bastien
872079bafb
/tmp is a RAM-backed tmpfs on Ubuntu (50% of RAM). Agent runs fill it: half the RAM goes, then every temp-file creation fails with ENOSPC and shells break. Swap does not lift the cap, so the fix is /tmp on disk. End-of-install offers (Linux, [y/N], skipped without a terminal, idempotent): - offer_tmp_on_disk: mask tmp.mount + etc/tmpfiles.d/tmp.conf (wipe at boot, 10-day purge, /var/tmp rule kept). Effective at next reboot. - offer_ssh_memory_guard: the previous server's rules. ssh.service drop-in (OOMScoreAdjust=-1000, MemoryMin=256M) + earlyoom with --avoid sshd and --prefer node/java. MemoryMin covers sshd only; earlyoom is the real guard. install_cloudpex deploys the NAS mount helper in the Linux block. Docs: README steps 12-14 + table, CLAUDE.md layout + lint command.
316 lines
13 KiB
Bash
Executable File
316 lines
13 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# install.sh — deploy the vim + bash dotfiles. OS is auto-detected.
|
|
# Usage: ./install.sh
|
|
set -euo pipefail
|
|
|
|
# Resolve the repo root so the script works from any working directory.
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
# Set up Docker's official Ubuntu apt repo, then install the engine + compose plugin.
|
|
# Idempotent: skips entirely if docker is already on PATH. Ubuntu-only (uses the ubuntu repo).
|
|
install_docker() {
|
|
if command -v docker >/dev/null 2>&1; then
|
|
echo "docker already installed — skipping Docker repo setup"
|
|
return
|
|
fi
|
|
echo "Setting up Docker apt repo"
|
|
sudo install -m 0755 -d /etc/apt/keyrings
|
|
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
|
|
sudo chmod a+r /etc/apt/keyrings/docker.asc
|
|
local codename arch
|
|
# shellcheck disable=SC1091 # /etc/os-release is sourced at runtime, not available to the linter.
|
|
codename="$(. /etc/os-release && echo "${VERSION_CODENAME}")"
|
|
arch="$(dpkg --print-architecture)"
|
|
echo "deb [arch=${arch} signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${codename} stable" |
|
|
sudo tee /etc/apt/sources.list.d/docker.list >/dev/null
|
|
sudo apt-get update
|
|
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
|
|
}
|
|
|
|
# RDP "gate" credentials: a shared username/password that unlocks the GDM
|
|
# login screen (each user then logs into GDM with his own account). Required —
|
|
# without it the RDP server rejects every connection (mstsc error 0x904). It is
|
|
# a secret, so never stored in this repo: prompted interactively when a terminal
|
|
# is attached, otherwise the user is told to set it himself. Idempotent: skipped
|
|
# when already configured.
|
|
ensure_rdp_credentials() {
|
|
local hint="set later: sudo grdctl --system rdp set-credentials"
|
|
|
|
# A non-empty Username means credentials are already configured — nothing to do.
|
|
if ! sudo grdctl --system status 2>/dev/null | grep -q 'Username: (empty)'; then
|
|
return 0
|
|
fi
|
|
|
|
if [ ! -t 0 ]; then
|
|
echo "RDP gate credentials not set ($hint)" >&2
|
|
return 0
|
|
fi
|
|
|
|
local rdp_user="" rdp_pass=""
|
|
read -rp "RDP gate username: " rdp_user || true
|
|
read -rsp "RDP gate password: " rdp_pass || true
|
|
echo
|
|
if [ -z "$rdp_user" ] || [ -z "$rdp_pass" ]; then
|
|
echo "No credentials entered — $hint" >&2
|
|
return 0
|
|
fi
|
|
sudo grdctl --system rdp set-credentials "$rdp_user" "$rdp_pass"
|
|
}
|
|
|
|
# Remote desktop via gnome-remote-desktop (GNOME's native, Wayland-compatible RDP).
|
|
# Mode: system "Remote Login". Two-layer auth: the RDP client first authenticates
|
|
# with shared "gate" credentials (set via ensure_rdp_credentials), then the user logs
|
|
# into GDM with his own Linux account and a fresh GNOME session starts. xrdp does NOT
|
|
# work on this GNOME: it is Wayland-only (GNOME Shell asserts XDG_SESSION_TYPE=wayland,
|
|
# which xrdp's Xorg backend cannot satisfy, so the session dies the instant you log in).
|
|
# Debian/Ubuntu only. Idempotent.
|
|
setup_remote_desktop() {
|
|
local cert="/etc/gnome-remote-desktop/rdp-tls.crt"
|
|
local key="/etc/gnome-remote-desktop/rdp-tls.key"
|
|
|
|
# xrdp and gnome-remote-desktop both bind port 3389 — disable xrdp if present.
|
|
if systemctl list-unit-files 2>/dev/null | grep -q '^xrdp\.service'; then
|
|
sudo systemctl disable --now xrdp xrdp-sesman 2>/dev/null || true
|
|
fi
|
|
|
|
sudo apt-get install -y gnome-remote-desktop openssl
|
|
|
|
# Self-signed TLS cert for the RDP server, generated once so the fingerprint stays
|
|
# stable across re-runs (clients accept it on first connect).
|
|
if [ ! -f "$cert" ]; then
|
|
sudo install -d -m 0755 /etc/gnome-remote-desktop
|
|
sudo openssl req -x509 -nodes -newkey rsa:4096 -days 3650 \
|
|
-subj "/CN=$(hostname)" -out "$cert" -keyout "$key"
|
|
sudo chown gnome-remote-desktop:gnome-remote-desktop "$cert" "$key"
|
|
sudo chmod 640 "$key"
|
|
fi
|
|
|
|
# Point the system (remote-login) RDP daemon at the cert and turn it on.
|
|
sudo grdctl --system rdp set-tls-cert "$cert"
|
|
sudo grdctl --system rdp set-tls-key "$key"
|
|
sudo grdctl --system rdp enable
|
|
|
|
# Gate credentials: prompted at install, never hardcoded.
|
|
ensure_rdp_credentials
|
|
|
|
# Open the RDP port only when a firewall is already active — never force ufw on.
|
|
if command -v ufw >/dev/null 2>&1 && sudo ufw status 2>/dev/null | grep -q "Status: active"; then
|
|
sudo ufw allow 3389/tcp
|
|
fi
|
|
|
|
sudo systemctl enable gnome-remote-desktop.service
|
|
sudo systemctl restart gnome-remote-desktop.service
|
|
}
|
|
|
|
# Disk-usage login warning: a profile.d snippet that warns (bold red) at login when
|
|
# / or /home cross the usage threshold. Deployed system-wide so every login shell
|
|
# sources it. /etc/profile.d is a Debian/Ubuntu convention and df --output=pcent is
|
|
# GNU-only, so this is Linux-only (called from the apt-get block). Idempotent: install
|
|
# overwrites in place and -D creates the dir if missing.
|
|
install_disk_warning() {
|
|
echo "Installing disk-usage login warning to /etc/profile.d"
|
|
sudo install -D -m 0644 "$SCRIPT_DIR/etc/profile.d/disk-usage-warning.sh" \
|
|
/etc/profile.d/disk-usage-warning.sh
|
|
}
|
|
|
|
# The dtach session-resume menu now ships in ~/.bashrc (deployed above): every interactive
|
|
# shell sources it, including VS Code Remote-SSH terminals, which are non-login and therefore
|
|
# never read ~/.profile. This strips any dtach block a previous install left in ~/.profile —
|
|
# the marker-delimited managed one AND the legacy execute-based one (DT=$(dt ls) ... fi) — so
|
|
# the menu does not also fire from there (a plain SSH login sources ~/.bashrc via ~/.profile,
|
|
# which would otherwise prompt twice). No-op when absent. User scope, no sudo.
|
|
unwire_dtach_profile() {
|
|
local profile="$HOME/.profile"
|
|
[ -f "$profile" ] || return 0
|
|
grep -qF 'dtach-router' "$profile" || return 0
|
|
|
|
awk '
|
|
$0 == "# >>> claude-dtach >>>" { drop = 1; next }
|
|
$0 == "# <<< claude-dtach <<<" { drop = 0; next }
|
|
drop { next }
|
|
$0 == "DT=$(dt ls)", $0 == "fi" { next }
|
|
{ print }
|
|
' "$profile" > "$profile.tmp" && mv "$profile.tmp" "$profile"
|
|
}
|
|
|
|
# NAS helper: deploys the on-demand CloudPex SMB mount command to /usr/local/bin
|
|
# (see cloudpex/README.md). Nothing is mounted and no credential is stored.
|
|
# Linux-only (cifs-utils); the helper's own installer is idempotent.
|
|
install_cloudpex() {
|
|
echo "Installing the cloudpex mount helper"
|
|
bash "$SCRIPT_DIR/cloudpex/install.sh"
|
|
}
|
|
|
|
# Yes/no prompt for the optional system changes offered at the end of the install.
|
|
# Declines (returns 1) when no terminal is attached (curl | bash), so an offer is
|
|
# skipped with a hint instead of blocking; re-run ./install.sh from a terminal to
|
|
# get it offered again.
|
|
confirm() {
|
|
local answer=""
|
|
if [ ! -t 0 ]; then
|
|
echo "Skipped (no terminal attached): $1" >&2
|
|
return 1
|
|
fi
|
|
read -rp "$1 [y/N] " answer || true
|
|
case "$answer" in
|
|
[yY]|[yY][eE][sS]) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
# /tmp on disk instead of the tmpfs Ubuntu mounts by default (RAM-backed, capped at
|
|
# 50% of RAM). Agent runs fill it: that eats half the RAM and, once the cap is hit,
|
|
# every temp-file creation fails with ENOSPC — which is what breaks shells. Masking
|
|
# tmp.mount leaves /tmp on the root filesystem; the tmpfiles rule keeps the tmpfs
|
|
# semantics (wiped at boot, entries older than 10 days purged). Takes effect at the
|
|
# next reboot: a busy /tmp is never unmounted live. Idempotent.
|
|
offer_tmp_on_disk() {
|
|
if [ "$(systemctl is-enabled tmp.mount 2>/dev/null)" = "masked" ]; then
|
|
echo "/tmp already on disk (tmp.mount masked) — skipping"
|
|
return 0
|
|
fi
|
|
if [ "$(findmnt -n -o FSTYPE -T /tmp)" != "tmpfs" ]; then
|
|
echo "/tmp is not a tmpfs — nothing to do"
|
|
return 0
|
|
fi
|
|
confirm "Move /tmp from RAM (tmpfs) to disk? Agents fill it and break shells" || return 0
|
|
sudo systemctl mask tmp.mount
|
|
sudo install -D -m 0644 "$SCRIPT_DIR/etc/tmpfiles.d/tmp.conf" /etc/tmpfiles.d/tmp.conf
|
|
echo "/tmp moves to disk at the next reboot."
|
|
}
|
|
|
|
# Keep SSH reachable when RAM runs out — the two rules the previous server ran:
|
|
# - ssh.service drop-in: OOMScoreAdjust=-1000 (the kernel OOM killer never picks
|
|
# sshd) + MemoryMin=256M (reclaim protection for the daemon's cgroup);
|
|
# - earlyoom: kills the single largest process (node preferred, sshd/systemd spared)
|
|
# once free RAM and free swap both drop under 10%, before the box thrashes.
|
|
# MemoryMin covers sshd only: logind puts login sessions in user.slice, so nothing can
|
|
# reserve RAM for a future shell — earlyoom acting in time is the real protection.
|
|
# Idempotent: each piece is skipped when already in place. Restarting ssh keeps the
|
|
# current sessions alive (KillMode=process).
|
|
offer_ssh_memory_guard() {
|
|
local dropin="/etc/systemd/system/ssh.service.d/override.conf"
|
|
local ssh_done=0 oom_done=0
|
|
cmp -s "$SCRIPT_DIR/etc/systemd/ssh.service.d/override.conf" "$dropin" && ssh_done=1
|
|
if cmp -s "$SCRIPT_DIR/etc/default/earlyoom" /etc/default/earlyoom \
|
|
&& [ "$(systemctl is-enabled earlyoom 2>/dev/null)" = "enabled" ]; then
|
|
oom_done=1
|
|
fi
|
|
if [ "$ssh_done" = 1 ] && [ "$oom_done" = 1 ]; then
|
|
echo "SSH memory guard already in place — skipping"
|
|
return 0
|
|
fi
|
|
confirm "Protect SSH under memory pressure (sshd OOM-exempt + earlyoom)?" || return 0
|
|
if [ "$ssh_done" = 0 ]; then
|
|
sudo install -D -m 0644 "$SCRIPT_DIR/etc/systemd/ssh.service.d/override.conf" "$dropin"
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl restart ssh
|
|
fi
|
|
if [ "$oom_done" = 0 ]; then
|
|
sudo apt-get install -y earlyoom
|
|
sudo install -m 0644 "$SCRIPT_DIR/etc/default/earlyoom" /etc/default/earlyoom
|
|
sudo systemctl enable earlyoom
|
|
sudo systemctl restart earlyoom
|
|
fi
|
|
}
|
|
|
|
# System packages: Debian/Ubuntu only. Skipped where apt-get is absent (e.g. macOS).
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
sudo apt-get update
|
|
sudo apt-get upgrade -y
|
|
|
|
# Build + version control + C dev tooling.
|
|
sudo apt-get install -y \
|
|
vim git git-lfs git-filter-repo gcc make pkg-config dkms valgrind shellcheck \
|
|
curl gnupg ca-certificates apt-transport-https \
|
|
unzip tree tmux fzf dtach net-tools \
|
|
openssh-server cifs-utils lftp ftp \
|
|
nodejs python3-pip pipx php-cli \
|
|
ffmpeg weasyprint poppler-utils qpdf webp libavif-bin gh
|
|
|
|
# Docker (separate repo).
|
|
install_docker
|
|
|
|
# code-server (VS Code in the browser) — skip the download if already installed.
|
|
if ! command -v code-server >/dev/null 2>&1; then
|
|
curl -fsSL https://code-server.dev/install.sh | sh
|
|
fi
|
|
sudo systemctl enable --now "code-server@$USER"
|
|
|
|
# Remote desktop (gnome-remote-desktop — see the function header for why not xrdp).
|
|
setup_remote_desktop
|
|
|
|
# Low-disk login warning (system-wide profile.d snippet).
|
|
install_disk_warning
|
|
|
|
# On-demand NAS mount helper (cloudpex/).
|
|
install_cloudpex
|
|
else
|
|
echo "apt-get not found — skipping system packages (install vim/git manually)."
|
|
fi
|
|
|
|
# Back up any existing config before overwriting (re-runnable).
|
|
echo "Backing up existing config to ~/Oldconfig"
|
|
rm -rf "$HOME/Oldconfig"
|
|
mkdir -p "$HOME/Oldconfig"
|
|
for cfg in .vim .Sublivim .vimrc .bashrc; do
|
|
if [ -e "$HOME/$cfg" ]; then
|
|
mv "$HOME/$cfg" "$HOME/Oldconfig/"
|
|
fi
|
|
done
|
|
|
|
# Recreate the vim directory layout.
|
|
echo "Creating vim directory structure"
|
|
mkdir -p "$HOME"/.vim/{autoload,colors,syntax,plugin,spell,config,bundle}
|
|
|
|
# Fetch external vim plugins (rm first so re-runs do not fail on existing clones).
|
|
echo "Cloning vim plugins"
|
|
rm -rf "$HOME/.vim/bundle/syntastic"
|
|
git clone --quiet https://github.com/vim-syntastic/syntastic "$HOME/.vim/bundle/syntastic"
|
|
rm -rf "$HOME/.vim/bundle/nerdtree"
|
|
git clone --quiet https://github.com/preservim/nerdtree "$HOME/.vim/bundle/nerdtree"
|
|
|
|
# Deploy tracked vim files: vimrc, pathogen loader, molokai colorscheme.
|
|
echo "Deploying vim config"
|
|
cp -rupv "$SCRIPT_DIR"/vim/* "$HOME/.vim/"
|
|
ln -sf "$HOME/.vim/vimrc" "$HOME/.vimrc"
|
|
|
|
# Deploy the bashrc matching the detected OS.
|
|
# macOS uses bashrc-osx (falling back to bashrc-linux if absent); everything else uses bashrc-linux.
|
|
if [ "$(uname -s)" = "Darwin" ] && [ -f "$SCRIPT_DIR/bash/bashrc-osx" ]; then
|
|
bashrc="bash/bashrc-osx"
|
|
else
|
|
bashrc="bash/bashrc-linux"
|
|
fi
|
|
echo "Deploying $bashrc"
|
|
cp "$SCRIPT_DIR/$bashrc" "$HOME/.bashrc"
|
|
|
|
# Python CLIs via pipx (run as the user, never sudo). Skipped if pipx is absent.
|
|
if command -v pipx >/dev/null 2>&1; then
|
|
echo "Installing pipx CLIs (PyMuPDF -> pymupdf, Markdown -> markdown_py)"
|
|
pipx install PyMuPDF || pipx upgrade PyMuPDF
|
|
pipx install Markdown || pipx upgrade Markdown
|
|
pipx ensurepath >/dev/null
|
|
fi
|
|
|
|
# Deploy personal CLI scripts to ~/.local/bin (dt, dtach-router, claude-provider).
|
|
echo "Deploying CLI scripts to ~/.local/bin"
|
|
mkdir -p "$HOME/.local/bin"
|
|
cp "$SCRIPT_DIR"/bin/* "$HOME/.local/bin/"
|
|
chmod +x "$HOME"/.local/bin/dt "$HOME"/.local/bin/dtach-router "$HOME"/.local/bin/claude-provider
|
|
|
|
|
|
# Remove any stale dtach wiring from ~/.profile (the menu now ships in ~/.bashrc; see above).
|
|
unwire_dtach_profile
|
|
|
|
# Optional system changes, offered last so the base install is complete even when
|
|
# declined. Linux/systemd only. Each prompts [y/N] on a terminal, is skipped otherwise.
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
offer_tmp_on_disk
|
|
offer_ssh_memory_guard
|
|
fi
|
|
|
|
echo "Done. Restart your shell or run: source ~/.bashrc"
|
|
echo "If you use zsh, switch to bash to enjoy these settings =)"
|
|
echo "Note: the deployed bashrc puts ~/.local/bin on PATH — re-login or run: source ~/.bashrc"
|