Stage 7: command-line helpers dsv, duser, dfw, dsys (0.5.0)
- das-helpers replaces the dsv package and adds shared functions in /usr/lib/das/helpers.sh (bilingual messages, sudo re-exec, prompts). - dsv new creates a runit service (command, user, directory, environment, svlogd log) and checks it stays up; dsv rm deletes one not from a package. - duser: list, add (installer groups, --admin, key, password), del, passwd, lock/unlock (key logins too), key add|list|rm, groups +/-. - dfw: allow/deny/status/reload for the tcp_ports and udp_ports sets of the inet das table, kept in /etc/nftables.d/dfw.nft and checked with nft -c. - dsys: info, hostname, timezone, locale, keymap. - xtools-minimal on both images. - nftables.conf no longer suggests restarting the nftables service: its finish script flushes the whole ruleset, fail2ban's and Docker's included. - das-server-install 0.2.0 mentions the helpers when it finishes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -1,7 +1,7 @@
|
||||
## Das OS
|
||||
### _A light, friendly Void Linux–based desktop with Xfce and a Ukrainian touch, plus a console server edition_
|
||||
|
||||
[](https://voidlinux.org) [](https://xfce.org) [](https://docs.voidlinux.org/config/services/) [](https://go.dev) [](https://www.docker.com) [](#)
|
||||
[](https://voidlinux.org) [](https://xfce.org) [](https://docs.voidlinux.org/config/services/) [](https://go.dev) [](https://www.docker.com) [](#)
|
||||
|
||||
🇺🇦 [Українська версія](README_ua.md)
|
||||
|
||||
@@ -15,7 +15,7 @@ Void Linux is fast, simple and independent: runit instead of systemd, and its ow
|
||||
- [System update](#Update) with a snapshot taken before it: a window, a tray icon and a terminal mode
|
||||
- [Welcome window](#Welcome) at the first login: language, home folders, updates and help
|
||||
- [Server image](#Server): a console live ISO with a text installer, SSH, firewall, fail2ban and Docker
|
||||
- [Service manager](#Services) `dsv`: enable, start and read the logs of runit services, like systemctl
|
||||
- [Command-line helpers](#Helpers) for everyday admin tasks: services (`dsv`), users (`duser`), firewall (`dfw`) and system settings (`dsys`)
|
||||
- [Das OS look](#Look): light and dark themes, generated window frames, wallpapers and logo
|
||||
- [Desktop defaults](#Defaults) for Xfce that don't overwrite stock files
|
||||
- [Own package repository](#Repository) built by xbps-src from in-tree templates
|
||||
@@ -129,17 +129,19 @@ Void Linux is fast, simple and independent: runit instead of systemd, and its ow
|
||||
- It uses the same GPT and Btrfs layout as the desktop installer, so snapshots, the *Das OS snapshots* boot menu and `snapper-rollback` work the same way. GRUB is installed for UEFI (also at the fallback path) or BIOS, on the serial console too when the installer was started there.
|
||||
- The administrator gets sudo through `wheel` and is in the `docker` and `socklog` groups. root has no password.
|
||||
- The installed system runs `sshd`, `chronyd`, `nftables`, `fail2ban`, `docker`, `socklog` and the chosen network service.
|
||||
- nftables lets in only SSH, ICMP and DHCPv6 (`/etc/nftables.conf`). The rules live in their own table `inet das`, so reloading them keeps the Docker and fail2ban rules. Ports that containers publish pass through Docker's own rules.
|
||||
- nftables lets in only SSH, ICMP and DHCPv6 (`/etc/nftables.conf`), more ports are opened with `dfw`. The rules live in their own table `inet das`, so reloading them keeps the Docker and fail2ban rules. Ports that containers publish pass through Docker's own rules.
|
||||
- fail2ban bans addresses that keep failing SSH logins, reading the socklog log. sshd doesn't accept root password logins.
|
||||
- Tools: Docker with Compose, lazydocker, lazygit, Midnight Commander, tmux, htop, Python 3, curl, `das-update --cli` and `dsv`. There are no graphical libraries.
|
||||
- Tools: Docker with Compose, lazydocker, lazygit, Midnight Commander, tmux, htop, Python 3, curl, `das-update --cli`, the [helpers](#Helpers) and xtools (`xi`, `xq`, `xrs`). There are no graphical libraries, and no firmware for NVIDIA graphics or sound cards (`/etc/xbps.d/das-server.conf` keeps updates from bringing it back).
|
||||
|
||||
#### Service manager<a id='Services' />
|
||||
**_`dsv` manages runit services the way systemctl does on systemd distributions._**
|
||||
- `dsv list` shows every service in `/etc/sv`: whether it is enabled, its state, PID and uptime.
|
||||
- `dsv enable NAME` starts a service at boot (a link in the default runlevel) and starts it now. `dsv disable NAME` does the opposite.
|
||||
- `dsv start|stop|restart|status NAME` wrap `sv` and print the new state.
|
||||
- `dsv logs NAME [-f]` shows the service's own svlogd log or, for services that log to syslog, their lines collected by socklog.
|
||||
- It runs itself through sudo when it needs root and has bash completion. It is on the desktop too.
|
||||
#### Command-line helpers<a id='Helpers' />
|
||||
**_Short commands for tasks that systemd distributions handle with systemctl, hostnamectl and the like, and that Void leaves to manual editing._**
|
||||
- They answer in Ukrainian or English, run themselves again through sudo when they need root and have bash completion. In a terminal they ask for whatever is missing, and with all arguments given they work in scripts.
|
||||
- `dsv` manages runit services: `list` (enabled or not, state, PID, uptime), `enable` and `disable` (at boot and right now), `start`, `stop`, `restart`, `status` and `logs [-f]` (the service's own svlogd log or its lines in socklog).
|
||||
- `dsv new` creates a service for your own program: the command, user, working directory and environment variables go to `/etc/sv/NAME`, with a log in `/var/log/NAME`. It then starts the service and checks that it stays up. `dsv rm` deletes such a service and refuses to touch services from packages.
|
||||
- `duser` manages accounts: `add` with the same groups as the desktop installer (`--admin` adds `wheel`, `docker` and `socklog`), a password and an SSH key; `passwd`, `lock` and `unlock` (a locked account can't log in with a key either), `key add|list|rm` for `authorized_keys`, `groups NAME +GROUP -GROUP` and `del`. It won't delete or lock out the current user, and it won't delete the only administrator.
|
||||
- `dfw` opens ports in the server firewall: `dfw allow 80/tcp`, `dfw allow https 8000-8010/tcp`, `dfw deny 80/tcp`. The ports are kept in `/etc/nftables.d/dfw.nft` and checked with `nft -c` before loading, and only the `inet das` table is reloaded. `dfw status` also lists the ports Docker containers publish and the addresses fail2ban has banned. SSH always stays open.
|
||||
- `dsys` replaces hostnamectl, timedatectl and localectl: `info` (time sync, language, console, addresses), `hostname`, `timezone` (part of the name will do: `dsys timezone Kyiv`), `locale` (builds the glibc locale if needed) and `keymap` (with a Cyrillic console font for Cyrillic layouts).
|
||||
- They come in the `das-helpers` package and are on the desktop too. Both images also include `xtools-minimal` from Void for package work: `xi` installs, `xrs` searches, `xq` shows package details and `xcheckrestart` finds programs to restart after an update.
|
||||
|
||||
#### Das OS look<a id='Look' />
|
||||
**_A modern minimal style with a blue and yellow eight-petal star from Ukrainian embroidery._**
|
||||
@@ -163,7 +165,7 @@ Void Linux is fast, simple and independent: runit instead of systemd, and its ow
|
||||
- `srcpkgs/das-tools` contains `das-welcome` and the update window and tray icon (Go, GTK 3 through gotk3) with their menu and autostart entries. Its subpackage `das-update` is the update command and polkit action, without GTK.
|
||||
- `srcpkgs/das-snapshots` contains the snapper configuration, `das-snapper-setup` and the dracut module for booting snapshots.
|
||||
- `srcpkgs/das-installer` contains the Calamares settings and branding, `srcpkgs/das-server-installer` the console installer. The steps both share (`mount-source`, `postinstall`) are in `srcpkgs/das-install-common`. They exist only on the live ISOs.
|
||||
- `srcpkgs/das-server` is the server metapackage with the nftables, fail2ban, sshd and Docker defaults. `srcpkgs/dsv` contains the service manager.
|
||||
- `srcpkgs/das-server` is the server metapackage with the nftables, fail2ban, sshd and Docker defaults. `srcpkgs/das-helpers` contains `dsv`, `duser`, `dfw` and `dsys`.
|
||||
- `srcpkgs/calamares`, `srcpkgs/adw-gtk3` and `srcpkgs/font-jetbrains-mono` package upstream releases that Void does not have.
|
||||
- `make packages` lays the templates over a shallow clone of void-packages and builds them with `xbps-src` into `out/hostdir/binpkgs`. The ISO build installs them from there.
|
||||
|
||||
@@ -185,6 +187,6 @@ make clean # remove build output, keep the download cache
|
||||
```
|
||||
The ISOs appear in `out/iso/dasos-<version>-x86_64.iso` and `out/iso/dasos-server-<version>-x86_64.iso`. Write them to a USB stick with `dd` or Ventoy.
|
||||
|
||||
**Note:** Das OS is an early version (0.4.0). The developer profile, smaller ISOs and signed repository hosting are planned for upcoming stages. Until the repository is hosted, an installed system gets updates from Void only. Das OS is based on Void Linux but is not affiliated with it.
|
||||
**Note:** Das OS is an early version (0.5.0). The developer profile and signed repository hosting are planned for upcoming stages. Until the repository is hosted, an installed system gets updates from Void only. Das OS is based on Void Linux but is not affiliated with it.
|
||||
|
||||
###### _Made by -=:dAs:=-_
|
||||
|
||||
Reference in New Issue
Block a user