diff --git a/harden.sh b/harden.sh index 73aa3e9..1eb1da8 100755 --- a/harden.sh +++ b/harden.sh @@ -27,5 +27,8 @@ chown 0:0 flake.lock; chown 0:0 flake.nix chown 0:0 profiles/*/configuration.nix; chown 0:0 harden.sh; +chown 0:0 soften.sh; +chown 0:0 install.sh; +chown 0:0 update.sh; chown 1000:users **/README.org; popd &> /dev/null; diff --git a/install.sh b/install.sh index cfe44f2..f8993a0 100755 --- a/install.sh +++ b/install.sh @@ -28,11 +28,12 @@ if [ -z "$EDITOR" ]; then fi $EDITOR ~/.dotfiles/flake.nix; +# Permissions for files that should be owned by root +sudo ~/.dotfiles/harden.sh ~/.dotfiles; + # Rebuild system sudo nixos-rebuild switch --flake ~/.dotfiles#system; # Install and build home-manager configuration nix run home-manager/master --extra-experimental-features nix-command --extra-experimental-features flakes -- switch --flake ~/.dotfiles#user; -# Permissions for files that should be owned by root -sudo ~/.dotfiles/harden.sh ~/.dotfiles; diff --git a/soften.sh b/soften.sh new file mode 100755 index 0000000..55dbbc5 --- /dev/null +++ b/soften.sh @@ -0,0 +1,27 @@ +#!/bin/sh + +# This will soften the security of these dotfiles, allowing +# the default unpriveleged user with UID/GID of 1000 to edit ALL FILES +# in the dotfiles directory + +# This mainly is just here to be used by some scripts + +# Run this inside of ~/.dotfiles (or whatever directory you installed +# the dotfiles to) + +# Run this as root! + +# BTW, this assumes your user account has a UID/GID of 1000 + +# After running this, YOUR UNPRIVELEGED USER CAN MAKE EDITS TO +# IMPORTANT SYSTEM FILES WHICH MAY COMPROMISE THE SYSTEM AFTER +# RUNNING nixos-rebuild switch! + +if [ "$#" = 1 ]; then + dotfilesDir=$1; +else + dotfilesDir=$(pwd); +fi +pushd $dotfilesDir &> /dev/null; +chown -R 1000:users .; +popd &> /dev/null; diff --git a/update.sh b/update.sh new file mode 100755 index 0000000..8c890b6 --- /dev/null +++ b/update.sh @@ -0,0 +1,23 @@ +#!/bin/sh + +# Automated script to update my non-primary systems +# to be in sync with upstream git repo while +# preserving local edits to dotfiles via git stash + +# Relax permissions temporarily so git can work +sudo ~/.dotfiles/soften.sh ~/.dotfiles; + +# Stash local edits, pull changes, and re-apply local edits +git stash +git pull +git stash apply + +# Permissions for files that should be owned by root +sudo ~/.dotfiles/harden.sh ~/.dotfiles; + +# Rebuild system +sudo nixos-rebuild switch --flake ~/.dotfiles#system; + +# Install and build home-manager configuration +home-manager --extra-experimental-features nix-command --extra-experimental-features flakes -- switch --flake ~/.dotfiles#user; +