mirror of
https://github.com/Start9Labs/start-os.git
synced 2026-03-26 10:21:52 +00:00
68f401bfa3
* fix live-build resolv.conf * improved debuggability * wip: start-tunnel * fixes for trixie and tor * non-free-firmware on trixie * wip * web server WIP * wip: tls refactor * FE patchdb, mocks, and most endpoints * fix editing records and patch mocks * refactor complete * finish api * build and formatter update * minor change toi viewing addresses and fix build * fixes * more providers * endpoint for getting config * fix tests * api fixes * wip: separate port forward controller into parts * simplify iptables rules * bump sdk * misc fixes * predict next subnet and ip, use wan ips, and form validation * refactor: break big components apart and address todos (#3043) * refactor: break big components apart and address todos * starttunnel readme, fix pf mocks, fix adding tor domain in startos --------- Co-authored-by: Matt Hill <mattnine@protonmail.com> * better tui * tui tweaks * fix: address comments * better regex for subnet * fixes * better validation * handle rpc errors * build fixes * fix: address comments (#3044) * fix: address comments * fix unread notification mocks * fix row click for notification --------- Co-authored-by: Matt Hill <mattnine@protonmail.com> * fix raspi build * fix build * fix build * fix build * fix build * try to fix build * fix tests * fix tests * fix rsync tests * delete useless effectful test --------- Co-authored-by: Matt Hill <mattnine@protonmail.com> Co-authored-by: Alex Inkin <alexander@inkin.ru>
137 lines
6.2 KiB
Bash
Executable File
137 lines
6.2 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
set -e
|
|
|
|
# install dependencies
|
|
/usr/bin/apt update
|
|
/usr/bin/apt install --no-install-recommends -y xserver-xorg x11-xserver-utils xinit firefox-esr matchbox-window-manager libnss3-tools p11-kit-modules
|
|
|
|
#Change a default preference set by stock debian firefox-esr
|
|
sed -i 's|^pref("extensions.update.enabled", true);$|pref("extensions.update.enabled", false);|' /etc/firefox-esr/firefox-esr.js
|
|
|
|
if ! id kiosk; then
|
|
# create kiosk user
|
|
useradd -s /bin/bash --create-home kiosk
|
|
fi
|
|
|
|
mkdir /home/kiosk/fx-profile
|
|
cat >> /home/kiosk/fx-profile/prefs.js << EOF
|
|
user_pref("app.normandy.api_url", "");
|
|
user_pref("app.normandy.enabled", false);
|
|
user_pref("app.shield.optoutstudies.enabled", false);
|
|
user_pref("app.update.enabled", false);
|
|
user_pref("browser.aboutHomeSnippets.updateUrl", "");
|
|
user_pref("browser.bookmarks.addedImportButton", false);
|
|
user_pref("browser.casting.enabled", false);
|
|
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false);
|
|
user_pref("browser.newtabpage.activity-stream.feeds.asrouterfeed", false);
|
|
user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
|
|
user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);
|
|
user_pref("browser.ping-centre.telemetry", false);
|
|
user_pref("browser.pocket.enabled", false);
|
|
user_pref("browser.safebrowsing.blockedURIs.enabled", false);
|
|
user_pref("browser.safebrowsing.malware.enabled", false);
|
|
user_pref("browser.safebrowsing.phishing.enabled", false);
|
|
user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
|
|
user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
|
|
user_pref("browser.safebrowsing.downloads.remote.enabled", false);
|
|
user_pref("browser.search.geoip.url", "");
|
|
user_pref("browser.search.update", false);
|
|
user_pref("browser.search.suggest.enabled", false);
|
|
user_pref("browser.startup.homepage_override.mstone", "ignore");
|
|
user_pref("browser.theme.content-theme", 0);
|
|
user_pref("browser.theme.toolbar-theme", 0);
|
|
user_pref("browser.urlbar.groupLabels.enabled", false);
|
|
user_pref("browser.urlbar.suggest.searches", false);
|
|
user_pref("datareporting.policy.firstRunURL", "");
|
|
user_pref("datareporting.healthreport.service.enabled", false);
|
|
user_pref("datareporting.healthreport.uploadEnabled", false);
|
|
user_pref("datareporting.policy.dataSubmissionEnabled", false);
|
|
user_pref("dom.securecontext.allowlist_onions", true);
|
|
user_pref("dom.securecontext.whitelist_onions", true);
|
|
user_pref("experiments.enabled", false);
|
|
user_pref("experiments.activeExperiment", false);
|
|
user_pref("extensions.activeThemeID", "firefox-compact-dark@mozilla.org");
|
|
user_pref("extensions.blocklist.enabled", false);
|
|
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
|
|
user_pref("extensions.pocket.enabled", false);
|
|
user_pref("extensions.update.enabled", false);
|
|
user_pref("extensions.shield-recipe-client.enabled", false);
|
|
user_pref("extensions.shield-recipe-client.user_id", "");
|
|
user_pref("extensions.shield-recipe-client.api_url", "");
|
|
user_pref("media.gmp-gmpopenh264.enabled", false);
|
|
user_pref("messaging-system.rsexperimentloader.enabled", false);
|
|
user_pref("network.allow-experiments", false);
|
|
user_pref("network.captive-portal-service.enabled", false);
|
|
user_pref("network.connectivity-service.enabled", false);
|
|
user_pref("network.proxy.socks", "10.0.3.1");
|
|
user_pref("network.proxy.socks_port", 9050);
|
|
user_pref("network.proxy.socks_version", 5);
|
|
user_pref("network.proxy.socks_remote_dns", true);
|
|
user_pref("network.proxy.type", 1);
|
|
user_pref("privacy.resistFingerprinting", true);
|
|
//Enable letterboxing if we want the window size sent to the server to snap to common resolutions:
|
|
//user_pref("privacy.resistFingerprinting.letterboxing", true);
|
|
user_pref("privacy.trackingprotection.enabled", true);
|
|
user_pref("signon.rememberSignons", false);
|
|
user_pref("toolkit.telemetry.archive.enabled", false);
|
|
user_pref("toolkit.telemetry.bhrPing.enabled", false);
|
|
user_pref("toolkit.telemetry.coverage.opt-out", true);
|
|
user_pref("toolkit.telemetry.enabled", false);
|
|
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false);
|
|
user_pref("toolkit.telemetry.newProfilePing.enabled", false);
|
|
user_pref("toolkit.telemetry.reportingpolicy.firstRun", false);
|
|
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false);
|
|
user_pref("toolkit.telemetry.unified", false);
|
|
user_pref("toolkit.telemetry.updatePing.enabled", false);
|
|
user_pref("toolkit.telemetry.cachedClientID", "");
|
|
//Blocking automatic Mozilla CDN server requests
|
|
user_pref("extensions.getAddons.showPane", false);
|
|
user_pref("extensions.getAddons.cache.enabled", false);
|
|
//user_pref("services.settings.server", ""); // Remote settings server (HSTS preload updates and Cerfiticate Revocation Lists are fetched)
|
|
user_pref("browser.aboutHomeSnippets.updateUrl", "");
|
|
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
|
|
user_pref("browser.newtabpage.activity-stream.feeds.section.topstories", false);
|
|
user_pref("browser.newtabpage.activity-stream.feeds.system.topstories", false);
|
|
user_pref("browser.newtabpage.activity-stream.feeds.discoverystreamfeed", false);
|
|
user_pref("browser.safebrowsing.provider.mozilla.updateURL", "");
|
|
user_pref("browser.safebrowsing.provider.mozilla.gethashURL", "");
|
|
EOF
|
|
|
|
ln -sf /usr/lib/$(uname -m)-linux-gnu/pkcs11/p11-kit-trust.so /usr/lib/firefox-esr/libnssckbi.so
|
|
|
|
# create kiosk script
|
|
cat > /home/kiosk/kiosk.sh << 'EOF'
|
|
#!/bin/sh
|
|
while ! curl "http://localhost" > /dev/null; do
|
|
sleep 1
|
|
done
|
|
matchbox-window-manager -use_titlebar no &
|
|
cp -r /home/kiosk/fx-profile /home/kiosk/fx-profile-tmp
|
|
firefox-esr http://localhost --profile /home/kiosk/fx-profile-tmp
|
|
rm -rf /home/kiosk/fx-profile-tmp
|
|
EOF
|
|
chmod +x /home/kiosk/kiosk.sh
|
|
|
|
# use kiosk if tty (not pts)
|
|
if ! grep -q 'kiosk' /home/kiosk/.profile; then
|
|
cat >> /home/kiosk/.profile << 'EOF'
|
|
# Use kiosk for TTY
|
|
if [[ "$(tty)" =~ ^/dev/tty ]]; then
|
|
exec startx "$HOME/kiosk.sh"
|
|
fi
|
|
EOF
|
|
fi
|
|
|
|
chown -R kiosk:kiosk /home/kiosk
|
|
|
|
# enable autologin
|
|
mkdir -p /etc/systemd/system/getty@tty1.service.d
|
|
cat > /etc/systemd/system/getty@tty1.service.d/autologin.conf << 'EOF'
|
|
[Service]
|
|
ExecStart=
|
|
ExecStart=-/sbin/agetty --autologin kiosk --noclear %I $TERM
|
|
EOF
|
|
ln -fs /etc/systemd/system/autologin@.service /etc/systemd/system/getty.target.wants/getty@tty1.service
|
|
|