mirror of
https://github.com/tommytran732/Linux-Setup-Scripts
synced 2024-11-09 11:41:33 -05:00
Better virtualization handling
Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
parent
24e7e6bd88
commit
7c8394ea12
@ -24,6 +24,8 @@ unpriv(){
|
|||||||
sudo -u nobody "$@"
|
sudo -u nobody "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
virtualization=$(systemd-detect-virt)
|
||||||
|
|
||||||
# Increase compression level
|
# Increase compression level
|
||||||
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
||||||
|
|
||||||
@ -98,63 +100,62 @@ sudo sed -i 's/^metalink=.*/&\&protocol=https/g' /etc/yum.repos.d/*
|
|||||||
# Remove unnecessary packages
|
# Remove unnecessary packages
|
||||||
sudo dnf remove -y cockpit*
|
sudo dnf remove -y cockpit*
|
||||||
|
|
||||||
|
# Install appropriate virtualization drivers
|
||||||
|
if [ "$virtualization" = 'kvm' ]; then
|
||||||
|
sudo dnf install -y qemu-guest-agent
|
||||||
|
fi
|
||||||
|
|
||||||
# Setup fwupd
|
# Setup fwupd
|
||||||
echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
|
if [ "$virtualization" = 'none' ]; then
|
||||||
sudo systemctl restart fwupd
|
sudo dnf install -y fwupd
|
||||||
|
echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
|
||||||
|
sudo systemctl restart fwupd
|
||||||
|
mkdir -p /etc/systemd/system/fwupd-refresh.service.d
|
||||||
|
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/systemd/system/fwupd-refresh.service.d/override.conf | sudo tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
|
||||||
|
sudo systemctl daemon-reload
|
||||||
|
sudo systemctl enable --now fwupd-refresh.timer
|
||||||
|
fi
|
||||||
|
|
||||||
# Enable auto TRIM
|
# Enable auto TRIM
|
||||||
sudo systemctl enable fstrim.timer
|
sudo systemctl enable fstrim.timer
|
||||||
|
|
||||||
### Differentiating bare metal and virtual installs
|
### Differentiating bare metal and virtual installs
|
||||||
|
|
||||||
# Installing tuned first here because virt-what is 1 of its dependencies anyways
|
# Setup tuned
|
||||||
sudo dnf install tuned -y
|
sudo dnf install -y tuned
|
||||||
sudo systemctl enable --now tuned
|
sudo systemctl enable --now tuned
|
||||||
|
|
||||||
virt_type=$(virt-what)
|
if [ "$virtualization" = 'none' ]; then
|
||||||
if [ "$virt_type" = '' ]; then
|
|
||||||
output 'Virtualization: Bare Metal.'
|
|
||||||
elif [ "$virt_type" = 'openvz lxc' ]; then
|
|
||||||
output 'Virtualization: OpenVZ 7.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM on AWS.'
|
|
||||||
else
|
|
||||||
output "Virtualization: $virt_type."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Setup tuned
|
|
||||||
if [ "$virt_type" = '' ]; then
|
|
||||||
sudo tuned-adm profile latency-performance
|
sudo tuned-adm profile latency-performance
|
||||||
else
|
else
|
||||||
if [ "$virt_type" = 'kvm' ]; then
|
if [ "$virtualization" = 'kvm' ]; then
|
||||||
sudo dnf install qemu-guest-agent -y
|
sudo dnf install -y qemu-guest-agent
|
||||||
fi
|
fi
|
||||||
sudo tuned-adm profile virtual-guest
|
sudo tuned-adm profile virtual-guest
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
||||||
# Setup real-ucode and hardened_malloc
|
# Setup real-ucode and hardened_malloc
|
||||||
MACHINE_TYPE=$(uname -m)
|
MACHINE_TYPE=$(uname -m)
|
||||||
if [ "$virt_type" = '' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||||
sudo dnf install 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm' -y
|
sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
|
||||||
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
||||||
if [ "${MACHINE_TYPE}" != 'x86_64' ]; then
|
if [ "${MACHINE_TYPE}" != 'x86_64' ]; then
|
||||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
||||||
sudo dnf install real-ucode -y
|
sudo dnf install -y real-ucode
|
||||||
sudo dracut -f
|
sudo dracut -f
|
||||||
elif [ "$virt_type" != '' ]; then
|
elif [ "$virtualization" != 'none' ]; then
|
||||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,hardened_malloc
|
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,hardened_malloc
|
||||||
sudo dnf install hardened_malloc -y
|
sudo dnf install -y hardened_malloc
|
||||||
else
|
else
|
||||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware,hardened_malloc
|
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware,hardened_malloc
|
||||||
sudo dnf install real-ucode hardened_malloc -y
|
sudo dnf install -y real-ucode hardened_malloc
|
||||||
echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
|
echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
|
||||||
sudo dracut -f
|
sudo dracut -f
|
||||||
fi
|
fi
|
||||||
elif [ "${MACHINE_TYPE}" == 'aarch64' ]; then
|
elif [ "${MACHINE_TYPE}" == 'aarch64' ]; then
|
||||||
sudo dnf copr enable secureblue/hardened_malloc -y
|
sudo dnf copr enable secureblue/hardened_malloc -y
|
||||||
sudo dnf install hardened_malloc -y
|
sudo dnf install -y hardened_malloc
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Setup Networking
|
# Setup Networking
|
||||||
|
@ -24,22 +24,7 @@ unpriv(){
|
|||||||
sudo -u nobody "$@"
|
sudo -u nobody "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
install_options(){
|
virtualization=$(systemd-detect-virt)
|
||||||
output "Are you using a Parallels Virtual Machine?"
|
|
||||||
output "[1] Yes"
|
|
||||||
output "[2] No"
|
|
||||||
read -r choice
|
|
||||||
case $choice in
|
|
||||||
1 ) parallels=1
|
|
||||||
;;
|
|
||||||
2 ) parallels=0
|
|
||||||
;;
|
|
||||||
* ) output "You did not enter a valid selection."
|
|
||||||
install_options
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
|
|
||||||
install_options
|
|
||||||
|
|
||||||
# Increase compression level
|
# Increase compression level
|
||||||
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
sudo sed -i 's/zstd:1/zstd:3/g' /etc/fstab
|
||||||
@ -59,7 +44,7 @@ sudo sed -i 's/umask 022/umask 077/g' /etc/bashrc
|
|||||||
sudo chmod 700 /home/*
|
sudo chmod 700 /home/*
|
||||||
|
|
||||||
# Setup NTS
|
# Setup NTS
|
||||||
if [ "${parallels}" = '1' ]; then
|
if [ "${virtualization}" = 'parallels' ]; then
|
||||||
sudo dnf -y remove chrony
|
sudo dnf -y remove chrony
|
||||||
else
|
else
|
||||||
sudo rm -rf /etc/chrony.conf
|
sudo rm -rf /etc/chrony.conf
|
||||||
@ -91,14 +76,14 @@ sudo dracut -f
|
|||||||
sudo sysctl -p
|
sudo sysctl -p
|
||||||
|
|
||||||
if sudo bootctl status | grep -q systemd-boot; then
|
if sudo bootctl status | grep -q systemd-boot; then
|
||||||
if [ "${parallels}" = '1' ]; then
|
if [ "${virtualization}" = 'parallels' ]; then
|
||||||
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off root/g' /etc/kernel/cmdline
|
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off root/g' /etc/kernel/cmdline
|
||||||
else
|
else
|
||||||
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 root/g' /etc/kernel/cmdline
|
sudo sed -i 's/quiet root/quiet mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1 root/g' /etc/kernel/cmdline
|
||||||
fi
|
fi
|
||||||
sudo dnf reinstall -y kernel-core
|
sudo dnf reinstall -y kernel-core
|
||||||
else
|
else
|
||||||
if [ "${parallels}" = '1' ]; then
|
if [ "${virtualization}" = 'parallels' ]; then
|
||||||
sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off'
|
sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off'
|
||||||
else
|
else
|
||||||
sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1'
|
sudo grubby --update-kernel=ALL --args='mitigations=auto,nosmt spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on tsx=off kvm.nx_huge_pages=force nosmt=force l1d_flush=on spec_rstack_overflow=safe-ret gather_data_sampling=force reg_file_data_sampling=on random.trust_bootloader=off random.trust_cpu=off intel_iommu=on amd_iommu=force_isolation efi=disable_early_pci_dma iommu=force iommu.passthrough=0 iommu.strict=1 slab_nomerge init_on_alloc=1 init_on_free=1 pti=on vsyscall=none ia32_emulation=0 page_alloc.shuffle=1 randomize_kstack_offset=on debugfs=off lockdown=confidentiality module.sig_enforce=1'
|
||||||
@ -180,6 +165,11 @@ sudo dnf -y upgrade
|
|||||||
# Install packages that I use
|
# Install packages that I use
|
||||||
sudo dnf -y install adw-gtk3-theme gnome-console gnome-shell-extension-appindicator gnome-shell-extension-blur-my-shell gnome-shell-extension-background-logo
|
sudo dnf -y install adw-gtk3-theme gnome-console gnome-shell-extension-appindicator gnome-shell-extension-blur-my-shell gnome-shell-extension-background-logo
|
||||||
|
|
||||||
|
# Install appropriate virtualization drivers
|
||||||
|
if [ "$virtualization" = 'kvm' ]; then
|
||||||
|
sudo dnf install -y qemu-guest-agent spice-vdagent
|
||||||
|
fi
|
||||||
|
|
||||||
# Setup Flatpak
|
# Setup Flatpak
|
||||||
sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
||||||
flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=input --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
||||||
@ -218,55 +208,36 @@ sudo systemctl enable fstrim.timer
|
|||||||
|
|
||||||
### Differentiating bare metal and virtual installs
|
### Differentiating bare metal and virtual installs
|
||||||
|
|
||||||
# Installing tuned first here because virt-what is 1 of its dependencies anyways
|
|
||||||
sudo dnf install tuned -y
|
|
||||||
sudo systemctl enable --now tuned
|
|
||||||
|
|
||||||
virt_type=$(virt-what)
|
|
||||||
if [ "$virt_type" = '' ]; then
|
|
||||||
output 'Virtualization: Bare Metal.'
|
|
||||||
elif [ "$virt_type" = 'openvz lxc' ]; then
|
|
||||||
output 'Virtualization: OpenVZ 7.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM on AWS.'
|
|
||||||
else
|
|
||||||
output "Virtualization: $virt_type."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Setup tuned
|
# Setup tuned
|
||||||
if [ "$virt_type" = '' ]; then
|
if [ "$virtualization" = 'none' ]; then
|
||||||
# Don't know whether using tuned would be a good idea on a laptop, power-profiles-daemon should be handling performance tuning IMO.
|
output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
|
||||||
sudo systemctl disable --now tuned
|
|
||||||
sudo dnf remove tuned -y
|
|
||||||
else
|
else
|
||||||
if [ "$virt_type" = 'kvm' ]; then
|
sudo dnf remove power-profiles-daemon
|
||||||
sudo dnf install qemu-guest-agent -y
|
sudo dnf install -y tuned
|
||||||
fi
|
sudo systemctl enable --now tuned
|
||||||
sudo tuned-adm profile virtual-guest
|
sudo tuned-adm profile virtual-guest
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Setup real-ucode and hardened_malloc
|
# Setup real-ucode and hardened_malloc
|
||||||
if [ "$virt_type" = '' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
if [ "$virtualization" = 'none' ] || [ "${MACHINE_TYPE}" == 'x86_64' ]; then
|
||||||
sudo dnf install 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm' -y
|
sudo dnf install -y 'https://divested.dev/rpm/fedora/divested-release-20231210-2.noarch.rpm'
|
||||||
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
sudo sed -i 's/^metalink=.*/&?protocol=https/g' /etc/yum.repos.d/divested-release.repo
|
||||||
if [ "${MACHINE_TYPE}" != 'x86_64' ]; then
|
if [ "${MACHINE_TYPE}" != 'x86_64' ]; then
|
||||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware
|
||||||
sudo dnf install real-ucode -y
|
sudo dnf install -y real-ucode
|
||||||
sudo dracut -f
|
sudo dracut -f
|
||||||
elif [ "$virt_type" != '' ]; then
|
elif [ "$virtualization" != 'none' ]; then
|
||||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,hardened_malloc
|
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,hardened_malloc
|
||||||
sudo dnf install hardened_malloc -y
|
sudo dnf install -y hardened_malloc
|
||||||
else
|
else
|
||||||
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware,hardened_malloc
|
sudo dnf config-manager --save --setopt=divested.includepkgs=divested-release,real-ucode,microcode_ctl,amd-ucode-firmware,hardened_malloc
|
||||||
sudo dnf install real-ucode hardened_malloc -y
|
sudo dnf install -y real-ucode hardened_malloc
|
||||||
echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
|
echo 'libhardened_malloc.so' | sudo tee /etc/ld.so.preload
|
||||||
sudo dracut -f
|
sudo dracut -f
|
||||||
fi
|
fi
|
||||||
elif [ "${MACHINE_TYPE}" == 'aarch64' ]; then
|
elif [ "${MACHINE_TYPE}" == 'aarch64' ]; then
|
||||||
sudo dnf copr enable secureblue/hardened_malloc -y
|
sudo dnf copr enable secureblue/hardened_malloc -y
|
||||||
sudo dnf install hardened_malloc -y
|
sudo dnf install -y hardened_malloc
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Setup Networking
|
# Setup Networking
|
||||||
|
@ -24,22 +24,7 @@ unpriv(){
|
|||||||
sudo -u nobody "$@"
|
sudo -u nobody "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
install_options(){
|
virtualization=$(systemd-detect-virt)
|
||||||
output "Are you using a Parallels Virtual Machine?"
|
|
||||||
output "[1] Yes"
|
|
||||||
output "[2] No"
|
|
||||||
read -r choice
|
|
||||||
case $choice in
|
|
||||||
1 ) parallels=1
|
|
||||||
;;
|
|
||||||
2 ) parallels=0
|
|
||||||
;;
|
|
||||||
* ) output "You did not enter a valid selection."
|
|
||||||
install_options
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
|
|
||||||
install_options
|
|
||||||
|
|
||||||
# Compliance and updates
|
# Compliance and updates
|
||||||
sudo systemctl mask debug-shell.service
|
sudo systemctl mask debug-shell.service
|
||||||
@ -57,7 +42,7 @@ sudo chmod 700 /home/*
|
|||||||
sudo systemctl disable --now systemd-timesyncd
|
sudo systemctl disable --now systemd-timesyncd
|
||||||
sudo systemctl mask systemd-timesyncd
|
sudo systemctl mask systemd-timesyncd
|
||||||
|
|
||||||
if [ "${parallels}" = "0" ]; then
|
if [ "${virtualization}" = "parallels" ]; then
|
||||||
sudo apt install -y chrony
|
sudo apt install -y chrony
|
||||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/chrony.conf | sudo tee /etc/chrony/chrony.conf
|
||||||
sudo systemctl restart chronyd
|
sudo systemctl restart chronyd
|
||||||
@ -126,16 +111,12 @@ sudo systemctl mask whoopsie.service
|
|||||||
sudo systemctl disable --now whoopsie.path
|
sudo systemctl disable --now whoopsie.path
|
||||||
sudo systemctl mask whoopsie.path
|
sudo systemctl mask whoopsie.path
|
||||||
|
|
||||||
# Update packages and firmware
|
# Update packages
|
||||||
sudo apt update -y
|
sudo apt update -y
|
||||||
sudo apt full-upgrade -y
|
sudo apt full-upgrade -y
|
||||||
sudo fwupdmgr get-devices
|
|
||||||
sudo fwupdmgr refresh --force
|
|
||||||
sudo fwupdmgr get-updates -y
|
|
||||||
sudo fwupdmgr update -y
|
|
||||||
|
|
||||||
## Avoid phased updates
|
## Avoid phased updates
|
||||||
sudo apt install curl -y
|
sudo apt install -y curl
|
||||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades
|
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/apt.conf.d/99sane-upgrades | sudo tee /etc/apt/apt.conf.d/99sane-upgrades
|
||||||
sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades
|
sudo chmod 644 /etc/apt/apt.conf.d/99sane-upgrades
|
||||||
|
|
||||||
@ -155,6 +136,11 @@ sudo rm -rf /usr/share/hplip
|
|||||||
sudo apt install -y gnome-console gnome-software-plugin-flatpak
|
sudo apt install -y gnome-console gnome-software-plugin-flatpak
|
||||||
sudo snap install gnome-text-editor
|
sudo snap install gnome-text-editor
|
||||||
|
|
||||||
|
# Install appropriate virtualization drivers
|
||||||
|
if [ "$virtualization" = 'kvm' ]; then
|
||||||
|
sudo apt install -y qemu-guest-agent spice-vdagent
|
||||||
|
fi
|
||||||
|
|
||||||
# Setup Flatpak
|
# Setup Flatpak
|
||||||
sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
sudo flatpak override --system --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
||||||
flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
flatpak override --user --nosocket=x11 --nosocket=fallback-x11 --nosocket=pulseaudio --nosocket=session-bus --nosocket=system-bus --unshare=network --unshare=ipc --nofilesystem=host:reset --nodevice=shm --nodevice=all --no-talk-name=org.freedesktop.Flatpak --no-talk-name=org.freedesktop.systemd1 --no-talk-name=ca.desrt.dconf --no-talk-name=org.gnome.Shell.Extensions
|
||||||
@ -202,33 +188,22 @@ fi
|
|||||||
# Enable fstrim.timer
|
# Enable fstrim.timer
|
||||||
sudo systemctl enable --now fstrim.timer
|
sudo systemctl enable --now fstrim.timer
|
||||||
|
|
||||||
# Installing tuned first here because virt-what is 1 of its dependencies anyways
|
### Differentiating bare metal and virtual installs
|
||||||
sudo apt install tuned -y
|
|
||||||
virt_type=$(virt-what)
|
|
||||||
if [ "$virt_type" = '' ]; then
|
|
||||||
output 'Virtualization: Bare Metal.'
|
|
||||||
elif [ "$virt_type" = 'openvz lxc' ]; then
|
|
||||||
output 'Virtualization: OpenVZ 7.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM on AWS.'
|
|
||||||
else
|
|
||||||
output "Virtualization: $virt_type."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Setup tuned
|
# Setup tuned
|
||||||
if [ "$virt_type" = '' ]; then
|
if [ "$virtualization" = 'none' ]; then
|
||||||
# Don't know whether using tuned would be a good idea on a laptop, power-profiles-daemon should be handling performance tuning IMO.
|
output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
|
||||||
sudo apt remove tuned -y
|
|
||||||
sudo apt autoremove -y
|
|
||||||
else
|
else
|
||||||
if [ "$virt_type" = 'kvm' ]; then
|
sudo apt purge -y power-profiles-daemon
|
||||||
sudo apt install qemu-guest-agent -y
|
sudo apt install -y tuned
|
||||||
fi
|
systemctl enable --now tuned
|
||||||
sudo tuned-adm profile virtual-guest
|
sudo tuned-adm profile virtual-guest
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
# Setup fwupd
|
||||||
|
echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
|
||||||
|
sudo systemctl restart fwupd
|
||||||
|
|
||||||
# Setup Networking
|
# Setup Networking
|
||||||
|
|
||||||
# UFW Snap is strictly confined, unlike its .deb counterpart
|
# UFW Snap is strictly confined, unlike its .deb counterpart
|
||||||
|
@ -24,6 +24,8 @@ unpriv(){
|
|||||||
sudo -u nobody "$@"
|
sudo -u nobody "$@"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
virtualization=$(systemd-detect-virt)
|
||||||
|
|
||||||
# Compliance and updates
|
# Compliance and updates
|
||||||
sudo systemctl mask debug-shell.service
|
sudo systemctl mask debug-shell.service
|
||||||
echo 'Authorized uses only. All activity may be monitored and reported.' | sudo tee /etc/issue
|
echo 'Authorized uses only. All activity may be monitored and reported.' | sudo tee /etc/issue
|
||||||
@ -95,50 +97,31 @@ sudo apt full-upgrade -y
|
|||||||
sudo apt autoremove -y
|
sudo apt autoremove -y
|
||||||
|
|
||||||
## Install basic sysadmin tools
|
## Install basic sysadmin tools
|
||||||
sudo apt install nano iputils-ping
|
sudo apt install -y nano iputils-ping
|
||||||
|
|
||||||
#Setup fwupd
|
# Install appropriate virtualization drivers
|
||||||
sudo apt install fwupd -y
|
if [ "$virtualization" = 'kvm' ]; then
|
||||||
mkdir -p /etc/systemd/system/fwupd-refresh.service.d
|
sudo apt install -y qemu-guest-agent
|
||||||
echo '[Service]
|
fi
|
||||||
ExecStart=/usr/bin/fwupdmgr update' | tee /etc/systemd/system/fwupd-refresh.service.d/override.conf
|
|
||||||
sudo systemctl daemon-reload
|
|
||||||
sudo systemctl enable --now fwupd-refresh.timer
|
|
||||||
|
|
||||||
# Enable fstrim.timer
|
# Enable fstrim.timer
|
||||||
sudo systemctl enable --now fstrim.timer
|
sudo systemctl enable --now fstrim.timer
|
||||||
|
|
||||||
### Differentiating bare metal and virtual installs
|
### Differentiating bare metal and virtual installs
|
||||||
|
|
||||||
# Installing tuned first here because virt-what is 1 of its dependencies anyways
|
|
||||||
sudo apt install tuned -y
|
|
||||||
|
|
||||||
virt_type=$(virt-what)
|
|
||||||
if [ "$virt_type" = "" ]; then
|
|
||||||
output 'Virtualization: Bare Metal.'
|
|
||||||
elif [ "$virt_type" = 'openvz lxc' ]; then
|
|
||||||
output 'Virtualization: OpenVZ 7.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM.'
|
|
||||||
elif [ "$virt_type" = 'xen xen-hvm aws' ]; then
|
|
||||||
output 'Virtualization: Xen-HVM on AWS.'
|
|
||||||
else
|
|
||||||
output "Virtualization: $virt_type."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Setup tuned
|
# Setup tuned
|
||||||
if [ "$virt_type" = "" ]; then
|
if [ "$virtualization" = 'none' ]; then
|
||||||
sudo tuned-adm profile latency-performance
|
output "Bare Metal installation. Tuned will not be set up here - PPD should take care of it."
|
||||||
else
|
else
|
||||||
if [ "$virt_type" = 'kvm' ]; then
|
sudo apt purge -y power-profiles-daemon
|
||||||
sudo apt install qemu-guest-agent -y
|
sudo apt install -y tuned
|
||||||
fi
|
systemctl enable --now tuned
|
||||||
sudo tuned-adm profile virtual-guest
|
sudo tuned-adm profile virtual-guest
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Setup fwupd
|
# Setup fwupd
|
||||||
if [ "$virt_type" = '' ]; then
|
if [ "$virtualization" = 'none' ]; then
|
||||||
sudo apt install fwupd -y
|
sudo apt install -y fwupd
|
||||||
echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
|
echo 'UriSchemes=file;https' | sudo tee -a /etc/fwupd/fwupd.conf
|
||||||
sudo systemctl restart fwupd
|
sudo systemctl restart fwupd
|
||||||
mkdir -p /etc/systemd/system/fwupd-refresh.service.d
|
mkdir -p /etc/systemd/system/fwupd-refresh.service.d
|
||||||
|
Loading…
Reference in New Issue
Block a user