echo "Syncing in $seconds seconds. Press Ctrl+C to cancel."
sleep $seconds
rsync -avz /opt/aninix/ShadowArch/etc/ /etc/
keyid=D9DC5933A1B0D4F7
# AniNIX GPG Package Signing
keyid=1CC1E3F4ED06F296
if ! gpg --homedir /etc/pacman.d/gnupg --list-key "${keyid}"; then
pacman-key --add /usr/share/pacman/keyrings/aninix.gpg
pacman-key --recv-key "${keyid}"
pacman-key --finger "${keyid}"
pacman-key --lsign-key "${keyid}"
fi
# Sync configuration
rsync -avz /opt/aninix/ShadowArch/etc/ /etc/

View File

@@ -11,9 +11,11 @@ install: compile
mkdir -p ${pkgdir}/opt/aninix/ShadowArch/etc/
mkdir -p ${pkgdir}/usr/lib/systemd/system
mkdir -p ${pkgdir}/etc/pacman.d/hooks
mkdir -p ${pkgdir}/usr/share/vim/vimfiles/plugin/
for i in ${syncList}; do cp "$$i" ${pkgdir}/opt/aninix/ShadowArch/etc/; done
for i in ${serviceList}; do cp "$$i" ${pkgdir}/usr/lib/systemd/system/"$$i"; done
for i in ${pacmanHooks}; do cp "$$i" ${pkgdir}/etc/pacman.d/hooks/"$$i"; done
cp ./shadowarch.vim ${pkgdir}/usr/share/vim/vimfiles/plugin/shadowarch.vim
cp -pr ./skel ${pkgdir}/opt/aninix/ShadowArch/etc
repository: shadowarch ${httpRoot}

View File

@@ -6,28 +6,43 @@
[[ $- != *i* ]] && return
### Prompt ###
organization="$(hostname | rev | cut -f 2 -d '.' | rev)"
PS1='\[\033[00;31m\][ '"${organization^^}"'::\h/\[\033[01;32m\]\u \[\033[00;31m\]\\\\\\\\ ${SHELL} {\[\033[m\]$? \[\033[00;36m\]\D{%F-%R} \[\033[00;35m\]\w\[\033[00;31m\]\[\033[00;31m\]} ]\n|\[\033[m\]> '
organization="$(echo $HOSTNAME | rev | cut -f 2 -d '.' | rev)"
PS1='\[\033[00;31m\][ \[\033[01;32m\]\u\[\033[00;31m\]@\H:${SHELL} {\[\033[m\]$? \[\033[00;36m\]\D{%F-%R} \[\033[00;35m\]\w\[\033[00;31m\]\[\033[00;31m\]\[\033[00;33m\]$(git_prompt_var)\[\033[00;31m\]} ]\n|\[\033[m\]> '
PS2='> '
PS3='> '
PS4='+ '
case ${TERM} in
xterm*|rxvt*|Eterm|aterm|kterm|gnome*)
PROMPT_COMMAND=${PROMPT_COMMAND:+$PROMPT_COMMAND; }'printf "\033]0;AniNIX::%s \134\134 %s in %s\007" "${HOSTNAME%%.*}" "${USER}" "${PWD/#$HOME/\~}"'
;;
screen)
PROMPT_COMMAND=${PROMPT_COMMAND:+$PROMPT_COMMAND; }'printf "\033]0;AniNIX::%s \134\134 %s in %s\007" "${HOSTNAME%%.*}" "${USER}" "${PWD/#$HOME/\~}"'
screen|xterm*|rxvt*|Eterm|aterm|kterm|gnome*)
PROMPT_COMMAND='echo -en "\033]0;'${organization^^}'/'${HOSTNAME%%.*}'\a"'
;;
esac
# Terminal settings
export TERM=xterm-256color
alias weechat="TERM=screen weechat"
# Disable bracketed paste mode
printf "\e[?2004l"
### MOTD ###
[ -f /etc/bash.motd ] && cat /etc/bash.motd
### AniNIX Customizations ###
alias get-commands='for i in $( echo $PATH | sed "s/:/\n/g"); do ls $i; done | sort | less'
alias whoison='who | grep -v tmux'
alias startvnc="vncserver -xstartup startxfce4; echo Use \"ssh -L 5901:localhost:5901 $(whoami)@$(hostname)\" to tunnel connections."
function vncdesktop() {
set -x
if [ -z "$@" ]; then
vncserver :2 -rfbport 5901
else
vncserver $@
fi
export DISPLAY=`vncserver -list | tail -n 1 | awk '{print $1; }' `
sleep 3
xfce4-session
vncserver -kill "$DISPLAY"
set +x
}
alias vi=vim
alias view="vim -R"
alias top="top -o %CPU"
@@ -38,21 +53,52 @@ fi
IFS="
"
### GIT ###
source /usr/share/git/completion/git-prompt.sh
function git_prompt_var() {
### If $PWD is a Git repo, add URL and branch to PS1
url=`git config remote.origin.url 2>/dev/null`
if [ -n "$url" ]; then
branch=`__git_ps1 '%s'`
url=`basename "$url"`
echo " $url($branch)"
fi
}
### SSH ###
# Aliases for hosts
if [ -f ~/.ssh/config ]; then
for i in `egrep '^Host' ~/.ssh/config | grep -v \* | cut -f 2 -d ' '`; do
alias "$i"="ssh $i";
done
fi
# Tell shell about ssh-agent -- enable with 'systemctl enable ssh-agent@$USER.service'
export SSH_AGENT_PID="$(ps -fu "$USER" | grep -v grep | grep -m 1 ssh-agent | awk '{ print $2; }')"
export SSH_AGENT_PID="$(pgrep -fu "$USER" ssh-agent)"
if [ -n "$SSH_AGENT_PID" ]; then
export SSH_AUTH_SOCK="$(ls -1 /tmp/ssh-*/agent.$(( $SSH_AGENT_PID - 1 )))"
export SSH_AUTH_SOCK="$(ls -ld /tmp/ssh-*/agent.* | grep -m 1 "$USER" | awk '{ print $9; }')"
echo ssh-agent PID is $SSH_AGENT_PID
fi
if [ -n "$SSH_AUTH_SOCK" ] && [ `ssh-add -L | grep -c no\ identities` -eq 1 ]; then
ssh-add
ssh-add -L
fi
### GPG ###
export GPG_TTY=$(tty)
### Ansible ###
export ANSIBLE_VAULT_PASSWORD_FILE=$HOME/password-store/${organization}.vault.password
export ANSIBLE_VAULT_FILE=$HOME/password-store/${organization}.vault
# ### User-directory .gitbare Support (Git) ###
# if [ -d ~/.git ]; then
# cd
# printf "~/.git: "
# if [ $SHLVL -eq 1 ] && [ -z "$TMUX" ]; then
# git pull
# else
# git rev-parse --short HEAD
# fi
# git status
# fi
#
# Set up screen/tmux safety nest by default for remote sessions
if [ ! -z "$SSH_CLIENT" ]; then
if [ -n "$SSH_CLIENT" ]; then
# Prefer tmux
if [ -x "$(which tmux 2>/dev/null)" ] && [ -z "$TMUX" ]; then
if [ `tmux list-sessions | grep created | wc -l` -eq 0 ]; then
@@ -63,20 +109,9 @@ if [ ! -z "$SSH_CLIENT" ]; then
tmux list-sessions
fi
alias tat="exec tmux a -d -t"
# Fallback on Screen
elif [ -x "$(which screen 2>/dev/null)" ] && [ "$TERM" != "screen" ]; then
if [ `screen -list | grep -c 'Detached'` -eq 1 ]; then
exec screen -r
elif [ `screen -list | grep -c 'No Sockets found in '` -eq 1 ] && [ "$TERM" != "screen" ]; then
exec /usr/bin/screen /bin/bash
else
screen -list
fi
alias sdr="screen -d -r"
fi;
### XFCE4 ###
elif [ `who -m | egrep "^$(whoami)" | awk '{ print $2; }' | egrep -c "^tty"` -eq 1 ] && [ -x /usr/sbin/startxfce4 ] && [ `pgrep -ac xinit` -eq 0 ] && [ `whoami` != 'root' ]; then
exec startxfce4
fi

View File

@@ -101,7 +101,7 @@ Include = /etc/pacman.d/mirrorlist
#SigLevel = Optional TrustAll
#Server = file:///home/custompkgs
[aninix]
[AniNIX]
SigLevel = Required DatabaseOptional
Server = https://aninix.net/maat/

View File

@@ -3,9 +3,30 @@
#Set our umask
umask 022
# Set our default path
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:~/bin"
# Append "$1" to $PATH when not already in.
# This function API is accessible to scripts in /etc/profile.d
append_path () {
case ":$PATH:" in
*:"$1":*)
;;
*)
PATH="${PATH:+$PATH:}$1"
esac
}
# Append our default paths
append_path '/usr/local/sbin'
append_path '/usr/local/bin'
append_path '/usr/sbin'
append_path '/usr/bin'
append_path '/sbin'
append_path '/bin'
append_path '~/bin'
# Force PATH to be environment
export PATH
# Set IFS to be newline delimited
IFS="
"
export IFS
@@ -18,8 +39,16 @@ if test -d /etc/profile.d/; then
unset profile
fi
# Source global bash config
if test "$PS1" && test "$BASH" && test -r /etc/bashrc; then
# Unload our profile API functions
unset -f append_path
# Source global bash config, when interactive but not posix or sh mode
if test "$BASH" &&\
test "$PS1" &&\
test -z "$POSIXLY_CORRECT" &&\
test "${0#-}" != sh &&\
test -r /etc/bashrc
then
. /etc/bashrc
fi
@@ -28,5 +57,3 @@ unset TERMCAP
# Man is much better than us at figuring this out
unset MANPATH

View File

@@ -2,8 +2,7 @@
function header () {
tput setaf 1
tput bold
echo $@
tput bold echo $@
tput sgr0
return
}
@@ -18,10 +17,10 @@ function help() {
echo '\-l FILE -- Log to a file'
echo '\-p -- Productivity package additions'
echo '\-P -- Power saving for laptops'
echo '\-s -- Create a layout for an AniNIX::Spartacus'
echo '\-s -- Create a layout for an AniNIX/Spartacus'
echo '\-m -- Skip disk operations and assume storage is mounted on /mnt'
echo '\-v -- Verbose output.'
echo '\-z -- Try to add all the packages on AniNIX::Core'
echo '\-z -- Try to add all the packages on AniNIX/Core'
exit 1;
}
@@ -76,6 +75,12 @@ if [ "$answer" != "YES" ]; then
echo User did not confirm.
exit 1;
fi
echo >> /etc/pacman.conf <EOM
[AniNIX]
SigLevel = Optional TrustAll
Server = https://aninix.net/maat/
EOM
pacman -Syy
if [ -z "$nodiskbuild" ]; then
header Allocating space
@@ -156,9 +161,9 @@ fi
# * make for source packages
# * tor for anonymity
header Installing ArchLinux to device\(s\) on /mnt
export pkglist="base base-devel parted net-tools bind-tools git openssh make elinks weechat vim wget tor torsocks grub os-prober rsync openntpd tmux efibootmgr"
export pkglist="base base-devel parted net-tools bind-tools git openssh make elinks weechat vim wget tor torsocks grub os-prober rsync chrony tmux efibootmgr shadowarch"
if [ ! -z "$gui" ]; then
export pkglist="$pkglist"" xorg-server xfce4 chromium conky tigervnc xscreensaver"
export pkglist="$pkglist"" xorg-server xfce4 hunspell hunspell-en_US thunar-archive-plugin thunar-media-tags-plugin thunar-volman chromium conky tigervnc xscreensaver"
fi
if [ ! -z "$spartacus" ]; then
export pkglist="$pkglist"" exfat-utils"
@@ -213,7 +218,7 @@ arch-chroot /mnt grub-mkconfig -o /boot/grub/grub.cfg
if [ $? -ne 0 ]; then header ERROR: Cannot continue; exit 1; fi
header Set networking
arch-chroot /mnt systemctl enable openntpd
arch-chroot /mnt systemctl enable chronyd
arch-chroot /mnt systemctl enable netctl
export interface=$(ip link list | grep "state" | cut -f 2 -d ":" | cut -f 2 -d " " | grep -v lo)
cp /mnt/etc/netctl/examples/ethernet-dhcp /mnt/etc/netctl/$interface
@@ -275,20 +280,6 @@ if [ ! -z "$audio" ]; then
printf 'echo 2048 > /sys/class/rtc/rtc0/max_user_freq\necho 2048 > /proc/sys/dev/hpet/max-user-freq\n' >> /mnt/etc/rc.local
fi
# Emulate old rc.local behavior
touch /mnt/etc/rc.local
echo '[Unit]
Description=Execute commands at boot
[Service]
ExecStart=/etc/rc.local
[Install]
WantedBy=multi-user.target' > /mnt/usr/lib/systemd/system/rclocal.service
arch-chroot /mnt systemctl enable rclocal
arch-chroot /mnt chmod 0700 /etc/rc.local
arch-chroot /mnt chown root: /etc/rc.local
# Set password
header Set new root passphrase and depriviledged user '(depriv)' password.
arch-chroot /mnt passwd
@@ -311,12 +302,12 @@ fi
# Set hostname
header Set hostname
printf "What is your fully-qualified hostname? (i.e. core.aninix.net) "
printf "What is your fully-qualified hostname? (i.e. host.site.example.com) "
read hostname
echo "$hostname" > /mnt/etc/hostname
hostname "$hostname"
header Installed ShadowArch on AniNIX::`hostname -s`\!
header "Installed ShadowArch on $HOSTNAME!"
if [ ! -z "$nodiskbuild" ]; then
header Remember to run grub-install and set up your bootloader.
echo 'https://wiki.archlinux.org/index.php/Installation_guide#Boot_loader'

1
EtcFiles/shadowarch.vim Normal file
View File

@@ -0,0 +1 @@
set mouse-=a

View File

@@ -3,7 +3,7 @@ Description=SSH-Agent for User %I
After=network.target shadow.service
[Service]
ExecStart=ssh-agent -s
ExecStart=/usr/bin/ssh-agent -s
ExecReload=/bin/kill -HUP $MAINPID
Type=oneshot
KillMode=process

View File

@@ -3,10 +3,12 @@ Description=TMUX/Weechat Session for User %I
After=network.target shadow.service
[Service]
ExecStart=/usr/sbin/tmux new-session -d -c IRC weechat
Environment=HOME=/home/%I
WorkingDirectory=/home/%I
ExecStart=/usr/bin/tmux new-session -d -s IRC "weechat"
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failed
Restart=no
Type=oneshot
User=%I
Group=%I

View File

@@ -5,7 +5,6 @@ compile: ${LIST}
install: compile
mkdir -p ${pkgdir}/usr/share/pacman/keyrings
cp ./aninix.gpg ${pkgdir}/usr/share/pacman/keyrings
for i in ${LIST}; do make -C ./$$i install; done
reverse:

View File

@@ -1,23 +1,22 @@
# Maintainer: Shikoba Kage <darkfeather@aninix.net>
pkgname="$(git config remote.origin.url | rev | cut -f 1 -d '/' | rev | sed 's/.git$//' | tr '[[:upper:]]' '[[:lower:]]')"
depends=('curl' 'grep' 'bash>=4.4' 'git>=2.13' 'elinks')
makedepends=('make>=4.2')
checkdepends=()
optdepends=()
pkgname="$(git config remote.origin.url | rev | cut -f 1 -d '/' | rev | sed 's/.git$//')"
pkgver="$(git describe --tag --abbrev=0)"."$(git rev-parse --short HEAD)"
pkgrel=1
pkgrel() {
git log "$(git describe --tag --abbrev=0)"..HEAD | grep -c commit
echo $(( `git log "$(git describe --tag --abbrev=0)"..HEAD | grep -c commit` + 1 ))
}
epoch=
epoch="$(git log | grep -c commit)"
pkgdesc="$(head -n 1 README)"
arch=("x86_64")
url="https://aninix.net/foundation/${pkgname}"
license=('custom')
groups=()
depends=('curl' 'grep' 'bash>=4.4' 'git>=2.13')
makedepends=('make>=4.2')
checkdepends=()
optdepends=()
provides=('shadowarch')
provides=("${pkgname}")
conflicts=()
replaces=('aninix-misc-scripts')
replaces=("${pkgname,,}", "aninix-${pkgname,,}")
backup=()
options=()
install=
@@ -36,7 +35,8 @@ build() {
}
check() {
printf 'quit\n\n' | make -C .. test
chmod -R u+r ../pkg
make -C .. test
}
package() {

6
README
View File

@@ -1,6 +0,0 @@
AniNIX::ShadowArch \\ AniNIX preferred shell environment
This package holds core files for our environment.
* EtcFiles: Core configuration for our experience
* AdminScripts: Scripts requiring root access for administration
* UserScripts: Useful user-space deprivileged scripts

107
README.md Normal file
View File

@@ -0,0 +1,107 @@
ShadowArch is an installation of [ArchLinux](https://www.archlinux.org/) following a general list of installed packages and configuration. We provide scripts to install the underlying OS and configure it, but we do not distribute ArchLinux software.
This package holds core files for our environment.
* EtcFiles: Core configuration for our experience
* AdminScripts: Scripts requiring root access for administration
* UserScripts: Useful user-space deprivileged scripts
# How to Install ShadowArch
The AniNIX provides an installer to install ShadowArch and some basic clients for its services, similar to the [KickStart concept from RHEL/CentOS](https://serverfault.com/questions/517908/how-to-create-a-custom-iso-image-in-centos#521672).
1. Acquire a read-write storage device and some hardware with at least 256M of RAM and one core.
1. [https://archlinux.org/download Download the Arch ISO] and boot the VM or host from that.
1. Run the following to minimally install ShadowArch:
1. `wget https://aninix.net/shadowarch; vi shadowarch; bash shadowarch`
1. Some flags are listed below.
1. If you run across trouble, take a look at the Troubleshooting section at the bottom.
# Defaults
These are installed by default with the base package of ShadowArch, along with the ArchLinux base packages, grub, parted, os-prober, net-tools, bind-tools, and wget.
* git for source-code access
* elinks for browsing
* openssh for remote access
* weechat for IRC
* make for compiling source
* tor for privacy
* tmux for terminal control and resumability.
Particularly in virtualized environments, ShadowArch has not had good luck with PulseAudio -- we instead rely on the default ALSA for sound. Especially when trying to play sound remotely, [AniNIX Yggdrasil](/AniNIX/Wiki/Services/Yggdrasil.md) is superior to PulseAudio over SSH due to the SSH overhead and buffering.
## Encryption
ShadowArch generally uses serpent-xts-plain64 with a sha512 hash and 512 keysize. If you choose not to encrypt your drive, you will need to edit the script accordingly in the storage layout section. When the ShadowArch install boots, it will prompt for a password unless you set up a crypttab for the root.
If you do encrypt your root on a server, you should look at [adding IP to mkinitcpio](https://wiki.archlinux.org/index.php/Mkinitcpio#Using_net) and [the encryptssh](https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Remote_unlocking_of_the_root_.28or_other.29_partition) hook. We recommend assigning a static IP for NAT forwarding rules and using the dropbear AUR package.
ShadowArch will encrypt your storage with the -e flag.
## GUI
The -g flag will add a graphical desktop environment (startxfce4), GUI browser (seamonkey), and resource visualizer (conky). You're welcome to replace this desktop environment with KDE, GNOME, Cinnamon, i3, or any other DE of choice, but we have found XFCE4 to be reliable and easy to configure.
Mac set some [standard keybinds](https://en.wikipedia.org/wiki/Keyboard_shortcut) that we abide by. Please note that the ⌘ character translates to the "Ctrl" key on most keyboards and "Super" translates to the Windows or ⊞ key on most keyboards. We assume QWERTY and standard Windows-style keyboards that saturate the market today. Some applications, like vim or tmux, will have their own keybinds, but most like Chromium or libreoffice will respect near-global defaults. The Alt key in particular will allow menu navigation in most applications -- this is really helpful for minimize mouse activity.
Some keybinds preferred for ShadowArch GUI management are below.
{|class="wikitable"
|-
| Super+B || Open Browser
|-
| Super+T || Open Terminal emulator
|-
| Super+R || Run Command
|-
| Super+E || File Explorer
|-
| Super+ArrowUp || Maximize current window
|-
| Super+ArrowDown || Minimize current window
|-
| Super+ArrowLeft || Snap window left
|-
| Super+ArrowRight || Snap window right
|-
| Super+PageUp || Next Workspace
|-
| Super+PageDown || Previous Workspace
|-
| Ctrl+Alt+[Number] || Move window to workspace [number]
|}
<b>Note:</b> Standalone machines may benefit from sound tuning found in [the Arch Wiki](https://wiki.archlinux.org/index.php/Professional_audio) for "professional audio."
## Productivity
LibreOffice is the package of choice for office productivity (powerpoints, documents, and spreadsheets), and gIMP is the image editor of choice. We include feh for images, VLC for video and music, and evince as a reader. We are searching for video and audio editors.
## Holocron
: The -s flag is reserved for [Holocron](/AniNIX/Wiki/Entities/Holocron.md).
# Emulating ShadowArch in Other Environments
## XFCE4 in Linux
Clone the [https://aninix.net/foundation/MiscScripts/ MiscScripts] repository from the Foundation and use the contents of ShadowArch/skel/ to set up your home folder. You may have to find additional themes that meet your needs -- we use stock Xfce-dusk.
## CLI Customizations
We include the following customizations:
* A tty-allow local group that is required for non-root users to have local access
* Auto-created aliases for all the hosts defined in a user's ~/.ssh/known_hosts and the local Irssi configs
* A PS1 that includes the last exit code, organization, hostname, OS type, user, date, and working directory.
* VNC and Tor Lynx aliases
* Autostarting and resuming tmux (or screen) sessions for remote logins
* Some niceties for Makefile, top, and vim support
## Windows
1. Desktop themes can be established with [https://aninix.net/wolfpack/aninix.deskthemepack a provided deskthemepack file].
1. [Chrome](https://www.google.com/chrome/) with [DuckDuckGo](https://duckduckgo.com/) as the default search engine is our browser recommendation. This can be bound to the ShadowArch-like keybind with Start > Chrome > Right-click > Open File Location > Right-click icon > Properties and set the shortcut key to B. We presently don't have a way to bind the Super key in the same way.
1. Terminal Emulator can be provided by either Powershell or [PuTTY](http://www.putty.org/), depending on where shell activity should live. Use the same steps as the browser above to set the keybind.
1. Default Windows Explorer and its keybinds equate to the XFCE4 thunar application used by ShadowArch. The Run and Explorer keybinds natively present in Windows will map.
1. Default Windows Aero window managment will map to the ShaodowArch keybinds.
1. Workspace management won't be quite the same, but this [CNET article](https://www.cnet.com/how-to/how-to-use-multiple-desktops-in-windows-10/) offers some help on understanding the difference. The Windows environment is a bit more dynamic so it requires more keybinds.
# References
* [The ArchLinux Wiki](https://wiki.archlinux.org/) is an invaluable source of information, particularly around packages deployed by ShadowArch hosts.
These are some known issues the users of ShadowArch have come across with weird reasons.
# Troubleshooting
## No Audio
Make sure the user is in the audio group on the system and alsamixer is not muted.
## No Desktop
Run xfdesktop -- sometimes xinit loses this execution and the desktop doesn't display.

View File

@@ -1,2 +1,2 @@
#!/bin/bash
/usr/bin/lynx -connect_timeout=5 -read_timeout=5 --dump whatismyipaddress.com | grep '/ip/' | head -n 1 | cut -f 5 -d '/'
timeout 5 /usr/bin/elinks --dump whatismyipaddress.com | grep '/ip/' | head -n 1 | cut -f 5 -d '/'

Binary file not shown.