From 9259853352cfe6dbafbc4272bf8c1703e4e75d21 Mon Sep 17 00:00:00 2001
From: Plom Heller <plom@plomlompom.com>
Date: Mon, 7 Sep 2026 12:40:33 +0200
Subject: [PATCH] Split start_root scripting into variants for desktop machine
 vs server.

---
 setup_scripts/_lib.sh                         | 24 +++++++++++++++++
 setup_scripts/start_root_server.sh            | 26 +++++++++++++++++++
 .../{start_root.sh => start_root_t490s.sh}    | 24 ++---------------
 to_install/server                             | 11 ++++++++
 .../packages_root.conf => to_install/t490s    |  0
 5 files changed, 63 insertions(+), 22 deletions(-)
 create mode 100755 setup_scripts/start_root_server.sh
 rename setup_scripts/{start_root.sh => start_root_t490s.sh} (71%)
 create mode 100644 to_install/server
 rename setup_scripts/packages_root.conf => to_install/t490s (100%)

diff --git a/setup_scripts/_lib.sh b/setup_scripts/_lib.sh
index 1dfa7e5..900184d 100644
--- a/setup_scripts/_lib.sh
+++ b/setup_scripts/_lib.sh
@@ -14,6 +14,7 @@ NAME_DATA=data
 NAME_LUKSVG=cryptolvm
 NAME_SWAP=swap
 PATH_MNT_ROOT="${PATH_MNT}/root"
+USERNAME=plom
 
 # constants derived from changeables
 PATH_PROFILE="${HOME}/${FNAME_PROFILE}"
@@ -165,3 +166,26 @@ augment_profile() {
     msg 'Augmenting user %s …' "${FNAME_PROFILE}"
     echo 'alias ls="ls --color=auto"' >> "${PATH_PROFILE}"
 }
+start_root() {
+    local TARGET=$1
+
+    # Assuming read file ends with a newline, has no blank lines, and its
+    # package-name lines contain no whitespace besides that newline.
+    local TO_INSTALL=
+    while read -r LINE; do
+        case "${LINE}" in
+            '#'*) continue ;;
+        esac
+        TO_INSTALL="${TO_INSTALL} ${LINE}"
+    done < "${PATH_REPO}/to_install/${TARGET}"
+    apt-get -y update
+    msg 'Ensuring packages: %s' "${TO_INSTALL}"
+    apt-get -y install ${TO_INSTALL}
+
+    msg 'Setting up user: %s' "${USERNAME}"
+    adduser --disabled-password --comment "" "${USERNAME}"
+    retry_until_success passwd "${USERNAME}"
+    usermod -a -G sudo "${USERNAME}"
+
+    augment_profile
+}
diff --git a/setup_scripts/start_root_server.sh b/setup_scripts/start_root_server.sh
new file mode 100755
index 0000000..8d82423
--- /dev/null
+++ b/setup_scripts/start_root_server.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+. "$(dirname "$0")/_lib.sh"
+
+# constants unlikely to change
+PATH_HOME_USER="/home/${USERNAME}"
+DIRNAME_SSH=.ssh
+PATH_ROOT_SSH="${HOME}/${DIRNAME_SSH}"
+PATH_USER_SSH="${PATH_HOME_USER}/${DIRNAME_SSH}"
+PATH_SSHD_DROPIN=/etc/ssh/sshd_config.d/60-no-root-login.conf
+
+start_root server
+
+msg 'Moving ssh access from root to user …'
+mv "${PATH_ROOT_SSH}" "${PATH_HOME_USER}"
+chown -R "${USERNAME}:${USERNAME}" "${PATH_USER_SSH}"
+
+# Removing root's key isn't enough on its own to guarantee no direct root
+# SSH login: whether that suffices depends on the image's own
+# PermitRootLogin setting, which a root password (set below) could
+# otherwise still satisfy. Pin it explicitly instead of relying on that.
+msg 'Disabling direct root SSH login …'
+printf 'PermitRootLogin no\n' >| "${PATH_SSHD_DROPIN}"
+systemctl reload ssh
+
+msg 'Setting up root password-login …'
+retry_until_success passwd
diff --git a/setup_scripts/start_root.sh b/setup_scripts/start_root_t490s.sh
similarity index 71%
rename from setup_scripts/start_root.sh
rename to setup_scripts/start_root_t490s.sh
index 4bed8db..f4fe135 100755
--- a/setup_scripts/start_root.sh
+++ b/setup_scripts/start_root_t490s.sh
@@ -8,10 +8,8 @@ PATH_TLP_THRESH_CONF=/etc/tlp.conf.d/60-thresholds.conf
 PATH_UDEV_RULES=/etc/udev/rules.d
 
 # constants we might want to change at some point
-FNAME_PACKAGES=packages_root.conf
 FNAME_UDEV_RULES_BACKLIGHT=90-backlight.rules
 LOCALE=C.UTF-8
-USERNAME=plom
 PRINTK_LEVELS="4 4 1 7"
 TLP_THRESH_START=40
 TLP_THRESH_STOP=80
@@ -19,19 +17,7 @@ TLP_THRESH_STOP=80
 # constants derived from changeables
 PATH_TO_COPY="${PATH_REPO}/to_copy"
 
-# Assumes FNAME_PACKAGES ends with a newline, has no blank lines, and its
-# package-name lines contain no whitespace besides that newline.
-TO_INSTALL=
-while read -r LINE; do
-    case "${LINE}" in
-        '#'*) continue ;;
-    esac
-    TO_INSTALL="${TO_INSTALL} ${LINE}"
-done < "${FNAME_PACKAGES}"
-
-msg 'Ensuring packages: %s' "${TO_INSTALL}"
-apt-get -y update
-apt-get -y install ${TO_INSTALL}
+start_root t490s
 
 # C.UTF-8 is built into glibc itself (unlike e.g. en_US.UTF-8), so no
 # "locales" package / locale-gen is needed to make it available — writing
@@ -54,13 +40,7 @@ msg 'Making backlight devices available to user-run backlight script …'
 cp "${PATH_TO_COPY}/${FNAME_UDEV_RULES_BACKLIGHT}" "${PATH_UDEV_RULES}/"
 udevadm control --reload-rules
 udevadm trigger --action=add --subsystem-match=backlight
-
-msg 'Setting up user: %s' "${USERNAME}"
-adduser --disabled-password --comment "" "${USERNAME}"
-retry_until_success passwd "${USERNAME}"
-usermod -a -G sudo,video "${USERNAME}"
+usermod -a -G video "${USERNAME}"
 
 msg 'Synchronizing clock …'
 ntpdate-debian
-
-augment_profile
diff --git a/to_install/server b/to_install/server
new file mode 100644
index 0000000..32e160b
--- /dev/null
+++ b/to_install/server
@@ -0,0 +1,11 @@
+# Packages installed by start_root.sh via apt-get.
+# One package per line; blank lines and lines starting with "#" are ignored.
+#
+# basic helpers
+ack
+ccrypt
+git
+man-db
+ntpsec-ntpdate
+sudo
+# last line ignored
diff --git a/setup_scripts/packages_root.conf b/to_install/t490s
similarity index 100%
rename from setup_scripts/packages_root.conf
rename to to_install/t490s
-- 
2.30.2