thomas.koppandClaude Opus 5
39f9d11200
p10k is now installed on shron, so the red prompt the role split was built around finally applies to the machine it was meant for. Cloned into $ZSH_CUSTOM/themes rather than installed as a package: no root, nothing outside the user's home, and undone by deleting a directory. Without a configuration p10k runs its setup wizard on the first interactive shell. Over SSH that is a login that sits there waiting for an answer, so the server gets a written configuration and the wizard is disabled outright. It is not a copy of beastix's. That one assumes a Nerd Font and a wide terminal; a server is reached from whatever is at hand, so this uses ASCII, one line, and a short segment list. user@host is always shown, on red - which is the whole point. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
100 lines
3.7 KiB
Bash
100 lines
3.7 KiB
Bash
# Role: server (shron - Arch, headless, mail/web/cloud)
|
|
#
|
|
# The theme and DISABLE_AUTO_UPDATE are in 05-pre-omz.zsh, because oh-my-zsh
|
|
# reads them while it is being sourced.
|
|
|
|
# The prompt, in a file of its own because there is more to it than a colour.
|
|
# Sourced here rather than earlier: this is the point at which oh-my-zsh has
|
|
# loaded powerlevel10k, which is where p10k expects its configuration.
|
|
#
|
|
# beastix keeps its own ~/.p10k.zsh, sourced from 30-path.zsh. This one is
|
|
# separate because a server is reached from whatever terminal is at hand and
|
|
# cannot assume the desktop's Nerd Font.
|
|
[[ -r "$HOME/.config/zsh/p10k-server.zsh" ]] && source "$HOME/.config/zsh/p10k-server.zsh"
|
|
|
|
# German locale. The base does not set one, since the desktop inherits it from
|
|
# the session and the Mac has its own; an SSH session brings only what the
|
|
# client sends, which is usually nothing useful.
|
|
export LANG=de_DE.UTF-8
|
|
export LANGUAGE=de_DE.UTF-8
|
|
export LC_MESSAGES=de_DE.UTF-8
|
|
export LC_ALL=de_DE.UTF-8
|
|
|
|
# vim rather than the base's nvim. Both are installed here; this is the
|
|
# existing preference and there is no reason to change it from a distance.
|
|
alias vi="vim"
|
|
|
|
# Colours for ls, from a file that only exists on this machine.
|
|
[[ -f "$HOME/.dircolors" ]] && eval "$(dircolors "$HOME/.dircolors")"
|
|
|
|
# Block a single address permanently.
|
|
ipt-block() {
|
|
sudo iptables -A INPUT -s "$1" -j DROP
|
|
echo "permblocked $1"
|
|
}
|
|
|
|
# Lift a CrowdSec ban and whitelist the address for a while. The message says
|
|
# one hour, the command says twelve - left as it was rather than guessing which
|
|
# one was meant.
|
|
whitelist() {
|
|
if [[ -z "$1" ]]; then
|
|
echo "Bitte geben Sie eine IP-Adresse an."
|
|
return 1
|
|
fi
|
|
|
|
local ip="$1"
|
|
sudo cscli decisions delete --ip "$ip"
|
|
sudo cscli decisions add --ip "$ip" --duration 12h --type whitelist --reason "Manuell whitelisted"
|
|
echo "IP $ip wurde für 1 Stunde whitelisted und entbannt."
|
|
}
|
|
|
|
# Is the running kernel still the installed one?
|
|
reboot_required() {
|
|
local installed running
|
|
installed=$(pacman -Q linux-lts | sed 's/linux-lts //')
|
|
running=$(uname -r | sed 's/-lts//')
|
|
|
|
if [[ "$installed" == "$running" ]]; then
|
|
echo "no reboot required."
|
|
else
|
|
echo "reboot required!"
|
|
fi
|
|
}
|
|
|
|
# Pull the OpenBL list into an iptables chain.
|
|
#
|
|
# Carried over unchanged, but it does not work: www.openbl.org answers 301 and
|
|
# the curl call has no -L, so the download returns nothing and the function
|
|
# reports "Blacklist download failed" every time. Kept rather than deleted
|
|
# because the iptables chain it manages may still exist and be worth cleaning
|
|
# up deliberately - CrowdSec covers this ground now.
|
|
update-blacklist() {
|
|
local CHAINLIST BLACKLIST IPCOUNT
|
|
CHAINLIST=$(sudo /sbin/iptables -nL | grep 'Chain block-traffic-from-openbl' | cut -d' ' -f 2)
|
|
|
|
if [ -z "$CHAINLIST" ]; then
|
|
sudo /sbin/iptables -N block-traffic-from-openbl
|
|
sudo /sbin/iptables -A INPUT -j block-traffic-from-openbl
|
|
fi
|
|
|
|
BLACKLIST=$(/usr/bin/curl -fs http://www.openbl.org/lists/base_7days.txt.gz | gunzip | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}")
|
|
|
|
if [ -z "$BLACKLIST" ]; then
|
|
echo "Blacklist download failed."
|
|
return 1
|
|
fi
|
|
|
|
sudo /sbin/iptables -F block-traffic-from-openbl
|
|
IPCOUNT=$(echo "$BLACKLIST" | tr ' ' '\n' | wc -l)
|
|
echo "Adding $IPCOUNT IPs to blacklist. - $(date)"
|
|
|
|
echo "$BLACKLIST" | tr ' ' '\n' | while read -r line ; do
|
|
case "$line" in \#*) continue ;; esac
|
|
sudo /sbin/iptables -A block-traffic-from-openbl -p tcp -s "$line" -j REJECT --reject-with tcp-reset
|
|
done
|
|
}
|
|
|
|
# The previous configuration exported PYTHONPATH=/usr/lib/python3.4/site-packages.
|
|
# Python 3.4 has not shipped with Arch for years and the directory is gone, so
|
|
# it is not carried over. beastix had the same line pointing at 3.9.
|