Amir Alexander Abdelbaki
268feaa1f2
Adds a built-in Nextcloud to the ansipa stack and wires every service's
logins back to FreeIPA, either through Keycloak or directly.
Nextcloud:
- nextcloud + redis services, sharing the existing postgres server via a
second database. The initdb hook only fires on an empty data directory,
so run.sh also creates the role/DB idempotently for stacks that predate
Nextcloud.
- served at the /nextcloud subpath of the gateway (OVERWRITEWEBROOT), with
the /.well-known/* DAV redirects at the server root that sync clients and
Nextcloud's own setup checks expect.
Identity:
- keycloak-configure.sh now provisions confidential OIDC clients per relying
party (nextcloud, proxmox-ve, proxmox-bs, opnsense) plus a realm-wide
"groups" claim, writing secrets to .oidc-secrets (0600, gitignored).
- nextcloud-configure.sh binds the IPA LDAP backend as the account source
and user_oidc for login. The internal username is pinned to the IPA uid
and unique-uid is disabled, otherwise every SSO login creates a second,
empty account beside the LDAP one.
- checkmk-ldap-configure.sh binds CheckMK straight to FreeIPA. CheckMK
cannot go through Keycloak: SAML is commercial-edition only and no
edition supports OIDC. The LDAP REST endpoints landed in 2.4 (werk
#16527) but the stack pins 2.3, so it writes user_connections.mk —
generated via Python repr() so quotes in a password cannot produce a
SyntaxError that takes the GUI down, backed up and rolled back if the
site fails to load it. Directory type is 389directoryserver, which is
what gives FreeIPA the correct uid/member attribute defaults.
Monitoring:
- OPNsense local check (gateways, pf state table vs its hard limit,
firmware, CARP) plus an installer. POSIX sh, since OPNsense is FreeBSD
with no bash or GNU grep. Transport is agent-over-SSH rather than inetd
on 6556, because OPNsense regenerates inetd.conf/services/hosts.allow
from config.xml and silently reverts those edits on reboot.
Fixes found along the way:
- keycloak-configure.sh used KC_URL without the /auth relative path and
probed /health/ready, which lives on management port 9000 and is not
under that path — so it 404'd and timed out on this deployment.
- .env.example had an unquoted `cn=Directory Manager`, which the shell
scripts sourcing it parsed as a command named `Manager`.
- summary heredocs printed raw escape codes; colours now use ANSI-C quoting.
docs/md/ansipa-sso.md covers the identity chain, the per-service support
matrix, Proxmox VE/PBS OpenID realm setup, and why packet captures should
not be tunnelled through the CheckMK API.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWLuyyrydC1u2FjM7naPcz
|
||
|---|---|---|
| alot | ||
| clamav | ||
| desktopenvs | ||
| docs | ||
| etc-greetd | ||
| etc-lightdm | ||
| etc-systemd-sleep | ||
| git | ||
| gtk-themes/cyberqueer | ||
| micro | ||
| notes | ||
| nvim | ||
| nvim.old | ||
| qt-themes/deprecated/cyberqueer | ||
| resources | ||
| setup | ||
| spotify-tui | ||
| yazi | ||
| .bashrc | ||
| .gitignore | ||
| .vimrc | ||
| .zshrc | ||
| apply-theme.sh | ||
| colors.conf | ||
| create-webapp.sh | ||
| decrypt.sh | ||
| encrypt.sh | ||
| etc-ly-config.ini | ||
| hyprdrive.md | ||
| readme.md | ||
| readme.md.old | ||
| setup-creds-missing.sh | ||
| starship.toml | ||
| sysupdate.sh | ||
| update-aur-onebyone.sh | ||
| update.sh | ||
| wgq-projekt.sh | ||
| zshplugins.sh | ||
readme.md
M-Archy Dotfiles
Arch Linux · Hyprland · Wayland · CyberQueer
Production-grade Arch Linux config for network administration, development, and gaming.
Quick Start
git clone https://git.abdelbaki.eu/The_miro/Dotfiles.git ~/Dotfiles
bash ~/Dotfiles/setup/tui-install.sh
The TUI installer covers: packages, desktop environment, optional apps, and colour palette.
To add modules to an existing system: bash ~/Dotfiles/setup/install-modules.sh
Cliff Notes
- Single source of truth for colours — edit
colors.conf, runapply-theme.shto propagate everywhere. - Answerfile — generate with
setup/tools/generate-answerfile.sh, place at/answerfile.jsonfor a fully automated install. Passwords are never stored in it. - Hostname uniqueness — the MAC address of the primary NIC is appended automatically when an answerfile hostname is set (
myhost→myhost-aabbccddee11). - LUKS encryption — backup key is auto-generated from
/dev/urandom, enrolled in a second LUKS slot, written to/_LUKS_BACKUP_KEY(root-only, inside the encrypted container). Collected by Ansible and stored on the SMBansipa-luks-keysshare (KeyAdmin-only read access). - Custom ISO —
setup/archiso/builds a live USB that can embed a pre-baked answerfile for zero-touch deployment. The live environment also includes a System Reset mode that reinstalls the root subvolume while preserving home data and FIDO2 auth keys. - FreeIPA + Keycloak + CheckMK + Nextcloud container —
setup/modules/FreeipaAnsible/image/ships a singledocker compose upstack: FreeIPA for identity, Keycloak for OIDC, CheckMK for monitoring, Nextcloud for files/calendar/contacts, and Samba for LUKS-key SMB shares. FreeIPA is the single source of truth for accounts; see ansipa-sso.md. Host-group-driven policies (binary blocking, daemon enable/disable, daily scans, alert delivery) are enforced on enrolled clients every 30 minutes via Ansible-deployed timers. - Modular — core, shell, services, and desktop are independent components; pick only what you need.
Documentation
Full docs live in docs/md/ (Markdown) and docs/html/ (rendered).
| Topic | Markdown | HTML |
|---|---|---|
| Overview & repo layout | index.md | index.html |
| Installation (TUI, answerfile, ISO) | installation.md | installation.html |
| Hyprland desktop | hyprland.md | hyprland.html |
| Theming & CyberQueer palette | theming.md | theming.html |
| Optional modules & app catalogue | modules.md | modules.html |
| Custom Archiso builder | archiso.md | archiso.html |
| FreeIPA, Ansible, Keycloak & SMB | freeipa-ansible.md | freeipa-ansible.html |
| ansipa Single Sign-On | ansipa-sso.md | ansipa-sso.html |
| Editors (Neovim, Micro, Yazi) | editors.md | editors.html |
| Utilities (encrypt, ClamAV, updates) | utilities.md | utilities.html |
The old readme is preserved at
readme.md.old.