From: Plom Heller <plom@plomlompom.com>
Date: Mon, 7 Sep 2026 10:40:33 +0000 (+0200)
Subject: Split start_root scripting into variants for desktop machine vs server.
X-Git-Url: https://plomlompom.com/repos/%7B%7Bprefix%7D%7D/static/edit?a=commitdiff_plain;h=9259853352cfe6dbafbc4272bf8c1703e4e75d21;p=confplom

Split start_root scripting into variants for desktop machine vs server.
---

diff --git a/setup_scripts/_lib.sh b/setup_scripts/_lib.sh
index 1dfa7e5..900184d 100644
--- a/setup_scripts/_lib.sh
+++ b/setup_scripts/_lib.sh
@@ -14,6 +14,7 @@ NAME_DATA=data
 NAME_LUKSVG=cryptolvm
 NAME_SWAP=swap
 PATH_MNT_ROOT="${PATH_MNT}/root"
+USERNAME=plom
 
 # constants derived from changeables
 PATH_PROFILE="${HOME}/${FNAME_PROFILE}"
@@ -165,3 +166,26 @@ augment_profile() {
     msg 'Augmenting user %s …' "${FNAME_PROFILE}"
     echo 'alias ls="ls --color=auto"' >> "${PATH_PROFILE}"
 }
+start_root() {
+    local TARGET=$1
+
+    # Assuming read file ends with a newline, has no blank lines, and its
+    # package-name lines contain no whitespace besides that newline.
+    local TO_INSTALL=
+    while read -r LINE; do
+        case "${LINE}" in
+            '#'*) continue ;;
+        esac
+        TO_INSTALL="${TO_INSTALL} ${LINE}"
+    done < "${PATH_REPO}/to_install/${TARGET}"
+    apt-get -y update
+    msg 'Ensuring packages: %s' "${TO_INSTALL}"
+    apt-get -y install ${TO_INSTALL}
+
+    msg 'Setting up user: %s' "${USERNAME}"
+    adduser --disabled-password --comment "" "${USERNAME}"
+    retry_until_success passwd "${USERNAME}"
+    usermod -a -G sudo "${USERNAME}"
+
+    augment_profile
+}
diff --git a/setup_scripts/packages_root.conf b/setup_scripts/packages_root.conf
deleted file mode 100644
index b03abbd..0000000
--- a/setup_scripts/packages_root.conf
+++ /dev/null
@@ -1,23 +0,0 @@
-# Packages installed by start_root.sh via apt-get.
-# One package per line; blank lines and lines starting with "#" are ignored.
-#
-# basic helpers
-ack
-ccrypt
-git
-man-db
-ntpsec-ntpdate
-sudo
-# battery management
-tlp
-# networking
-openssh-client
-wget
-# gui
-firefox-esr
-foot
-vim-gtk3
-sway
-wmenu
-xwayland
-# last line ignored
diff --git a/setup_scripts/start_root.sh b/setup_scripts/start_root.sh
deleted file mode 100755
index 4bed8db..0000000
--- a/setup_scripts/start_root.sh
+++ /dev/null
@@ -1,66 +0,0 @@
-#!/bin/sh
-. "$(dirname "$0")/_lib.sh"
-
-# constants unlikely to change
-PATH_DEFAULT_LOCALE=/etc/default/locale
-PATH_SYSCTL_PRINTK=/etc/sysctl.d/60-printk-console.conf
-PATH_TLP_THRESH_CONF=/etc/tlp.conf.d/60-thresholds.conf
-PATH_UDEV_RULES=/etc/udev/rules.d
-
-# constants we might want to change at some point
-FNAME_PACKAGES=packages_root.conf
-FNAME_UDEV_RULES_BACKLIGHT=90-backlight.rules
-LOCALE=C.UTF-8
-USERNAME=plom
-PRINTK_LEVELS="4 4 1 7"
-TLP_THRESH_START=40
-TLP_THRESH_STOP=80
-
-# constants derived from changeables
-PATH_TO_COPY="${PATH_REPO}/to_copy"
-
-# Assumes FNAME_PACKAGES ends with a newline, has no blank lines, and its
-# package-name lines contain no whitespace besides that newline.
-TO_INSTALL=
-while read -r LINE; do
-    case "${LINE}" in
-        '#'*) continue ;;
-    esac
-    TO_INSTALL="${TO_INSTALL} ${LINE}"
-done < "${FNAME_PACKAGES}"
-
-msg 'Ensuring packages: %s' "${TO_INSTALL}"
-apt-get -y update
-apt-get -y install ${TO_INSTALL}
-
-# C.UTF-8 is built into glibc itself (unlike e.g. en_US.UTF-8), so no
-# "locales" package / locale-gen is needed to make it available — writing
-# it here is enough for it to apply system-wide from the next login on.
-msg 'Setting system locale to %s …' "${LOCALE}"
-printf 'LANG=%s\n' "${LOCALE}" >| "${PATH_DEFAULT_LOCALE}"
-
-msg 'Quieting routine kernel messages on the console …'
-printf 'kernel.printk = %s\n' "${PRINTK_LEVELS}" >| "${PATH_SYSCTL_PRINTK}"
-sysctl -p "${PATH_SYSCTL_PRINTK}"
-
-msg 'Setting TLP battery charge thresholds: start %s%%, stop %s%% …' \
-    "${TLP_THRESH_START}" "${TLP_THRESH_STOP}"
-mkdir -p "$(dirname "${PATH_TLP_THRESH_CONF}")"
-printf 'START_CHARGE_THRESH_BAT0=%s\nSTOP_CHARGE_THRESH_BAT0=%s\n' \
-    "${TLP_THRESH_START}" "${TLP_THRESH_STOP}" >| "${PATH_TLP_THRESH_CONF}"
-tlp start
-
-msg 'Making backlight devices available to user-run backlight script …'
-cp "${PATH_TO_COPY}/${FNAME_UDEV_RULES_BACKLIGHT}" "${PATH_UDEV_RULES}/"
-udevadm control --reload-rules
-udevadm trigger --action=add --subsystem-match=backlight
-
-msg 'Setting up user: %s' "${USERNAME}"
-adduser --disabled-password --comment "" "${USERNAME}"
-retry_until_success passwd "${USERNAME}"
-usermod -a -G sudo,video "${USERNAME}"
-
-msg 'Synchronizing clock …'
-ntpdate-debian
-
-augment_profile
diff --git a/setup_scripts/start_root_server.sh b/setup_scripts/start_root_server.sh
new file mode 100755
index 0000000..8d82423
--- /dev/null
+++ b/setup_scripts/start_root_server.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+. "$(dirname "$0")/_lib.sh"
+
+# constants unlikely to change
+PATH_HOME_USER="/home/${USERNAME}"
+DIRNAME_SSH=.ssh
+PATH_ROOT_SSH="${HOME}/${DIRNAME_SSH}"
+PATH_USER_SSH="${PATH_HOME_USER}/${DIRNAME_SSH}"
+PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-no-root-login.conf
+
+start_root server
+
+msg 'Moving ssh access from root to user …'
+mv "${PATH_ROOT_SSH}" "${PATH_HOME_USER}"
+chown -R "${USERNAME}:${USERNAME}" "${PATH_USER_SSH}"
+
+# Removing root's key isn't enough on its own to guarantee no direct root
+# SSH login: whether that suffices depends on the image's own
+# PermitRootLogin setting, which a root password (set below) could
+# otherwise still satisfy. Pin it explicitly instead of relying on that.
+msg 'Disabling direct root SSH login …'
+printf 'PermitRootLogin no\n' >| "${PATH_SSHD_DROPIN}"
+systemctl reload ssh
+
+msg 'Setting up root password-login …'
+retry_until_success passwd
diff --git a/setup_scripts/start_root_t490s.sh b/setup_scripts/start_root_t490s.sh
new file mode 100755
index 0000000..f4fe135
--- /dev/null
+++ b/setup_scripts/start_root_t490s.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+. "$(dirname "$0")/_lib.sh"
+
+# constants unlikely to change
+PATH_DEFAULT_LOCALE=/etc/default/locale
+PATH_SYSCTL_PRINTK=/etc/sysctl.d/60-printk-console.conf
+PATH_TLP_THRESH_CONF=/etc/tlp.conf.d/60-thresholds.conf
+PATH_UDEV_RULES=/etc/udev/rules.d
+
+# constants we might want to change at some point
+FNAME_UDEV_RULES_BACKLIGHT=90-backlight.rules
+LOCALE=C.UTF-8
+PRINTK_LEVELS="4 4 1 7"
+TLP_THRESH_START=40
+TLP_THRESH_STOP=80
+
+# constants derived from changeables
+PATH_TO_COPY="${PATH_REPO}/to_copy"
+
+start_root t490s
+
+# C.UTF-8 is built into glibc itself (unlike e.g. en_US.UTF-8), so no
+# "locales" package / locale-gen is needed to make it available — writing
+# it here is enough for it to apply system-wide from the next login on.
+msg 'Setting system locale to %s …' "${LOCALE}"
+printf 'LANG=%s\n' "${LOCALE}" >| "${PATH_DEFAULT_LOCALE}"
+
+msg 'Quieting routine kernel messages on the console …'
+printf 'kernel.printk = %s\n' "${PRINTK_LEVELS}" >| "${PATH_SYSCTL_PRINTK}"
+sysctl -p "${PATH_SYSCTL_PRINTK}"
+
+msg 'Setting TLP battery charge thresholds: start %s%%, stop %s%% …' \
+    "${TLP_THRESH_START}" "${TLP_THRESH_STOP}"
+mkdir -p "$(dirname "${PATH_TLP_THRESH_CONF}")"
+printf 'START_CHARGE_THRESH_BAT0=%s\nSTOP_CHARGE_THRESH_BAT0=%s\n' \
+    "${TLP_THRESH_START}" "${TLP_THRESH_STOP}" >| "${PATH_TLP_THRESH_CONF}"
+tlp start
+
+msg 'Making backlight devices available to user-run backlight script …'
+cp "${PATH_TO_COPY}/${FNAME_UDEV_RULES_BACKLIGHT}" "${PATH_UDEV_RULES}/"
+udevadm control --reload-rules
+udevadm trigger --action=add --subsystem-match=backlight
+usermod -a -G video "${USERNAME}"
+
+msg 'Synchronizing clock …'
+ntpdate-debian
diff --git a/to_install/server b/to_install/server
new file mode 100644
index 0000000..32e160b
--- /dev/null
+++ b/to_install/server
@@ -0,0 +1,11 @@
+# Packages installed by start_root.sh via apt-get.
+# One package per line; blank lines and lines starting with "#" are ignored.
+#
+# basic helpers
+ack
+ccrypt
+git
+man-db
+ntpsec-ntpdate
+sudo
+# last line ignored
diff --git a/to_install/t490s b/to_install/t490s
new file mode 100644
index 0000000..b03abbd
--- /dev/null
+++ b/to_install/t490s
@@ -0,0 +1,23 @@
+# Packages installed by start_root.sh via apt-get.
+# One package per line; blank lines and lines starting with "#" are ignored.
+#
+# basic helpers
+ack
+ccrypt
+git
+man-db
+ntpsec-ntpdate
+sudo
+# battery management
+tlp
+# networking
+openssh-client
+wget
+# gui
+firefox-esr
+foot
+vim-gtk3
+sway
+wmenu
+xwayland
+# last line ignored