Free Software on Adur

Plymouth Configuration

Thu, 25 Nov 2021 13:21:56 +0100

This post describes the steps to configure Plymouth on Debian when all partitions are encrypted with LUKS, except for the /boot partition. The plymouth-themes repository is used as a reference.

What is Plymouth?

Plymouth is an application that starts very early in the boot process (even before the filesystem is mounted) and provides a graphical boot animation while the startup process runs in the background.

It is designed to work on systems that have DRM modesetting drivers. The idea is that very early in the boot process, native modesetting is configured, and Plymouth uses this mode. This mode must be maintained throughout the entire boot process, even after starting the X graphical server. The main purpose is to avoid flickering during the startup process ¹.

Plymouth Installation

1

sudo apt install plymouth

GRUB Modification

Edit the default GRUB configuration file:

1

sudo nano /etc/default/grub

Modify line 9 by adding splash:

1

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

Plymouth Themes

Clone the themes repository:

1

git clone https://github.com/adi1090x/plymouth-themes.git

Navigate into one of the directories named pack_X, for example pack_3:

1

cd plymouth-themes/pack_3

Select the theme you want, for example lone:

1

sudo cp -r lone /usr/share/plymouth/themes/

Plymouth - Debian ↩︎

Installing and Configuring Debian, Ubuntu, RaspberryPiOS, LibreElec or Arch on a Raspberry Pi

Thu, 21 Oct 2021 00:00:00 +0000

This post outlines the steps to install and configure a Raspberry Pi for deploying a series of services.

1. OS Installation

1.1. Ubuntu, RaspberryPiOS or LibreElec

Using the Raspberry Pi Imager tool, you can flash the image of Ubuntu, RaspberryPiOS, LibreElec, or whichever you prefer, onto any micro SD card or USB drive ¹. For example, we will choose the Raspbian OS image with desktop and flash it onto a 64GB USB drive.

Another way to flash an image onto an SD card or a USB drive is by using the following commands:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


# See the partitions
lsblk

# Umount the USB partition
umount /dev/sdc1

# Format in vFAT
mkfs.vfat -F 32 /dev/sdc -I

# Flash the ISO into USB
dd status=progress if=NAME.iso of=/dev/sdc

1.2. Arch

To install Arch, the steps from the AArch64 version of the Arch installation ² were followed. We reproduced those steps for AArch64.

Start fdisk to partition the SD card:

1

 fdisk /dev/sdX

At the fdisk prompt, delete old partitions and create a new one:

Type o. This will clear out any partitions on the drive.
Type p to list partitions. There should be no partitions left.
Type n, then p for primary, 1 for the first partition on the drive, press ENTER to accept the default first sector, then type +200M for the last sector.
Type t, then c to set the first partition to type W95 FAT32 (LBA).
Type n, then p for primary, 2 for the second partition on the drive, and then press ENTER twice to accept the default first and last sector.
Write the partition table and exit by typing w.

Create and mount the FAT filesystem:

1
2
3


mkfs.vfat /dev/sdX1
mkdir boot
mount /dev/sdX1 boot

Create and mount the ext4 filesystem:

1
2
3


mkfs.ext4 /dev/sdX2
mkdir root
mount /dev/sdX2 root

Download and extract the root filesystem (as root, not via sudo):

1
2
3


wget http://os.archlinuxarm.org/os/ArchLinuxARM-rpi-aarch64-latest.tar.gz
bsdtar -xpf ArchLinuxARM-rpi-aarch64-latest.tar.gz -C root
sync

Move boot files to the first partition:

1

mv root/boot/* boot

Before unmounting the partitions, update /etc/fstab for the different SD block device compared to the Raspberry Pi 3:

1

sed -i 's/mmcblk0/mmcblk1/g' root/etc/fstab

Unmount the two partitions:

1

umount boot root

Insert the SD card into the Raspberry Pi, connect ethernet, and apply 5V power.
Use the serial console or SSH to the IP address given to the board by your router.

Login as the default user alarm with the password alarm.
The default root password is root.

Initialize the pacman keyring and populate the Arch Linux ARM package signing keys:

1
2


pacman-key --init
pacman-key --populate archlinuxarm

2. Basic Configuration

Once the operating system is installed, there are several options to configure the Raspberry Pi. The simplest approach is to run a network scan with sudo nmap -f 192.168.1.0/24 to identify the IP address assigned to the Raspberry Pi by the router. Then connect via ssh pi@192.168.10.250 (for Raspbian) or ssh alarm@192.168.10.250 (for Arch). You can also set it up headlessly, without an extra monitor, keyboard, and mouse, as explained in a previous post, or by using these three external peripherals. In this case, we will use an external monitor, keyboard, and mouse to simplify the walkthrough. Once the Raspberry Pi is powered on with the USB drive or SD card connected, a dialog will appear to configure the language, Wi-Fi, and a password (for example, use KeepassXC to generate a random password).

2.1 System Update

Once we have a console with a non-root user, we will open a new console as the root user:

1

su -

The default password is usually root or similar.

Debian-based:

1
2


# Update and upgrade packages system
apt-get update -y && sudo apt-get upgrade -y

Arch-based:

1
2


# Update and upgrade packages system
pacman -Syu

2.2 Time Configuration

We follow this guide on first steps after installing Arch ³ or any minimalist distribution such as HypriotOS. We set the timezone to the appropriate one:

1

timedatectl set-timezone Europe/London

We synchronize the clock with the internet:

1

timedatectl set-ntp true

2.3 Locale Configuration

Uncomment the desired locale in the locale.gen file (for example: en_US.UTF-8):

1

nano /etc/locale.gen

Run:

1

locale-gen

And run:

1

localectl set-locale LANG=en_US.UTF-8

2.4 Hostname Change

Change the hostname with:

1

hostnamectl set-hostname <name>

Add an alias for the hostname in the /etc/hosts file of the computer you are using for the configuration. Use nano /etc/hosts:

1
2


127.0.0.1		localhost.localdomain	<name>	localhost
::1				localhost.localdomain	<name>	localhost

(Optional) Enable colored output in pacman

If using Arch, run:

1

sed -i 's/#Color/Color/' /etc/pacman.conf

(Optional) Add 8GB of SWAP memory

If using Arch, run:

1

fallocate -l 8192M /swapfile

(Optional) New user with sudo permissions

If using Arch, we will now use the visudo utility to edit group permissions for running administrative commands with sudo.

1
2


pacman -S sudo
EDITOR=nano visudo

Uncomment the following line:

1
2


## Uncomment to allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

Create a new sudo group with:

1

sudo groupadd sudo

Create a new user with:

1

useradd -m -G sudo username

Set a password for the new user:

1

passwd username

Once the new user is created, delete the alarm user.

1

userdel alarm

On Debian or derivatives, modify the permissions of the user created during installation and add them to the sudo group with the following command:

1
2


su -
usermod -aG sudo username

Reboot the system:

1

reboot

2.5 SSH

The next step is to copy the public key to the ~/.ssh/authorized_keys file on the Raspberry Pi. Use the following command:

1

ssh-copy-id -i <identity.pub> pi@<raspberry ip or node-1>

Now it will prompt for the SSH key password, and we will connect to the Raspberry Pi via:

1

ssh pi@node-1

(Optional) Wi-Fi Configuration

Reproduced from the guide: first steps after installing Arch ³

karog, on ArchLinux ARM forums provided a simple way to connect to Wi-Fi. As root, do the following steps:

nano /etc/systemd/network/wlan0.network to configure the wlan0 interface:
Add the following contents to the file:

1
2
3
4
5


[Match]
Name=wlan0

[Network]
DHCP=yes

wpa_passphrase "<SSID>" "<PASSWORD>" > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf. Replace and with your respective Wi-Fi network name and password.
systemctl enable wpa_supplicant@wlan0 to enable the Wi-Fi when booting
systemctl start wpa_supplicant@wlan0 to connect to Wi-Fi.

You’re good to go!

If you ever want to remove Wi-Fi connection (e.g. when you want to make it connect only through ethernet):

systemctl stop wpa_supplicant@wlan0
systemctl disable wpa_supplicant@wlan0
rm /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
rm /etc/systemd/network/wlan0.network

3. Software Installation

3.1. Basic Packages

Debian:

1

sudo apt install -y software-properties-common git wget

Arch:

1

sudo pacman -S -y git wget

3.2. Docker and Docker Compose

It is recommended to install docker rootless.

3.2.1. Installation on Debian

Install Docker using the installation script:

1
2


curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

For docker-compose, install it through Python 3:

1
2
3
4


sudo apt-get install libffi-dev libssl-dev
sudo apt install python3-dev
sudo apt-get install -y python3 python3-pip
sudo pip3 install docker-compose

Add the user to the docker group:

1

sudo usermod -aG docker ${USER}

3.2.2. Installation on Arch

Install Docker and docker-compose from the official repositories:

1
2


sudo pacman -Sy docker
sudo pacman -Sy docker-compose

Enable the service with:

1

sudo systemctl start docker.service

Enable it on every reboot:

1

sudo systemctl start docker.service

Add the user to the docker group:

1

sudo usermod -aG docker ${USER}

3.2.3 Docker Rootless

Arch:

1
2


sudo pacman -S shadow
sudo pacman -S fuse-overlayfs

Add kernel.unprivileged_userns_clone=1 in /etc/sysctl.conf:

1
2


sudo nano /etc/sysctl.conf
sudo sysctl --system

Common:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


sudo touch /etc/subuid && sudo touch /etc/subgid
su -
echo "pi:100000:65536" >> /etc/subgid
echo "pi:100000:65536" >> /etc/subuid
exit

sudo systemctl disable --now docker.service docker.socket
curl -fsSL https://get.docker.com/rootless | sh

systemctl --user start docker
systemctl --user enable docker
sudo loginctl enable-linger $(whoami)

export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock

Test it with docker run -d -p 8080:80 nginx.

If you want it to start at boot, run the following commands:

1
2


 sudo systemctl enable docker.service
 sudo systemctl enable containerd.service

3.3. Ansible

Debian

1

sudo apt install -y ansible

Arch:

1

sudo pacman -Sy ansible

3.3.1 SSH Hardening with Ansible

Using the Ansible collections devsec.hardening, we apply security mechanisms and verify them with the following commands.

Installation:

1

ansible-galaxy install dev-sec.ssh-hardening

Create a playbook for each Ansible role called ansible-ssh-hardening.yaml.
Run these playbooks with the following commands:

1

ansible-playbook ansible-ssh-hardening.yaml --ask-become-pass

You can also create an Ansible playbook with any modules you wish to include.

Add your SSH key to an ssh-agent using zsh (or bash):

1
2


ssh-agent zsh
ssh-add ~/.ssh/id_ed25519

Run the Ansible playbook with the required sudo password for the commands:

1

ansible-playbook playbook.yaml --ask-become-pass

3.4. Installing zsh and Oh My Zsh

Debian⁴:

1
2


sudo apt install zsh
sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

Arch:

1
2


sudo pacman -Sy zsh zsh-completions
sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

3.4.1. Installing Powerlevel10k

Download and place the 4 Meslo Nerd .ttf fonts in /usr/local/share/fonts. They must have permissions 644 (-rw-r–r–).⁵

MesloLGS NF Regular.ttf
MesloLGS NF Bold.ttf
MesloLGS NF Italic.ttf
MesloLGS NF Bold Italic.ttf Create the /usr/local/share/fonts directory:

1
2


sudo mkdir /usr/local/share/fonts
cd /usr/local/share/fonts

Download the fonts:

1

sudo wget https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Regular.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Italic.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold%20Italic.ttf

Clone the powerlevel10k project:

1
2
3


git clone --depth=1 https://github.com/romkatv/powerlevel10k.git ~/powerlevel10k
echo 'source ~/powerlevel10k/powerlevel10k.zsh-theme' >>~/.zshrc
exec zsh

Replace the following value in ~/.zshrc:

1

ZSH_THEME="powerlevel10k/powerlevel10k"

3.4.2. Installing zsh Plugins

To add a series of useful plugins, edit the ~/.zshrc file with nano ~/.zshrc and modify the following:

1
2


#plugins=(git)
plugins=(git git-extras history ansible zsh-autosuggestions zsh-syntax-highlighting docker-helpers docker docker-compose kubectl kubectx colorize nmap pip ssh-agent sudo pipenv fzf fzf-docker)

We need to install the zsh-autosuggestions, zsh-syntax-highlighting, docker-helpers, fzf, and fzf-docker plugins.

To install zsh-autosuggestions:

1

git clone https://github.com/zsh-users/zsh-autosuggestions ~/.oh-my-zsh/plugins/zsh-autosuggestions

To install zsh-syntax-highlighting:

1

git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ~/.oh-my-zsh/plugins/zsh-syntax-highlighting

To install fzf use the official repositories:

1

sudo pacman -Sy fzf

To install fzf-docker:

1

git clone https://github.com/pierpo/fzf-docker ~/.oh-my-zsh/plugins/fzf-docker

To install docker-helpers:

1

git clone https://github.com/unixorn/docker-helpers.zshplugin ~/.oh-my-zsh/plugins/docker-helpers

Customize to your liking and reload the ~/.zshrc file:

1

source ~/.zshrc

Snapd

Installation

Install the snapd and core packages:

1

sudo apt install -y snapd core

Add the Snap Executables Path to bash and Zsh PATH

Add the snap executables path to PATH:

1
2
3
4


echo "export PATH=$PATH:/snap/bin" >> ~/.bashrc
source ~/.bashrc
echo "export PATH=$PATH:/snap/bin" >> ~/.zshrc
source ~/.zshrc

Verify the path was added correctly:

1

echo $PATH

Create a symbolic link from the directory that stores snap launchers (/var/lib/snapd/desktop/applications) to the system applications directory (usr/share/applications/):

1

sudo ln -s /var/lib/snapd/desktop/applications /usr/share/applications/snapd

Flatpak

Installation

From the official Flatpak documentation, follow these steps:

Install Flatpak

1

sudo apt install flatpak -y

Add the Flatpak repository

1

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

Reboot the system to apply the changes.

Create a symbolic link from the directory that stores flatpak launchers (/var/lib/flatpak/exports/share/applications/) to the system applications directory (usr/share/applications/):

1

sudo ln -s /var/lib/flatpak/exports/share/applications/ /usr/share/applications/flatpak

KeePassXC

Note: installed via Snap because the official repositories have an outdated version.

Install via Snap:

1

sudo snap install keepassxc

Download the browser extension.
Configure the browser extension using an official KeePassXC script. Save the script and run it:

1
2


wget https://raw.githubusercontent.com/keepassxreboot/keepassxc/master/utils/keepassxc-snap-helper.sh
zsh keepassxc-snap-helper.sh

If you get the error Could not find keepassxc.proxy! Ensure the keepassxc snap is installed properly., this is because the snap executables path is missing from PATH. Add it with:

1
2
3
4


echo "export PATH=$PATH:/snap/bin" >> ~/.zshrc
source ~/.zshrc
echo "export PATH=$PATH:/snap/bin" >> ~/.bashrc
source ~/.bashrc

Run the script again:

1

bash keepassxc-snap-helper.sh

VSCodium ⁴

Add the repository GPG key:

1

wget -qO - https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/raw/master/pub.gpg | gpg --dearmor | sudo dd of=/etc/apt/trusted.gpg.d/vscodium.gpg

Add the repository:

1
2
3
4


echo 'deb
 [ signed-by=/usr/share/keyrings/vscodium-archive-keyring.gpg ]
https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs vscodium main'
 | sudo tee /etc/apt/sources.list.d/vscodium.list

Update repositories and install VSCodium:

1

sudo apt update && sudo apt install codium

Arch Installation and Configuration

Fri, 02 Apr 2021 00:00:00 +0000

This post covers the configuration of the Arch operating system.

1. Arch Installation

1.1. What is Arch?

Arch Linux is an independently developed, general-purpose x86-64 GNU/Linux distribution that strives to provide the latest stable versions of most software by following a rolling-release model. The default installation is a minimal base system, configured by the user to only add what is purposely required ¹.

1.2. Basic Concepts

LVM is an implementation of a logical volume manager for the Linux kernel. LVM includes many of the features expected from a volume manager, including:

Resizing of logical groups
Resizing of logical volumes
Read-only snapshots (LVM2 offers read and write)
RAID0 of logical volumes. LVM does not implement RAID1 or RAID5, so it is recommended to use dedicated RAID software for these operations, placing the LVs on top of the RAID ².

RAID will not be used in this configuration.

LUKS is a disk encryption specification created by Clemens Fruhwirth, originally intended for Linux. While most disk encryption software implements different and incompatible undocumented formats, LUKS specifies a standard on-disk format, platform-independent, for use with various tools. This not only facilitates compatibility and interoperability between different programs, but also ensures that they all implement password management in a secure and documented manner. The reference implementation runs on Linux and is based on an enhanced version of cryptsetup, using dm-crypt as the disk encryption interface ³.

A boot loader loads an operating system kernel into memory and executes it. A boot manager hands over control to another boot program. GRUB is both a boot loader and a boot manager. rEFInd is only a boot manager.

Another fundamental concept is understanding the difference between EFI/UEFI and BIOS.

LVM is an implementation of a logical volume manager for the Linux kernel. LVM includes many of the features expected from a volume manager, including:

Resizing of logical groups
Resizing of logical volumes
Read-only snapshots (LVM2 offers read and write)
RAID0 of logical volumes. LVM does not implement RAID1 or RAID5, so it is recommended to use dedicated RAID software for these operations, placing the LVs on top of the RAID ².

RAID will not be used in this configuration.

In the Partition Table, the ext4 format is used for partitions because it improves I/O speed and uses less CPU than the ext3 and ext2 formats. The following minimum values are recommended:

Partition	Recommended Size	Debian Allocation	Custom Allocation	Contains
/	>= 750MB	22GB	64GB	/etc, /bin, /sbin, /lib, /dev, /usr
/usr	>= 4-6GB	0	0	User programs, libs and docs
/var	>= 2-3GB	32GB	112GB	Variable data such as emails
/tmp	>= 100MB	16GB	32GB	Web pages, package cache, temporary data
/home	>= 100MB	200GB	288GB	Directory with Documents, Downloads, …
/boot	>= 256MB	500MB	512GB	Primary Partition, ext4 or ext2, encryption not recommended
/boot/efi	>= 100MB	250MB	0	Encryption not recommended and bootable flag: on
/swap	>= 8GB	16GB	16GB	Swap area

1.3. Flashing the Arch Image

The steps from the Arch installation guide were followed ⁴.

One way to flash an image is with the dd command as shown below:

1
2


# See the partitions
lsblk -f

1
2


# Umount the USB partition
umount /dev/sda1

1
2


# Flash the ISO into USB
sudo dd bs=4M if=archlinux-2022.05.01-x86_64.iso of=/dev/sda conv=fsync oflag=direct status=progress

1.4. Booting Arch

Connect the USB and ethernet cable, then boot Arch Linux from the USB via the BIOS.

2. Initial Configuration

2.1. Set the Keyboard Layout in the Live Environment

Switch the keyboard to Spanish:

1

loadkeys es

2.2. Configure Wi-Fi

If the iwd package is not installed, install it using an ethernet connection:

1

sudo pacman -yS iwd

Configure the Wi-Fi interface with:

: wlan0
: Wi-Fi network name
: password

To find these values, you can use the iwctl command followed by device device show.

1

iwctl --passphrase <passphrase> station <device> connect <SSID>

To see available Wi-Fi networks, run the following commands:

1
2
3


iwctl station list
iwctl station wlan0 scan
iwctl station station get-networks

Verify that you have an IP address with:

1

ip a

Now, if you change the root user password with the passwd command, you can connect to the machine with:

1

ssh root@<machine-IP>

2.3. Time Update

We follow this guide with the first steps after installing Arch ⁵. Set the timezone to the appropriate one with:

1

timedatectl set-timezone Europe/Madrid

Synchronize the clock with the internet:

1

timedatectl set-ntp true

2.4. Unlock LUKS-encrypted Partition Configured with LVM Logical Volumes

Decrypt the partition with:

1

cryptsetup luksOpen /dev/sdaX all-Operative-Systems

Then detect the LVM volume group with:

1

vgchange -a y

Note: the following steps may not work on the first attempt and may need to be completed with the next section. You could skip the end of this section and install GRUB directly.

Once the commands above have been executed, continue with the installation until the GRUB installation. Open a terminal again and identify the UUID of the encrypted partition with:

1

blkid /dev/sdaX >> nano /etc/crypttab

Next, edit the /etc/crypttab file:

1

nano /etc/crypttab

Add the following content, where the UUID is the one obtained from the blkid command:

1

all-Operative-Systems UUID=524c1ad6-1111-2222-0000-c8db1286b262 none luks

This configuration may need to be repeated later.

2.5. Mount the Partitions

According to the Arch documentation for creating filesystems and mounting volumes, format the previously created volumes and mount the following partitions:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


# Format and mount the root partition
mkfs.ext4 -L arch-root /dev/lvm-all-OS/lvm-arch-root
mount /dev/lvm-all-OS/lvm-arch-root /mnt

# Format and mount the home partition
mkfs.ext4 -L arch-home /dev/lvm-all-OS/lvm-arch-home
mount --mkdir /dev/lvm-all-OS/lvm-arch-home /mnt/home

# Format and mount the EFI (ESP) and BOOT partitions
# If the boot partition is not formatted as FAT32, use the following commented command
# mkfs.fat -F 32 -n boot-arch /dev/sda4
mkfs.ext4 -L boot-arch /dev/sda4
mount --mkdir /dev/sda4 /mnt/boot
mount --mkdir /dev/sda1 /mnt/boot/efi

2.6. Installation of Essential and Recommended Packages

Sources:

[https://denovatoanovato.net/instalar-arch-linux/#uefi]
[https://linuxhint.com/setup-luks-encryption-on-arch-linux/] Try following with encrypt instead of lvm2 or using both

Essential packages:

1

pacstrap /mnt base base-devel linux linux-firmware lvm2 nano vim intel-ucode iwd

Recommended packages (some may produce errors):

1

pacstrap /mnt grub networkmanager dhcpcd efibootmgr gvfs gvfs-mtp netctl wpa_supplicant dialog nano initramfs

To enable the touchpad, install the xf86-input-synaptics package.

Other additional packages could include os-probes (may produce errors).

Then generate the fstab file, which contains the system’s partition table.

1

genfstab -pU /mnt >> /mnt/etc/fstab

2.7. Enter the Base System

It is time to enter the installed base system to continue configuring it from within. To access the system in chroot, run:

1

arch-chroot /mnt

2.8 Update Hostname

1

echo hostname > /etc/hostname

2.9. Update Timezone

1

ln -sf /usr/share/zoneinfo/Europe/Madrid /etc/localtime

2.10. Set the Clock

1

hwclock --systohc

2.11. Configure Keyboard Layout

1

echo KEYMAP=es >> /etc/vconsole.conf

2.12. Configure mkinitcpio

Sources:

[https://www.linuxserver.io/blog/2014-01-18-installing-arch-linux-with-root-on-an-lvm]
[https://wiki.archlinux.org/title/LVM_(Espa%C3%B1ol)#Crear_sistemas_de_archivos_y_montar_los_vol%C3%BAmenes_l%C3%B3gicos]

1

nano /etc/mkinitcpio.conf

Edit the HOOKS line and add the following:

1

HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems fsck)

Then run:

1

mkinitcpio -p linux

At this point, you could unmount the partition and reboot the operating system with the following commands if you did not install Arch on an encrypted partition. If you installed it on an encrypted partition, you must configure GRUB to indicate that it is encrypted (step 2.13).

1
2


umount -R /mnt
sudo reboot

2.13. Configure GRUB

Install GRUB with the following commands:

1

grub-install --boot-directory=/boot --efi-directory=/boot/efi --target=x86_64-efi --recheck /dev/sda4

In /etc/default/grub, edit the GRUB_CMDLINE_LINUX line to:

1

GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda2:luks:allow-discards"

[Tip] To automatically detect other operating systems on your computer, install os-prober (pacman -S os-prober) before running the following command.

Finally, configure GRUB with:

1
2


grub-mkconfig -o /boot/grub/grub.cfg
grub-mkconfig -o /boot/efi/EFI/arch/grub.cfg

2.14. Configuration for LUKS-encrypted Partition

Note: the following steps are the same as those in section 2.4, so check carefully whether they already worked in that step or need to be repeated.

Detect the UUID of the encrypted partition. The X in sdaX corresponds to the number of the encrypted partition; if you do not know it, simply use the blkid command.

1

blkid /dev/sdaX >> /etc/crypttab

Edit the /etc/crypttab file with nano:

1

sudo nano /etc/crypttab

Add the following:

1

all-Operative-Systems UUID=524c1ad6-1111-2222-0000-c8db1286b262 none luks

Install initramfs:

1

pacman -Sy initramfs

Once finished, use the following command to update initramfs:

1

sudo update-initramfs -u

2.14 (Optional) Initialize the Pacman Keyring

Install the keyring:

1

pacman -Sy archlinux-keyring

Initialize the pacman keyring and populate the Arch Linux ARM package signing keys (if using a Raspberry Pi):

1
2


pacman-key --init
pacman-key --populate archlinuxarm

2.15 Unmount the Partitions

Unmount the mnt partition:

1

umount -R /mnt

Reboot the operating system with:

1

sudo reboot

3. Advanced Configuration

Connect via SSH to the machine again and follow the steps below.

3.1. System Update

Once you have a console with a non-root user, open a new console as the root user:

1

su -

The default password is usually root or the one previously configured.

Update Arch:

1

pacman -Syu

3.2. Language Update

If not previously configured, uncomment the desired language in the locale.gen file (e.g., en_US.UTF-8):

1

nano /etc/locale.gen

Run:

1

locale-gen

Then run:

1

localectl set-locale LANG=en_US.UTF-8

3.3. Hostname Change

Change the hostname with:

1

hostnamectl set-hostname <name>

Add a hostname alias in the /etc/hosts file of the computer you are using for the configuration. Use nano /etc/hosts:

1
2


127.0.0.1		localhost.localdomain	<name>	localhost
::1				localhost.localdomain	<name>	localhost

3.4. (Optional) Enable Color Output in Pacman

If using Arch, run:

1

sed -i 's/#Color/Color/' /etc/pacman.conf

3.5. (Optional) Add 8GB of SWAP Memory

If using Arch, run:

1

fallocate -l 8192M /swapfile

3.6. (Optional) New User with Sudo Privileges

If using Arch, we will now use the visudo utility to edit group permissions for running administrative commands with sudo.

1
2


pacman -S sudo
EDITOR=nano visudo

Uncomment the following line:

1
2


## Uncomment to allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

Create a new sudo group with:

1

sudo groupadd sudo

Create a new user with:

1

useradd -m -G sudo username

Set a password for the new user:

1

passwd username

Once you have the new user, delete the alarm user or the default installation user (if one exists).

1

userdel alarm

Modify the permissions of the user created during installation and add them to the sudo group with the following command:

1
2


su -
usermod -aG sudo username

Reboot the system:

1

reboot

3.6. SSH Keys

In the next step, you need to copy the public key to the ~/.ssh/authorized_keys file on the machine. To do this, use the following command:

1

ssh-copy-id -i <identity.pub> pi@<machine IP>

Now it will ask for your SSH key password, and you can connect to the machine with:

1

ssh pi@<machine IP>

3.7. (Optional) Wi-Fi Configuration

Reproduced from the guide: first steps after installing Arch ⁵. karog, on ArchLinux ARM forums provides a very simple way to connect to Wi-Fi. As root, follow these steps:

nano /etc/systemd/network/wlan0.network to configure the wlan0 interface:
Add the following content to the file:

1
2
3
4
5


[Match]
Name=wlan0

[Network]
DHCP=yes

wpa_passphrase "<SSID>" "<PASSWORD>" > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf. Replace and with your Wi-Fi network name and password.
systemctl enable wpa_supplicant@wlan0 to enable Wi-Fi on boot.
systemctl start wpa_supplicant@wlan0 to connect to Wi-Fi.

Everything is now set up. However, if you ever want to remove the Wi-Fi connection (for example, when you want the machine to connect only via ethernet):

systemctl stop wpa_supplicant@wlan0
systemctl disable wpa_supplicant@wlan0
rm /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
rm /etc/systemd/network/wlan0.network

4. Package and Software Installation

4.1. Basic Packages

git and wget:

1

sudo pacman -S -y git wget

yay: The most commonly used AUR helpers in Arch Linux are Yaourt and Packer. You can easily use them for Arch Linux package management tasks such as installing and updating packages.

However, both have been discontinued in favor of yay, short for Yet Another Yaourt. Yay is a modern AUR helper written in the Go language. It has very few dependencies and supports AUR tab completion so you don’t have to type out full commands.

We install it with the following commands in the opt directory, which is the designated folder for storing third-party programs.

1
2
3
4


cd /opt
sudo git clone https://aur.archlinux.org/yay.git
sudo chown -R $USER:$USER ./yay
makepkg -si

Update the repos with:

1

sudo yay -Syu

4.2 Install zsh, Oh My Zsh and Powerlevel10k

Install zsh and oh-my-zsh with the following commands:

1
2


sudo pacman -S zsh
sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

To install Powerlevel10k, we need to install the required fonts with the command:

1
2


yay -Sy --noconfirm ttf-meslo-nerd-font-powerlevel10k
sudo pacman -S powerline-common awesome-terminal-fonts

Alternatively, you can do it manually by downloading and placing the 4 .ttf fonts from Meslo Nerd in /usr/local/share/fonts. They must have permissions 644 (-rw-r–r–)⁶.

Create the /usr/local/share/fonts directory:

1
2


sudo mkdir /usr/local/share/fonts
cd /usr/local/share/fonts

Download the fonts:

1

sudo wget https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Regular.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Italic.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold%20Italic.ttf

Install and configure Powerlevel10k with:

1
2


yay -S --noconfirm zsh-theme-powerlevel10k-git
echo 'source /usr/share/zsh-theme-powerlevel10k/powerlevel10k.zsh-theme' >>~/.zshrc

4.2. Docker and Docker Compose

It is recommended to install Docker rootless (4.2.2.) but it may cause issues with some Docker containers. If you do not want to deal with those issues or you are configuring a production server that requires security, follow the next section (4.2.1.).

4.2.1. Installation on Arch

Install Docker from the official repositories:

1

sudo pacman -Sy docker docker-compose

Add the user to the docker group:

1

sudo usermod -aG docker ${USER}

Enable the Docker daemon:

1
2


sudo systemctl enable docker.service
sudo systemctl enable docker.socket

If you get an error, reboot the machine.

4.2.2 Docker Rootless

Arch:

1
2


sudo pacman -S shadow
sudo pacman -S fuse-overlayfs

Add kernel.unprivileged_userns_clone=1 in /etc/sysctl.conf:

1
2


sudo nano /etc/sysctl.conf
sudo sysctl --system

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


sudo touch /etc/subuid && sudo touch /etc/subgid
su -
echo "pi:100000:65536" >> /etc/subgid
echo "pi:100000:65536" >> /etc/subuid
exit

sudo systemctl disable --now docker.service docker.socket
curl -fsSL https://get.docker.com/rootless | sh

systemctl --user start docker
systemctl --user enable docker
sudo loginctl enable-linger $(whoami)

export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock

Test with docker run -d -p 8080:80 nginx.

If you want it to start at boot, run the following commands:

1
2


 sudo systemctl enable docker.service
 sudo systemctl enable containerd.service

4.3 i3wm Window Manager

Following the steps from Low Orbit Flux - Arch Linux How to Install i3 Gaps, install the xorg-xinit package which installs xinit. The xinit program allows the user to manually start an Xorg display server. Install the X window server xorg and xterm.

1

sudo pacman -S xorg xorg-xinit xterm

Install some optional extras:

1

pacman -S xorg-xeyes xorg-xclock

Install the entire i3 group, prioritizing i3-gaps over i3-wm since the former is a fork of the latter.

1

sudo apt install i3-w

Install the necessary drivers for your machine.

1
2
3


sudo pacman -S nvidia nvidia-utils # NVIDIA
sudo pacman -S xf86-video-amdgpu mesa # AMD
sudo pacman -S xf86-video-intel mesa # Intel

Follow the steps from Low Orbit Flux - Arch Linux How to Install i3 Gaps to completion.

5. References

Debian Configuration

Fri, 02 Apr 2021 00:00:00 +0000

This post covers the configuration of the Debian operating system.

What is Debian?

Debian GNU/Linux is a free operating system, developed by thousands of volunteers from around the world who collaborate via the Internet.

Debian’s dedication to free software, its volunteer base, its non-commercial nature, and its open development model distinguish it from other GNU operating system distributions¹.

Add Wi-Fi and NVIDIA Drivers

Running the following commands will log in as root and add the repositories needed to install drivers not included in the fully free repositories:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


# Log in as root
su -

# Install vim
apt install -y vim

# Add contrib and non-free reopositories
## Edit /etc/apt/sources.list
vim /etc/apt/sources.list

## Add contrib and non-free at the end
deb http://mirror.librelabucm.org/debian/ buster main contrib non-free

deb http://security.debian.org/debian-security buster/updates main contrib non-free

deb http://mirror.librelabucm.org/debian/ buster-updates main contrib non-free

# Add non-free drivers for WiFi
apt install -y firmware-iwlwifi firmware-atheros firmware-misc-nonfree firmware-intelwimax firmware-realtek firmware-linux firmware-linux-nonfree

Verify that the packages have been installed:

1

sudo apt list --installed | grep firmware

Add a User to the Sudo Group

1
2


su -
usermod -aG sudo username

Verify Sudo Group Membership

1

getent group sudo

Log In with the Sudo Group User

1

su - username

Install git and wget

1

sudo apt install git wget -y

Install zsh and Oh My Zsh²

1
2


sudo apt install zsh
sh -c "$(curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

Install Powerlevel10k

Download and place the 4 .ttf fonts from Meslo Nerd in /usr/local/share/fonts. They must have permissions 644 (-rw-r–r–).³

Create the /usr/local/share/fonts directory:

1
2


sudo mkdir /usr/local/share/fonts
cd /usr/local/share/fonts

Download the fonts:

1

sudo wget https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Regular.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Italic.ttf https://github.com/romkatv/powerlevel10k-media/raw/master/MesloLGS%20NF%20Bold%20Italic.ttf

Clone the powerlevel10k project:

1

git clone --depth=1 https://github.com/romkatv/powerlevel10k.git ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/themes/powerlevel10k

Replace the following value in ~/.zshrc:

1

ZSH_THEME="powerlevel10k/powerlevel10k"

Configure to your liking and reload the ~/.zshrc file:

1

source ~/.zshrc

Use the following command to emulate the applications in /etc/profile within zsh.

1

emulate sh -c 'source /etc/profile'

Recommended Software Installation

Snapd

Installation

Install the snapd and core packages:

1
2


sudo apt install snapd
sudo snap install core

Add Snap Executables Path to bash and Zsh PATH

Add the snap executables path to the PATH:

1
2
3
4


echo "export PATH=$PATH:/snap/bin" >> ~/.bashrc
source ~/.bashrc
echo "export PATH=$PATH:/snap/bin" >> ~/.zshrc
source ~/.zshrc

Verify that the path has been added correctly:

1

echo $PATH

Create a symbolic link from the directory that stores snap launchers (/var/lib/snapd/desktop/applications) to the system applications directory (usr/share/applications/)

1

sudo ln -s /var/lib/snapd/desktop/applications /usr/share/applications/snapd

Flatpak

Installation

From the official Flatpak documentation, follow these steps:

Install Flatpak

1

sudo apt install flatpak -y

Add the Flatpak repository

1

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

Reboot the system to apply the changes.

Create a symbolic link from the directory that stores flatpak launchers (/var/lib/flatpak/exports/share/applications/) to the system applications directory (usr/share/applications/)

1

sudo ln -s /var/lib/flatpak/exports/share/applications/ /usr/share/applications/flatpak

Aptitude

1

sudo apt install aptitude

Nextcloud Sync Client

Download the AppImage file from Nextcloud, grant execution permissions to the user, and run it with:

1
2


chmod u+x Nextcloud-3.3.5-x86_64.AppImage
./Nextcloud-3.3.5-x86_64.AppImage

Sync the folders.

KeePassXC

Note: installed via Snap because the official repositories have an outdated version.

Install via snap:

1

sudo snap install keepassxc

Download the browser extension.
Configure the browser extension using an official KeePassXC script. Save the script and run:

1
2


wget https://raw.githubusercontent.com/keepassxreboot/keepassxc/master/utils/keepassxc-snap-helper.sh
zsh keepassxc-snap-helper.sh

If you get the error Could not find keepassxc.proxy! Ensure the keepassxc snap is installed properly., this is because the snap executables path needs to be added to the PATH:

1
2
3
4


echo "export PATH=$PATH:/snap/bin" >> ~/.zshrc
source ~/.zshrc
echo "export PATH=$PATH:/snap/bin" >> ~/.bashrc
source ~/.bashrc

Run the script again:

1

bash keepassxc-snap-helper.sh

VSCodium ⁴

Add the repository GPG key:

1

wget -qO - https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/raw/master/pub.gpg | gpg --dearmor | sudo dd of=/etc/apt/trusted.gpg.d/vscodium.gpg

Add the repository:

1
2
3
4


echo 'deb
 [ signed-by=/usr/share/keyrings/vscodium-archive-keyring.gpg ]
https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs vscodium main'
 | sudo tee /etc/apt/sources.list.d/vscodium.list

Update repositories and install VSCodium:

1

sudo apt update && sudo apt install codium

Using LaTeX with VSCodium

In settings, search for word wrap and enable it so that lines do not extend infinitely.
Install the LaTeX distribution Texlive (recommended by the VSCodium LaTeX Workshop extension), ChkTex for LaTeX semantic checking, and texlive-extra-utils for extensions like latexindent.

1

apt-get install -y texlive texlive-latex-extra texlive-extra-utils chktex latexmk texlive-fonts-recommended texlive-fonts-extra texlive-science texlive-latex-base-doc

Add the path

1
2
3
4


echo 'export PATH=$PATH:/usr/share' >> ~/.bashrc
echo 'export PATH=$PATH:/usr/share' >> ~/.zshrc
source ~/.bashrc
source ~/.zshrc

Inkscape

Install via the Flatpak repositories.

1

flatpak install org.inkscape.Inkscape

Mattermost-Desktop

According to the official Mattermost documentation, for Debian-based operating systems, the steps to follow are:

Download the latest version of Mattermost (use the official documentation page): 64-bit systems mattermost-desktop-4.6.2-linux-amd64.deb

Zotero

The reference steps are from the Debian wiki for installing Zotero.

Install Zotero via Flatpak:

1

flatpak install flathub org.zotero.Zotero

Add Zotero to the PATH:

1

echo 'export PATH=$PATH:/var/lib/flatpak/exports/bin' >> ~/.bashrc

Run Zotero:

1

flatpak run org.zotero.Zotero

Sync the library and install the BetterBibTex plugin. To install the BetterBibTex plugin, follow its documentation.

Once installed, add the following script to include the keywords when exporting with

OwnCloud

Follow the installation guide for Debian.

Once installed, sync the folders.

Thunderbird

Copy and paste the .thunderbird folder for a complete migration. Install with:

1

sudo apt install thunderbird

Pip

1

sudo apt install python3-pip

Node and npm

1
2


sudo curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo bash -
sudo apt-get install -y nodejs

Kubernetes

kubectl

Install using native package management

HDMI Audio Configuration

According to this post, add the following to /etc/pulse/default.pa:

1
2
3


load-module module-alsa-sink device=hdmi:0
load-module module-combine-sink sink_name=combined
set-default-sink combined

XFCE Customization on Debian

Theme

Download themes from xfce-look, filtering by rating. Some recommended ones are Qogir-dark, Ultimate-dark, or Nordic. Extract them and copy them to the .themes folder, located at /home/username/.themes.

Go to Appearance -> Themes -> Qogir-dark.

Icons

Add the Qogir-dark icons. Download them from xfce-look, extract them, and copy them to the .icons folder located at /home/username/.icons.

Go to Appearance -> Icons -> Qogir-dark

Dock

Install Plank:

1

sudo apt-get install plank

Window Manager

Install emerald:

1

sudo apt install emerald

Run the emerald-theme-manager program and choose a theme:

1

emerald-theme-manager

Run in the background:

1

emerald --replace &

Plymouth

Steps followed from the official Debian wiki.

i3wm Window Manager

1

sudo apt install i3 i3status

Free Software on Adur

Plymouth Configuration

What is Plymouth?

Plymouth Installation

GRUB Modification

Plymouth Themes

Installing and Configuring Debian, Ubuntu, RaspberryPiOS, LibreElec or Arch on a Raspberry Pi

1. OS Installation

1.1. Ubuntu, RaspberryPiOS or LibreElec

1.2. Arch

2. Basic Configuration

2.1 System Update

2.2 Time Configuration

2.3 Locale Configuration

2.4 Hostname Change

(Optional) Enable colored output in pacman

(Optional) Add 8GB of SWAP memory

(Optional) New user with sudo permissions

2.5 SSH

(Optional) Wi-Fi Configuration

3. Software Installation

3.1. Basic Packages

3.2. Docker and Docker Compose

3.2.1. Installation on Debian

3.2.2. Installation on Arch

3.2.3 Docker Rootless

3.3. Ansible

3.3.1 SSH Hardening with Ansible

3.4. Installing zsh and Oh My Zsh

3.4.1. Installing Powerlevel10k

3.4.2. Installing zsh Plugins

Snapd

Installation

Add the Snap Executables Path to bash and Zsh PATH

Add Launchers to the Applications Menu

Flatpak

Installation

Add Launchers to the Menu

KeePassXC

VSCodium 4

Arch Installation and Configuration

1. Arch Installation

1.1. What is Arch?

1.2. Basic Concepts

1.3. Flashing the Arch Image

1.4. Booting Arch

2. Initial Configuration

2.1. Set the Keyboard Layout in the Live Environment

2.2. Configure Wi-Fi

2.3. Time Update

2.4. Unlock LUKS-encrypted Partition Configured with LVM Logical Volumes

2.5. Mount the Partitions

2.6. Installation of Essential and Recommended Packages

2.7. Enter the Base System

2.8 Update Hostname

2.9. Update Timezone

2.10. Set the Clock

2.11. Configure Keyboard Layout

2.12. Configure mkinitcpio

2.13. Configure GRUB

2.14. Configuration for LUKS-encrypted Partition

2.14 (Optional) Initialize the Pacman Keyring

2.15 Unmount the Partitions

3. Advanced Configuration

3.1. System Update

3.2. Language Update

3.3. Hostname Change

3.4. (Optional) Enable Color Output in Pacman

3.5. (Optional) Add 8GB of SWAP Memory

3.6. (Optional) New User with Sudo Privileges

3.6. SSH Keys

3.7. (Optional) Wi-Fi Configuration

4. Package and Software Installation

4.1. Basic Packages

4.2 Install zsh, Oh My Zsh and Powerlevel10k

4.2. Docker and Docker Compose

4.2.1. Installation on Arch

4.2.2 Docker Rootless

4.3 i3wm Window Manager

5. References

VSCodium ⁴

Install zsh and Oh My Zsh²

VSCodium ⁴