37 lines
1.4 KiB
Bash
37 lines
1.4 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -Eeuo pipefail
|
||
|
|
|
||
|
|
install -d -m 0755 /var/lib/rk1-media
|
||
|
|
hostnamectl set-hostname rk1-media 2>/dev/null || printf 'rk1-media\n' >/etc/hostname
|
||
|
|
|
||
|
|
for group_name in audio video render input; do
|
||
|
|
getent group "$group_name" >/dev/null || groupadd --system "$group_name"
|
||
|
|
done
|
||
|
|
|
||
|
|
getent group rkadmin >/dev/null || groupadd rkadmin
|
||
|
|
if ! id rkadmin >/dev/null 2>&1; then
|
||
|
|
useradd --create-home --gid rkadmin --shell /bin/bash --groups sudo,adm,systemd-journal,video,render,audio,input rkadmin
|
||
|
|
fi
|
||
|
|
usermod --password '!' rkadmin
|
||
|
|
install -d -o rkadmin -g rkadmin -m 0700 /home/rkadmin/.ssh
|
||
|
|
install -o rkadmin -g rkadmin -m 0600 /opt/rk1-seed/authorized_keys /home/rkadmin/.ssh/authorized_keys
|
||
|
|
|
||
|
|
install -d -m 0755 /etc/sudoers.d
|
||
|
|
printf 'rkadmin ALL=(ALL:ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/90-rkadmin
|
||
|
|
chmod 0440 /etc/sudoers.d/90-rkadmin
|
||
|
|
visudo --check --file=/etc/sudoers.d/90-rkadmin >/dev/null
|
||
|
|
|
||
|
|
usermod --password '!' root
|
||
|
|
if grep -q '^127\.0\.1\.1[[:space:]]' /etc/hosts; then
|
||
|
|
sed -i 's/^127\.0\.1\.1[[:space:]].*/127.0.1.1\trk1-media/' /etc/hosts
|
||
|
|
else
|
||
|
|
printf '127.0.1.1\trk1-media\n' >>/etc/hosts
|
||
|
|
fi
|
||
|
|
rm -f /root/.not_logged_in_yet /etc/ssh/ssh_host_*
|
||
|
|
ssh-keygen -A
|
||
|
|
# ssh.service normally creates this through RuntimeDirectory=sshd. This
|
||
|
|
# validation runs before ssh.service, so it must provide the directory itself.
|
||
|
|
install -d -o root -g root -m 0755 /run/sshd
|
||
|
|
/usr/sbin/sshd -t
|
||
|
|
touch /var/lib/rk1-media/identity-ready
|