Compare commits

...

4 commits

4 changed files with 25 additions and 24 deletions

View file

@ -214,7 +214,7 @@ PORTAGE_LOGDIR_CLEAN="find \"\${PORTAGE_LOGDIR}\" -type f ! -name \"summary.log*
ACCEPT_LICENSE="-* @FREE" ACCEPT_LICENSE="-* @FREE"
# USE flags # USE flags
USE="${USE} -debug -telemetry -modemmanager -ext* -ppp -systemd -elogind -X -kde -gnome -gtk-doc -webengine hardened dist-kernel udev initramfs hostonly secureboot modules-sign apparmor acpi networkmanager dbus hwaccel bash-completion man pam pipewire vulkan wayland jpeg png svg" #(2)! USE="${USE} -debug -telemetry -modemmanager -ext* -ppp -systemd -elogind -X -kde -gnome -gtk-doc -webengine hardened dist-kernel udev initramfs hostonly secureboot modules-sign apparmor acpi networkmanager dbus hwaccel bash-completion man pam pipewire vulkan wayland eme-free jpeg png svg" #(2)!
# Emerge flags # Emerge flags
EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --with-bdeps y --quiet-build y" EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --with-bdeps y --quiet-build y"
@ -242,8 +242,8 @@ Configure some key aspects of the system:
``` shell-session ``` shell-session
sh# echo <hostname> > /etc/hostname sh# echo <hostname> > /etc/hostname
sh# echo TZ="/usr/share/zoneinfo/<region>/<city>" > /etc/env.d/timezone sh# echo TZ="/usr/share/zoneinfo/<Region>/<City>" > /etc/env.d/00tz
sh# echo MUSL_LOCPATH="/usr/share/i18n/locales/musl" > /etc/env.d/musl_locales #(1)! sh# echo MUSL_LOCPATH="/usr/share/i18n/locales/musl" > /etc/env.d/01locales #(1)!
sh# env-update && source /etc/profile sh# env-update && source /etc/profile
sh# eselect locale set <locale> #(2)! sh# eselect locale set <locale> #(2)!
sh# rc-update add ntpd default sh# rc-update add ntpd default
@ -599,4 +599,4 @@ For users to be able to modify connections on the system they will have to be ad
## Concluding remarks ## Concluding remarks
This is the bare minimum for a Gentoo Linux desktop system. Some additional features such as bluetooth, laptop battery management, printer compatiblity, et cetera, have been documented well in the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Main_Page), and can thus be found there. The next steps are the improvement of the security of the system and the configuration of the graphical session. This is the bare minimum for a Gentoo Linux desktop system. Some additional features such as bluetooth, laptop battery management, printer compatiblity, et cetera, have been documented well in the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Main_Page), and can thus be found there. The next steps are the improvement of the security of the system and the configuration of the graphical session.

View file

@ -154,7 +154,7 @@ sh# zfs create -o mountpoint=/home -o atime=off -o setuid=off -o devices=off -o
Write the encryption key to TPM with `zlevis`: Write the encryption key to TPM with `zlevis`:
``` shell-session ``` shell-session
sh# zlevis encrypt rpool '{"pcr_ids":"0,1,7"}' < /tmp/rpool.key #(1)! sh# zlevis encrypt rpool '{"pcr_ids":"0,5,7"}' < /tmp/rpool.key #(1)!
``` ```
1. See [zlevis functionality](https://docs.ampel.dev/zlevis/functionality/) to see the functionality of each `pcr_id`, and the other options that can be set. 1. See [zlevis functionality](https://docs.ampel.dev/zlevis/functionality/) to see the functionality of each `pcr_id`, and the other options that can be set.
@ -393,25 +393,26 @@ To configure Swap install `zram-init`:
sh# apk add zram-init sh# apk add zram-init
``` ```
and add it to the default runlevel: Configure `zram-init` to create a swap device of size one fourth of the ram size:
``` shell title="/etc/conf.d/zram-init"
load_on_start="yes"
unload_on_stop="yes"
num_devices="1"
type0="swap"
size0=`LC_ALL=C free -m | awk '/^mem:/{print int($2/4)}'`
maxs0=1
algo0=zstd
labl0=zram_swap
```
and add `zram-init` to the default runlevel:
``` shell-session ``` shell-session
sh# rc-update add zram-init default sh# rc-update add zram-init default
``` ```
Configure `zram-init` by editing:
``` shell title="/etc/conf.d/zram-init"
num_devices=<n>
# swap - 500M
#size0=512
size0=`LC_ALL=C free -m | awk '/^mem:/{print int($2/4)}'`
```
Now the size of the swap device will be one fourth of the ram size.
### Users ### Users
To run applications securely, in an environment with fewer privileges, a user is necessary. To run applications securely, in an environment with fewer privileges, a user is necessary.
@ -455,4 +456,4 @@ root:x:0:0:root:/root:/sbin/nologin
## Concluding remarks ## Concluding remarks
This is essentially it, you now have a fully operational alpine base system running, configured for server use. The next steps are the improvement of the security of the system and the configuration of the container management software. This is essentially it, you now have a fully operational alpine base system running, configured for server use. The next steps are the improvement of the security of the system and the configuration of the container management software.

View file

@ -104,7 +104,7 @@ sh$ podman run --rm hello-world
To run a single container create: To run a single container create:
``` shell title="~/.config/sv/<container-name>/run" ``` shell title="~/.config/sv/{container-name}/run"
#!/bin/sh #!/bin/sh
command="/usr/bin/podman" command="/usr/bin/podman"
@ -360,4 +360,4 @@ Make it executable and link it to the service directory:
``` shell-session ``` shell-session
sh$ chmod +x ~/.config/sv/caddy/run sh$ chmod +x ~/.config/sv/caddy/run
sh$ ln -s <home>/.config/sv/caddy <home>/.local/service sh$ ln -s <home>/.config/sv/caddy <home>/.local/service
``` ```

View file

@ -1,6 +1,6 @@
site_name: Ampel Blog site_name: Ampel Blog
site_url: https://blog.ampel.dev site_url: https://blog.ampel.dev
copyright: This work is dedicated to the public domain under the Creative Commons CC0 public domain dedication. copyright: "\copyright 2022-2025 Ampel Authors: This work is licensed under the CC-BY-NC-SA-4.0 license"
repo_name: ampel/blog repo_name: ampel/blog
repo_url: https://git.ampel.dev/ampel/blog repo_url: https://git.ampel.dev/ampel/blog
@ -69,4 +69,4 @@ nav:
- 'Desktop OS': - 'Desktop OS':
- desktop-os/index.md - desktop-os/index.md
- 'Server OS': - 'Server OS':
- server-os/index.md - server-os/index.md