karim
faaba27ed4
- core/display.py: write_positions() persists Arrangement's drag-and-drop
layout into niri's config.kdl (one output { position x= y= } per output),
validated via `niri validate` on a temp copy with a .kdl.bak backup before
writing — same pattern as core/keybindings.py's rebind(). Previously the
page only ever called `niri msg output … position set`, which niri treats
as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
output … position set` synchronously instead of queuing them all on the
single-shot ProcessRunner (which rejects a second run() while the first is
still async) — a 2-monitor apply previously moved only the first output
and silently dropped the rest. _dock_to_nearest keeps the free axis at the
dragged position (so a shorter display can sit vertically centered next to
a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).
96 lines
4.6 KiB
Bash
Executable File
96 lines
4.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# One-time setup of the dedicated "tanin-build" account for the daily [tanin]
|
|
# AUR rebuild, so the root-equivalent makechrootpkg/arch-nspawn/mkarchroot
|
|
# sudo grant (tanin-aur-update.sudoers) lives on a locked system account
|
|
# instead of the maintainer's own login ("karim"). Run as root (or via sudo)
|
|
# on the machine that will run tanin-aur-update.timer.
|
|
#
|
|
# sudo ./setup-build-user.sh
|
|
#
|
|
# What it does:
|
|
# 1) create the tanin-build system user, home /var/lib/tanin-build, locked
|
|
# password (no interactive/SSH login — only systemd + sudo can act as it)
|
|
# 2) clone/sync this checkout's packaging scripts into ~tanin-build/taninux,
|
|
# because the systemd unit's %h paths resolve against tanin-build's home,
|
|
# not /home/karim
|
|
# 3) prepare ~tanin-build/.gnupg (mode 700) for the packager signing key
|
|
# 4) install the sudoers drop-in + systemd unit/timer
|
|
#
|
|
# What it deliberately does NOT do:
|
|
# - generate or import the signing key (packaging/gen-signing-key.sh is a
|
|
# separate, explicit step — key material shouldn't be created as a side
|
|
# effect of account provisioning)
|
|
# - enable/start the timer (review Environment=GPGKEY=... in the unit first)
|
|
set -euo pipefail
|
|
|
|
[ "$(id -u)" -eq 0 ] || { echo "!! run as root (sudo ./setup-build-user.sh)" >&2; exit 1; }
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)" # .../packaging/systemd
|
|
ROOT="$(cd "$HERE/../.." && pwd)" # taninux checkout root
|
|
BUILD_USER="tanin-build"
|
|
BUILD_HOME="/var/lib/tanin-build"
|
|
|
|
echo "==> user: $BUILD_USER (system account, home=$BUILD_HOME)"
|
|
if ! id "$BUILD_USER" >/dev/null 2>&1; then
|
|
useradd --system --create-home --home-dir "$BUILD_HOME" \
|
|
--shell /usr/bin/bash "$BUILD_USER"
|
|
passwd --lock "$BUILD_USER" # no password login — only sudo (via the
|
|
# NOPASSWD drop-in) and systemd User= can act as it
|
|
else
|
|
echo " already exists — skipping useradd"
|
|
fi
|
|
|
|
echo "==> syncing packaging scripts to $BUILD_HOME/taninux"
|
|
# The systemd unit uses %h-relative paths (ExecStart=%h/taninux/packaging/...),
|
|
# which resolve against tanin-build's home — so a copy of the checkout (or at
|
|
# least packaging/) has to live there too, owned by tanin-build, not karim.
|
|
install -d -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/taninux"
|
|
rsync -a --delete \
|
|
--exclude '.git' --exclude 'iso/out' --exclude 'iso/build-profile' \
|
|
"$ROOT/" "$BUILD_HOME/taninux/"
|
|
chown -R "$BUILD_USER:$BUILD_USER" "$BUILD_HOME/taninux"
|
|
echo " NOTE: re-run this script (or your own sync) after pulling changes —"
|
|
echo " it is a one-shot copy, not a live checkout."
|
|
|
|
echo "==> GPG homedir for the packager key"
|
|
install -d -m700 -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/.gnupg"
|
|
cat <<EOT
|
|
$BUILD_HOME/.gnupg is ready but EMPTY. The packager secret key created by
|
|
packaging/gen-signing-key.sh must be imported here before the daily
|
|
rebuild can sign anything, e.g. (as $BUILD_USER):
|
|
sudo -u $BUILD_USER gpg --homedir $BUILD_HOME/.gnupg --import packager-secret.asc
|
|
Trust implication: whoever can read $BUILD_HOME/.gnupg's secring can sign
|
|
packages as TANINUX — keep its permissions at 700/600 and don't put it on
|
|
a shared or less-trusted host than the maintainer's own signing machine.
|
|
EOT
|
|
|
|
echo "==> makepkg env"
|
|
install -d -m755 -o "$BUILD_USER" -g "$BUILD_USER" "$BUILD_HOME/.cache" "$BUILD_HOME/.config"
|
|
|
|
echo "==> installing sudoers drop-in"
|
|
install -m440 "$HERE/tanin-aur-update.sudoers" /etc/sudoers.d/tanin-aur-update
|
|
visudo -cf /etc/sudoers.d/tanin-aur-update
|
|
|
|
echo "==> installing systemd unit + timer (SYSTEM units — the .service sets"
|
|
echo " User=/Group=$BUILD_USER itself, so it must run under the system"
|
|
echo " manager, not --user; that's also what makes the sudo NOPASSWD"
|
|
echo " grant for tanin-build actually apply)"
|
|
install -m644 "$HERE/tanin-aur-update.service" /etc/systemd/system/
|
|
install -m644 "$HERE/tanin-aur-update.timer" /etc/systemd/system/
|
|
systemctl daemon-reload
|
|
|
|
cat <<EOT
|
|
|
|
== setup done ==
|
|
Still TODO before the timer can run for real:
|
|
1) packaging/gen-signing-key.sh (if not already done), then import the
|
|
secret key into $BUILD_HOME/.gnupg as shown above.
|
|
2) sudo systemctl edit tanin-aur-update.service
|
|
and set Environment=GPGKEY=<fingerprint> (or uncomment it in
|
|
/etc/systemd/system/tanin-aur-update.service directly).
|
|
3) sudo -u $BUILD_USER $BUILD_HOME/taninux/packaging/aur-autoupdate.sh setup
|
|
(one-time: installs devtools + creates the makechrootpkg chroot —
|
|
needs the sudo grant just installed, so run this AFTER step 4 too)
|
|
4) sudo systemctl enable --now tanin-aur-update.timer
|
|
EOT
|