moar security theater

Co-authored-by: Tessu Suomalainen <soopeli@aminda.eu>

.mikaela_install

@@ -4,7 +4,7 @@
 # stop.
 set -x
 
-git verify-commit HEAD
+git verify-commit HEAD || exit 1
 
 cat .mikaela/bash_aliases >~/.bash_aliases
 cat .mikaela/zsh_aliases >~/.zsh_aliases

.pre-commit-config.yaml

@@ -3,7 +3,7 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.ci for more information
 ci:
-  skip: [install-dev-deps, prettier]
+  skip: [prettier]
   # Forĝejo/Gitea mirrors will autoclose pull requests. This should decrease
   # the frequency of unnecessary PRs.
   # https://github.com/pre-commit-ci/issues/issues/83
@@ -50,6 +50,11 @@ repos:
             "Name,name",
           ]
 
+  - repo: https://github.com/pre-commit-ci/pre-commit-ci-config
+    rev: v1.6.1
+    hooks:
+      - id: check-pre-commit-ci-config
+
   # Markdown Table of Contents generation.
   - repo: https://github.com/thlorenz/doctoc
     rev: v2.2.0

conf/firefox-forbidden-policies.js

@@ -20,45 +20,64 @@ lockPref("cookiebanners.service.mode.privateBrowsing", 2);
 
 // I can set my preferred fonts in an order! :O
 // but obviously this is forbidden in policies.json!
-lockPref("font.default.el", "serif");
+//lockPref("font.default.el", "serif");
-lockPref("font.default.x-cyrillic", "serif");
+//lockPref("font.default.x-cyrillic", "serif");
+clearPref("font.default.el");
+clearPref("font.default.x-cyrillic");
 //lockPref("font.default.x-western", "serif");
-lockPref("font.default.x-western", "sans-serif");
+clearPref("font.default.x-western");
 // lockPref(
 // 	"font.name-list.monospace.x-cyrillic",
 // 	"Noto Shanns Mono, monospace",
 // );
-// lockPref("font.name-list.monospace.x-western", "Noto Shanns Mono, monospace");
+lockPref(
-// lockPref("font.name-list.sans-serif.x-cyrillic", "Noto Sans, sans-serif");
+	"font.name-list.monospace.x-western",
+	"Roboto Mono, Noto Sans Mono, monospace",
+);
+lockPref(
+	"font.name-list.sans-serif.x-cyrillic",
+	"Roboto, Noto Sans, sans-serif",
+);
 lockPref(
 	"font.name-list.sans-serif.x-western",
-	"Comic Neue Angular, Liberation Sans, Arimo, Arial, Noto Sans, sans-serif",
+	"Roboto, Noto Sans, sans-serif",
 );
-// lockPref("font.name-list.serif.x-cyrillic", "Noto Serif, serif");
+lockPref(
-// lockPref("font.name-list.serif.x-western", "Noto Serif, serif");
+	"font.name-list.serif.x-cyrillic",
-clearPref("font.name-list.monospace.x-cyrillic");
+	"Roboto Serif, Noto Serif, serif",
+);
+lockPref("font.name-list.serif.x-western", "Roboto Serif, Noto Serif, serif");
+//clearPref("font.name-list.monospace.x-cyrillic");
 //clearPref("font.name-list.monospace.x-western");
-clearPref("font.name-list.sans-serif.x-cyrillic");
+//clearPref("font.name-list.sans-serif.x-cyrillic");
-clearPref("font.name-list.sans-serif.x-western");
+//clearPref("font.name-list.sans-serif.x-western");
-clearPref("font.name-list.serif.x-cyrillic");
+//clearPref("font.name-list.serif.x-cyrillic");
-clearPref("font.name-list.serif.x-western");
+//clearPref("font.name-list.serif.x-western");
 //
-lockPref("font.name.monospace.el", "Liberation Mono");
+//lockPref("font.name.monospace.el", "Liberation Mono");
-lockPref("font.name.monospace.x-cyrillic", "Liberation Mono");
+clearPref("font.name.monospace.el", "Liberation Mono");
-lockPref("font.name.monospace.x-western", "Liberation Mono");
+//lockPref("font.name.monospace.x-cyrillic", "Liberation Mono");
+clearPref("font.name.monospace.x-cyrillic", "Liberation Mono");
+//lockPref("font.name.monospace.x-western", "Liberation Mono");
+clearPref("font.name.monospace.x-western", "Liberation Mono");
 //
 //lockPref("font.name.sans-serif.el", "Liberation Sans");
 clearPref("font.name.sans-serif.el");
-lockPref("font.name.sans-serif.x-cyrillic", "Liberation Sans");
+//lockPref("font.name.sans-serif.x-cyrillic", "Liberation Sans");
-lockPref("font.name.sans-serif.x-western", "Liberation Sans");
+clearPref("font.name.sans-serif.x-cyrillic", "Liberation Sans");
+//lockPref("font.name.sans-serif.x-western", "Liberation Sans");
+clearPref("font.name.sans-serif.x-western", "Liberation Sans");
 //
-lockPref("font.name.serif.el", "Liberation Serif");
+//lockPref("font.name.serif.el", "Liberation Serif");
-lockPref("font.name.serif.x-cyrillic", "Liberation Serif");
+clearPref("font.name.serif.el", "Liberation Serif");
-lockPref("font.name.serif.x-western", "Liberation Serif");
+//lockPref("font.name.serif.x-cyrillic", "Liberation Serif");
+clearPref("font.name.serif.x-cyrillic", "Liberation Serif");
+//lockPref("font.name.serif.x-western", "Liberation Serif");
+clearPref("font.name.serif.x-western", "Liberation Serif");
 // Allow these fonts regardless of the fingerprinting resistance
 lockPref(
 	"font.system.whitelist",
-	"Liberation Serif, Tinos, Times New Roman, Liberation Sans, Arimo, Arial, Liberation Mono, Cousine, Courier New, Noto Sans, Noto Serif, Noto Mono, OpenDyslexic, Noto Emoji, Noto Color Emoji, Comic Neue, Comic Neue Angular, Comic Neue Angular Light, Comic Neue Angular Light Italic, Comic Neue Light, Twemoji Mozilla, Noto Sans CJK JP, Noto Math, Noto Music",
+	"Liberation Serif, Tinos, Times New Roman, Liberation Sans, Arimo, Arial, Liberation Mono, Cousine, Courier New, Noto Sans, Noto Serif, Noto Mono, OpenDyslexic, Noto Emoji, Noto Color Emoji, Comic Neue, Comic Neue Angular, Comic Neue Angular Light, Comic Neue Angular Light Italic, Comic Neue Light, Twemoji Mozilla, Noto Sans CJK JP, Noto Math, Noto Music, Roboto, Roboto Serif, Roboto Mono, Roboto Flex",
 );
 
 // Play animated images only once, accessibility.

conf/mpv.conf

@@ -10,10 +10,13 @@ alang=jpn,jp,ja,en,eng
 # but I still prefer to have subtitles. Note that two are shown simultaneously.
 slang=fi,fin,sdh,doh,en,eng,eo,epo,sv,swe,ru,rus,cs,ces,cze,es,spa
 
-# I find myself reading it a lot faster than other fonts which is kind of
+# Subtitle font, although only one is allowed at a time?
-# relevant with subtitles
 #sub-font='Noto Serif Regular'
-sub-font='Comic Shanns Mono'
+# Roboto would be metrically compatible with Noto, but if only one is allowed
+# at a time, Noto is likely better covered.
+#sub-font='Roboto'
+sub-font='Noto Sans'
+#sub-font='Comic Shanns Mono'
 # YLE uses Tiresias Screenfont which is the only not-FOSS one. This is the
 # closest?
 #sub-font='Tiresias PCfont'

etc/profile.d/99-brew-whateverenv.sh

@@ -8,10 +8,10 @@
 
 # https://github.com/go-nv/goenv
 if [ -f /home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv ]; then
-	eval "$(/home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv init -)"
+	eval "$(/home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv init -)" > /dev/null 2>&1
 	PATH=/home/linuxbrew/.linuxbrew/opt/goenv/bin/shims:$PATH
 elif [ -f ~/.goenv/bin/goenv ]; then
-	eval "$(~/.goenv/bin/goenv init -)"
+	eval "$(~/.goenv/bin/goenv init -)" > /dev/null 2>&1
 fi
 
 # https://github.com/nvm-sh/nvm
@@ -28,6 +28,8 @@ fi
 if [ -f /home/linuxbrew/.linuxbrew/opt/rbenv/bin/rbenv ]; then
 	eval "$(/home/linuxbrew/.linuxbrew/opt/rbenv/bin/rbenv init -)"
 	PATH=/home/linuxbrew/.linuxbrew/opt/rbenv/bin/shims:$PATH
+	# No OpenSSL? Remember (and substitute the x, y and z)!:
+	# rbenv install --  --with-openssl-dir=/home/linuxbrew/.linuxbrew/Cellar/openssl@x/x.y.z/
 elif [ -f ~/.rbenv/bin/rbenv ]; then
 	eval "$(~/.rbenv/bin/rbenv init -)"
 	# Remember! And verify it before running!

etc/systemd/network/10-ether.network

@@ -2,30 +2,16 @@
 Type=ether
 
 [Link]
-RequiredForOnline=false
+# I always mask systemd-networkd-wait-online.service anyway, so everything can
-# If something else (like NetworkManager) manages network, uncomment
+# be required for online if it wants to be.
-#Unmanaged=true
+ActivationPolicy=always-up
-# Required for mDNS
+# Nothing else is managing addressing etc.
-#Multicast=true
+Unmanaged=false
 
 [Network]
 DHCP=true
-# systemctl enable systemd-resolved && systemctl start systemd-resolved
+IPv6PrivacyExtensions=true
-# ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+IPv6LinkLocalAddressGenerationMode=stable-privacy
-DNS=
-DNS=::1
-DNS=127.0.0.1
-DNS=127.0.0.53
 DNSSEC=true
-#DNSOverTLS=opportunistic
 DNSOverTLS=true
-# Search domains
 Domains=.
-# Enable systemd-timesyncd with `timedatectl set-ntp true`, may be specified
-# multiple times, but you are using Chrony instead, right?
-#NTP=fi.pool.ntp.org
-#NTP=time.cloudflare.com
-# Enable mDNS/.local for systemd-resolved
-#MulticastDNS=true
-# Windows
-#LLMNR=true

etc/systemd/network/10-ether.network.d/home-static.conf

@@ -2,11 +2,9 @@
 # Dock MACAddress here?
 MACAddress=ff:ff:ff:ff:ff:ff
 
-[Link]
+# Redunant for reading in the main file, but reminder never hurts?
-RequiredForOnline=true
+#[Link]
-# Takes "ipv4", "ipv6", "both", or "any" (default).
+#ActivationPolicy=always-up
-#RequiredFamilyForOnline=both
-ActivationPolicy=always-up
 
 [Network]
 # /24, /16, /8 are the the class C, B, A networks

etc/systemd/network/10-wlan.network

@@ -1,35 +1,17 @@
 [Match]
-#Name=*
-# Can be {colon,hyphen,dot}-delimited hexadecimal or IPv{4,6} address
-#MACAddress=
 Type=wlan
 
 [Link]
-# Takes "ipv4", "ipv6", "both", or "any" (default).
+# I always mask systemd-networkd-wait-online.service anyway, so everything can
-#RequiredFamilyForOnline=both
+# be required for online if it wants to be.
-# Always set administrative state to up. Implies RequiredForOnline=true
 ActivationPolicy=always-up
-# If something else (like iwd EnableNetworkConfiguration=true) manages network,
+# Nothing else is managing addressing etc.
-# uncomment
+Unmanaged=false
-#Unmanaged=true
-# Required for mDNS
-#Multicast=true
 
 [Network]
 DHCP=true
 IPv6PrivacyExtensions=true
 IPv6LinkLocalAddressGenerationMode=stable-privacy
-DNS=
-DNS=::1
-DNS=127.0.0.1
-DNS=127.0.0.53
-# Enable mDNS/.local for systemd-resolved
-#MulticastDNS=true
-# Windows
-#LLMNR=true
-# systemd-resolved configuration
 DNSSEC=true
-#DNSOverTLS=opportunistic
 DNSOverTLS=true
-# Search domains
 Domains=.

install

@@ -3,7 +3,7 @@
 set -x
 
 if [ -d ~/src/gitea.blesmrt.net/Mikaela/ssh-allowed_signers ]; then
-	git verify-commit HEAD
+	git verify-commit HEAD || exit 1
 	sleep 3
 else
 	echo "Keys not found, cloning..."

local/share/dark-mode.d/00-do-not-repeat-yourself.bash

@@ -23,9 +23,9 @@ export DARKMANGET="$(darkman get)"
 
 printf "Distribution: $DISTROID\nRelease: $DISTROREL\nMode: $DARKMANGET\n"
 
-if [[ "$DARKMANGET" -eq "dark" ]]; then
+if [[ "$DARKMANGET" -eq "light" ]]; then
 	notify-send --app-name="darkman" --urgency=low --icon=weather-clear-night "Teema: $DARKMANGET"
-elif [[ "$DARKMANGET" -eq "light" ]]; then
+elif [[ "$DARKMANGET" -eq "dark" ]]; then
 	notify-send --app-name="darkman" --urgency=low --icon=weather-clear "Teema: $DARKMANGET"
 else
 	ERRORMESSAGE="Something went wrong?"

local/share/dark-mode.d/10-adwaita-breeze-dark.bash

@@ -6,11 +6,11 @@
 
 # GTK Theme
 gsettings set org.gnome.desktop.interface color-scheme 'prefer-dark'
-gsettings set org.gnome.desktop.interface gtk-theme Adwaita-dark
+gsettings set org.gnome.desktop.interface gtk-theme Adwaita
-dbus-send --session --dest=org.kde.GtkConfig --type=method_call /GtkConfig org.kde.GtkConfig.setGtkTheme "string:Adwaita-dark"
+dbus-send --session --dest=org.kde.GtkConfig --type=method_call /GtkConfig org.kde.GtkConfig.setGtkTheme "string:Adwaita"
 
 # Xfce theme?e
-xfconf-query --channel xsettings --create --type string --property /Net/ThemeName --set Adwaita-dark
+xfconf-query --channel xsettings --create --type string --property /Net/ThemeName --set Adwaita
 
 # Plasma
 lookandfeeltool --platform offscreen --apply "org.kde.breezedark.desktop"

rc/bashrc

@@ -269,10 +269,10 @@ export RES_OPTIONS="timeout:2 attempts:2 rotate edns0 trust-ad"
 
 # https://github.com/go-nv/goenv
 if [ -f /home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv ]; then
-	eval "$(/home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv init -)"
+	eval "$(/home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv init -)" > /dev/null 2>&1
 	PATH=/home/linuxbrew/.linuxbrew/opt/goenv/bin/shims:$PATH
 elif [ -f ~/.goenv/bin/goenv ]; then
-	eval "$(~/.goenv/bin/goenv init -)"
+	eval "$(~/.goenv/bin/goenv init -)" > /dev/null 2>&1
 fi
 
 # https://github.com/nvm-sh/nvm
@@ -289,6 +289,8 @@ fi
 if [ -f /home/linuxbrew/.linuxbrew/opt/rbenv/bin/rbenv ]; then
 	eval "$(/home/linuxbrew/.linuxbrew/opt/rbenv/bin/rbenv init -)"
 	PATH=/home/linuxbrew/.linuxbrew/opt/rbenv/bin/shims:$PATH
+# No OpenSSL? Remember (and substitute the x, y and z)!:
+# rbenv install --  --with-openssl-dir=/home/linuxbrew/.linuxbrew/Cellar/openssl@x/x.y.z/
 elif [ -f ~/.rbenv/bin/rbenv ]; then
 	eval "$(~/.rbenv/bin/rbenv init -)"
 	# Remember! And verify it before running!
@@ -746,7 +748,7 @@ function shell-things {
 		git remote set-url origin https://gitea.blesmrt.net/Mikaela/shell-things.git
 		git fetch --all
 		git pull
-		git verify-commit HEAD
+		git verify-commit HEAD || exit 1
 		sleep 10
 		echo ""
 		echo "shell-things: Installing/Upgrading..."

rc/zshrc

@@ -223,10 +223,10 @@ export RES_OPTIONS="timeout:2 attempts:2 rotate edns0 trust-ad"
 
 # https://github.com/go-nv/goenv
 if [ -f /home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv ]; then
-	eval "$(/home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv init -)"
+	eval "$(/home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv init -)" > /dev/null 2>&1
 	PATH=/home/linuxbrew/.linuxbrew/opt/goenv/bin/shims:$PATH
 elif [ -f ~/.goenv/bin/goenv ]; then
-	eval "$(~/.goenv/bin/goenv init -)"
+	eval "$(~/.goenv/bin/goenv init -)" > /dev/null 2>&1
 fi
 
 # https://github.com/nvm-sh/nvm
@@ -243,6 +243,9 @@ fi
 if [ -f /home/linuxbrew/.linuxbrew/opt/rbenv/bin/rbenv ]; then
 	eval "$(/home/linuxbrew/.linuxbrew/opt/rbenv/bin/rbenv init -)"
 	PATH=/home/linuxbrew/.linuxbrew/opt/rbenv/bin/shims:$PATH
+
+# No OpenSSL? Remember (and substitute the x, y and z)!:
+# rbenv install --  --with-openssl-dir=/home/linuxbrew/.linuxbrew/Cellar/openssl@x/x.y.z/
 elif [ -f ~/.rbenv/bin/rbenv ]; then
 	eval "$(~/.rbenv/bin/rbenv init -)"
 	# Remember! And verify it before running!
@@ -724,7 +727,7 @@ function shell-things {
 		git remote set-url origin https://gitea.blesmrt.net/Mikaela/shell-things.git
 		git fetch --all
 		git pull
-		git verify-commit HEAD
+		git verify-commit HEAD || exit 1
 		sleep 10
 		echo ""
 		echo "shell-things: Installing/Upgrading..."