- orpie's mirror is down, is flagged out-of-date
- attic/atticmatic are now borg/borgmatic, atticmatic removed from AUR
- terraform-bin is broken, is flagged out-of-date
- tucnak3 superceded by tucnak4, is flagged out-of-date, mirror url
changed, no tucnak4 pkgbuild available
We need to set GNUPG_KEYSERVER_OPTIONS and pass something to address
EtiennePerot/parcimonie.sh#15
I set no-honor-keyserver-url in my gpg.conf anyway. I think the option
makes sense, so we'll use that until the parcimonie issue is resolved.
This is used in parcimonie's delay computation function to determine
frequency of key refresh. It defaults to 1 (ie, the computer is online
100% of the time). Spark targets laptops. For a laptop which is off at
night and moving with the user between home and work, 70% seems
reasonable. Maybe still high. We'll start here and tweak as needed.
Hooking into tor's nmtrust config seems to make sense. I don't know if
someone would want to run tor and not this, and you can't run this and
not tor.
This does introduce a new requirement for nmtrust that we haven't seen
before: tor must be started before parcimonie for it to work. Given the
order of the tasks, spark will cause parcimonie to be added to the
trusted unit file after tor, which means we should be good here. But if
a user were to manually edit the file, placing parcimonie above tor, it
would not work. I'm not sure I really want to deal with that problem.
We're running parcimonie for the primary user rather than using the
special `all-users.conf` that parcimonie ships with. That would cause
parcimonie to run for all users who have a ~~/.gnupg`, which in our case
includes root. Running this as root seems like a Bad Idea.
Only running Tor on trusted networks seems a little strange. However, I
like having the system stop as many background network services as
possible when I connect to untrusted networks. This means that the
majority of traffic that I generate is due to explicit action taken by
the user, which makes me feel a bit more sneaky. If I'm on an untrusted
network and want to do something through tor, I'm happy to just
`systemctl start tor.service`.
This should help people doing installs on hidpi displays and/or using
only wifi connectivity. And by installing git here, you are one step
closer to running ansible.
This was only needed for Skylake chips on pre-4.6 kernels to prevent
freeze on lid close. Now that grsec is shipping 4.6 we're in the brave
new world of Skylake support.
Ansible `copy` module has `validation` parameter that allows to validate the file prior to replacing it on remote:
> The validation command to run before copying into place. The path to the file to validate is passed in via '%s' which must be present as in the example below. The command is passed securely so shell features like expansion and pipes won't work.
Here we use `visudo` to validate the file before writing it in place, so the user won't lock himself out in case of incorrect changes to `sudoers.j2` template.
