# Arch Base This is the base configuration from which you can build a variety of systems. Right now I have instructions for building a: 1. [Workstation](workstation.md) 2. [Gaming PC](gaming.md) 3. [Kubernetes Server](server.md) ## Table of Contents - [Arch Base](#arch-base) - [Table of Contents](#table-of-contents) - [Installation](#installation) - [Preparation](#preparation) - [Boot](#boot) - [AUR](#aur) - [Security](#security) - [Secure Boot](#secure-boot) - [TPM2 LUKS Decryption](#tpm2-luks-decryption) - [Re-enroll](#re-enroll) - [FIDO2 LUKS Decryption](#fido2-luks-decryption) - [Firewall](#firewall) - [AppArmor](#apparmor) - [Install Apparmor](#install-apparmor) - [Custom Profiles](#custom-profiles) - [ClamAV](#clamav) - [Config](#config) - [btrbk](#btrbk) - [fstab](#fstab) - [Snapshots](#snapshots) - [Backups](#backups) - [Backing up a snapshot](#backing-up-a-snapshot) - [Chroots](#chroots) - [Fingerprint Reader Support](#fingerprint-reader-support) - [Setup](#setup) - [Turn Off Fingerprint When Laptop Lid Closed](#turn-off-fingerprint-when-laptop-lid-closed) - [Desktop Environment](#desktop-environment) - [Gnome](#gnome) - [Hardware Management](#hardware-management) - [Hardware Acceleration](#hardware-acceleration) - [Power Management](#power-management) - [Don't sleep while plugged in](#dont-sleep-while-plugged-in) - [Bluetooth](#bluetooth) - [Audio](#audio) - [ISCSI](#iscsi) - [Software Stores](#software-stores) - [AppImage Support](#appimage-support) - [Troubleshooting](#troubleshooting) - [Flatpak](#flatpak) - [Apps](#apps) - [Firefox](#firefox) - [Gnome Extensions](#gnome-extensions) - [Avahi (Bonjour)](#avahi-bonjour) - [CUPS Printing](#cups-printing) - [Yubikey](#yubikey) - [Bashrc](#bashrc) - [Colorized Prompt](#colorized-prompt) - [Standard Bashrc](#standard-bashrc) ## Installation ### Preparation Follow most of the instructions here: 1. Download Arch 2. Verify the image ```bash gpg --auto-key-locate clear,wkd -v --locate-external-key pierre@archlinux.org ``` 3. Create a bootable ISO 1. If you are booting into a VM, create an ISO with installation files so you don't have to copy-paste: ```bash sudo pacman -S cdrtools mkisofs -r -iso-level 4 -l -o /tmp/arch-files.iso ./arch ``` 2. If you are booting from a live usb, copy the files in ./arch to the usb drive 4. Disable secureboot (reenable later) ### Boot 1. Boot into the live image 2. Check for network connectivity ```bash # Check for internet ip a ping archlinux.org ``` 3. `timedatectl` to update system clock 4. If using a VM, mount the iso with arch conf files ```bash mount --mkdir /dev/sr1 /media ``` 5. Create disk partitions. Use gdisk or beware "bootctl install is not on a gpt partition table" ```bash fdisk -l gdisk /dev/vda ``` - +1G for /boot - t EFI SYSTEM for /boot - remaining for / 6. `mkfs.fat -F 32 /dev/vda1` (/mnt/boot partition) 7. This next step involves generating a secure, random password. Make sure to save this somewhere. I recommend having an encrypted partition on your installation drive to which you can write a few bytes of text. `echo -n $(pwgen 8 5) | sed 's/ /-/g' > root-key.txt` 8. `cryptsetup luksFormat /dev/vda2 --key-file /path/to/root-key.txt` 9. `cryptsetup luksOpen /dev/vda2 root --key-file /path/to/root-key.txt` 10. `mkfs.btrfs /dev/mapper/root` (root partition) 11. At this point you can choose how to subvolume your root partition ```bash mount --mkdir -o subvolid=5 /btr_pool btrfs sub create root /btr_pool btrfs sub create home /btr_pool ... ``` 12. Mount the root partition with `mount -o subvol=root /dev/mapper/root /mnt` 13. Mount the home partition with `mount -o subvol=home /dev/mapper/root /mnt/home` 14. Mount the boot partition with `mount --mkdir /dev/vda1 /mnt/boot` 15. If on VM: Mount the conf files with `mount --mkdir /dev/sr1 /mnt/media` 16. `pacstrap -K /mnt base linux linux-firmware` This command might show an error. This is ok, we'll fix it later. 17. `genfstab -U /mnt >> /mnt/etc/fstab` 18. `arch-chroot /mnt` 19. `ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime` 20. `hwclock --systohc` 21. `echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen` 22. `echo 'KEYMAP=us' > /etc/vconsole.conf` 23. `echo 'hostname' > /etc/hostname` 24. `pacman -S sudo vim dhclient dhcpcd bash-completion btrfs-progs plymouth` - dhclient/dhcpcd provides dhcp for network - bash-completion provides tab complete - btrfs-progs provides fsck for btrfs - plymouth gives a nice bootloader screen 25. Edit /etc/mkinitcpio.conf and set up systemd/sd-encrypt /etc/mkinitcpio.conf ```conf HOOKS=(systemd plymouth autodetect modconf kms keyboard sd-vconsole block sd-encrypt filesystems fsck) ``` 26. `mkinitcpio -P` 27. Install systemd-boot ```bash bootctl install ``` If this raises an error like "efi partition not found" you probably forgot to format /mnt/boot as an EFI partition. Edit this by reformatting it with gdisk (ef00 is the hex code). 28. edit your loader.conf with some defaults /boot/loader/loader.conf ```conf default main.conf timeout 4 console-mode max editor no ``` 29. Create a loader (/usr/share/systemd/bootctl/arch.conf for example) /boot/loader/entries/main.conf ```conf title Arch Linux linux /vmlinuz-linux initrd /initramfs-linux.img options quiet splash rd.luks.name=d9828faa-2b8c-4184-9e74-9054ae328c6d=root root=/dev/mapper/root rootflags=subvol=root nvme.noacpi=1 acpi_osi="!Windows 2020" mem_sleep_default="deep" rw ``` You can get the UUID of the disk into arch.conf with some grepping. Use vim to cut the excess and copy it into the correct location. ```bash blkid | grep /dev/vda2 >> /boot/loader/entries/main.conf ``` 30. `useradd ducoterra` 31. `passwd ducoterra` 32. `groupadd sudo` 33. Edit /etc/sudoers and uncomment the section allowing sudo and wheel group privilege 34. `usermod -aG sudo ducoterra` 35. `usermod -aG wheel ducoterra` 36. `mkdir /home/ducoterra` 37. `chown ducoterra:ducoterra /home/ducoterra` 38. `locale-gen` 39. `systemctl enable dhcpcd` 40. If on VM install guest drivers: `pacman -S qemu-guest-agent spice-vdagent` 41. If you need ssh: `pacman -S openssh; systemctl enable sshd` 42. `exit` 43. `reboot` 44. Remove your installation medium and boot into arch 45. Add a pacman hook for systemd-boot updates /etc/pacman.d/hooks/95-systemd-boot.hook ```conf [Trigger] Type = Package Operation = Upgrade Target = systemd [Action] Description = Gracefully upgrading systemd-boot... When = PostTransaction Exec = /usr/bin/systemctl restart systemd-boot-update.service ``` ### AUR The AUR lets you install community-created and maintained packages. Here are the basics: ```bash pacman -S --needed git base-devel mkdir ~/aur # When you find a project, the basic installation looks like this: git clone cd makepkg -si ``` ### Security Every machine, regardless of use-case, should perform some basic hardening. You don't need to follow every instruction in the above wiki, but you should at least enable secure boot, tpm2 disk decryption, firewall, apparmor, clamav, btrfs snapshots, and btrfs backups. Security Philosophy 1. Secure Boot Protection from pre-boot malware that might hijack your EFI binary. 2. TPM2 Decryption Since we have secure boot enabled we can safely auto-decrypt our hard drive with a tpm2 device. This is purely a convenience. 3. Firewall This should be self-explanatory, but I'll explain anyway. Don't allow any arbitrary network traffic into your device. Block those ports. Only open what you need. Firewalls drastically reduce the risk of remote exploits by stopping them before they can even establish a connection. Firewalls can also be used to limit an attacker's ability to even discover you on a network with icmp blocking. 4. AppArmor AppArmor is a mandatory access control system like SELinux. Even if you don't configure it beyond its defaults, AppArmor is still a good thing to have available. Apps which come with an apparmor profile will offer you an additional layer of security. In the same way that a firewall protects you from remote attacks, AppArmor protects you from privilege escalation attacks and malicious binaries by blocking them at the source. 5. ClamAV Much like Windows has Windows Defender, Linux has ClamAV. Running an antivirus scanner certainly isn't the end-all-be-all of security, and it definitely isn't good enough on its own to keep your system safe, but in combination with apparmor and a firewall you can identify and quarantine malware before it has a chance to compromise your system. That being said, finding *any* malware on a system is reason enough to nuke it from orbit and restore from a known good backup. 6. BTRFS Snapshots This is not a backup, this is a snapshot. It serves an equally important function, however, in that it protects you from accidental deletion and corruption. Let's imagine you perform an update, reboot, and your computer crashes mid-startup. You could easily restore root from a btrfs snapshot on your system and go on with your day like nothing happened. 7. BTRFS Backups This is a backup. Unlike snapshots, which live on the same drive your system exists on, backups are physically separate copies of your computer stored (hopefully) in a physically separate location. In the event your computer is lost or stolen these backups give you a way to perfectly restore your system to its former glory. #### Secure Boot 1. Put your machine in setup mode On framework this is done in the UEFI setup page for Security, sub-page Secure Boot, choose “Erase all Secure Boot Settings.” On my Gigabyte motherboard this is done in the BIOS under security. Set secure boot to custom. 2. `pacman -S efitools sbctl` 3. `cd /root/` 4. `for var in PK KEK db dbx ; do efi-readvar -v $var -o old_${var}.esl ; done` 5. `sbctl create-keys` 6. `sbctl enroll-keys -m` 7. `sbctl status` 8. `sbctl verify` 9. `sbctl sign -s /boot/vmlinuz-linux` 10. `sbctl sign -s /boot/EFI/BOOT/BOOTX64.EFI` 11. `sbctl sign -s /boot/EFI/systemd/systemd-bootx64.efi` 12. `sbctl verify` 13. `reboot` 14. Enable secure boot 15. `sbctl status` to check secure boot 16. `bootctl` to check boot loader status There is a pacman hook which will automatically sign new binaries on update. #### TPM2 LUKS Decryption Using `--tpm2-pcrs=7` enforces secure boot and will require password if secure boot is disabled. 1. `pacman -S tpm2-tss` 2. `systemd-cryptenroll /dev/vda2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7` ##### Re-enroll ```bash systemd-cryptenroll /dev/nvme0n1p2 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 systemd-cryptenroll /dev/nvme0n1p3 --wipe-slot=tpm2 --tpm2-device=auto --tpm2-pcrs=7 ``` #### FIDO2 LUKS Decryption 1. `pacman -S libfido2` #### Firewall ```bash pacman -S ufw systemctl enable --now ufw ``` #### AppArmor ##### Install Apparmor Apparmor protects your system by limiting the access binaries have to specific files. All binaries which are protected by apparmor profiles have a whitelist of allowed paths they can touch, even if they run as root. 1. `pacman -S apparmor` 2. `systemctl enable --now apparmor` 3. `systemctl enable --now auditd` 4. Add the correct kernel parameters /boot/loaders/entries/main.conf ```conf title Arch Linux ... options ...lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1... ``` 5. `reboot` ##### Custom Profiles You will likely need to create custom profiles for your apps. There are a few ways to do this but the least painful ways are as follows: 1. A profile already exists in `/usr/share/apparmor/extra-profiles/` Check here first. More than likely there's a good starting point. This will probably need to be tuned but you can (and should) copy it to /etc/apparmor.d 2. No profile exists in `/usr/share/apparmor/extra-profiles/` You can use `aa-genprof ` to generate a profile for that binary and begin listening to log events. Then, launch the application and use it as intended. When you've done what you consider to be the typical use-case you should. 1. Press `s` until it begins recommending additions to your profile 2. Use (A) or (D) to add or deny paths 3. Use (G) to glob a path 4. Use (N) to write a custom path 5. If prompted for an executable choose (I) to inherit the execution privileges from the parent process or (P) to use this application's profile. Sanitize if you chooose this app's profile 6. When done, (F) to finish and (S) to save. 7. Use `apparmor_parser -r /etc/apparmor.d/` to reload the profile 8. Run `aa-enforce /etc/apparmor.d/` to set to enforce mode 9. Try to launch the app. It will probably crash 10. Run `aa-logprof`, add rules, `apparmor_parser -r /etc/apparmor.d/`, launch app, repeat until it works 11. You can `tail /var/log/audit/audit.log` and grab a string like `msg=audit(1692576444.967:102858)` to use as a starting point rather than parsing the whole log. Like: `aa-logprof -m 'msg=audit(1692576444.967:102858)'`. From ```text Access Modes File permission access modes consists of combinations of the following modes: r - read w - write -- conflicts with append a - append -- conflicts with write ux - unconfined execute Ux - unconfined execute -- scrub the environment px - discrete profile execute Px - discrete profile execute -- scrub the environment cx - transition to subprofile on execute Cx - transition to subprofile on execute -- scrub the environment ix - inherit execute pix - discrete profile execute with inherit fallback Pix - discrete profile execute with inherit fallback -- scrub the environment cix - transition to subprofile on execute with inherit fallback Cix - transition to subprofile on execute with inherit fallback -- scrub the environment pux - discrete profile execute with fallback to unconfined PUx - discrete profile execute with fallback to unconfined -- scrub the environment cux - transition to subprofile on execute with fallback to unconfined CUx - transition to subprofile on execute with fallback to unconfined -- scrub the environment deny x - disallow execute (in rules with the deny qualifier) m - allow PROT_EXEC with mmap(2) calls l - link k - lock ``` #### ClamAV 1. `pacman -S clamav` 2. `clamscan --recursive --infected /path/to/dir` - OR - 1. `freshclam` 2. `systemctl enable --now clamav-freshclam.service` 3. `systemctl enable --now clamav-daemon.service` 4. `clamdscan --multiscan --fdpass /home/ducoterra` ##### Config ```conf UpdateLogFile /var/log/clamav/freshclam.log PidFile /run/clamav/freshclam.pid DatabaseMirror database.clamav.net NotifyClamd /etc/clamav/clamd.conf ``` #### btrbk ```bash cd Downloads wget https://raw.githubusercontent.com/digint/btrbk/master/btrbk clamscan . chmod +x btrbk sudo mv btrbk /usr/bin/ ``` ##### fstab You'll need to mount your btrfs volumes in a location which exposes their subvolumes. ```bash mkdir -p /btr_pools/root ``` /etc/fstab ```conf # btr_pools UUID=84153269-f194-43f7-a4fe-e72aaffdb97a /btr_pools/root btrfs rw,relatime,ssd,space_cache=v2,subvolid=256,subvolid=5 0 0 ``` ```bash systemctl daemon-reload mount -a btrfs sub create /btr_pools/root/.snapshots btrbk -c /etc/btrbk/snapshots.conf dryrun btrbk -c /etc/btrbk/snapshots.conf run ``` ##### Snapshots 1. Create a snapshot config /etc/btrbk/snapshots.conf ```conf snapshot_preserve_min 24h snapshot_preserve 14d # root volume /btr_pools/root subvolume root snapshot_dir .snapshots # home volume /btr_pools/root subvolume home snapshot_dir .snapshots # libvirt volume /btr_pools/root subvolume libvirt snapshot_dir .snapshots # nextcloud volume /btr_pools/root subvolume nextcloud snapshot_dir .snapshots ``` 2. Then create a snapshot service /etc/systemd/system/btrbk_snapshots.service ```conf [Unit] Description=Runs btrbk with config file at /etc/btrbk/snapshots.conf [Service] ExecStart=/usr/bin/btrbk -c /etc/btrbk/snapshots.conf -v run ``` 3. Then create a timer for the service /etc/systemd/system/btrbk_snapshots.timer ```conf [Unit] Description=Run snapshots every hour [Timer] OnCalendar=hourly AccuracySec=10min Persistent=true Unit=btrbk_snapshots.service [Install] WantedBy=timers.target ``` 4. Then enable the service ```bash systemctl enable --now btrbk_snapshots.timer ``` ##### Backups Before you begin, go through the usual process of setting up an encrypted drive. If you're using Gnome I recommend using the GUI since it handles encrypted USB drives really nicely. The only thing I'd recommend doing manually is creating the mountpoint as a read-only subvolume. This prevents backups from being written to the root device when the backup disk isn't mounted. ```bash btrfs sub create /btr_pools/backup btrfs property set /btr_pools/backup ro true ``` 1. Create a backup config /etc/btrbk/backups.conf ```conf snapshot_create no target_preserve_min no target_preserve 30d # root volume /btr_pools/root target /btr_pools/backup subvolume root snapshot_dir .snapshots # home volume /btr_pools/root target /btr_pools/backup subvolume home snapshot_dir .snapshots # libvirt volume /btr_pools/root target /btr_pools/backup subvolume libvirt snapshot_dir .snapshots ``` 2. Create a backup service /etc/systemd/system/btrbk_backups.service ```conf [Unit] Description=Runs btrbk with config file at /etc/btrbk/backups.conf [Service] ExecStart=/usr/bin/btrbk -c /etc/btrbk/backups.conf -v run ``` 3. Create a timer to activate the service /etc/systemd/system/btrbk_backups.timer ```conf [Unit] Description=Run btrbk backups every hour [Timer] OnCalendar=hourly AccuracySec=10min Persistent=true Unit=btrbk_backups.service [Install] WantedBy=timers.target ``` 4. Enable the timer ```bash systemctl enable --now btrbk_backup.conf ``` ##### Backing up a snapshot ```bash pacman -S pv btrfs send /mnt/btr_backup/root.20230727T1000 | pv | btrfs receive /mnt/btr_iscsi ``` #### Chroots You can create chroot environments to run firejails or just use for testing purposes. 1. `btrfs sub create /chroots` 2. `mkdir /testing` 3. `pacman -S arch-install-scripts` 4. `pacstrap -K /chroots/testing/ base base-devel` 5. `arch-chroot /chroots/testing` #### Fingerprint Reader Support ##### Setup 1. `pacman -S fprintd` 2. `systemctl enable --now fprintd` 3. `fprintd-enroll ducoterra` 4. Enable fingerprint terminal login but prompt for password first (enter switches to prompt for fingerprint) /etc/pam.d/sudo ```conf # fingerprint auth auth sufficient pam_fprintd.so ``` ##### Turn Off Fingerprint When Laptop Lid Closed **NOTE: This may break fingerprint unlock. Testing in progress.** To disable fingerprint authentication when the laptop lid is closed, and re-enable when it is reopened, we will use acpid to bind to the button/lid.* event to a custom script that will comment out fprintd auth in /etc/pam.d/sudo. Usually we'd just `systemctl mask fprintd` but this breaks gdm (as of 08/06/23). See and . 1. `pacman -S acpid` and then `systemctl enable --now acpid` 2. Create file /etc/acpi/laptop-lid.sh with the following contents: ```bash #!/bin/bash if grep -Fq closed /proc/acpi/button/lid/LID0/state # && # This is used to detect if a display is connected. # For USB C displayport use: # grep -Fxq connected /sys/class/drm/card1-DP-2/status # For hdmi use: # grep -Fxq connected /sys/class/drm/card0-HDMI-A-1/status then # comment out fprintd sed -i -E 's/^([^#].*pam_fprintd.so)/#\1/g' /etc/pam.d/sudo else # uncomment fprintd sed -i -E 's/#(.*pam_fprintd.so)/\1/g' /etc/pam.d/sudo fi ``` 3. Make the file executable with `chmod +x /etc/acpi/laptop-lid.sh` 4. Create file /etc/acpi/events/laptop-lid with the following contents: ```bash event=button/lid.* action=/etc/acpi/laptop-lid.sh ``` 5. Restart the acpid service with: `systemctl restart acpid` Now the fingerprint will be used only when the lid is open. In order to ensure the correct state after suspend we need a service file which runs our script on wake. 1. Create a file named /etc/systemd/system/laptop-lid.service with the following contents: ```bash [Unit] Description=Laptop Lid After=suspend.target [Service] ExecStart=/etc/acpi/laptop-lid.sh [Install] WantedBy=multi-user.target WantedBy=suspend.target ``` 2. Reload the systemd config files with `sudo systemctl daemon-reload` 3. Start and enable the service with `sudo systemctl enable --now laptop-lid.service` Now the status should be correct even after connecting/disconnecting when the computer is off. ## Desktop Environment ### Gnome 1. `pacman -S gdm gnome` - choose pipewire-jack - choose wireplumber - choose noto-fonts-emoji 2. `systemctl enable --now gdm` 3. `pacman -S networkmanager` 4. `systemctl enable --now NetworkManager` 5. `pacman -S gnome-tweaks dconf-editor seahorse` ## Hardware Management ### Hardware Acceleration (This helps enable hardware encoding/decoding for steam streaming) Intel ```bash pacman -S libva-utils intel-media-driver vainfo ``` AMD ```bash pacman -S vulkan-radeon libva-utils libva-mesa-driver xf86-video-amdgpu vainfo ``` ### Power Management 1. For laptops install `tlp` ```bash pacman -S tlp tlp-rdw systemctl enable --now tlp systemctl mask systemd-rfkill.service systemctl mask systemd-rfkill.socket ``` 2. Then configure it with the following settings (optional) /etc/tlp.conf ```conf # I've seen some issues with usb autosuspend USB_AUTOSUSPEND=0 # Restore bluetooth/wifi state on reboot # Otherwise it defaults to on RESTORE_DEVICE_STATE_ON_STARTUP=1 # Disable wifi when plugged in # You might not want this for continuity - eg. you're copying a file to a network # share over wifi - plugging in will cancel the copy with this option enabled. DEVICES_TO_DISABLE_ON_LAN_CONNECT="wifi wwan" # Re-enable wifi when unplugged. DEVICES_TO_ENABLE_ON_LAN_DISCONNECT="wifi wwan" ``` 3. For desktops install cpupower ```bash pacman -S cpupower systemctl enable --now cpupower ``` Temporarily set power profile with `cpupower frequency-set -g performance` Edit /etc/default/cpupower ```conf governor='performance' ``` ### Don't sleep while plugged in This is needed for the Framework 13 (11th gen) since sleeping while plugged in to a dock will prevent it from waking up. /etc/systemd/logind.conf ```conf ... HandleLidSwitchExternalPower=lock HandleLidSwitchDocked=ignore ... ``` ### Bluetooth 1. `pacman -S bluez bluez-utils` 2. `systemctl enable --now bluetooth` ### Audio Without pipewire-pulse the audio level/device will reset every reboot. 1. `pacman -S pipewire-pulse` (remove conflicting packages) ### ISCSI ```bash pacman -S open-iscsi systemctl enable --now iscsid ``` 1. Add auth login /etc/iscsi/iscsid.conf ```conf node.session.auth.chap_algs = SHA3-256,SHA256,SHA1,MD5 node.session.auth.username = username node.session.auth.password = password ``` 2. Initiate and login to the portal ```bash # Add a new target to your list of nodes iscsiadm \ -m discovery \ -t st \ -p driveripper.reeselink.com # Login to the target iscsiadm \ -m node \ --targetname iqn.2023-01.driveripper.reeselink.com:backup-reese-pc \ -p driveripper.reeselink.com:3260 \ --login # or login to all targets iscsiadm -m node --loginall all # View current session iscsiadm -m session # Log out of all sessions iscsiadm -m node -u # Log out of a single session iscsiadm -m node -T iqn.2023-01.driveripper.reeselink.com:2024-01-framework --logout # Remove session iscsiadm -m node -o delete -T iqn.2023-01.driveripper.reeselink.com:2023-01-framework ``` ## Software Stores ### AppImage Support Also chmod +x before running. 1. `cp ~/Downloads/xxxxxxx.appimage ~/Applications` 2. Find an icon online and save it to ~/.icons 3. Write a .desktop entry at ~/.local/share/applications/ ```conf [Desktop Entry] Name= Exec=/home/ducoterra/Applications/ Icon=/home/ducoterra/.icons/ Type=Application ``` 4. `desktop-file-validate ~/.local/share/applications/*.desktop` 5. `update-desktop-database` #### Troubleshooting fuse may be required to run an appimage. ```bash sudo pacman -S fuse ``` ### Flatpak ```bash pacman -S flatpak ``` ## Apps ### Firefox You'll want firefox and gnome-browser-connector (for gnome extension management). ```bash pacman -S firefox gnome-browser-connector ``` Choose noto-fonts #### Gnome Extensions 1. AlphabeticalAppGrid@stuarthayhurst 2. Vitals@CoreCoding.com 3. dash-to-dock@micxgx.gmail.com 4. tactile@lundal.io ### Avahi (Bonjour) 1. `sudo pacman -S avahi` 2. `sudo vim /etc/nsswitch.conf` ```conf hosts: mymachines mdns [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns ``` 3. `sudo vim /etc/mdns.allow` ```conf .local. .local ``` ### CUPS Printing Note: you probably need avahi (see above) 1. `sudo pacman -S cups cups-pdf system-config-printer` 2. `sudo vim /etc/nsswitch.conf` ```conf hosts: mymachines mdns [NOTFOUND=return] resolve [!UNAVAIL=return] files myhostname dns ``` 3. `sudo systemctl start cups` 4. `sudo systemctl start avahi-daemon` ### Yubikey You'll need the yubikey manager appimage in addition to the pacman package ```bash sudo pacman -S yubikey-manager ``` Reboot and things should work. You might also have to start pcscd: ```bash sudo systemctl enable --now pcscd ``` ## Bashrc ### Colorized Prompt You can change the prompt color by setting PROMPT_COLOR at the top of your .bashrc Examples: Yellow: `PROMPT_COLOR=33;` Orange: `PROMPT_COLOR=38;5;208;` Red: `PROMPT_COLOR=38;5;160;` ### Standard Bashrc Don't do this if you installed `zsh` ~/.bashrc ```bash # .bashrc # Source global definitions if [ -f /etc/bashrc ]; then . /etc/bashrc fi # User specific binaries if ! [[ "$PATH" =~ "$HOME/.local/bin:$HOME/bin:" ]] then PATH="$HOME/.local/bin:$HOME/bin:$PATH" fi export PATH # User specific aliases and functions (source .bashrc.d/) if [ -d ~/.bashrc.d ]; then for rc in ~/.bashrc.d/*; do if [ -f "$rc" ]; then . "$rc" fi done fi # clear var used in for loop unset rc ``` ~/.bashrc.d/aliases.sh ```bash # (Mostly) Taken from https://www.cyberciti.biz/tips/bash-aliases-mac-centos-linux-unix.html # Author: Vivek Gite ## Colorize the ls output ## alias ls="ls --color=auto" ## Colorize the grep command output for ease of use (good for log files)## alias grep='grep --color=auto' alias egrep='egrep --color=auto' alias fgrep='fgrep --color=auto' ## Make mount human readable ## alias mount='mount |column -t' ## show open ports ## alias ports='ss -tulanp' # do not delete / or prompt if deleting more than 3 files at a time # alias rm='rm -I --preserve-root' # confirmation # alias mv='mv -i' alias cp='cp -i' alias ln='ln -i' # Parenting changing perms on / # alias chown='chown --preserve-root' alias chmod='chmod --preserve-root' alias chgrp='chgrp --preserve-root' ## pass options to free ## alias meminfo='free -m -l -t' ## get top process eating memory alias psmem='ps auxf | sort -nr -k 4' alias psmem10='ps auxf | sort -nr -k 4 | head -10' ## get top process eating cpu ## alias pscpu='ps auxf | sort -nr -k 3' alias pscpu10='ps auxf | sort -nr -k 3 | head -10' ## this one saved by butt so many times ## alias wget='wget -c' ## set some other defaults ## alias df='df -H' alias du='du -ch' ## ls but with file sizes, showing largest at the bottom ## alias lst='ls --human-readable --size -1 -S --classify -r' ## ls show only directories alias lsd='ls -d */' ## Count the number of files in a directory alias lsc='find . -type f | wc -l' ## ls sort by last modified ## alias lmt='ls -t -1' ```