Skip to content

Instantly share code, notes, and snippets.

@usrme

usrme/INSTALL.md

Last active October 4, 2023 12:46
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save usrme/6deadb1d03669eb057480e6e5f5b4fa6 to your computer and use it in GitHub Desktop.
Save usrme/6deadb1d03669eb057480e6e5f5b4fa6 to your computer and use it in GitHub Desktop.
Download ZIP
Steps to set up a fresh machine with customizations
Raw
INSTALL.md

Install

Tested with:

  • Fedora 36
  • Fedora 37
  • Fedora 38
    • Unable to install due to hard requirement on kernel version 6.0.18-300, which isn't built for Fedora 38

OS installation

  • Download latest Fedora Server ISO
  • Create live installation image
  • Boot to USB drive
    • Spam Esc key to enter Startup menu
  • Choose English as installation language
  • Under Software Selection choose KDE Plasma Workspaces
    • Additional software:
      • KDE Applications
  • Add Estonian to keyboard layouts
  • Under Installation Destination choose custom Storage Configuration
    • When sparing existing home partition just wipe all other existing "Unknown" partitions when manually partitioning
    • Be sure not to tick the little box that asks to wipe all other file systems under "Unknown"
  • Click + icon and set up partitions as follows:
    • Mount point: /boot/efi
      • Desired capacity: 500M
      • Device type: Standard Partition
      • File System: EFI System Partition
    • Mount point: /boot
      • Desired capacity: 1G
      • Device type: Standard Partition
      • File System: xfs
    • Mount point: /
      • Desired capacity: 100G
      • Device type: LVM
      • File System: xfs
      • Encrypt: yes
      • Volume Group: fedora
      • LUKS version: luks2
      • Label: root
      • Update Settings
    • /home
      • Desired capacity: leave blank and that fill up everything else
      • Device type: LVM
      • File System: xfs
      • Encrypt: yes
      • Volume Group: fedora
      • LUKS version: luks2
      • Label: home
      • Update Settings
    • Enter disk encryption passphrase
      • Use one from previous install or enter new one
      • 5779225450
  • When creating users make non-root user an administrator
  • Reboot into system

System

  • Set up passwordless sudo:
    • Last line in file
$ sudo visudo
...
#includedir /etc/sudoers.d
+ usrme   ALL=(ALL)       NOPASSWD:ALL

Initial configuration

  • sudo dnf install git firefox openssl -y
    • This is installed prior to make the rest of the bootstrap steps easier
  • Download personal SSH keys from Nextcloud into ~/.ssh/
  • Download work SSH keys from work Google Drive into ~/.ssh
  • Enable forwarding

Font installation

Automatic configuration

Firefox

Slack

  • Apply Nord theme: #2E3440,#3B4252,#88C0D0,#2E3440,#3B4252,#D8DEE9,#A3BE8C,#81A1C1,#3B4252,#D8DEE9
  • Apply Catppuccin theme: #303446,#F8F8FA,#A6D189,#303446,#232634,#C6D0F5,#A6D189,#EA999C,#303446,#C6D0F5

Signal

  • Flatpak documentation
  • Add remote for Flatpak: flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
  • Install Signal: flatpak install flathub org.signal.Signal -y
  • Modify Signal's .desktop file at /var/lib/flatpak/app/org.signal.Signal/current/active/export/share/applications/org.signal.Signal.desktop: 
-Exec=/usr/bin/flatpak run --branch=stable --arch=x86_64 --command=signal --file-forwarding org.signal.Signal @@u %U @@
+Exec=/usr/bin/flatpak run --branch=stable --arch=x86_64 --command=signal --file-forwarding org.signal.Signal @@u %U @@ --use-tray-icon
  • Start Signal from that same file from a file manager
  • Pin to Task Manager

U2F

  • Initial guide modified as follows
  • Follow every relevant portion, but to just set up YubiKey to easily bypass lockscreen, then do not modify anything else except /etc/pam.d/kde as follows:
    • Adding the auth sufficient pam_u2f.so line below as the guide suggests will not work, which is why it is added above
    • While the initial portion works just fine, then you'll still need to input a password for KWallet, which kind of negates the comfort
    • Another useful link
#%PAM-1.0
#auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth       sufficient   pam_u2f.so
auth       substack     system-auth
auth       include      postlogin
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
session    optional     pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    include      postlogin
#-session   optional     pam_ck_connector.so

When just mounting home partition back again

  • Identify encrypted device:
$ sudo lsblk -f
NAME                                            FSTYPE      FSVER    LABEL UUID                                   FSAVAIL FSUSE% MOUNTPOINTS
zram0                                                                                                                            [SWAP]
nvme0n1                                                                                                                          
├─nvme0n1p1                                     vfat        FAT16          63FA-5AF2                               493,6M     1% /boot/efi
├─nvme0n1p2                                     xfs                        ea62f33e-9e16-462d-9797-9a79c6ca166c    806,9M    20% /boot
└─nvme0n1p3                                     LVM2_member LVM2 001       gysTys-KwoA-84Qj-ypUA-dG0T-auCy-reXsYT                
  ├─fedora_fedora-root                          crypto_LUKS 2              ed78d89a-caf6-4526-a6ff-0075532beeea                  
  │ └─luks-ed78d89a-caf6-4526-a6ff-0075532beeea xfs                  root  c21bf21b-4f2d-4f71-8e59-fba7c2656a96     90,8G     9% /
  └─fedora_fedora-home                          crypto_LUKS 2              4715b989-56d9-4e53-84b7-8615dd51ac9b                  
    └─luks-4715b989-56d9-4e53-84b7-8615dd51ac9b xfs                  home  62e7d7e8-fc93-488c-91f5-062ff2e9d255    347,9G     7% /home
  • Add entry to /etc/fstab:
/dev/mapper/luks-ed78d89a-caf6-4526-a6ff-0075532beeea /                       xfs     defaults,x-systemd.device-timeout=0 0 0
+ /dev/mapper/luks-4715b989-56d9-4e53-84b7-8615dd51ac9b /home                   xfs     defaults 0 0
UUID=ea62f33e-9e16-462d-9797-9a79c6ca166c /boot                   xfs     defaults        0 0
UUID=63FA-5AF2          /boot/efi               vfat    umask=0077,shortname=winnt 0 2
  • Add entry to /etc/crypttab:
luks-ed78d89a-caf6-4526-a6ff-0075532beeea UUID=ed78d89a-caf6-4526-a6ff-0075532beeea none discard
+ luks-4715b989-56d9-4e53-84b7-8615dd51ac9b UUID=4715b989-56d9-4e53-84b7-8615dd51ac9b none discard
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment