punkfairie/install.fairie
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Latest

Browse source
This commit is contained in:
Brian Zalewski 2023-12-24 23:35:24 +00:00
parent 7826e4cef3
commit 489e6f8a38
2 changed files with 144 additions and 123 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

218
home/.chezmoiscripts/universal/run_before_02-homebrew.sh.tmpl
View file

@ -20,67 +20,8 @@
{{ includeTemplate "universal/profile-before" }} {{ includeTemplate "universal/profile-before" }}
{{ includeTemplate "universal/logg-before" }} {{ includeTemplate "universal/logg-before" }}
### Configure Firewall # @description This script ensures all the system utilities necessary to install Homebrew are present on the system.
# TODO: If this is required, notes should be added describing the pros / cons of the security ensureHomebrewDeps() {
# if [ -d /Applications ] && [ -d /System ]; then
# logg info 'Disabling the block all incoming traffic option in the system Firewall settings'
# /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall off || (logg error 'Failed to disable incoming traffic block in the system Firewall' && logg info 'Manually disable the option under "System Preferences" > "Network" > "Firewall" > "Incoming Traffic Block Toggle"')
# fi
### System upgrade on macOS
# Note: If a shutdown is required and the `softwareupdate` command restart command does not work then `m shutdown -f` might be useful or `m restart -f`
# Do you want to terminate running processes in this window?
# Closing this window will terminate the running processes: softwareupdate, sudo
# Running sudo softwareupdate -i -a -R --agree-to-license reboots just not in the script due to the running processes perhaps
# Check for pending reboot by checking
if [ -d /Applications ] && [ -d /Library ] && [ -z "$NO_RESTART" ]; then
logg info 'Applying OS upgrades (if available)'
sudo sh -c "softwareupdate -i -a --agree-to-license" || logg error 'Failed to trigger a system update via sudo softwareupdate -i -a --agree-to-license'
logg info 'If system updates are downloaded / installed, a reboot might be required.'
### Source: https://community.jamf.com/t5/jamf-pro/determine-if-update-requires-restart/m-p/11682
if softwareupdate -l | grep restart > /dev/null; then
### Add kickstart script to .zshrc so it triggers automatically
if [ ! -f "$HOME/.zshrc" ] || ! cat "$HOME/.zshrc" | grep '# TEMPORARY FOR INSTALL DOCTOR MACOS' > /dev/null; then
echo 'bash <(curl -sSL https://install.doctor/start) # TEMPORARY FOR INSTALL DOCTOR MACOS' >> "$HOME/.zshrc"
fi
### Attempt to populate SUDO_PASSWORD from secrets
if [ -z "$SUDO_PASSWORD" ]; then
SUDO_PASSWORD="{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "SUDO_PASSWORD")) -}}{{- includeTemplate "secrets/SUDO_PASSWORD" | decrypt | trim -}}{{- end -}}"
export SUDO_PASSWORD
fi
### Prompt for SUDO_PASSWORD
if [ "$SUDO_PASSWORD" = "" ]; then
logg prompt "Enter the current user's login / admin password. Press ENTER to bypass and skip enabling auto-login. If you would like to bypass this prompt next time then pass in the password as an environment variable named SUDO_PASSWORD before running the kickstart script."
SUDO_PASSWORD="$(gum input --password --placeholder="Enter password..")"
export SUDO_PASSWORD
fi
if [ -n "$SUDO_PASSWORD" ] && [ "$SUDO_PASSWORD" != "" ]; then
### Install kcpassword
if ! command -v enable_autologin > /dev/null; then
logg info 'enable_autologin is not installed and it is a requirement for auto-logging in after reboot'
brew install xfreebird/utils/kcpassword
fi
### Enable auto-login via kcpassword
sudo enable_autologin "$USER" "$SUDO_PASSWORD"
fi
### Reboot
logg info 'Reboot required - shutting down immediately' && sudo sh -c 'shutdown -r now'
fi
if [ -f "$HOME/.zshrc" ]; then
if command -v gsed > /dev/null; then
sudo gsed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
else
sudo sed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
fi
fi
fi
### Ensure dependencies are installed on Linux
if ! command -v curl > /dev/null || ! command -v git > /dev/null || ! command -v expect > /dev/null || ! command -v rsync > /dev/null; then if ! command -v curl > /dev/null || ! command -v git > /dev/null || ! command -v expect > /dev/null || ! command -v rsync > /dev/null; then
if command -v apt-get > /dev/null; then if command -v apt-get > /dev/null; then
# @description Ensure `build-essential`, `curl`, `expect`, `git`, `rsync`, `procps`, and `file` are installed on Debian / Ubuntu # @description Ensure `build-essential`, `curl`, `expect`, `git`, `rsync`, `procps`, and `file` are installed on Debian / Ubuntu
@ -113,8 +54,121 @@ if ! command -v curl > /dev/null || ! command -v git > /dev/null || ! command -v
choco install -y curl expect git rsync choco install -y curl expect git rsync
fi fi
fi fi
}
### Ensure Homebrew is loaded # @description This script ensures Homebrew is installed.
ensurePackageManagerHomebrew() {
if ! command -v brew > /dev/null; then
if command -v sudo > /dev/null && sudo -n true; then
echo | bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
else
logg info 'Homebrew is not installed. Password may be required.'
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || BREW_EXIT_CODE="$?"
if [ -n "$BREW_EXIT_CODE" ]; then
logg warn 'Homebrew was installed but part of the installation failed to complete successfully.'
if command -v brew > /dev/null; then
logg info 'Applying proper permissions on Homebrew folders'
sudo chmod -R go-w "$(brew --prefix)/share"
BREW_DIRS="share etc/bash_completion.d"
for BREW_DIR in $BREW_DIRS; do
if [ -d "$(brew --prefix)/$BREW_DIR" ]; then
sudo chown -Rf "$(whoami)" "$(brew --prefix)/$BREW_DIR"
fi
done
logg info 'Running brew update --force --quiet' && brew update --force --quiet
fi
fi
fi
fi
}
# @description Helper function utilized by [[upgradeDarwin]] to ensure the `expect` command is available on macOS
installExpect() {
if ! command -v expect > /dev/null; then
logg info 'Installing expect via Homebrew' && brew install expect
fi
}
# @description Helper function utilized by [[upgradeDarwin]] to ensure the `gsed` command is available on macOS
installGsed() {
if ! command -v gsed > /dev/null; then
logg info 'Installing gnu-sed via Homebrew' && brew install gnu-sed
fi
}
# @description This script ensures `expect` and `gsed` are available. It then either extracts the escalation password by decrypting the
# `SUDO_PASSWORD` secret or prompts the user for the sudo password. After that, it automates the process of downloading
# system updates, rebooting, and re-starting the provisioning process until the system is fully updated.
#
# It may be important to note that although this script attempts to make the process fully automated, there may be
# certain circumstances where additional user input is necessary during the process. This might be true in cases
# where the system settings are controlled by MDM profiles for corporate laptops.
upgradeDarwin() {
if [ -d /Applications ] && [ -d /Library ] && [ -z "$NO_RESTART" ]; then
### Ensure dependencies are installed
installExpect
installGsed
### Attempt to populate SUDO_PASSWORD from secrets
if [ -z "$SUDO_PASSWORD" ]; then
SUDO_PASSWORD="{{- if and (stat (joinPath .host.home ".config" "age" "chezmoi.txt")) (stat (joinPath .chezmoi.sourceDir ".chezmoitemplates" "secrets" "SUDO_PASSWORD")) -}}{{- includeTemplate "secrets/SUDO_PASSWORD" | decrypt | trim -}}{{- end -}}"
export SUDO_PASSWORD
fi
### Prompt for SUDO_PASSWORD
if [ "$SUDO_PASSWORD" = "" ]; then
logg prompt "Enter the current user's login / admin password. Press ENTER to bypass and skip enabling auto-login. If you would like to bypass this prompt next time then pass in the password as an environment variable named SUDO_PASSWORD before running the kickstart script."
SUDO_PASSWORD="$(gum input --password --placeholder="Enter password..")"
export SUDO_PASSWORD
fi
### Run upgrade process
logg info 'Applying OS upgrades (if available)'
expect -c "set timeout -1
spawn sudo sh -c "sudo softwareupdate -i -a --agree-to-license" || logg error 'Failed to trigger a system update via sudo softwareupdate -i -a --agree-to-license'
expect \"Password:\"
send \"${SUDO_PASSWORD}\r\"
expect eof" &> /dev/null || EXIT_CODE=$?
if [ -n "$EXIT_CODE" ]; then
logg warn 'Error running softwareupdate'
unset EXIT_CODE
fi
# sudo sh -c "sudo softwareupdate -i -a --agree-to-license" || logg error 'Failed to trigger a system update via sudo softwareupdate -i -a --agree-to-license'
logg info 'If system updates were downloaded / installed, a reboot might be required.'
### Reboot if necessary
# Source: https://community.jamf.com/t5/jamf-pro/determine-if-update-requires-restart/m-p/11682
if softwareupdate -l | grep restart > /dev/null; then
### Add kickstart script to .zshrc so it triggers automatically
if [ ! -f "$HOME/.zshrc" ] || ! cat "$HOME/.zshrc" | grep '# TEMPORARY FOR INSTALL DOCTOR MACOS' > /dev/null; then
echo 'bash <(curl -sSL https://install.doctor/start) # TEMPORARY FOR INSTALL DOCTOR MACOS' >> "$HOME/.zshrc"
fi
if [ -n "$SUDO_PASSWORD" ] && [ "$SUDO_PASSWORD" != "" ]; then
### Install kcpassword
if ! command -v enable_autologin > /dev/null; then
logg info 'enable_autologin is not installed and it is a requirement for auto-logging in after reboot'
brew install xfreebird/utils/kcpassword
fi
### Enable auto-login via kcpassword
sudo enable_autologin "$USER" "$SUDO_PASSWORD"
fi
### Reboot
logg info 'Reboot required - shutting down immediately' && sudo sh -c 'shutdown -r now'
fi
if [ -f "$HOME/.zshrc" ]; then
if command -v gsed > /dev/null; then
sudo gsed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
else
sudo sed -i '/# TEMPORARY FOR INSTALL DOCTOR MACOS/d' "$HOME/.zshrc" || logg warn "Failed to remove kickstart script from .zshrc"
fi
fi
fi
}
# @description This script attempts to load Homebrew by checking in typical locations.
loadHomebrew() { loadHomebrew() {
if ! command -v brew > /dev/null; then if ! command -v brew > /dev/null; then
if [ -f /usr/local/bin/brew ]; then if [ -f /usr/local/bin/brew ]; then
@ -129,43 +183,9 @@ loadHomebrew() {
fi fi
} }
### Ensures Homebrew folders have proper owners / permissions ### Logic sequence
fixHomebrewPermissions() { ensureHomebrewDeps
if command -v brew > /dev/null; then
logg info 'Applying proper permissions on Homebrew folders'
sudo chmod -R go-w "$(brew --prefix)/share"
BREW_DIRS="share etc/bash_completion.d"
for BREW_DIR in $BREW_DIRS; do
if [ -d "$(brew --prefix)/$BREW_DIR" ]; then
sudo chown -Rf "$(whoami)" "$(brew --prefix)/$BREW_DIR"
fi
done
logg info 'Running brew update --force --quiet' && brew update --force --quiet
fi
}
### Installs Homebrew
ensurePackageManagerHomebrew() {
if ! command -v brew > /dev/null; then
if command -v sudo > /dev/null && sudo -n true; then
echo | bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
else
logg info 'Homebrew is not installed. Password may be required.'
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" || BREW_EXIT_CODE="$?"
if [ -n "$BREW_EXIT_CODE" ]; then
logg warn 'Homebrew was installed but part of the installation failed to complete successfully.'
fixHomebrewPermissions
fi
fi
fi
}
### Logic
loadHomebrew loadHomebrew
ensurePackageManagerHomebrew ensurePackageManagerHomebrew
loadHomebrew loadHomebrew
upgradeDarwin
### Scrub ~/.viminfo
if [ -f "$HOME/.viminfo" ]; then
logg info 'Removing ~/.viminfo' && sudo rm -f "$HOME/.vimino"
fi

23
home/.chezmoiscripts/universal/run_before_03-decrypt-age-key.sh.tmpl
View file

@ -32,7 +32,8 @@
{{ includeTemplate "universal/logg-before" }} {{ includeTemplate "universal/logg-before" }}
{{ includeTemplate "universal/profile-before" }} {{ includeTemplate "universal/profile-before" }}
### Handle decryption failure # @description Helper function utilized by [[decryptKey]] that removes all `encrypted_` files from the Chezmoi source
# if the Age decryption process fails due to wrong password or from not being set up yet.
decryptionFailure() { decryptionFailure() {
logg info 'Proceeding without decrypting age encryption key stored at ~/.local/share/chezmoi/home/key.txt.age' logg info 'Proceeding without decrypting age encryption key stored at ~/.local/share/chezmoi/home/key.txt.age'
logg info 'To have Chezmoi handle your encryption (so you can store your private files publicly) take a look at https://shorturl.at/jkpzG' logg info 'To have Chezmoi handle your encryption (so you can store your private files publicly) take a look at https://shorturl.at/jkpzG'
@ -43,7 +44,7 @@ decryptionFailure() {
done done
} }
### Install Age via Homebrew if not present # @description Helper function utilized by [[decryptKey]] to ensure the `age` command is available
installAge() { installAge() {
if ! command -v age > /dev/null; then if ! command -v age > /dev/null; then
logg info 'Running brew install age' logg info 'Running brew install age'
@ -51,7 +52,7 @@ installAge() {
fi fi
} }
### Install Expect via Homebrew if not present # @description Helper function utilized by [[decryptKey]] to ensure the `expect` command is available
installExpect() { installExpect() {
if ! command -v expect > /dev/null; then if ! command -v expect > /dev/null; then
logg info 'Running brew install expect' logg info 'Running brew install expect'
@ -59,14 +60,14 @@ installExpect() {
fi fi
} }
### Decrypt private key if it is not already present # @description Decrypt private Chezmoi key if it is not already present at `${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt`
decryptKey() { decryptKey() {
if command -v age > /dev/null; then if command -v age > /dev/null; then
if [ ! -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then if [ ! -f "${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt" ]; then
mkdir -p "${XDG_CONFIG_HOME}/age" mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/age"
if [ -z "$AGE_PASSWORD" ]; then if [ -z "$AGE_PASSWORD" ]; then
logg star 'PRESS ENTER if you have not set up your encryption token yet' logg star 'PRESS ENTER if you have not set up your encryption token yet'
age --decrypt --output "${XDG_CONFIG_HOME}/age/chezmoi.txt" "{{ .chezmoi.sourceDir }}/key.txt.age" || EXIT_CODE=$? age --decrypt --output "${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt" "{{ .chezmoi.sourceDir }}/key.txt.age" || EXIT_CODE=$?
if [ -n "$EXIT_CODE" ]; then if [ -n "$EXIT_CODE" ]; then
decryptionFailure decryptionFailure
else else
@ -75,7 +76,7 @@ decryptKey() {
else else
installExpect installExpect
expect -c "set timeout -1 expect -c "set timeout -1
spawn age --decrypt --output "${XDG_CONFIG_HOME}/age/chezmoi.txt" "${XDG_DATA_HOME:-$HOME/.local/share}/chezmoi/home/key.txt.age" spawn age --decrypt --output "${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt" "${XDG_DATA_HOME:-$HOME/.local/share}/chezmoi/home/key.txt.age"
expect \"Enter passphrase:\" expect \"Enter passphrase:\"
send \"${AGE_PASSWORD}\r\" send \"${AGE_PASSWORD}\r\"
expect eof" &> /dev/null || EXIT_CODE=$? expect eof" &> /dev/null || EXIT_CODE=$?
@ -102,8 +103,8 @@ else
fi fi
### Ensure proper permissions on private key ### Ensure proper permissions on private key
if [ -f "${XDG_CONFIG_HOME}/age/chezmoi.txt" ]; then if [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt" ]; then
logg info 'Ensuring proper permissions on Chezmoi / age decryption key' logg info 'Ensuring proper permissions on Chezmoi / age decryption key'
logg info 'Chezmoi / age decryption key is stored in '"${XDG_CONFIG_HOME}/age/chezmoi.txt" logg info 'Chezmoi / age decryption key is stored in '"${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt"
chmod 600 "${XDG_CONFIG_HOME}/age/chezmoi.txt" chmod 600 "${XDG_CONFIG_HOME:-$HOME/.config}/age/chezmoi.txt"
fi fi