michel_ouba/points

Fork 0

Michel b836555422 feat(qubes): Split SSH

2024-10-13 20:13:51 +02:00

13 KiB

Raw Blame History

Installation Tips

Recommended installation order:

Debian packages
dotfiles
System Config
Qubes Specific
ASDF & plugins
Newer Debian packages
Fonts
kitty — st?
lazygit
nnn
neovim
Install into /etc/skel (see dotfiles)

Generic Tips

Desktop Files

See https://specifications.freedesktop.org/desktop-entry-spec/latest/

GIT remotes as subtree

https://www.atlassian.com/git/tutorials/git-subtree
Create an alias for remote repository
- dotfiles remote add <remote-name> <URL>
Import remote as a single commit (squashed)
- `dotfiles subtree add --prefix --squash
- Note 1: Must be called from $HOME
- Note 2: Do not start with $HOME or ~

Github Patches

From stackoverflow.

wget https://github.com/jesseduffield/lazygit/pull/2604.patch
git apply --stat --apply 2604.patch

Qubes: Temporary Internet Access

In Basic, connect to sys-firewall;
In Firewall rules:
- check Limit outgoing connections;
- check Allow full access for 25 minutes.

Debian Packages

apt install --no-install-recommends \
  aptitude \
  curl fd-find fzf git grc ripgrep \
  vim-nox vim-tiny- wget xdg-utils xsel \
  libarchive-tools trash-cli \
  kitty-terminfo

dpkg-divert --rename --divert /usr/bin/fd /usr/bin/fdfind
dpkg-divert --rename --divert /usr/share/man/man1/fd.1.gz \
                              /usr/share/man/man1/fdfind.1.gz
dpkg-divert --rename --divert /usr/share/zsh/vendor-completions/_rg \
                              /usr/share/zsh/vendor-completions/rg.zsh

 # Installed by kicksecure
dpkg-divert --rename --divert /usr/share/zsh-autosuggestions/disabled \
                              /usr/share/zsh-autosuggestions/zsh-autosuggestions.zsh

dotfiles — Bare Git Repository

https://www.atlassian.com/git/tutorials/dotfiles
StreakyCobra

Starting from scratch

git init --bare $HOME/.dotfiles
alias dotfiles='/usr/bin/git --git-dir=$HOME/.dotfiles --work-tree=$HOME'
dotfiles config --local status.showUntrackedFiles no

Install onto a new system

The checkout command is expected to fail with a message. This is because your $HOME folder might already have some stock configuration files which would be overwritten by Git. The “BKDIR” part is a rough shortcut to move all the offending files automatically to a backup folder:

git clone --bare <git-repo-url> $HOME/.dotfiles

export ALL_PROXY=127.0.0.1:8082
git clone --bare https://forge.chapril.org/michel_ouba/points.git $HOME/.dotfiles

alias dotfiles='/usr/bin/git --git-dir=$HOME/.dotfiles --work-tree=$HOME'

dotfiles config --local status.showUntrackedFiles no

BRANCH=main
BKDIR=".dotfiles-backup/";
dotfiles checkout ${BRANCH} 2>&1 | egrep "\s+" | awk {'print $1'} |
  xargs -I{} sh -c "mkdir -p \$(dirname ${BKDIR}{}); mv -iv {} ${BKDIR}{}";

dotfiles checkout ${BRANCH}

for file in ${BKDIR%/}/*(D); {
  ls -lh ${file} ./${file#${BKDIR}}; read;
  vimdiff ${file} ./${file#${BKDIR}} }

To upgrade to SSH (not compatible with Qubes proxy):

dotfiles remote set-url origin ssh://gitea@forge.chapril.org:222/michel_ouba/points.git

When the fetch configuration is not set, insert the following line in the remote section of .dotfiles/config:

    fetch = +refs/heads/*:refs/remotes/<remote-name>/*

Install into `/etc/skel`

sudo vi /etc/adduser.conf

sudo mkdir -p /etc/skel/.dotfiles
sudo chown $(whoami) /etc/skel /etc/skel/.dotfiles
sudo chown $(whoami) -R /etc/skel/.config

git clone --bare $(dotfiles remote -v | head -1 | cut -f2 | cut -f1 -d' ') /etc/skel/.dotfiles

alias skelfiles='/usr/bin/git --git-dir=/etc/skel/.dotfiles --work-tree=/etc/skel'
skelfiles config --local status.showUntrackedFiles no
skelfiles checkout

Update the fetch remote setting in .dotfiles/config.

Useful Commands

List all tracked files (from CWD):
dotfiles ls-tree --name-only -rz HEAD | xargs -0 $(whence lsd) -lU
--color always | fzf --multi --height=~100 --exact

Other Tools

lazygit --git-dir=$HOME/.dotfiles --work-tree=$HOME
lazygit --git-dir=/etc/skel/.dotfiles --work-tree=/etc/skel

System Config

SysRq
sudo cp -aiv ~/.aptitude /root
Zsh completion “already initialized”
- https://github.com/Kicksecure/desktop-config-dist
- /etc/zsh/zshrc_completions
  - comment out the compinit -u line

Qubes Specific

Kicksecure

Disable sdwdate-gui

Launch Services

qvm-run -q --service -- <VM-name> qubes.StartApp+firefox-PM
qvm-run -q --service -- <VM-name> qubes.StartApp+kitty-opt

Can be used in global Keyboard settings (shortcuts).

Proxy Scripts

chmod +x $HOME/bin/*-proxy

export ALL_PROXY=127.0.0.1:8082
source ~/.zshrc

TODO: Insert random part in filenames.

AppVM without sys-net

 # In TemplateVM:
qvm-copy .asdf .zim
 # In AppVM:
asdf direnv setup --version latest
asdf global direnv 2.34.X

ASDF & main plugins

.zshrc will install asdf.

Before installing/compiling Python, make sure you have the required system dependencies.

sudo apt install --no-install-recommends \
  build-essential libssl-dev zlib1g-dev \
  libbz2-dev libreadline-dev libsqlite3-dev curl \
  libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev

asdf plugin add direnv
asdf install direnv latest
asdf direnv setup --version latest
asdf global direnv latest

asdf plugin add python

for Plugin in $(asdf plugin list); { echo $Plugin; asdf list $Plugin }

Newer Debian packages

Flatpak

com.github.tchx84.Flatseal
org.mozilla.firefox
org.mozilla.Thunderbird

TODO: Where are all the installed flatpak apps .desktop files located

Qubes Integration

https://dataswamp.org/~solene/2023-09-15-flatpak-on-qubesos.html
/etc/qubes/post-install.d/10-qubes-core-agent-appmenus.sh

Kicksecure Wiki

Install Additional Software Safely
- Qubes OS Specific
  Applications installed using Flatpak:
  Qube settings → applications tab → press "Refresh Applications".
Bootstrapping a Trust path To Flathub Repository Signing Key
- NOTE: Not needed with package anon-apt-sources-list
  - https://github.com/Kicksecure/anon-apt-sources-list

% cd ~/Downloads
% scurl-download https://flathub.org/repo/flathub.flatpakrepo
% sed -ne 's/^GPGKey=//p' flathub.flatpakrepo | base64 -w0 -d | gpg --import

% gpg --fingerprint 6E5C05D979C76DAF93C081354184DD4D907A7CAE
pub   rsa4096/0x4184DD4D907A7CAE 2017-06-16 [SC] [expires: 2027-06-14]
      Key fingerprint = 6E5C 05D9 79C7 6DAF 93C0  8135 4184 DD4D 907A 7CAE
uid                   [ unknown] Flathub Repo Signing Key <flathub@flathub.org>
sub   rsa4096/0x562702E9E3ED7EE8 2017-06-16 [S] [expires: 2027-06-14]

% diff ~/Downloads/flathub.flatpakrepo /etc/flatpak/remotes.d/flathub.flatpakrepo
2c2,3
< Title=Flathub
---
> Title=Flathub - Verified and Floss (Freedom Software) - --subset=verified_floss
> Subset=verified_floss

Versions Checking Tool

cd ~/bin
asdf current
asdf local direnv latest
asdf install
direnv allow
python -m pip install -r requirements.txt

cd ~/Downloads
versions_check

wget-proxy https://...
dpkg -i *.deb

Fonts

JetBrains Mono
- Choose files without “NL” (No Ligatures) in their names
Nerd Fonts
- Download
  - JetBrainsMono.tar.xz
  - NerdFontsSymbolsOnly.tar.xz
- Cheat Sheet
- https://raw.githubusercontent.com/ryanoasis/nerd-fonts/master/bin/scripts/test-fonts.sh
xfce4-appearance-settings
- http://www.lagom.nl/lcd-test/subpixel.php

in $HOME/.fonts

mv *(/) ~/.fonts
fc-cache -fv ~/.fonts

in /opt/fonts

/etc/fonts/conf.d/00-opt.conf:

<?xml version="1.0"?><!DOCTYPE fontconfig SYSTEM "fonts.dtd">
<fontconfig>
<dir>/opt/fonts</dir>
</fontconfig>

sudo mkdir -p /opt/fonts
sudo mv -i *(/) /opt/fonts
sudo chown root:root -R /opt/fonts
sudo chmod go+rX -R /opt/fonts
sudo fc-cache -fv /opt/fonts

kitty

https://sw.kovidgoyal.net/kitty/binary/

Dependencies

JetBrains Mono (without NL)
NerdFontsSymbolsOnly
- Note: outside of kitty, it may be interesting to also install JetBrains Mono with NL.
terminfo

sudo apt install kitty-terminfo
 # OR:
wget 'https://salsa.debian.org/debian/kitty/-/raw/debian/sid/terminfo/x/xterm-kitty'
sudo cp xterm-kitty /usr/share/terminfo/x

Install

 # Show installed version, debian package & changelog
(ls =kitty;
 kitty --version;
 apt show kitty;
 curl https://sw.kovidgoyal.net/kitty/changelog/ | html2text) | less

 # Debian package
sudo apt install kitty

 # In $HOME
sh ~/.config/kitty/installer.sh

 # In /opt/kitty.app
sudo --preserve-env=ALL_PROXY sh ~/.config/kitty/installer.sh launch=n dest=/opt
sudo update-alternatives \
  --install /usr/bin/x-terminal-emulator \
  x-terminal-emulator /opt/kitty.app/bin/kitty 99

Note: Kitty prepends its bin folder to the path. So it is more coherent/simpler to copy this behaviour into Zsh.

lazygit

Dependencies

git-delta
go language (when compiling)

 # debian testing & unstable: 
apt install git-delta

From Source

mkdir -p $HOME/dev_3rd/golang
cd $HOME/dev_3rd/golang

git clone https://github.com/jesseduffield/lazygit.git
cd lazygit

path+=(/usr/lib/go-1.21/bin)
go install

Binary Releases

URI=https://api.github.com/repos/jesseduffield/lazygit
LOCATION=$(curl -s $URI/releases/latest \
  | grep "browser_download_url.*Linux_x86_64" \
  | awk '{ print $2 }' \
  | sed 's/,$//'       \
  | sed 's/"//g')
echo $LOCATION
wget $LOCATION

sudo mkdir -p /opt/lazygit/bin
cd /opt/lazygit/bin
sudo tar xf ${OLDPWD}/*.tar.gz(om[1])
sudo chown root:root -R /opt/lazygit
sudo chmod go+rX -R /opt/lazygit

From Go Package

go install github.com/jesseduffield/lazygit@latest
export GOPATH=/opt/go && sudo mkdir -p $GOPATH
sudo -E go install github.com/jesseduffield/lazygit@latest

Problem: Commit ID, build date and version aren't set.

$ lazygit --version
commit=, build date=, build source=unknown, version=unversioned, os=linux, arch=amd64, git version=2.43.0

neovim

Dependencies

kitty / NerdFont
libfuse2
xsel

Binary Nightly Release

mkdir -p $HOME/.local/bin
cd $HOME/.local/bin
 # ---
sudo mkdir -p /opt/neovim/bin
cd /opt/neovim/bin

sudo =curl-proxy -LO https://github.com/neovim/neovim/releases/download/nightly/nvim.appimage
sudo mv ~/Downloads/nvim.appimage /opt/neovim/bin
sudo chown root:root nvim.appimage
sudo chmod ugo+rx nvim.appimage
sudo ln -sf nvim.appimage nvim
sudo ln -sf nvim.appimage vi

cd $HOME
nvim --version
vi --version

LazyVim

git clone https://forge.chapril.org/michel_ouba/LazyVim.git ~/.config/nvim
bat ~/.config/nvim/README.md

nnn — n³

Dependencies

kitty / NerdFont
Archives Management:
- bsdtar (libarchive-tools) supports Zstd
- fuse-archive
- atool: last release is from 2012
  - https://github.com/solsticedhiver/atool2
  - https://github.com/wummel/patool
Drag&Drop: https://github.com/mwh/dragon
Trash:
- trash-cli is a much better CLI-only solution! Compare the outputs of trash-cli and gio trash --list… https://github.com/andreafrancia/trash-cli
- For gio trash, packages libglib2.0 & gvfs are recommended.

From source (to enable some options)

 # From repository
mkdir -p ~/dev_3rd; cd ~/dev_3rd
git clone https://github.com/jarun/nnn.git

 # Compile
cd nnn
make clean

 # into /usr/local
sudo make O_GITSTATUS=1 O_NAMEFIRST=1 O_NERD=1 install
sudo cp -v misc/auto-completion/zsh/* /usr/local/share/zsh/site-functions
sudo chmod -v a+r /usr/local/share/zsh/site-functions/*

 # into /opt
sudo make O_GITSTATUS=1 O_NAMEFIRST=1 O_NERD=1 PREFIX=/opt/nnn install
sudo mkdir -p /opt/zsh/site-functions
sudo cp -v misc/auto-completion/zsh/* /opt/zsh/site-functions
sudo chmod -v a+r /opt/zsh/site-functions/*

 # Plugins
mv -v ~/.config/nnn/plugins $HOME/nnn_plugins_$(stat -c %Y ~/.config/nnn/plugins)
mkdir -p ~/.config/nnn
cp -av plugins ~/.config/nnn
sudo mkdir -p /etc/skel/.config/nnn
sudo cp -av plugins /etc/skel/.config/nnn

13 KiB Raw Blame History

Installation Tips

Generic Tips

Desktop Files

GIT remotes as subtree

Github Patches

Qubes: Temporary Internet Access

Debian Packages

dotfiles — Bare Git Repository

Starting from scratch

Install onto a new system

Install into /etc/skel

Useful Commands

Other Tools

System Config

Qubes Specific

Kicksecure

Launch Services

Proxy Scripts

AppVM without sys-net

ASDF & main plugins

Newer Debian packages

Flatpak

Qubes Integration

Kicksecure Wiki

Versions Checking Tool

Fonts

in $HOME/.fonts

in /opt/fonts

kitty

Dependencies

Install

lazygit

Dependencies

From Source

Binary Releases

From Go Package

neovim

Dependencies

Binary Nightly Release

LazyVim

nnn — n³

Dependencies

From source (to enable some options)

13 KiB

Raw Blame History

Install into `/etc/skel`