feat(config): implement .env-based configuration system for credential passing
- commit
- 3692d10aa5b8624e39bed307a966127e973e93e1
- author
- bnema · · 2025-10-20 04:38 UTC
- parent
- 64c8067
- signature
- unsigned
6 files · +109 -22
M install.sh +2 -1
| @@ -8,6 +8,7 @@ set -eo pipefail | |||
| 8 | 8 | export ARCHUP_PATH="${ARCHUP_PATH:-$HOME/.local/share/archup}" | |
| 9 | 9 | export ARCHUP_INSTALL="$ARCHUP_PATH/install" | |
| 10 | 10 | export ARCHUP_INSTALL_LOG_FILE="/var/log/archup-install.log" | |
| 11 | + | export ARCHUP_INSTALL_CONFIG="/var/log/archup-install.conf" | |
| 11 | 12 | export ARCHUP_REPO_URL="${ARCHUP_REPO_URL:-https://github.com/bnema/archup}" | |
| 12 | 13 | export ARCHUP_RAW_URL="${ARCHUP_RAW_URL:-https://raw.githubusercontent.com/bnema/archup/dev}" | |
| 13 | 14 | ||
| @@ -51,7 +52,7 @@ if [ ! -d "$ARCHUP_INSTALL" ]; then | |||
| 51 | 52 | curl -sL "$GITHUB_RAW/logo.txt" -o "$ARCHUP_PATH/logo.txt" | |
| 52 | 53 | ||
| 53 | 54 | echo "Downloading helpers..." | |
| 54 | - | for file in all.sh logging.sh errors.sh presentation.sh chroot.sh cleanup.sh; do | |
| 55 | + | for file in all.sh config.sh logging.sh errors.sh presentation.sh chroot.sh cleanup.sh; do | |
| 55 | 56 | curl -sL "$GITHUB_RAW/install/helpers/$file" -o "$ARCHUP_INSTALL/helpers/$file" | |
| 56 | 57 | done | |
| 57 | 58 | ||
| @@ -8,6 +8,7 @@ set -eo pipefail | |||||
| 8 | export ARCHUP_PATH="${ARCHUP_PATH:-$HOME/.local/share/archup}" | 8 | export ARCHUP_PATH="${ARCHUP_PATH:-$HOME/.local/share/archup}" | ||
| 9 | export ARCHUP_INSTALL="$ARCHUP_PATH/install" | 9 | export ARCHUP_INSTALL="$ARCHUP_PATH/install" | ||
| 10 | export ARCHUP_INSTALL_LOG_FILE="/var/log/archup-install.log" | 10 | export ARCHUP_INSTALL_LOG_FILE="/var/log/archup-install.log" | ||
| 11 | + | export ARCHUP_INSTALL_CONFIG="/var/log/archup-install.conf" | |||
| 11 | export ARCHUP_REPO_URL="${ARCHUP_REPO_URL:-https://github.com/bnema/archup}" | 12 | export ARCHUP_REPO_URL="${ARCHUP_REPO_URL:-https://github.com/bnema/archup}" | ||
| 12 | export ARCHUP_RAW_URL="${ARCHUP_RAW_URL:-https://raw.githubusercontent.com/bnema/archup/dev}" | 13 | export ARCHUP_RAW_URL="${ARCHUP_RAW_URL:-https://raw.githubusercontent.com/bnema/archup/dev}" | ||
| 13 | 14 | ||||
| @@ -51,7 +52,7 @@ if [ ! -d "$ARCHUP_INSTALL" ]; then | |||||
| 51 | curl -sL "$GITHUB_RAW/logo.txt" -o "$ARCHUP_PATH/logo.txt" | 52 | curl -sL "$GITHUB_RAW/logo.txt" -o "$ARCHUP_PATH/logo.txt" | ||
| 52 | 53 | ||||
| 53 | echo "Downloading helpers..." | 54 | echo "Downloading helpers..." | ||
| 54 | - | for file in all.sh logging.sh errors.sh presentation.sh chroot.sh cleanup.sh; do | 55 | + | for file in all.sh config.sh logging.sh errors.sh presentation.sh chroot.sh cleanup.sh; do |
| 55 | curl -sL "$GITHUB_RAW/install/helpers/$file" -o "$ARCHUP_INSTALL/helpers/$file" | 56 | curl -sL "$GITHUB_RAW/install/helpers/$file" -o "$ARCHUP_INSTALL/helpers/$file" | ||
| 56 | done | 57 | done | ||
| 57 | 58 | ||||
M install/helpers/all.sh +1 -0
| @@ -2,6 +2,7 @@ | |||
| 2 | 2 | # Source all helper utilities | |
| 3 | 3 | # This file is sourced by install.sh to load all helper functions | |
| 4 | 4 | ||
| 5 | + | source "$ARCHUP_INSTALL/helpers/config.sh" | |
| 5 | 6 | source "$ARCHUP_INSTALL/helpers/presentation.sh" | |
| 6 | 7 | source "$ARCHUP_INSTALL/helpers/logging.sh" | |
| 7 | 8 | source "$ARCHUP_INSTALL/helpers/errors.sh" | |
| @@ -2,6 +2,7 @@ | |||||
| 2 | # Source all helper utilities | 2 | # Source all helper utilities | ||
| 3 | # This file is sourced by install.sh to load all helper functions | 3 | # This file is sourced by install.sh to load all helper functions | ||
| 4 | 4 | ||||
| 5 | + | source "$ARCHUP_INSTALL/helpers/config.sh" | |||
| 5 | source "$ARCHUP_INSTALL/helpers/presentation.sh" | 6 | source "$ARCHUP_INSTALL/helpers/presentation.sh" | ||
| 6 | source "$ARCHUP_INSTALL/helpers/logging.sh" | 7 | source "$ARCHUP_INSTALL/helpers/logging.sh" | ||
| 7 | source "$ARCHUP_INSTALL/helpers/errors.sh" | 8 | source "$ARCHUP_INSTALL/helpers/errors.sh" | ||
A install/helpers/config.sh +63 -0
| @@ -0,0 +1,63 @@ | |||
| 1 | + | #!/bin/bash | |
| 2 | + | # ArchUp Configuration Manager - .env-based config system | |
| 3 | + | # Stores preflight settings in KEY=VALUE format for reliable access across scripts | |
| 4 | + | ||
| 5 | + | # Initialize empty config file if it doesn't exist | |
| 6 | + | init_config() { | |
| 7 | + | if [ ! -f "$ARCHUP_INSTALL_CONFIG" ]; then | |
| 8 | + | touch "$ARCHUP_INSTALL_CONFIG" | |
| 9 | + | chmod 600 "$ARCHUP_INSTALL_CONFIG" | |
| 10 | + | fi | |
| 11 | + | # Ensure permissions are restricted (owner read/write only) | |
| 12 | + | chmod 600 "$ARCHUP_INSTALL_CONFIG" 2>/dev/null || true | |
| 13 | + | } | |
| 14 | + | ||
| 15 | + | # Write a value to config | |
| 16 | + | # Usage: config_set "ARCHUP_USERNAME" "brice" | |
| 17 | + | config_set() { | |
| 18 | + | local key="$1" | |
| 19 | + | local value="$2" | |
| 20 | + | ||
| 21 | + | init_config | |
| 22 | + | ||
| 23 | + | # Remove existing key if present, then append new value | |
| 24 | + | sed -i "/^${key}=/d" "$ARCHUP_INSTALL_CONFIG" | |
| 25 | + | echo "${key}=${value}" >> "$ARCHUP_INSTALL_CONFIG" | |
| 26 | + | } | |
| 27 | + | ||
| 28 | + | # Read a value from config | |
| 29 | + | # Usage: config_get "ARCHUP_USERNAME" | |
| 30 | + | config_get() { | |
| 31 | + | local key="$1" | |
| 32 | + | ||
| 33 | + | init_config | |
| 34 | + | ||
| 35 | + | grep "^${key}=" "$ARCHUP_INSTALL_CONFIG" | cut -d'=' -f2- || echo "" | |
| 36 | + | } | |
| 37 | + | ||
| 38 | + | # Source entire config file into current shell | |
| 39 | + | # Usage: config_source | |
| 40 | + | config_source() { | |
| 41 | + | init_config | |
| 42 | + | ||
| 43 | + | if [ -f "$ARCHUP_INSTALL_CONFIG" ]; then | |
| 44 | + | # Source the file but handle values with spaces/special chars | |
| 45 | + | set -a | |
| 46 | + | source "$ARCHUP_INSTALL_CONFIG" | |
| 47 | + | set +a | |
| 48 | + | fi | |
| 49 | + | } | |
| 50 | + | ||
| 51 | + | # Display config (for debugging) | |
| 52 | + | config_show() { | |
| 53 | + | init_config | |
| 54 | + | if [ -f "$ARCHUP_INSTALL_CONFIG" ]; then | |
| 55 | + | cat "$ARCHUP_INSTALL_CONFIG" | |
| 56 | + | fi | |
| 57 | + | } | |
| 58 | + | ||
| 59 | + | # Clear config | |
| 60 | + | config_clear() { | |
| 61 | + | rm -f "$ARCHUP_INSTALL_CONFIG" | |
| 62 | + | init_config | |
| 63 | + | } | |
| @@ -0,0 +1,63 @@ | |||||
| 1 | + | #!/bin/bash | |||
| 2 | + | # ArchUp Configuration Manager - .env-based config system | |||
| 3 | + | # Stores preflight settings in KEY=VALUE format for reliable access across scripts | |||
| 4 | + | ||||
| 5 | + | # Initialize empty config file if it doesn't exist | |||
| 6 | + | init_config() { | |||
| 7 | + | if [ ! -f "$ARCHUP_INSTALL_CONFIG" ]; then | |||
| 8 | + | touch "$ARCHUP_INSTALL_CONFIG" | |||
| 9 | + | chmod 600 "$ARCHUP_INSTALL_CONFIG" | |||
| 10 | + | fi | |||
| 11 | + | # Ensure permissions are restricted (owner read/write only) | |||
| 12 | + | chmod 600 "$ARCHUP_INSTALL_CONFIG" 2>/dev/null || true | |||
| 13 | + | } | |||
| 14 | + | ||||
| 15 | + | # Write a value to config | |||
| 16 | + | # Usage: config_set "ARCHUP_USERNAME" "brice" | |||
| 17 | + | config_set() { | |||
| 18 | + | local key="$1" | |||
| 19 | + | local value="$2" | |||
| 20 | + | ||||
| 21 | + | init_config | |||
| 22 | + | ||||
| 23 | + | # Remove existing key if present, then append new value | |||
| 24 | + | sed -i "/^${key}=/d" "$ARCHUP_INSTALL_CONFIG" | |||
| 25 | + | echo "${key}=${value}" >> "$ARCHUP_INSTALL_CONFIG" | |||
| 26 | + | } | |||
| 27 | + | ||||
| 28 | + | # Read a value from config | |||
| 29 | + | # Usage: config_get "ARCHUP_USERNAME" | |||
| 30 | + | config_get() { | |||
| 31 | + | local key="$1" | |||
| 32 | + | ||||
| 33 | + | init_config | |||
| 34 | + | ||||
| 35 | + | grep "^${key}=" "$ARCHUP_INSTALL_CONFIG" | cut -d'=' -f2- || echo "" | |||
| 36 | + | } | |||
| 37 | + | ||||
| 38 | + | # Source entire config file into current shell | |||
| 39 | + | # Usage: config_source | |||
| 40 | + | config_source() { | |||
| 41 | + | init_config | |||
| 42 | + | ||||
| 43 | + | if [ -f "$ARCHUP_INSTALL_CONFIG" ]; then | |||
| 44 | + | # Source the file but handle values with spaces/special chars | |||
| 45 | + | set -a | |||
| 46 | + | source "$ARCHUP_INSTALL_CONFIG" | |||
| 47 | + | set +a | |||
| 48 | + | fi | |||
| 49 | + | } | |||
| 50 | + | ||||
| 51 | + | # Display config (for debugging) | |||
| 52 | + | config_show() { | |||
| 53 | + | init_config | |||
| 54 | + | if [ -f "$ARCHUP_INSTALL_CONFIG" ]; then | |||
| 55 | + | cat "$ARCHUP_INSTALL_CONFIG" | |||
| 56 | + | fi | |||
| 57 | + | } | |||
| 58 | + | ||||
| 59 | + | # Clear config | |||
| 60 | + | config_clear() { | |||
| 61 | + | rm -f "$ARCHUP_INSTALL_CONFIG" | |||
| 62 | + | init_config | |||
| 63 | + | } | |||
M install/partitioning/format.sh +13 -3
| @@ -14,22 +14,32 @@ echo "Formatted $ARCHUP_EFI_PART as FAT32" >> "$ARCHUP_INSTALL_LOG_FILE" | |||
| 14 | 14 | if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | |
| 15 | 15 | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up LUKS encryption..." | |
| 16 | 16 | ||
| 17 | + | # Read password from config file (NOTE: Never log the actual password!) | |
| 18 | + | ARCHUP_PASSWORD=$(config_get "ARCHUP_PASSWORD") | |
| 19 | + | ||
| 20 | + | if [ -z "$ARCHUP_PASSWORD" ]; then | |
| 21 | + | gum style --foreground 1 --padding "1 0 1 $PADDING_LEFT" "ERROR: Encryption password not set!" | |
| 22 | + | echo "ERROR: Encryption password is empty during LUKS setup" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 23 | + | exit 1 | |
| 24 | + | fi | |
| 25 | + | ||
| 17 | 26 | # Wipe any existing signatures on root partition to avoid conflicts | |
| 18 | 27 | wipefs -af "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 19 | 28 | ||
| 20 | 29 | # Setup LUKS with Argon2id and 2000ms iteration time (using user password) | |
| 21 | - | echo "$ARCHUP_PASSWORD" | cryptsetup luksFormat \ | |
| 30 | + | cryptsetup luksFormat \ | |
| 22 | 31 | --type luks2 \ | |
| 23 | 32 | --batch-mode \ | |
| 24 | 33 | --pbkdf argon2id \ | |
| 25 | 34 | --iter-time 2000 \ | |
| 26 | 35 | --label ARCHUP_LUKS \ | |
| 27 | - | "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 36 | + | --stdin \ | |
| 37 | + | "$ARCHUP_ROOT_PART" <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 28 | 38 | ||
| 29 | 39 | echo "LUKS container created" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 30 | 40 | ||
| 31 | 41 | # Open the encrypted container | |
| 32 | - | echo "$ARCHUP_PASSWORD" | cryptsetup open "$ARCHUP_ROOT_PART" cryptroot >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 42 | + | cryptsetup open --key-file=- "$ARCHUP_ROOT_PART" cryptroot <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 33 | 43 | ||
| 34 | 44 | echo "LUKS container opened" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 35 | 45 | ||
| @@ -14,22 +14,32 @@ echo "Formatted $ARCHUP_EFI_PART as FAT32" >> "$ARCHUP_INSTALL_LOG_FILE" | |||||
| 14 | if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | 14 | if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | ||
| 15 | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up LUKS encryption..." | 15 | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up LUKS encryption..." | ||
| 16 | 16 | ||||
| 17 | + | # Read password from config file (NOTE: Never log the actual password!) | |||
| 18 | + | ARCHUP_PASSWORD=$(config_get "ARCHUP_PASSWORD") | |||
| 19 | + | ||||
| 20 | + | if [ -z "$ARCHUP_PASSWORD" ]; then | |||
| 21 | + | gum style --foreground 1 --padding "1 0 1 $PADDING_LEFT" "ERROR: Encryption password not set!" | |||
| 22 | + | echo "ERROR: Encryption password is empty during LUKS setup" >> "$ARCHUP_INSTALL_LOG_FILE" | |||
| 23 | + | exit 1 | |||
| 24 | + | fi | |||
| 25 | + | ||||
| 17 | # Wipe any existing signatures on root partition to avoid conflicts | 26 | # Wipe any existing signatures on root partition to avoid conflicts | ||
| 18 | wipefs -af "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | 27 | wipefs -af "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | ||
| 19 | 28 | ||||
| 20 | # Setup LUKS with Argon2id and 2000ms iteration time (using user password) | 29 | # Setup LUKS with Argon2id and 2000ms iteration time (using user password) | ||
| 21 | - | echo "$ARCHUP_PASSWORD" | cryptsetup luksFormat \ | 30 | + | cryptsetup luksFormat \ |
| 22 | --type luks2 \ | 31 | --type luks2 \ | ||
| 23 | --batch-mode \ | 32 | --batch-mode \ | ||
| 24 | --pbkdf argon2id \ | 33 | --pbkdf argon2id \ | ||
| 25 | --iter-time 2000 \ | 34 | --iter-time 2000 \ | ||
| 26 | --label ARCHUP_LUKS \ | 35 | --label ARCHUP_LUKS \ | ||
| 27 | - | "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | 36 | + | --stdin \ |
| 37 | + | "$ARCHUP_ROOT_PART" <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |||
| 28 | 38 | ||||
| 29 | echo "LUKS container created" >> "$ARCHUP_INSTALL_LOG_FILE" | 39 | echo "LUKS container created" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 30 | 40 | ||||
| 31 | # Open the encrypted container | 41 | # Open the encrypted container | ||
| 32 | - | echo "$ARCHUP_PASSWORD" | cryptsetup open "$ARCHUP_ROOT_PART" cryptroot >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | 42 | + | cryptsetup open --key-file=- "$ARCHUP_ROOT_PART" cryptroot <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 |
| 33 | 43 | ||||
| 34 | echo "LUKS container opened" >> "$ARCHUP_INSTALL_LOG_FILE" | 44 | echo "LUKS container opened" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 35 | 45 | ||||
M install/preflight/begin.sh +25 -18
| @@ -19,25 +19,15 @@ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Bootloader: Limine" | |||
| 19 | 19 | gum style --padding "0 0 1 $PADDING_LEFT" "ArchUp uses Limine for superior btrfs and snapshot support" | |
| 20 | 20 | ||
| 21 | 21 | export ARCHUP_BOOTLOADER="limine" | |
| 22 | + | config_set "ARCHUP_BOOTLOADER" "limine" | |
| 22 | 23 | echo "Bootloader: limine" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 23 | 24 | ||
| 24 | - | # Ask for encryption preference (Phase 2) | |
| 25 | + | # Ask for user credentials first (will be used for user account, root, and encryption) | |
| 25 | 26 | echo | |
| 26 | - | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Disk Encryption" | |
| 27 | - | gum style --padding "0 0 0 $PADDING_LEFT" "LUKS encryption protects your data with Argon2id (2000ms iteration)" | |
| 28 | - | echo | |
| 29 | - | ||
| 30 | - | if gum confirm "Enable full-disk encryption?" --padding "0 0 1 $PADDING_LEFT"; then | |
| 31 | - | export ARCHUP_ENCRYPTION="enabled" | |
| 32 | - | echo "Encryption: enabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 33 | - | else | |
| 34 | - | export ARCHUP_ENCRYPTION="disabled" | |
| 35 | - | echo "Encryption: disabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 36 | - | fi | |
| 37 | - | ||
| 38 | - | # Ask for user credentials (will be used for user account, root, and encryption) | |
| 39 | - | echo | |
| 40 | - | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "User Account" | |
| 27 | + | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "User Account & Security" | |
| 28 | + | gum style --padding "0 0 0 $PADDING_LEFT" "Create account with sudo privileges. This password will be used for:" | |
| 29 | + | gum style --padding "0 0 0 $PADDING_LEFT" " • User login with sudo access" | |
| 30 | + | gum style --padding "0 0 0 $PADDING_LEFT" " • Disk encryption (LUKS) if enabled" | |
| 41 | 31 | echo | |
| 42 | 32 | ||
| 43 | 33 | # Ask for username | |
| @@ -70,11 +60,28 @@ done | |||
| 70 | 60 | export ARCHUP_USERNAME | |
| 71 | 61 | export ARCHUP_PASSWORD | |
| 72 | 62 | ||
| 63 | + | # Save to config file (passwords are never logged) | |
| 64 | + | config_set "ARCHUP_USERNAME" "$ARCHUP_USERNAME" | |
| 65 | + | config_set "ARCHUP_PASSWORD" "$ARCHUP_PASSWORD" | |
| 66 | + | ||
| 73 | 67 | gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "[OK] User: $ARCHUP_USERNAME" | |
| 74 | 68 | echo "User: $ARCHUP_USERNAME" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 75 | 69 | ||
| 76 | - | if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | |
| 77 | - | gum style --foreground 3 --padding "0 0 1 $PADDING_LEFT" "Note: This password will also be used for disk encryption" | |
| 70 | + | # Ask for encryption preference | |
| 71 | + | echo | |
| 72 | + | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Disk Encryption" | |
| 73 | + | gum style --padding "0 0 0 $PADDING_LEFT" "LUKS encryption protects your data with Argon2id (2000ms iteration)" | |
| 74 | + | echo | |
| 75 | + | ||
| 76 | + | if gum confirm "Enable full-disk encryption?" --padding "0 0 1 $PADDING_LEFT"; then | |
| 77 | + | export ARCHUP_ENCRYPTION="enabled" | |
| 78 | + | config_set "ARCHUP_ENCRYPTION" "enabled" | |
| 79 | + | echo "Encryption: enabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 80 | + | gum style --foreground 3 --padding "0 0 1 $PADDING_LEFT" "Note: Using account password for disk encryption" | |
| 81 | + | else | |
| 82 | + | export ARCHUP_ENCRYPTION="disabled" | |
| 83 | + | config_set "ARCHUP_ENCRYPTION" "disabled" | |
| 84 | + | echo "Encryption: disabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 78 | 85 | fi | |
| 79 | 86 | ||
| 80 | 87 | gum style --foreground 2 --padding "1 0 1 $PADDING_LEFT" "[OK] Configuration saved" | |
| @@ -19,25 +19,15 @@ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Bootloader: Limine" | |||||
| 19 | gum style --padding "0 0 1 $PADDING_LEFT" "ArchUp uses Limine for superior btrfs and snapshot support" | 19 | gum style --padding "0 0 1 $PADDING_LEFT" "ArchUp uses Limine for superior btrfs and snapshot support" | ||
| 20 | 20 | ||||
| 21 | export ARCHUP_BOOTLOADER="limine" | 21 | export ARCHUP_BOOTLOADER="limine" | ||
| 22 | + | config_set "ARCHUP_BOOTLOADER" "limine" | |||
| 22 | echo "Bootloader: limine" >> "$ARCHUP_INSTALL_LOG_FILE" | 23 | echo "Bootloader: limine" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 23 | 24 | ||||
| 24 | - | # Ask for encryption preference (Phase 2) | 25 | + | # Ask for user credentials first (will be used for user account, root, and encryption) |
| 25 | echo | 26 | echo | ||
| 26 | - | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Disk Encryption" | 27 | + | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "User Account & Security" |
| 27 | - | gum style --padding "0 0 0 $PADDING_LEFT" "LUKS encryption protects your data with Argon2id (2000ms iteration)" | 28 | + | gum style --padding "0 0 0 $PADDING_LEFT" "Create account with sudo privileges. This password will be used for:" |
| 28 | - | echo | 29 | + | gum style --padding "0 0 0 $PADDING_LEFT" " • User login with sudo access" |
| 29 | - | 30 | + | gum style --padding "0 0 0 $PADDING_LEFT" " • Disk encryption (LUKS) if enabled" | |
| 30 | - | if gum confirm "Enable full-disk encryption?" --padding "0 0 1 $PADDING_LEFT"; then | |||
| 31 | - | export ARCHUP_ENCRYPTION="enabled" | |||
| 32 | - | echo "Encryption: enabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |||
| 33 | - | else | |||
| 34 | - | export ARCHUP_ENCRYPTION="disabled" | |||
| 35 | - | echo "Encryption: disabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |||
| 36 | - | fi | |||
| 37 | - | ||||
| 38 | - | # Ask for user credentials (will be used for user account, root, and encryption) | |||
| 39 | - | echo | |||
| 40 | - | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "User Account" | |||
| 41 | echo | 31 | echo | ||
| 42 | 32 | ||||
| 43 | # Ask for username | 33 | # Ask for username | ||
| @@ -70,11 +60,28 @@ done | |||||
| 70 | export ARCHUP_USERNAME | 60 | export ARCHUP_USERNAME | ||
| 71 | export ARCHUP_PASSWORD | 61 | export ARCHUP_PASSWORD | ||
| 72 | 62 | ||||
| 63 | + | # Save to config file (passwords are never logged) | |||
| 64 | + | config_set "ARCHUP_USERNAME" "$ARCHUP_USERNAME" | |||
| 65 | + | config_set "ARCHUP_PASSWORD" "$ARCHUP_PASSWORD" | |||
| 66 | + | ||||
| 73 | gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "[OK] User: $ARCHUP_USERNAME" | 67 | gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "[OK] User: $ARCHUP_USERNAME" | ||
| 74 | echo "User: $ARCHUP_USERNAME" >> "$ARCHUP_INSTALL_LOG_FILE" | 68 | echo "User: $ARCHUP_USERNAME" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 75 | 69 | ||||
| 76 | - | if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | 70 | + | # Ask for encryption preference |
| 77 | - | gum style --foreground 3 --padding "0 0 1 $PADDING_LEFT" "Note: This password will also be used for disk encryption" | 71 | + | echo |
| 72 | + | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Disk Encryption" | |||
| 73 | + | gum style --padding "0 0 0 $PADDING_LEFT" "LUKS encryption protects your data with Argon2id (2000ms iteration)" | |||
| 74 | + | echo | |||
| 75 | + | ||||
| 76 | + | if gum confirm "Enable full-disk encryption?" --padding "0 0 1 $PADDING_LEFT"; then | |||
| 77 | + | export ARCHUP_ENCRYPTION="enabled" | |||
| 78 | + | config_set "ARCHUP_ENCRYPTION" "enabled" | |||
| 79 | + | echo "Encryption: enabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |||
| 80 | + | gum style --foreground 3 --padding "0 0 1 $PADDING_LEFT" "Note: Using account password for disk encryption" | |||
| 81 | + | else | |||
| 82 | + | export ARCHUP_ENCRYPTION="disabled" | |||
| 83 | + | config_set "ARCHUP_ENCRYPTION" "disabled" | |||
| 84 | + | echo "Encryption: disabled" >> "$ARCHUP_INSTALL_LOG_FILE" | |||
| 78 | fi | 85 | fi | ||
| 79 | 86 | ||||
| 80 | gum style --foreground 2 --padding "1 0 1 $PADDING_LEFT" "[OK] Configuration saved" | 87 | gum style --foreground 2 --padding "1 0 1 $PADDING_LEFT" "[OK] Configuration saved" | ||
M install/preflight/detect-environment.sh +5 -0
| @@ -22,6 +22,7 @@ if [ -z "$DETECTED_KEYMAP" ] || [ "$DETECTED_KEYMAP" = "(unset)" ]; then | |||
| 22 | 22 | fi | |
| 23 | 23 | ||
| 24 | 24 | export ARCHUP_KEYMAP="$DETECTED_KEYMAP" | |
| 25 | + | config_set "ARCHUP_KEYMAP" "$ARCHUP_KEYMAP" | |
| 25 | 26 | gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "[OK] Keyboard layout: $ARCHUP_KEYMAP" | |
| 26 | 27 | echo "Keyboard layout detected: $ARCHUP_KEYMAP" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 27 | 28 | ||
| @@ -60,6 +61,10 @@ if [ "$HAS_ETHERNET" = false ] && command -v iwctl >/dev/null 2>&1; then | |||
| 60 | 61 | export ARCHUP_WIFI_DEVICE="$WIFI_DEVICE" | |
| 61 | 62 | export ARCHUP_WIFI_PASSPHRASE="$WIFI_PASSPHRASE" | |
| 62 | 63 | ||
| 64 | + | config_set "ARCHUP_WIFI_SSID" "$WIFI_SSID" | |
| 65 | + | config_set "ARCHUP_WIFI_DEVICE" "$WIFI_DEVICE" | |
| 66 | + | config_set "ARCHUP_WIFI_PASSPHRASE" "$WIFI_PASSPHRASE" | |
| 67 | + | ||
| 63 | 68 | gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "[OK] WiFi network: $WIFI_SSID (device: $WIFI_DEVICE)" | |
| 64 | 69 | echo "WiFi detected: SSID=$WIFI_SSID, device=$WIFI_DEVICE" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 65 | 70 | else | |
| @@ -22,6 +22,7 @@ if [ -z "$DETECTED_KEYMAP" ] || [ "$DETECTED_KEYMAP" = "(unset)" ]; then | |||||
| 22 | fi | 22 | fi | ||
| 23 | 23 | ||||
| 24 | export ARCHUP_KEYMAP="$DETECTED_KEYMAP" | 24 | export ARCHUP_KEYMAP="$DETECTED_KEYMAP" | ||
| 25 | + | config_set "ARCHUP_KEYMAP" "$ARCHUP_KEYMAP" | |||
| 25 | gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "[OK] Keyboard layout: $ARCHUP_KEYMAP" | 26 | gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "[OK] Keyboard layout: $ARCHUP_KEYMAP" | ||
| 26 | echo "Keyboard layout detected: $ARCHUP_KEYMAP" >> "$ARCHUP_INSTALL_LOG_FILE" | 27 | echo "Keyboard layout detected: $ARCHUP_KEYMAP" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 27 | 28 | ||||
| @@ -60,6 +61,10 @@ if [ "$HAS_ETHERNET" = false ] && command -v iwctl >/dev/null 2>&1; then | |||||
| 60 | export ARCHUP_WIFI_DEVICE="$WIFI_DEVICE" | 61 | export ARCHUP_WIFI_DEVICE="$WIFI_DEVICE" | ||
| 61 | export ARCHUP_WIFI_PASSPHRASE="$WIFI_PASSPHRASE" | 62 | export ARCHUP_WIFI_PASSPHRASE="$WIFI_PASSPHRASE" | ||
| 62 | 63 | ||||
| 64 | + | config_set "ARCHUP_WIFI_SSID" "$WIFI_SSID" | |||
| 65 | + | config_set "ARCHUP_WIFI_DEVICE" "$WIFI_DEVICE" | |||
| 66 | + | config_set "ARCHUP_WIFI_PASSPHRASE" "$WIFI_PASSPHRASE" | |||
| 67 | + | ||||
| 63 | gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "[OK] WiFi network: $WIFI_SSID (device: $WIFI_DEVICE)" | 68 | gum style --foreground 2 --padding "0 0 0 $PADDING_LEFT" "[OK] WiFi network: $WIFI_SSID (device: $WIFI_DEVICE)" | ||
| 64 | echo "WiFi detected: SSID=$WIFI_SSID, device=$WIFI_DEVICE" >> "$ARCHUP_INSTALL_LOG_FILE" | 69 | echo "WiFi detected: SSID=$WIFI_SSID, device=$WIFI_DEVICE" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 65 | else | 70 | else | ||