Compare commits
4 commits
4bebbdf203
...
7cb603a415
Author | SHA1 | Date | |
---|---|---|---|
7cb603a415 | |||
e063a86dff | |||
3871127f43 | |||
090e412f5b |
4 changed files with 25 additions and 24 deletions
|
@ -214,7 +214,7 @@ PORTAGE_LOGDIR_CLEAN="find \"\${PORTAGE_LOGDIR}\" -type f ! -name \"summary.log*
|
||||||
ACCEPT_LICENSE="-* @FREE"
|
ACCEPT_LICENSE="-* @FREE"
|
||||||
|
|
||||||
# USE flags
|
# USE flags
|
||||||
USE="${USE} -debug -telemetry -modemmanager -ext* -ppp -systemd -elogind -X -kde -gnome -gtk-doc -webengine hardened dist-kernel udev initramfs hostonly secureboot modules-sign apparmor acpi networkmanager dbus hwaccel bash-completion man pam pipewire vulkan wayland jpeg png svg" #(2)!
|
USE="${USE} -debug -telemetry -modemmanager -ext* -ppp -systemd -elogind -X -kde -gnome -gtk-doc -webengine hardened dist-kernel udev initramfs hostonly secureboot modules-sign apparmor acpi networkmanager dbus hwaccel bash-completion man pam pipewire vulkan wayland eme-free jpeg png svg" #(2)!
|
||||||
|
|
||||||
# Emerge flags
|
# Emerge flags
|
||||||
EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --with-bdeps y --quiet-build y"
|
EMERGE_DEFAULT_OPTS="${EMERGE_DEFAULT_OPTS} --with-bdeps y --quiet-build y"
|
||||||
|
@ -242,8 +242,8 @@ Configure some key aspects of the system:
|
||||||
|
|
||||||
``` shell-session
|
``` shell-session
|
||||||
sh# echo <hostname> > /etc/hostname
|
sh# echo <hostname> > /etc/hostname
|
||||||
sh# echo TZ="/usr/share/zoneinfo/<region>/<city>" > /etc/env.d/timezone
|
sh# echo TZ="/usr/share/zoneinfo/<Region>/<City>" > /etc/env.d/00tz
|
||||||
sh# echo MUSL_LOCPATH="/usr/share/i18n/locales/musl" > /etc/env.d/musl_locales #(1)!
|
sh# echo MUSL_LOCPATH="/usr/share/i18n/locales/musl" > /etc/env.d/01locales #(1)!
|
||||||
sh# env-update && source /etc/profile
|
sh# env-update && source /etc/profile
|
||||||
sh# eselect locale set <locale> #(2)!
|
sh# eselect locale set <locale> #(2)!
|
||||||
sh# rc-update add ntpd default
|
sh# rc-update add ntpd default
|
||||||
|
@ -599,4 +599,4 @@ For users to be able to modify connections on the system they will have to be ad
|
||||||
|
|
||||||
## Concluding remarks
|
## Concluding remarks
|
||||||
|
|
||||||
This is the bare minimum for a Gentoo Linux desktop system. Some additional features such as bluetooth, laptop battery management, printer compatiblity, et cetera, have been documented well in the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Main_Page), and can thus be found there. The next steps are the improvement of the security of the system and the configuration of the graphical session.
|
This is the bare minimum for a Gentoo Linux desktop system. Some additional features such as bluetooth, laptop battery management, printer compatiblity, et cetera, have been documented well in the [Gentoo Wiki](https://wiki.gentoo.org/wiki/Main_Page), and can thus be found there. The next steps are the improvement of the security of the system and the configuration of the graphical session.
|
||||||
|
|
|
@ -154,7 +154,7 @@ sh# zfs create -o mountpoint=/home -o atime=off -o setuid=off -o devices=off -o
|
||||||
Write the encryption key to TPM with `zlevis`:
|
Write the encryption key to TPM with `zlevis`:
|
||||||
|
|
||||||
``` shell-session
|
``` shell-session
|
||||||
sh# zlevis encrypt rpool '{"pcr_ids":"0,1,7"}' < /tmp/rpool.key #(1)!
|
sh# zlevis encrypt rpool '{"pcr_ids":"0,5,7"}' < /tmp/rpool.key #(1)!
|
||||||
```
|
```
|
||||||
|
|
||||||
1. See [zlevis functionality](https://docs.ampel.dev/zlevis/functionality/) to see the functionality of each `pcr_id`, and the other options that can be set.
|
1. See [zlevis functionality](https://docs.ampel.dev/zlevis/functionality/) to see the functionality of each `pcr_id`, and the other options that can be set.
|
||||||
|
@ -393,25 +393,26 @@ To configure Swap install `zram-init`:
|
||||||
sh# apk add zram-init
|
sh# apk add zram-init
|
||||||
```
|
```
|
||||||
|
|
||||||
and add it to the default runlevel:
|
Configure `zram-init` to create a swap device of size one fourth of the ram size:
|
||||||
|
|
||||||
|
``` shell title="/etc/conf.d/zram-init"
|
||||||
|
load_on_start="yes"
|
||||||
|
unload_on_stop="yes"
|
||||||
|
num_devices="1"
|
||||||
|
|
||||||
|
type0="swap"
|
||||||
|
size0=`LC_ALL=C free -m | awk '/^mem:/{print int($2/4)}'`
|
||||||
|
maxs0=1
|
||||||
|
algo0=zstd
|
||||||
|
labl0=zram_swap
|
||||||
|
```
|
||||||
|
|
||||||
|
and add `zram-init` to the default runlevel:
|
||||||
|
|
||||||
``` shell-session
|
``` shell-session
|
||||||
sh# rc-update add zram-init default
|
sh# rc-update add zram-init default
|
||||||
```
|
```
|
||||||
|
|
||||||
Configure `zram-init` by editing:
|
|
||||||
|
|
||||||
``` shell title="/etc/conf.d/zram-init"
|
|
||||||
num_devices=<n>
|
|
||||||
|
|
||||||
# swap - 500M
|
|
||||||
|
|
||||||
#size0=512
|
|
||||||
size0=`LC_ALL=C free -m | awk '/^mem:/{print int($2/4)}'`
|
|
||||||
```
|
|
||||||
|
|
||||||
Now the size of the swap device will be one fourth of the ram size.
|
|
||||||
|
|
||||||
### Users
|
### Users
|
||||||
|
|
||||||
To run applications securely, in an environment with fewer privileges, a user is necessary.
|
To run applications securely, in an environment with fewer privileges, a user is necessary.
|
||||||
|
@ -455,4 +456,4 @@ root:x:0:0:root:/root:/sbin/nologin
|
||||||
|
|
||||||
## Concluding remarks
|
## Concluding remarks
|
||||||
|
|
||||||
This is essentially it, you now have a fully operational alpine base system running, configured for server use. The next steps are the improvement of the security of the system and the configuration of the container management software.
|
This is essentially it, you now have a fully operational alpine base system running, configured for server use. The next steps are the improvement of the security of the system and the configuration of the container management software.
|
||||||
|
|
|
@ -104,7 +104,7 @@ sh$ podman run --rm hello-world
|
||||||
|
|
||||||
To run a single container create:
|
To run a single container create:
|
||||||
|
|
||||||
``` shell title="~/.config/sv/<container-name>/run"
|
``` shell title="~/.config/sv/{container-name}/run"
|
||||||
#!/bin/sh
|
#!/bin/sh
|
||||||
|
|
||||||
command="/usr/bin/podman"
|
command="/usr/bin/podman"
|
||||||
|
@ -360,4 +360,4 @@ Make it executable and link it to the service directory:
|
||||||
``` shell-session
|
``` shell-session
|
||||||
sh$ chmod +x ~/.config/sv/caddy/run
|
sh$ chmod +x ~/.config/sv/caddy/run
|
||||||
sh$ ln -s <home>/.config/sv/caddy <home>/.local/service
|
sh$ ln -s <home>/.config/sv/caddy <home>/.local/service
|
||||||
```
|
```
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
site_name: Ampel Blog
|
site_name: Ampel Blog
|
||||||
site_url: https://blog.ampel.dev
|
site_url: https://blog.ampel.dev
|
||||||
copyright: This work is dedicated to the public domain under the Creative Commons CC0 public domain dedication.
|
copyright: "\copyright 2022-2025 Ampel Authors: This work is licensed under the CC-BY-NC-SA-4.0 license"
|
||||||
|
|
||||||
repo_name: ampel/blog
|
repo_name: ampel/blog
|
||||||
repo_url: https://git.ampel.dev/ampel/blog
|
repo_url: https://git.ampel.dev/ampel/blog
|
||||||
|
@ -69,4 +69,4 @@ nav:
|
||||||
- 'Desktop OS':
|
- 'Desktop OS':
|
||||||
- desktop-os/index.md
|
- desktop-os/index.md
|
||||||
- 'Server OS':
|
- 'Server OS':
|
||||||
- server-os/index.md
|
- server-os/index.md
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue