Mirrors/spark
1
0
Fork 0
mirror of https://github.com/pigmonkey/spark.git synced 2026-07-17 16:37:46 +00:00
Code Issues Projects Releases Wiki Activity

remove out of date references from the README

Browse source 
I haven't actually read this in about a decade.
This commit is contained in:
Pig Monkey 2026-05-10 11:39:20 -07:00
parent 085423aa87
commit 938cf331dc
1 changed files with 5 additions and 246 deletions
Download patch file Download diff file Expand all files Collapse all files

251
README.md
View file

@ -9,13 +9,9 @@ Spark assumes it will be run on a laptop and performs some configuration based
on this assumption. This behaviour may be changed by removing the `laptop` role
from the playbook or by skipping the `laptop` tag.
If Spark is run on either a ThinkPad or a MacBook, it will detect this and
If Spark is run on either a ThinkPad or a Framework, it will detect this and
execute platform-specific tasks.
**Note:** If you would like to try recreating all the tasks that are currently
included in the ansible playbook, through a VM, you would need a disk of at least
**16GB** in size.
## Running
First, sync mirrors and install Ansible:
@ -29,7 +25,7 @@ Second, install and update the submodules:
Next, install the required Ansible collections as root.
# ansible-galaxy collection install -r requirements.yml
Run the playbook as root.
# ansible-playbook -i localhost playbook.yml
@ -109,27 +105,9 @@ The `firejail.blacklist` variable is used to populate
This file is included by all security profiles, causing the specified locations
to be inaccessible to jailed programs.
## MAC Spoofing
By default, the MAC address of all network interfaces is spoofed at boot,
before any network services are brought up. This is done with [macchiato][11],
which uses legitimate OUI prefixes to make the spoofing less recognizable.
MAC spoofing is desirable for greater privacy on public networks, but may be
inconvenient on home or corporate networks where a consistent (if not real) MAC
address is wanted for authentication. To work around this, allow `macchiato` to
randomize the MAC on boot, but tell NetworkManager to clone the real (or a fake
but consistent) MAC address in its profile for the trusted networks. This can
be done in the GUI by populating the "Cloned MAC address" field for the
appropriate profiles, or by setting the `cloned-mac-address` property in the
profile file at `/etc/NetworkManager/system-connections/`.
Spoofing may be disabled entirely by setting the `network.spoof_mac` variable
to `False`.
## Trusted Networks
The trusted network framework provided by [nmtrust][12] is leveraged to start
The trusted network framework provided by [nmtrust][11] is leveraged to start
certain systemd units when connected to trusted networks, and stop them
elsewhere.
@ -144,232 +122,13 @@ Trusted networks are defined using their NetworkManager UUIDs, configured in
the `network.trusted_uuid` list. NetworkManager UUIDs may be discovered using
`nmcli con`.
## Mail
### Receiving Mail
Receiving mail is supported by syncing from IMAP servers via both [isync][13]
and [OfflineIMAP][14]. By default isync is enabled, but this can be changed to
OfflineIMAP by setting the value of the `mail.sync_tool` variable to
`offlineimap`.
### Sending Mail
[msmtp][15] is used to send mail. Included as part of msmtp's documentation are
a set of [msmtpq scripts][16] for queuing mail. These scripts are copied to the
user's path for use. When calling `msmtpq` instead of `msmtp`, mail is sent
normally if internet connectivity is available. If the user is offline, the
mail is saved in a queue, to be sent out when internet connectivity is again
available. This helps support a seamless workflow, both offline and online.
### System Mail
If the `email.user` variable is defined, the system will be configured to
forward mail for the user and root to this address. Removing this variable will
cause no mail aliases to be put in place.
The cron implementation is configured to send mail using `msmtp`.
### Syncing and Scheduling Mail
A shell script called `mailsync` is included to sync mail, by first sending any
mail in the msmtp queue and then syncing with the chosen IMAP servers via
either isync or OfflineIMAP. The script will also attempt to sync contacts and
calendars via [vdirsyncer][17]. To disable this behavior, set the
`mail.sync_pim` variable to `False`.
Before syncing, the `mailsync` script checks for internet connectivity using
NetworkMananger. `mailsync` may be called directly by the user, ie by
configuring a hotkey in Mutt.
A [systemd timer][18] is also included to periodically call `mailsync`. The
timer is set to sync every 5 minutes (configurable through the `mail.sync_time`
variable).
The timer is not started or enabled by default. Instead, the timer is added to
`/etc/nmtrust/trusted_units`, causing the NetworkManager trusted unit
dispatcher to activate the timer whenever a connection is established to a
trusted network. The timer is stopped whenever the network goes down or a
connection is established to an untrusted network.
To have the timer activated at boot, change the `mail.sync_on` variable from
`trusted` to `all`.
If the `mail.sync_on` variable is set to anything other than `trusted` or
`all`, the timer will never be activated.
## Tarsnap
[Tarsnap][19] is installed with its default configuration file. However,
setting up Tarsnap is left as an exercise for the user. New Tarsnap users
should [register their machine and generate a key][20]. Existing users should
recover their key(s) and cache directory from their backups (or, alternatively,
recover their key(s) and rebuild the cache directory with `tarsnap --fsck`).
[Tarsnapper][21] is installed to manage backups. A basic configuration file to
backup `/etc` is included. Tarsnapper is configured to look in
`/usr/local/etc/tarsnapper.d` for additional jobs. As with with the Tarsnap key
and cache directory, users should recover their jobs files from backups after
the Tarsnapper install is complete. See the Tarsnapper documentation for more
details.
### Running Tarsnap
A systemd unit file and timer are included for Tarsnapper. Rather than calling
it directly, the systemd unit wraps Tarsnapper with [backitup][22].
The timer is set to execute the unit hourly, but backitup will only call
Tarsnapper once within the period defined in the `tarsnapper.period` variable.
This defaults to `DAILY`. This increases the likelyhood of completing daily
backups by checking each hour if the unit has run succesfully on the current
calendar day.
In addition to the period limitation, backitup defaults to only calling
Tarsnapper when it detects the machine ison AC power. To allow Tarsnapper to
run when on battery, set the `tarsnapper.ac_only` variable to `False`.
As with `mailsync`, the timer is not started or enabled by default. Instead,
the timer is added to `/etc/nmtrust/trusted_units`, causing the NetworkManager
trusted unit dispatcher to activate the timer whenever a connection is
established to a trusted network. The timer is stopped whenever the network
goes down or a connection is established to an untrusted network.
To have the timer activated at boot, change the `tarsnapper.run_on` variable
from `trusted` to `all`.
If the `tarsnapper.run_on` variable is set to anything other than `trusted` or
`all`, the timer will never be activated.
## Tor
[Tor][23] is installed by default. A systemd service unit for Tor is installed,
but not enabled or started. instead, the service is added to
`/etc/nmtrust/trusted_units`, causing the NetworkManager trusted unit
dispatcher to activate the service whenever a connection is established to a
trusted network. The service is stopped whenever the network goes down or a
connection is established to an untrusted network.
To have the service activated at boot, change the `tor.run_on` variable
from `trusted` to `all`.
If you do not wish to use Tor, simply remove the `tor` variable from the
configuration.
### parcimonie.sh
[parcimonie.sh][24] is provided to periodically refresh entries in the user's
GnuPG keyring over the Tor network. The service is added to
`/etc/nmtrust/trusted_units` and respects the `tor.run_on` variable.
## BitlBee
[BitlBee][25] and [WeeChat][26] are used to provide chat services. A systemd
service unit for BitlBee is installed, but not enabled or started by default.
Instead, the service is added to `/etc/nmtrust/trusted_units`, causing the
NetworkManager trusted unit dispatcher to activate the service whenever a
connection is established to a trusted network. The service is stopped whenever
the network goes down or a connection is established to an untrusted network.
To have the service activated at boot, change the `bitlbee.run_on` variable
from `trusted` to `all`.
If the `bitlbee.run_on` variable is set to anything other than `trusted` or
`all`, the service will never be activated.
By default BitlBee will be configured to proxy through Tor. To disable this,
remove the `bitlebee.torify` variable or disable Tor entirely by removing the
`tor` variable.
## git-annex
[git-annex][27] is installed for file syncing. A systemd service unit for the
git-annex assistant is enabled and started by default. To prevent this, remove
the `gitannex` variable from the config.
Additionally, the git-annex unit is added to `/etc/nmtrust/trusted_units`,
causing the NetworkManager trusted unit dispatcher to activate the service
whenever a connection is established to a trusted network. The service is
stopped whenever a connection is established to an untrusted network. Unlike
other units using the trusted network framework, the git-annex unit is also
activated when there are no active network connections. This allows the
git-annex assistant to be used when on trusted networks and when offline, but
not when on untrusted networks.
If the `gitannex.stop_on_untrusted` variable is set to anything other than
`True` or is not defined, the git-annex unit will not be added to the trusted
unit file, resulting in the git-annex assistant not being stopped on untrusted
networks.
## PostgreSQL
[PostgreSQL][28] is installed and enabled by default. If the
`postgresql.enable` variable is set to anything other than `True` or is not
defined, the service will not be started or enabled.
This is intended for local development. PostgreSQL is configured to only listen
on localhost and no additional ports are opened in the default firewall. This
configuration means that PostgreSQL is not a network service. As such, the
PostgreSQL service is not added to `/etc/nmtrust/trusted_units`.
Additional configuration options are set which improve performance but make the
database service inappropriate for production use.
## Himawaripy
[Himawaripy][29] is provided to fetch near-realtime photos of Earth from the
Japanese [Himawari 8][30] weather satellite and set them as the user's desktop
background via feh. This should provide early warning of the presence of any
Vogon constructor fleets appearing over the Eastern Hemisphere.
A systemd service unit and timer is installed, but not enabled or started by
default. Instead, the service is added to `/etc/nmtrust/trusted_units`, causing
the NetworkManager trusted unit dispatcher to activate the service whenever a
connection is established to a trusted network. The service is stopped whenever
the network goes down or a connection is established to an untrusted network.
To have the service activated at boot, change the `himawaripy.run_on` variable
from `trusted` to `all`.
If the `himawaripy.run_on` variable is set to anything other than `trusted` or
`all`, the service will never be activated.
By default the timer is scheduled to fetch a new image at 15 minute intervals.
This can be changed by modifying the `himawaripy.run_time` variable.
By completely removing the `himawaripy` variable, no related tasks will be run.
[1]: http://www.ansible.com
[2]: https://www.archlinux.org
[3]: https://wiki.archlinux.org/index.php/Installation_guide#Post-installation
[4]: https://wiki.archlinux.org/index.php/Secure_Shell#Managing_the_sshd_daemon
[5]: https://thoughtbot.github.io/rcm/
[6]: https://aur.archlinux.org
[7]: https://github.com/pigmonkey/ansible-aur
[7]: https://github.com/kewlfft/ansible-aur
[8]: https://github.com/Jguer/yay
[9]: https://wiki.archlinux.org/index.php/AUR_helpers
[10]: https://firejail.wordpress.com/
[11]: https://github.com/EtiennePerot/macchiato
[12]: https://github.com/pigmonkey/nmtrust
[13]: http://isync.sourceforge.net/
[14]: http://offlineimap.org/
[15]: http://msmtp.sourceforge.net/
[16]: http://sourceforge.net/p/msmtp/code/ci/master/tree/scripts/msmtpq/README.msmtpq
[17]: https://github.com/pimutils/vdirsyncer
[18]: https://wiki.archlinux.org/index.php/Systemd/Timers
[19]: https://www.tarsnap.com/
[20]: https://www.tarsnap.com/gettingstarted.html
[21]: https://github.com/miracle2k/tarsnapper
[22]: https://github.com/pigmonkey/backitup
[23]: https://www.torproject.org/
[24]: https://github.com/EtiennePerot/parcimonie.sh
[25]: https://www.bitlbee.org/main.php/news.r.html
[26]: https://weechat.org/
[27]: https://git-annex.branchable.com/
[28]: http://www.postgresql.org/
[29]: https://github.com/boramalper/himawaripy
[30]: https://en.wikipedia.org/wiki/Himawari_8
[11]: https://github.com/pigmonkey/nmtrust