# Arch Base

This is the base configuration from which you can build a variety of systems. Right now
I have instructions for building a:

1. [Workstation](workstation.md)
2. [Gaming PC](gaming.md)
3. [Kubernetes Server](server.md)

## Table of Contents

- [Arch Base](#arch-base)
  - [Table of Contents](#table-of-contents)
  - [Installation](#installation)
    - [Preparation](#preparation)
    - [Boot](#boot)
    - [AUR](#aur)
    - [Security](#security)
      - [Secure Boot](#secure-boot)
      - [TPM2 LUKS Decryption](#tpm2-luks-decryption)
        - [Re-enroll](#re-enroll)
      - [FIDO2 LUKS Decryption](#fido2-luks-decryption)
      - [Firewall](#firewall)
      - [AppArmor](#apparmor)
        - [Install Apparmor](#install-apparmor)
        - [Custom Profiles](#custom-profiles)
      - [ClamAV](#clamav)
        - [Config](#config)
      - [btrbk](#btrbk)
        - [fstab](#fstab)
        - [Snapshots](#snapshots)
        - [Backups](#backups)
        - [Backing up a snapshot](#backing-up-a-snapshot)
      - [Chroots](#chroots)
      - [Fingerprint Reader Support](#fingerprint-reader-support)
        - [Setup](#setup)
        - [Turn Off Fingerprint When Laptop Lid Closed](#turn-off-fingerprint-when-laptop-lid-closed)
  - [Desktop Environment](#desktop-environment)
    - [Gnome](#gnome)
  - [Hardware Management](#hardware-management)
    - [Hardware Acceleration](#hardware-acceleration)
    - [Power Management](#power-management)
    - [Don't sleep while plugged in](#dont-sleep-while-plugged-in)
    - [Bluetooth](#bluetooth)
    - [Audio](#audio)
    - [ISCSI](#iscsi)
  - [Software Stores](#software-stores)
    - [AppImage Support](#appimage-support)
      - [Troubleshooting](#troubleshooting)
    - [Flatpak](#flatpak)
  - [Apps](#apps)
    - [Firefox](#firefox)
      - [Gnome Extensions](#gnome-extensions)
    - [Avahi (Bonjour)](#avahi-bonjour)
    - [CUPS Printing](#cups-printing)
    - [Yubikey](#yubikey)
  - [Bashrc](#bashrc)
    - [Colorized Prompt](#colorized-prompt)
    - [Standard Bashrc](#standard-bashrc)

## Installation

### Preparation

Follow most of the instructions here:
<https://wiki.archlinux.org/title/Installation_guide>

1. Download Arch
2. Verify the image

    ```bash
    gpg --auto-key-locate clear,wkd -v --locate-external-key pierre@archlinux.org
    ```

3. Create a bootable ISO

    1. If you are booting into a VM, create an ISO with installation files so you don't have to copy-paste:

        ```bash
        sudo pacman -S cdrtools
        mkisofs -r -iso-level 4 -l -o /tmp/arch-files.iso ./arch
        ```

    2. If you are booting from a live usb, copy the files in ./arch to the usb drive

4. Disable secureboot (reenable later)

### Boot

1. Boot into the live image
2. Check for network connectivity

    ```bash
    # Check for internet
    ip a
    ping archlinux.org
    ```

3. `timedatectl` to update system clock
4. If using a VM, mount the iso with arch conf files

    ```bash
    mount --mkdir /dev/sr1 /media
    ```

5. Create disk partitions. Use gdisk or beware "bootctl install is not on a gpt partition table"

    ```bash
    fdisk -l
    gdisk /dev/vda
    ```

    - +1G for /boot
    - t EFI SYSTEM for /boot
    - remaining for /

6. `mkfs.fat -F 32 /dev/vda1` (/mnt/boot partition)
7. This next step involves generating a secure, random password. Make sure to
   save this somewhere. I recommend having an encrypted partition on your
   installation drive to which you can write a few bytes of text.

    `echo -n $(pwgen 8 5) | sed 's/ /-/g' > root-key.txt`

8. `cryptsetup luksFormat /dev/vda2  --key-file /path/to/root-key.txt`
9. `cryptsetup luksOpen /dev/vda2 root --key-file /path/to/root-key.txt`
10. `mkfs.btrfs /dev/mapper/root` (root partition)
11. At this point you can choose how to subvolume your root partition

    ```bash
    mount --mkdir -o subvolid=5 /btr_pool
    btrfs sub create root /btr_pool
    btrfs sub create home /btr_pool
    ...
    ```

12. Mount the root partition with `mount -o subvol=root /dev/mapper/root /mnt`
13. Mount the home partition with `mount -o subvol=home /dev/mapper/root /mnt/home`
14. Mount the boot partition with `mount --mkdir /dev/vda1 /mnt/boot`
15. If on VM: Mount the conf files with `mount --mkdir /dev/sr1 /mnt/media`
16. `pacstrap -K /mnt base linux linux-firmware`

    This command might show an error. This is ok, we'll fix it later.

17. `genfstab -U /mnt >> /mnt/etc/fstab`
18. `arch-chroot /mnt`
19. `ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime`
20. `hwclock --systohc`
21. `echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen`
22. `echo 'KEYMAP=us' > /etc/vconsole.conf`
23. `echo 'hostname' > /etc/hostname`
24. `pacman -S sudo vim dhclient dhcpcd bash-completion btrfs-progs plymouth`

    - dhclient/dhcpcd provides dhcp for network
    - bash-completion provides tab complete
    - btrfs-progs provides fsck for btrfs
    - plymouth gives a nice bootloader screen

25. Edit /etc/mkinitcpio.conf and set up systemd/sd-encrypt

    /etc/mkinitcpio.conf

    ```conf
    HOOKS=(systemd plymouth autodetect modconf kms keyboard sd-vconsole block sd-encrypt filesystems fsck)
    ```

26. `mkinitcpio -P`
27. Install systemd-boot

    <https://wiki.archlinux.org/title/systemd-boot>

    ```bash
    bootctl install
    ```

    If this raises an error like "efi partition not found" you probably forgot to format
    /mnt/boot as an EFI partition. Edit this by reformatting it with gdisk (ef00 is the hex code).

28. edit your loader.conf with some defaults

    /boot/loader/loader.conf

    ```conf
    default  main.conf
    timeout  4
    console-mode max
    editor   no
    ```

29. Create a loader (/usr/share/systemd/bootctl/arch.conf for example)

    /boot/loader/entries/main.conf

    ```conf
    title   Arch Linux
    linux   /vmlinuz-linux
    initrd  /initramfs-linux.img
    options quiet splash rd.luks.name=d9828faa-2b8c-4184-9e74-9054ae328c6d=root root=/dev/mapper/root rootflags=subvol=root nvme.noacpi=1 acpi_osi="!Windows 2020" mem_sleep_default="deep" rw
    ```

    You can get the UUID of the disk into arch.conf with some grepping. Use vim to cut
    the excess and copy it into the correct location.

    ```bash
    blkid | grep /dev/vda2 >> /boot/loader/entries/main.conf
    ```

30. `useradd ducoterra`
31. `passwd ducoterra`
32. `groupadd sudo`
33. Edit /etc/sudoers and uncomment the section allowing sudo and wheel group privilege
34. `usermod -aG sudo ducoterra`
35. `usermod -aG wheel ducoterra`
36. `mkdir /home/ducoterra`
37. `chown ducoterra:ducoterra /home/ducoterra`
38. `locale-gen`
39. `systemctl enable dhcpcd`
40. If on VM install guest drivers: `pacman -S qemu-guest-agent spice-vdagent`
41. If you need ssh: `pacman -S openssh; systemctl enable sshd`
42. `exit`
43. `reboot`
44. Remove your installation medium and boot into arch
45. Add a pacman hook for systemd-boot updates

    /etc/pacman.d/hooks/95-systemd-boot.hook

    ```conf
    [Trigger]
    Type = Package
    Operation = Upgrade
    Target = systemd

    [Action]
    Description = Gracefully upgrading systemd-boot...
    When = PostTransaction
    Exec = /usr/bin/systemctl restart systemd-boot-update.service
    ```

### AUR

```bash
pacman -S --needed git base-devel
mkdir ~/aur
git clone <git repo from aur>
cd <folder name>
makepkg -si
```

### Security

<https://wiki.archlinux.org/title/security>

Every machine, regardless of use-case, should perform some basic hardening. You don't
need to follow every instruction in the above wiki, but you should at least
enable secure boot, tpm2 disk decryption, firewall, apparmor, clamav, btrfs snapshots,
and btrfs backups.

Security Philosophy

1. Secure Boot

    Protection from pre-boot malware that might hijack your EFI binary.

    <https://www.rodsbooks.com/efi-bootloaders/secureboot.html>

2. TPM2 Decryption

    Since we have secure boot enabled we can safely auto-decrypt our hard drive with a
    tpm2 device. This is purely a convenience.

3. Firewall

    This should be self-explanatory, but I'll explain anyway. Don't allow any arbitrary
    network traffic into your device. Block those ports. Only open what you need. Firewalls
    drastically reduce the risk of remote exploits by stopping them before they can even
    establish a connection. Firewalls can also be used to limit an attacker's ability
    to even discover you on a network with icmp blocking.

4. AppArmor

    AppArmor is a mandatory access control system like SELinux. Even if you
    don't configure it beyond its defaults, AppArmor is still a good thing to
    have available. Apps which come with an apparmor profile will offer you an
    additional layer of security. In the same way that a firewall protects you
    from remote attacks, AppArmor protects you from privilege escalation
    attacks and malicious binaries by blocking them at the source.

5. ClamAV

    Much like Windows has Windows Defender, Linux has ClamAV. Running an antivirus scanner
    certainly isn't the end-all-be-all of security, and it definitely isn't good enough
    on its own to keep your system safe, but in combination with apparmor and a firewall
    you can identify and quarantine malware before it has a chance to compromise your system. That
    being said, finding *any* malware on a system is reason enough to nuke it from orbit and restore from a
    known good backup.

6. BTRFS Snapshots

    This is not a backup, this is a snapshot. It serves an equally important function, however,
    in that it protects you from accidental deletion and corruption. Let's imagine you perform
    an update, reboot, and your computer crashes mid-startup. You could easily restore root
    from a btrfs snapshot on your system and go on with your day like nothing happened.

7. BTRFS Backups

    This is a backup. Unlike snapshots, which live on the same drive your system exists
    on, backups are physically separate copies of your computer stored (hopefully) in a
    physically separate location. In the event your computer is lost or stolen these
    backups give you a way to perfectly restore your system to its former glory.

#### Secure Boot

1. Put your machine in setup mode

    On framework this is done in the UEFI setup page for Security, sub-page
    Secure Boot, choose “Erase all Secure Boot Settings.”

    On my Gigabyte motherboard this is done in the BIOS under security. Set secure boot
    to custom.

2. `pacman -S efitools sbctl`
3. `cd /root/`
4. `for var in PK KEK db dbx ; do efi-readvar -v $var -o old_${var}.esl ; done`
5. `sbctl create-keys`
6. `sbctl enroll-keys -m`
7. `sbctl status`
8. `sbctl verify`
9. `sbctl sign -s /boot/vmlinuz-linux`
10. `sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI`
11. `sbctl sign -s /boot/EFI/systemd/systemd-bootx64.efi`
12. `sbctl verify`
13. `reboot`
14. Enable secure boot
15. `sbctl status` to check secure boot
16. `bootctl` to check boot loader status

There is a pacman hook which will automatically sign new binaries on update.

#### TPM2 LUKS Decryption

Using `--tpm2-pcrs=7` enforces secure boot and will require password if secure boot is disabled.

1. `pacman -S tpm2-tss`
2. `systemd-cryptenroll /dev/vda2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7`

##### Re-enroll

```bash
systemd-cryptenroll /dev/nvme0n1p2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7
systemd-cryptenroll /dev/nvme0n1p3 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7
```

#### FIDO2 LUKS Decryption

1. `pacman -S libfido2`

#### Firewall

```bash
pacman -S ufw
systemctl enable --now ufw
```

#### AppArmor

##### Install Apparmor

Apparmor protects your system by limiting the access binaries have to specific files.
All binaries which are protected by apparmor profiles have a whitelist of allowed
paths they can touch, even if they run as root.

1. `pacman -S apparmor`
2. `systemctl enable --now apparmor`
3. `systemctl enable --now auditd`
4. Add the correct kernel parameters

    /boot/loaders/entries/main.conf

    ```conf
    title Arch Linux
    ...
    options ...lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1...
    ```

5. `reboot`

##### Custom Profiles

You will likely need to create custom profiles for your apps. There are a few ways to
do this but the least painful ways are as follows:

1. A profile already exists in `/usr/share/apparmor/extra-profiles/`

    Check here first. More than likely there's a good starting point. This will probably
    need to be tuned but you can (and should) copy it to /etc/apparmor.d

2. No profile exists in `/usr/share/apparmor/extra-profiles/`

    You can use `aa-genprof <binary>` to generate a profile for that binary and begin
    listening to log events. Then, launch the application and use it as intended. When
    you've done what you consider to be the typical use-case you should.

    1. Press `s` until it begins recommending additions to your profile
    2. Use (A) or (D) to add or deny paths
    3. Use (G) to glob a path
    4. Use (N) to write a custom path
    5. If prompted for an executable choose (I) to inherit the execution privileges from the parent process or (P) to use this application's profile. Sanitize if you chooose this app's profile
    6. When done, (F) to finish and (S) to save.
    7. Use `apparmor_parser -r /etc/apparmor.d/<profile>` to reload the profile
    8. Run `aa-enforce /etc/apparmor.d/<profile>` to set to enforce mode
    9. Try to launch the app. It will probably crash
    10. Run `aa-logprof`, add rules, `apparmor_parser -r /etc/apparmor.d/<profile>`, launch app, repeat until it works
    11. You can `tail /var/log/audit/audit.log` and grab a string like `msg=audit(1692576444.967:102858)` to use as a starting point rather than parsing the whole log. Like: `aa-logprof -m 'msg=audit(1692576444.967:102858)'`.

From <https://manpages.ubuntu.com/manpages/xenial/man5/apparmor.d.5.html>

```text
Access Modes
    File permission access modes consists of combinations of the following modes:

    r       - read
    w       - write -- conflicts with append
    a       - append -- conflicts with write
    ux      - unconfined execute
    Ux      - unconfined execute -- scrub the environment
    px      - discrete profile execute
    Px      - discrete profile execute -- scrub the environment
    cx      - transition to subprofile on execute
    Cx      - transition to subprofile on execute -- scrub the environment
    ix      - inherit execute
    pix     - discrete profile execute with inherit fallback
    Pix     - discrete profile execute with inherit fallback -- scrub the environment
    cix     - transition to subprofile on execute with inherit fallback
    Cix     - transition to subprofile on execute with inherit fallback -- scrub the
            environment
    pux     - discrete profile execute with fallback to unconfined
    PUx     - discrete profile execute with fallback to unconfined -- scrub the environment
    cux     - transition to subprofile on execute with fallback to unconfined
    CUx     - transition to subprofile on execute with fallback to unconfined -- scrub the
            environment
    deny x  - disallow execute (in rules with the deny qualifier)
    m       - allow PROT_EXEC with mmap(2) calls
    l       - link
    k       - lock
```

#### ClamAV

1. `pacman -S clamav`
2. `clamscan --recursive --infected /path/to/dir`

- OR -

1. `freshclam`
2. `systemctl enable --now clamav-freshclam.service`
3. `systemctl enable --now clamav-daemon.service`
4. `clamdscan --multiscan --fdpass /home/ducoterra`

##### Config

```conf
UpdateLogFile /var/log/clamav/freshclam.log
PidFile /run/clamav/freshclam.pid
DatabaseMirror database.clamav.net
NotifyClamd /etc/clamav/clamd.conf
```

#### btrbk

```bash
cd Downloads
wget https://raw.githubusercontent.com/digint/btrbk/master/btrbk
clamscan .
chmod +x btrbk
sudo mv btrbk /usr/bin/
```

##### fstab

You'll need to mount your btrfs volumes in a location which exposes their subvolumes.

```bash
mkdir -p /btr_pools/root
```

/etc/fstab

```conf
# btr_pools
UUID=84153269-f194-43f7-a4fe-e72aaffdb97a       /btr_pools/root               btrfs           rw,relatime,ssd,space_cache=v2,subvolid=256,subvolid=5  0 0
```

```bash
systemctl daemon-reload
mount -a
btrfs sub create /btr_pools/root/.snapshots
btrbk -c /etc/btrbk/snapshots.conf dryrun
btrbk -c /etc/btrbk/snapshots.conf run
```

##### Snapshots

1. Create a snapshot config

    /etc/btrbk/snapshots.conf

    ```conf
    snapshot_preserve_min   24h
    snapshot_preserve       14d

    # root
    volume /btr_pools/root
        subvolume           root
        snapshot_dir        .snapshots

    # home
    volume /btr_pools/root
        subvolume           home
        snapshot_dir        .snapshots

    # libvirt
    volume /btr_pools/root
        subvolume           libvirt
        snapshot_dir        .snapshots

    # nextcloud
    volume /btr_pools/root
        subvolume           nextcloud
        snapshot_dir        .snapshots
    ```

2. Then create a snapshot service

    /etc/systemd/system/btrbk_snapshots.service

    ```conf
    [Unit]
    Description=Runs btrbk with config file at /etc/btrbk/snapshots.conf

    [Service]
    ExecStart=/usr/bin/btrbk -c /etc/btrbk/snapshots.conf -v run
    ```

3. Then create a timer for the service

    /etc/systemd/system/btrbk_snapshots.timer

    ```conf
    [Unit]
    Description=Run snapshots every hour

    [Timer]
    OnCalendar=hourly

    AccuracySec=10min
    Persistent=true
    Unit=btrbk_snapshots.service

    [Install]
    WantedBy=timers.target
    ```

4. Then enable the service

    ```bash
    systemctl enable --now btrbk_snapshots.timer
    ```

##### Backups

Before you begin, go through the usual process of setting up an encrypted drive. If
you're using Gnome I recommend using the GUI since it handles encrypted USB drives
really nicely.

The only thing I'd recommend doing manually is creating the mountpoint as a read-only
subvolume. This prevents backups from being written to the root device when the backup
disk isn't mounted.

```bash
btrfs sub create /btr_pools/backup
btrfs property set /btr_pools/backup ro true
```

1. Create a backup config

    /etc/btrbk/backups.conf

    ```conf
    snapshot_create         no
    target_preserve_min     no
    target_preserve         30d

    # root
    volume /btr_pools/root
        target /btr_pools/backup
        subvolume           root
        snapshot_dir        .snapshots

    # home
    volume /btr_pools/root
        target /btr_pools/backup
        subvolume           home
        snapshot_dir        .snapshots

    # libvirt
    volume /btr_pools/root
        target /btr_pools/backup
        subvolume           libvirt
        snapshot_dir        .snapshots
    ```

2. Create a backup service

    /etc/systemd/system/btrbk_backups.service

    ```conf
    [Unit]
    Description=Runs btrbk with config file at /etc/btrbk/backups.conf

    [Service]
    ExecStart=/usr/bin/btrbk -c /etc/btrbk/backups.conf -v run
    ```

3. Create a timer to activate the service

    /etc/systemd/system/btrbk_backups.timer

    ```conf
    [Unit]
    Description=Run btrbk backups every hour

    [Timer]
    OnCalendar=hourly
    AccuracySec=10min
    Persistent=true
    Unit=btrbk_backups.service

    [Install]
    WantedBy=timers.target
    ```

4. Enable the timer

    ```bash
    systemctl enable --now btrbk_backup.conf
    ```

##### Backing up a snapshot

```bash
pacman -S pv

btrfs send /mnt/btr_backup/root.20230727T1000 | pv | btrfs receive /mnt/btr_iscsi
```

#### Chroots

You can create chroot environments to run firejails or just use for testing purposes.

1. `btrfs sub create /chroots`
2. `mkdir /testing`
3. `pacman -S arch-install-scripts`
4. `pacstrap -K /chroots/testing/ base base-devel`
5. `arch-chroot /chroots/testing`

#### Fingerprint Reader Support

##### Setup

1. `pacman -S fprintd`
2. `systemctl enable --now fprintd`
3. `fprintd-enroll ducoterra`
4. Enable fingerprint terminal login but prompt for password first (enter switches to prompt for fingerprint)

    /etc/pam.d/sudo

    ```conf
    # fingerprint auth
    auth      sufficient pam_fprintd.so
    ```

##### Turn Off Fingerprint When Laptop Lid Closed

To disable fingerprint authentication when the laptop lid is closed, and
re-enable when it is reopened, we will use acpid to bind to the button/lid.*
event to a custom script that will comment out fprintd auth in /etc/pam.d/sudo.

Usually we'd just `systemctl mask fprintd` but this breaks gdm (as of 08/06/23). See
<https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2267> and
<https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6585>.

1. `pacman -S acpid` and then `systemctl enable --now acpid`
2. Create file /etc/acpi/laptop-lid.sh with the following contents:

    ```bash
    #!/bin/bash

    if grep -Fq closed /proc/acpi/button/lid/LID0/state # &&
        # This is used to detect if a display is connected.
        # For USB C displayport use: 
        # grep -Fxq connected /sys/class/drm/card1-DP-2/status
        # For hdmi use:
        # grep -Fxq connected /sys/class/drm/card0-HDMI-A-1/status
    then
        # comment out fprintd
        sed -i -E 's/^([^#].*pam_fprintd.so)/#\1/g' /etc/pam.d/sudo
    else
        # uncomment fprintd
        sed -i -E 's/#(.*pam_fprintd.so)/\1/g' /etc/pam.d/sudo

    fi
    ```

3. Make the file executable with

    `chmod +x /etc/acpi/laptop-lid.sh`

4. Create file /etc/acpi/events/laptop-lid with the following contents:

    ```bash
    event=button/lid.*
    action=/etc/acpi/laptop-lid.sh
    ```

5. Restart the acpid service with:

    `systemctl restart acpid`

Now the fingerprint will be used only when the lid is open.

In order to ensure the correct state after suspend we need a service file which
runs our script on wake.

1. Create a file named /etc/systemd/system/laptop-lid.service with the following contents:

    ```bash
    [Unit]
    Description=Laptop Lid
    After=suspend.target

    [Service]
    ExecStart=/etc/acpi/laptop-lid.sh

    [Install]
    WantedBy=multi-user.target
    WantedBy=suspend.target
    ```

2. Reload the systemd config files with

    `sudo systemctl daemon-reload`

3. Start and enable the service with

    `sudo systemctl enable --now laptop-lid.service`

Now the status should be correct even after connecting/disconnecting when the computer is off.

## Desktop Environment

### Gnome

1. `pacman -S gdm gnome`

    - choose pipewire-jack
    - choose wireplumber
    - choose noto-fonts-emoji

2. `systemctl enable --now gdm`
3. `pacman -S networkmanager`
4. `systemctl enable --now NetworkManager`
5. `pacman -S gnome-tweaks dconf-editor seahorse`

## Hardware Management

### Hardware Acceleration

(This helps enable hardware encoding/decoding for steam streaming)

Intel

```bash
pacman -S libva-utils intel-media-driver
vainfo
```

AMD

```bash
pacman -S vulkan-radeon libva-utils libva-mesa-driver xf86-video-amdgpu
vainfo
```

### Power Management

1. For laptops install `tlp`

    ```bash
    pacman -S tlp tlp-rdw
    systemctl enable --now tlp
    systemctl mask systemd-rfkill.service
    systemctl mask systemd-rfkill.socket
    ```

2. Then configure it with the following settings (optional)

    /etc/tlp.conf

    ```conf
    # I've seen some issues with usb autosuspend
    USB_AUTOSUSPEND=0
    # Restore bluetooth/wifi state on reboot
    # Otherwise it defaults to on
    RESTORE_DEVICE_STATE_ON_STARTUP=1
    # Disable wifi when plugged in
    # You might not want this for continuity - eg. you're copying a file to a network
    # share over wifi - plugging in will cancel the copy with this option enabled.
    DEVICES_TO_DISABLE_ON_LAN_CONNECT="wifi wwan"
    # Re-enable wifi when unplugged.
    DEVICES_TO_ENABLE_ON_LAN_DISCONNECT="wifi wwan"
    ```

3. For desktops install cpupower

    ```bash
    pacman -S cpupower
    systemctl enable --now cpupower
    ```

    Temporarily set power profile with `cpupower frequency-set -g performance`

    Edit /etc/default/cpupower

    ```conf
    governor='performance'
    ```

### Don't sleep while plugged in

This is needed for the Framework 13 (11th gen) since sleeping while plugged in to a dock
will prevent it from waking up.

/etc/systemd/logind.conf

```conf
...
HandleLidSwitchExternalPower=lock
HandleLidSwitchDocked=ignore
...
```

### Bluetooth

1. `pacman -S bluez bluez-utils`
2. `systemctl enable --now bluetooth`

### Audio

Without pipewire-pulse the audio level/device will reset every reboot.

1. `pacman -S pipewire-pulse` (remove conflicting packages)

### ISCSI

```bash
pacman -S open-iscsi
systemctl enable --now iscsid
```

1. Add auth login

    /etc/iscsi/iscsid.conf

    ```conf
    node.session.auth.chap_algs = SHA3-256,SHA256,SHA1,MD5
    node.session.auth.username = username
    node.session.auth.password = password
    ```

2. Initiate and login to the portal

    ```bash
    # Add a new target to your list of nodes
    iscsiadm \
        -m discovery \
        -t st \
        -p driveripper.reeselink.com

    # Login to the target
    iscsiadm \
        -m node \
        --targetname iqn.2023-01.driveripper.reeselink.com:backup-reese-pc \
        -p driveripper.reeselink.com:3260 \
        --login

    # or login to all targets
    iscsiadm -m node --loginall all

    # View current session
    iscsiadm -m session

    # Log out of all sessions
    iscsiadm -m node -u

    # Log out of a single session
    iscsiadm -m node -T iqn.2023-01.driveripper.reeselink.com:2024-01-framework --logout

    # Remove session
    iscsiadm -m node -o delete -T iqn.2023-01.driveripper.reeselink.com:2023-01-framework
    ```

## Software Stores

### AppImage Support

Also chmod +x before running.

1. `cp ~/Downloads/xxxxxxx.appimage ~/Applications`
2. Find an icon online and save it to ~/.icons
3. Write a .desktop entry at ~/.local/share/applications/

    ```conf
    [Desktop Entry]
    Name=
    Exec=/home/ducoterra/Applications/
    Icon=/home/ducoterra/.icons/
    Type=Application
    ```

4. `desktop-file-validate ~/.local/share/applications/*.desktop`
5. `update-desktop-database`

#### Troubleshooting

fuse may be required to run an appimage.

```bash
sudo pacman -S fuse
```

### Flatpak

```bash
pacman -S flatpak
```

## Apps

### Firefox

You'll want firefox and gnome-browser-connector (for gnome extension management).

```bash
pacman -S firefox gnome-browser-connector
```

Choose noto-fonts

#### Gnome Extensions

1. AlphabeticalAppGrid@stuarthayhurst
2. Vitals@CoreCoding.com
3. dash-to-dock@micxgx.gmail.com
4. tactile@lundal.io

### Avahi (Bonjour)

1. `sudo pacman -S avahi`
2. `sudo vim /etc/nsswitch.conf`

    ```conf
    hosts: mymachines mdns [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns
    ```

3. `sudo vim /etc/mdns.allow`

    ```conf
    .local.
    .local
    ```

### CUPS Printing

Note: you probably need avahi (see above)

1. `sudo pacman -S cups cups-pdf system-config-printer`
2. `sudo vim /etc/nsswitch.conf`

    ```conf
    hosts: mymachines mdns [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns
    ```

3. `sudo systemctl start cups`
4. `sudo systemctl start avahi-daemon`

### Yubikey

You'll need the yubikey manager appimage in addition to the pacman package

```bash
sudo pacman -S yubikey-manager
```

Reboot and things should work. You might also have to start pcscd:

```bash
sudo systemctl enable --now pcscd
```

## Bashrc

### Colorized Prompt

<https://colors.sh/>

You can change the prompt color by setting PROMPT_COLOR at the top of your .bashrc

Examples:

Yellow: `PROMPT_COLOR=33;`
Orange: `PROMPT_COLOR=38;5;208;`
Red: `PROMPT_COLOR=38;5;160;`

### Standard Bashrc

Don't do this if you installed `zsh`

~/.bashrc

```bash
# .bashrc

# Source global definitions
if [ -f /etc/bashrc ]; then
        . /etc/bashrc
fi

# User specific binaries
if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]]
then
    PATH="$HOME/.local/bin:$HOME/bin:$PATH"
fi
export PATH

# User specific aliases and functions (source .bashrc.d/)
if [ -d ~/.bashrc.d ]; then
        for rc in ~/.bashrc.d/*; do
                if [ -f "$rc" ]; then
                        . "$rc"
                fi
        done
fi

# clear var used in for loop
unset rc
```

~/.bashrc.d/aliases.sh

```bash
# (Mostly) Taken from https://www.cyberciti.biz/tips/bash-aliases-mac-centos-linux-unix.html
# Author: Vivek Gite

## Colorize the ls output ##
alias ls="ls --color=auto"

## Colorize the grep command output for ease of use (good for log files)##
alias grep='grep --color=auto'
alias egrep='egrep --color=auto'
alias fgrep='fgrep --color=auto'

## Make mount human readable ##
alias mount='mount |column -t'

## show open ports ##
alias ports='ss -tulanp'

# do not delete / or prompt if deleting more than 3 files at a time #
alias rm='rm -I --preserve-root'

# confirmation #
alias mv='mv -i'
alias cp='cp -i'
alias ln='ln -i'

# Parenting changing perms on / #
alias chown='chown --preserve-root'
alias chmod='chmod --preserve-root'
alias chgrp='chgrp --preserve-root'

## pass options to free ##
alias meminfo='free -m -l -t'
 
## get top process eating memory
alias psmem='ps auxf | sort -nr -k 4'
alias psmem10='ps auxf | sort -nr -k 4 | head -10'
 
## get top process eating cpu ##
alias pscpu='ps auxf | sort -nr -k 3'
alias pscpu10='ps auxf | sort -nr -k 3 | head -10'

## this one saved by butt so many times ##
alias wget='wget -c'

## set some other defaults ##
alias df='df -H'
alias du='du -ch'

## ls but with file sizes, showing largest at the bottom ## 
alias lst='ls --human-readable --size -1 -S --classify -r'

## ls show only directories
alias lsd='ls -d */'

## Count the number of files in a directory
alias lsc='find . -type f | wc -l'

## ls sort by last modified ##
alias lmt='ls -t -1'
```
