feat(server): carry shron's own configuration into the role file

Task 7 as planned would have checked out over shron and reviewed what was lost
afterwards. That is the wrong order for a machine whose .zshrc holds working
operational tooling: ipt-block, a CrowdSec whitelist helper, reboot_required,
the German locale and dircolors would all have been gone between the checkout
and the review.

Also found: shron runs ZSH_THEME="ys" and has no powerlevel10k. The theme
selection would have fallen through to oh-my-zsh's default, which is a
regression nobody asked for, so 05-pre-omz.zsh keeps ys where p10k is absent.
The red role colour is still set, but it is honest to say it does nothing there
until p10k is installed - the safeguard the role split was built around does
not currently apply to the one machine it was meant for.

05-prompt.zsh becomes 05-pre-omz.zsh: the theme was never the only thing that
has to precede oh-my-zsh. DISABLE_AUTO_UPDATE belongs there too - a server
should not go fetching updates on its own while somebody is logged in fixing
something - and the stub no longer sets the update mode itself.

update-blacklist is carried over with a note rather than silently: openbl.org
answers 301 and the curl call has no -L, so it has been reporting "Blacklist
download failed" for some time. CrowdSec covers that ground now, but the
iptables chain it created may still exist and is worth removing deliberately.

PYTHONPATH pointed at python3.4 on shron and at 3.9 on beastix. Neither
directory exists; neither is carried over.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.config/zsh/rc.d/05-pre-omz.zsh

@@ -0,0 +1,30 @@
+# Everything that has to be set before oh-my-zsh is sourced, and nothing else.
+#
+# oh-my-zsh reads the theme and its own settings while being sourced, so any of
+# these placed in a role file - which comes afterwards - is silently ignored.
+# The first attempt put ZSH_THEME in the role file and produced a shell that
+# reported the right value while running without powerlevel10k at all.
+#
+# The role COLOUR is deliberately NOT here. ~/.p10k.zsh assigns
+# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced later from
+# 30-path.zsh, so a colour set here is overwritten before the first prompt is
+# drawn. It belongs in the role files, which run after that.
+
+if [[ -d "${ZSH_CUSTOM:-$ZSH/custom}/themes/powerlevel10k" ]]; then
+  ZSH_THEME="powerlevel10k/powerlevel10k"
+elif [[ "$ROLE" == "server" ]]; then
+  # What shron already used. Without this it would silently fall back to
+  # oh-my-zsh's default, which is a change nobody asked for.
+  ZSH_THEME="ys"
+fi
+
+case "$ROLE" in
+  server)
+    # A server should not decide on its own to go fetching updates while
+    # someone is logged in trying to fix something.
+    DISABLE_AUTO_UPDATE="true"
+    ;;
+  *)
+    zstyle ':omz:update' mode auto
+    ;;
+esac

.config/zsh/rc.d/05-prompt.zsh

@@ -1,15 +0,0 @@
-# Theme selection. Sourced by the stub BEFORE oh-my-zsh, and that placement is
-# the point of the file.
-#
-# oh-my-zsh loads the theme while it is being sourced, so ZSH_THEME set
-# afterwards is ignored - the first attempt put it in the role file and produced
-# a shell reporting the right value while running without powerlevel10k at all.
-#
-# The role COLOUR is deliberately not here. ~/.p10k.zsh sets
-# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced later, so a colour set
-# here is overwritten before the first prompt is ever drawn. It lives in the
-# role files, which come after.
-
-if [[ -d "${ZSH_CUSTOM:-$ZSH/custom}/themes/powerlevel10k" ]]; then
-  ZSH_THEME="powerlevel10k/powerlevel10k"
-fi

.config/zsh/rc.d/50-server.zsh

@@ -1,15 +1,100 @@
-# Role: server (shron - Arch, headless)
+# Role: server (shron - Arch, headless, mail/web/cloud)
 #
-# Deliberately thin. A server shell wants to be recognisable and otherwise get
+# The theme and DISABLE_AUTO_UPDATE are in 05-pre-omz.zsh, because oh-my-zsh
-# out of the way; anything that assumes a graphical session belongs in
+# reads them while it is being sourced.
-# 50-desktop.zsh.
 
-# Role colour, set here rather than in 05-prompt.zsh because ~/.p10k.zsh
+# Role colour, set here rather than earlier because ~/.p10k.zsh assigns
-# assigns POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced in 30-path.zsh.
+# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced in 30-path.zsh.
-# Anything set before that is silently replaced. Not decoration: shron carries
+#
-# mail, web and cloud, and a glance should say which machine this is.
+# Note that this only takes effect where powerlevel10k is installed, and on
+# shron it is not - the ys theme has no equivalent. The colour is kept anyway
+# so it works the moment p10k arrives, but the red prompt cannot be relied on
+# as a safeguard there today.
 typeset -g POWERLEVEL9K_CONTEXT_BACKGROUND=red
-# Show the host even in a local shell. Noise on a desktop; here it is the one
-# thing worth always having in view.
 typeset -g POWERLEVEL9K_ALWAYS_SHOW_CONTEXT=true
 
+# German locale. The base does not set one, since the desktop inherits it from
+# the session and the Mac has its own; an SSH session brings only what the
+# client sends, which is usually nothing useful.
+export LANG=de_DE.UTF-8
+export LANGUAGE=de_DE.UTF-8
+export LC_MESSAGES=de_DE.UTF-8
+export LC_ALL=de_DE.UTF-8
+
+# vim rather than the base's nvim. Both are installed here; this is the
+# existing preference and there is no reason to change it from a distance.
+alias vi="vim"
+
+# Colours for ls, from a file that only exists on this machine.
+[[ -f "$HOME/.dircolors" ]] && eval "$(dircolors "$HOME/.dircolors")"
+
+# Block a single address permanently.
+ipt-block() {
+  sudo iptables -A INPUT -s "$1" -j DROP
+  echo "permblocked $1"
+}
+
+# Lift a CrowdSec ban and whitelist the address for a while. The message says
+# one hour, the command says twelve - left as it was rather than guessing which
+# one was meant.
+whitelist() {
+    if [[ -z "$1" ]]; then
+        echo "Bitte geben Sie eine IP-Adresse an."
+        return 1
+    fi
+
+    local ip="$1"
+    sudo cscli decisions delete --ip "$ip"
+    sudo cscli decisions add --ip "$ip" --duration 12h --type whitelist --reason "Manuell whitelisted"
+    echo "IP $ip wurde für 1 Stunde whitelisted und entbannt."
+}
+
+# Is the running kernel still the installed one?
+reboot_required() {
+  local installed running
+  installed=$(pacman -Q linux-lts | sed 's/linux-lts //')
+  running=$(uname -r | sed 's/-lts//')
+
+  if [[ "$installed" == "$running" ]]; then
+    echo "no reboot required."
+  else
+    echo "reboot required!"
+  fi
+}
+
+# Pull the OpenBL list into an iptables chain.
+#
+# Carried over unchanged, but it does not work: www.openbl.org answers 301 and
+# the curl call has no -L, so the download returns nothing and the function
+# reports "Blacklist download failed" every time. Kept rather than deleted
+# because the iptables chain it manages may still exist and be worth cleaning
+# up deliberately - CrowdSec covers this ground now.
+update-blacklist() {
+  local CHAINLIST BLACKLIST IPCOUNT
+  CHAINLIST=$(sudo /sbin/iptables -nL | grep 'Chain block-traffic-from-openbl' | cut -d' ' -f 2)
+
+  if [ -z "$CHAINLIST" ]; then
+    sudo /sbin/iptables -N block-traffic-from-openbl
+    sudo /sbin/iptables -A INPUT -j block-traffic-from-openbl
+  fi
+
+  BLACKLIST=$(/usr/bin/curl -fs http://www.openbl.org/lists/base_7days.txt.gz | gunzip | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}")
+
+  if [ -z "$BLACKLIST" ]; then
+    echo "Blacklist download failed."
+    return 1
+  fi
+
+  sudo /sbin/iptables -F block-traffic-from-openbl
+  IPCOUNT=$(echo "$BLACKLIST" | tr ' ' '\n' | wc -l)
+  echo "Adding $IPCOUNT IPs to blacklist. - $(date)"
+
+  echo "$BLACKLIST" | tr ' ' '\n' | while read -r line ; do
+    case "$line" in \#*) continue ;; esac
+    sudo /sbin/iptables -A block-traffic-from-openbl -p tcp -s "$line" -j REJECT --reject-with tcp-reset
+  done
+}
+
+# The previous configuration exported PYTHONPATH=/usr/lib/python3.4/site-packages.
+# Python 3.4 has not shipped with Arch for years and the directory is gone, so
+# it is not carried over. beastix had the same line pointing at 3.9.

.zshrc

@@ -41,12 +41,10 @@ for _p in $_want_plugins; do
 done
 unset _p _want_plugins
 
-zstyle ':omz:update' mode auto
+# Theme and oh-my-zsh's own settings, which it reads while being sourced.
-
+# Anything of that kind placed in a role file - which comes afterwards - is
-# Also before oh-my-zsh: it loads the theme while sourcing, and powerlevel10k
+# silently ignored, so it lives here instead.
-# reads its settings when it loads. Putting either in the role file - which is
+[[ -r "$HOME/.config/zsh/rc.d/05-pre-omz.zsh" ]] && source "$HOME/.config/zsh/rc.d/05-pre-omz.zsh"
-# sourced afterwards - leaves the value set and the theme unloaded.
-[[ -r "$HOME/.config/zsh/rc.d/05-prompt.zsh" ]] && source "$HOME/.config/zsh/rc.d/05-prompt.zsh"
 
 source "$ZSH/oh-my-zsh.sh"