The_miro
/
Dotfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,150 Commits
2 Branches
0 Tags
23 MiB
Shell 40.2%
Python 18.3%
CSS 16.7%
Makefile 11.1%
Lua 8.6%
Other 5%
 
 
 
 
 
 
Go to file
Amir Alexander Abdelbaki 4f22a3b03f refactor(ansipa): dev_security-scan → dev_mon_clamscan, report to CheckMK; drop SMB scan pipeline 
Rename the security-scan policy to dev_mon_clamscan (fits the XXX_mon_* naming
for monitoring groups) and make it hand results to CheckMK natively instead of
uploading logs to an SMB share.

- dev_mon_clamscan.sh: runs the daily ClamAV/rkhunter/chkrootkit scan and writes
  its own CheckMK local check (ansipa_clamscan → service "Ansipa_ClamScan"); the
  agent from dev_mon_base collects it. Removes the SMB upload entirely. Discovery
  matches dev_mon_clamscan BEFORE the generic dev_mon_* catch-all so it sets
  WANT_CLAMSCAN rather than being treated as a dev_mon.sh check. mkdir -p the
  cron dir (minimal hosts lack /etc/cron.d until cron is installed).
- Remove the now-redundant dev_mon_malware check from dev_mon.sh (subsumed).
- Remove usr_scan-notify and the whole SMB scan-alert pipeline it fed:
  ansipa-fetch-alerts.sh, ansipa-scan-notify.sh, server ansipa-check-scans.sh,
  the ansipa-scans Samba share + scanupload account, /etc/ansipa-smb.creds, and
  the SMB_SCAN_PASSWORD/smb_scan_password variables (playbook, compose, run.sh,
  .env, Dockerfile). The ansipa-luks-keys and ansipa-policystore shares stay.

Verified live on the Arch client: enrolling in dev_mon_clamscan writes the scan
script, cron, and local check (which reports "Ansipa_ClamScan"); leaving the
group removes all three. Docs updated (policy tables, architecture, SMB shares,
scan-flow → CheckMK).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi
 		2026-07-02 13:49:18 +02:00
alot fix(alot): restore esc = exit in search mode, add / = refineprompt 2026-05-26 13:31:22 +02:00
clamav chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
desktopenvs fix(eww): stop duplicate stacked bars from ewwstart race 2026-06-28 02:23:45 +02:00
docs refactor(ansipa): dev_security-scan → dev_mon_clamscan, report to CheckMK; drop SMB scan pipeline 2026-07-02 13:49:18 +02:00
git amssh now themed 2026-05-11 13:26:02 +02:00
gtk-themes/cyberqueer feat(qt,gtk): overhaul theming — qt6ct style plugin, dark palette, GTK color-scheme 2026-05-19 13:43:13 +02:00
micro cleanup: archive deprecated configs, remove logs and merge artifacts 2026-05-08 10:13:12 +02:00
notes renamed old doc -> notes 2026-05-18 15:49:38 +02:00
nvim chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
nvim.old feat(nvim): convert config to Lua with lazy.nvim 2026-05-19 08:56:43 +02:00
qt-themes/deprecated/cyberqueer fixed theming issues 2026-05-19 14:39:29 +02:00
resources feat(plymouth+resources): bundle bg-skull.svg in repo and archiso 2026-06-26 10:48:45 +02:00
setup refactor(ansipa): dev_security-scan → dev_mon_clamscan, report to CheckMK; drop SMB scan pipeline 2026-07-02 13:49:18 +02:00
spotify-tui added spotify tui 2024-11-20 01:12:57 +01:00
yazi yazi: remove invalid \$schema key from keymap.toml 2026-05-12 12:48:38 +02:00
.bashrc feat(archiso+branding): rebrand to m-archy, ship fastfetch logo and os-release 2026-06-26 09:50:39 +02:00
.gitignore chore(gitignore): ignore inventory-test to avoid committing test credentials 2026-07-02 07:03:12 +02:00
.vimrc chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
.zshrc feat(archiso+branding): rebrand to m-archy, ship fastfetch logo and os-release 2026-06-26 09:50:39 +02:00
apply-theme.sh feat(niri): add Niri as a full desktop environment option 2026-06-01 16:38:47 +02:00
colors.conf chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
create-webapp.sh chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
decrypt.sh chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
encrypt.sh chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
etc-ly-config.ini we switching to ly 2026-02-12 10:35:05 +01:00
readme.md refactor(setup): consolidate build/deploy tooling under setup/tools; docs 2026-07-02 13:09:18 +02:00
readme.md.old docs: replace readme with cliff notes and links to full docs 2026-05-18 16:00:30 +02:00
setup-creds-missing.sh chmods 2026-06-01 15:37:40 +02:00
starship.toml reverted starship config because claude fucked it up 2026-06-25 14:11:14 +02:00
sysupdate.sh fix(hypridle,sysupdate,archiso): misc improvements 2026-06-23 09:03:17 +02:00
update-aur-onebyone.sh chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
update.sh chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00
wgq-projekt.sh added school project vpn-connect script 2026-06-09 11:05:52 +02:00
zshplugins.sh chore: add inline comments across all modules and configs 2026-06-25 13:07:06 +02:00

readme.md

M-Archy Dotfiles

Arch Linux · Hyprland · Wayland · CyberQueer

Production-grade Arch Linux config for network administration, development, and gaming.

Quick Start

git clone https://git.abdelbaki.eu/The_miro/Dotfiles.git ~/Dotfiles
bash ~/Dotfiles/setup/tui-install.sh

The TUI installer covers: packages, desktop environment, optional apps, and colour palette. To add modules to an existing system: bash ~/Dotfiles/setup/install-modules.sh

Cliff Notes

  • Single source of truth for colours — edit colors.conf, run apply-theme.sh to propagate everywhere.
  • Answerfile — generate with setup/tools/generate-answerfile.sh, place at /answerfile.json for a fully automated install. Passwords are never stored in it.
  • Hostname uniqueness — the MAC address of the primary NIC is appended automatically when an answerfile hostname is set (myhost → myhost-aabbccddee11).
  • LUKS encryption — backup key is auto-generated from /dev/urandom, enrolled in a second LUKS slot, written to /_LUKS_BACKUP_KEY (root-only, inside the encrypted container). Collected by Ansible and stored on the SMB ansipa-luks-keys share (KeyAdmin-only read access).
  • Custom ISO — setup/archiso/ builds a live USB that can embed a pre-baked answerfile for zero-touch deployment. The live environment also includes a System Reset mode that reinstalls the root subvolume while preserving home data and FIDO2 auth keys.
  • FreeIPA + Keycloak + Samba container — setup/modules/FreeipaAnsible/image/ ships a single docker compose up stack: FreeIPA for identity, Keycloak for OIDC, and Samba for scan-result and LUKS-key SMB shares. Host-group-driven policies (binary blocking, daemon enable/disable, daily scans, alert delivery) are enforced on enrolled clients every 30 minutes via Ansible-deployed timers.
  • Modular — core, shell, services, and desktop are independent components; pick only what you need.

Documentation

Full docs live in docs/md/ (Markdown) and docs/html/ (rendered).

Topic Markdown HTML
Overview & repo layout index.md index.html
Installation (TUI, answerfile, ISO) installation.md installation.html
Hyprland desktop hyprland.md hyprland.html
Theming & CyberQueer palette theming.md theming.html
Optional modules & app catalogue modules.md modules.html
Custom Archiso builder archiso.md archiso.html
FreeIPA, Ansible, Keycloak & SMB freeipa-ansible.md freeipa-ansible.html
Editors (Neovim, Micro, Yazi) editors.md editors.html
Utilities (encrypt, ClamAV, updates) utilities.md utilities.html

The old readme is preserved at readme.md.old.