feat(security): add ufw firewall and improve first-boot UX
- commit
- e3c2051532e3b4574bc45587b5e4affff0881ae0
- author
- bnema · · 2025-10-21 17:00 UTC
- committer
- bnema · · 2025-10-21 19:20 UTC
- parent
- 04812b1
- signature
- unsigned
7 files · +49 -3
M CHANGELOG.md +2 -0
| @@ -5,6 +5,8 @@ All notable changes to this project will be documented in this file. | |||
| 5 | 5 | ## [Unreleased] | |
| 6 | 6 | ||
| 7 | 7 | ### Added | |
| 8 | + | - **UFW firewall**: Added ufw with default deny incoming policy for basic network protection | |
| 9 | + | - **First-boot branding**: Display ArchUp logo and completion message during first-boot setup | |
| 8 | 10 | - **zram swap**: Configured zram-generator for compressed in-memory swap with optimized sysctl parameters | |
| 9 | 11 | - **Broadcom WiFi**: Added broadcom-wl driver to base packages for Broadcom wireless support | |
| 10 | 12 | - **Multilib support**: Enabled multilib repository on ISO and installed system with reusable helper | |
| @@ -5,6 +5,8 @@ All notable changes to this project will be documented in this file. | |||||
| 5 | ## [Unreleased] | 5 | ## [Unreleased] | ||
| 6 | 6 | ||||
| 7 | ### Added | 7 | ### Added | ||
| 8 | + | - **UFW firewall**: Added ufw with default deny incoming policy for basic network protection | |||
| 9 | + | - **First-boot branding**: Display ArchUp logo and completion message during first-boot setup | |||
| 8 | - **zram swap**: Configured zram-generator for compressed in-memory swap with optimized sysctl parameters | 10 | - **zram swap**: Configured zram-generator for compressed in-memory swap with optimized sysctl parameters | ||
| 9 | - **Broadcom WiFi**: Added broadcom-wl driver to base packages for Broadcom wireless support | 11 | - **Broadcom WiFi**: Added broadcom-wl driver to base packages for Broadcom wireless support | ||
| 10 | - **Multilib support**: Enabled multilib repository on ISO and installed system with reusable helper | 12 | - **Multilib support**: Enabled multilib repository on ISO and installed system with reusable helper | ||
M install/extra.packages +3 -0
| @@ -15,6 +15,9 @@ wget | |||
| 15 | 15 | unzip | |
| 16 | 16 | p7zip | |
| 17 | 17 | ||
| 18 | + | # Security | |
| 19 | + | ufw | |
| 20 | + | ||
| 18 | 21 | # Bluetooth | |
| 19 | 22 | bluez | |
| 20 | 23 | bluez-utils | |
| @@ -15,6 +15,9 @@ wget | |||||
| 15 | unzip | 15 | unzip | ||
| 16 | p7zip | 16 | p7zip | ||
| 17 | 17 | ||||
| 18 | + | # Security | |||
| 19 | + | ufw | |||
| 20 | + | ||||
| 18 | # Bluetooth | 21 | # Bluetooth | ||
| 19 | bluez | 22 | bluez | ||
| 20 | bluez-utils | 23 | bluez-utils | ||
M install/helpers/download.sh +1 -1
| @@ -58,7 +58,7 @@ download_archup_files() { | |||
| 58 | 58 | ||
| 59 | 59 | # Post-install | |
| 60 | 60 | download_section "Downloading post-install scripts..." "post-install" \ | |
| 61 | - | all.sh boot-logo.sh plymouth.sh snapper.sh post-boot-setup.sh hooks.sh shell-config.sh verify.sh unmount.sh | |
| 61 | + | all.sh boot-logo.sh plymouth.sh snapper.sh ufw.sh post-boot-setup.sh hooks.sh shell-config.sh verify.sh unmount.sh | |
| 62 | 62 | ||
| 63 | 63 | # Post-boot | |
| 64 | 64 | download_section "Downloading post-boot scripts..." "post-boot" \ | |
| @@ -58,7 +58,7 @@ download_archup_files() { | |||||
| 58 | 58 | ||||
| 59 | # Post-install | 59 | # Post-install | ||
| 60 | download_section "Downloading post-install scripts..." "post-install" \ | 60 | download_section "Downloading post-install scripts..." "post-install" \ | ||
| 61 | - | all.sh boot-logo.sh plymouth.sh snapper.sh post-boot-setup.sh hooks.sh shell-config.sh verify.sh unmount.sh | 61 | + | all.sh boot-logo.sh plymouth.sh snapper.sh ufw.sh post-boot-setup.sh hooks.sh shell-config.sh verify.sh unmount.sh |
| 62 | 62 | ||||
| 63 | # Post-boot | 63 | # Post-boot | ||
| 64 | download_section "Downloading post-boot scripts..." "post-boot" \ | 64 | download_section "Downloading post-boot scripts..." "post-boot" \ | ||
M install/post-boot/all.sh +15 -2
| @@ -3,7 +3,14 @@ | |||
| 3 | 3 | ||
| 4 | 4 | LOG_FILE="/var/log/archup-first-boot.log" | |
| 5 | 5 | ||
| 6 | - | echo "=== ArchUp First Boot Setup - $(date) ===" > "$LOG_FILE" | |
| 6 | + | # Display ArchUp logo | |
| 7 | + | if [ -f /usr/local/share/archup/logo.txt ]; then | |
| 8 | + | cat /usr/local/share/archup/logo.txt | |
| 9 | + | echo "" | |
| 10 | + | fi | |
| 11 | + | ||
| 12 | + | echo "=== ArchUp First Boot Setup - $(date) ===" | tee "$LOG_FILE" | |
| 13 | + | echo "" | |
| 7 | 14 | ||
| 8 | 15 | # Run snapper configuration | |
| 9 | 16 | if [ -f /usr/local/share/archup/post-boot/snapper.sh ]; then | |
| @@ -40,4 +47,10 @@ echo "=== First Boot Setup Complete ===" >> "$LOG_FILE" | |||
| 40 | 47 | # Disable this service after first run | |
| 41 | 48 | systemctl disable archup-first-boot.service | |
| 42 | 49 | ||
| 43 | - | echo "First boot setup completed successfully" | |
| 50 | + | echo "" | |
| 51 | + | echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| 52 | + | echo " ✓ ArchUp is ready!" | |
| 53 | + | echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| 54 | + | echo "" | |
| 55 | + | echo " Next: Run 'archup wizard' to configure your system" | |
| 56 | + | echo "" | |
| @@ -3,7 +3,14 @@ | |||||
| 3 | 3 | ||||
| 4 | LOG_FILE="/var/log/archup-first-boot.log" | 4 | LOG_FILE="/var/log/archup-first-boot.log" | ||
| 5 | 5 | ||||
| 6 | - | echo "=== ArchUp First Boot Setup - $(date) ===" > "$LOG_FILE" | 6 | + | # Display ArchUp logo |
| 7 | + | if [ -f /usr/local/share/archup/logo.txt ]; then | |||
| 8 | + | cat /usr/local/share/archup/logo.txt | |||
| 9 | + | echo "" | |||
| 10 | + | fi | |||
| 11 | + | ||||
| 12 | + | echo "=== ArchUp First Boot Setup - $(date) ===" | tee "$LOG_FILE" | |||
| 13 | + | echo "" | |||
| 7 | 14 | ||||
| 8 | # Run snapper configuration | 15 | # Run snapper configuration | ||
| 9 | if [ -f /usr/local/share/archup/post-boot/snapper.sh ]; then | 16 | if [ -f /usr/local/share/archup/post-boot/snapper.sh ]; then | ||
| @@ -40,4 +47,10 @@ echo "=== First Boot Setup Complete ===" >> "$LOG_FILE" | |||||
| 40 | # Disable this service after first run | 47 | # Disable this service after first run | ||
| 41 | systemctl disable archup-first-boot.service | 48 | systemctl disable archup-first-boot.service | ||
| 42 | 49 | ||||
| 43 | - | echo "First boot setup completed successfully" | 50 | + | echo "" |
| 51 | + | echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |||
| 52 | + | echo " ✓ ArchUp is ready!" | |||
| 53 | + | echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |||
| 54 | + | echo "" | |||
| 55 | + | echo " Next: Run 'archup wizard' to configure your system" | |||
| 56 | + | echo "" | |||
M install/post-install/all.sh +1 -0
| @@ -4,6 +4,7 @@ | |||
| 4 | 4 | source "$ARCHUP_INSTALL/post-install/boot-logo.sh" | |
| 5 | 5 | source "$ARCHUP_INSTALL/post-install/plymouth.sh" | |
| 6 | 6 | source "$ARCHUP_INSTALL/post-install/snapper.sh" | |
| 7 | + | source "$ARCHUP_INSTALL/post-install/ufw.sh" | |
| 7 | 8 | source "$ARCHUP_INSTALL/post-install/post-boot-setup.sh" | |
| 8 | 9 | source "$ARCHUP_INSTALL/post-install/hooks.sh" | |
| 9 | 10 | source "$ARCHUP_INSTALL/post-install/shell-config.sh" | |
| @@ -4,6 +4,7 @@ | |||||
| 4 | source "$ARCHUP_INSTALL/post-install/boot-logo.sh" | 4 | source "$ARCHUP_INSTALL/post-install/boot-logo.sh" | ||
| 5 | source "$ARCHUP_INSTALL/post-install/plymouth.sh" | 5 | source "$ARCHUP_INSTALL/post-install/plymouth.sh" | ||
| 6 | source "$ARCHUP_INSTALL/post-install/snapper.sh" | 6 | source "$ARCHUP_INSTALL/post-install/snapper.sh" | ||
| 7 | + | source "$ARCHUP_INSTALL/post-install/ufw.sh" | |||
| 7 | source "$ARCHUP_INSTALL/post-install/post-boot-setup.sh" | 8 | source "$ARCHUP_INSTALL/post-install/post-boot-setup.sh" | ||
| 8 | source "$ARCHUP_INSTALL/post-install/hooks.sh" | 9 | source "$ARCHUP_INSTALL/post-install/hooks.sh" | ||
| 9 | source "$ARCHUP_INSTALL/post-install/shell-config.sh" | 10 | source "$ARCHUP_INSTALL/post-install/shell-config.sh" | ||
M install/post-install/post-boot-setup.sh +3 -0
| @@ -6,6 +6,9 @@ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up first-boot | |||
| 6 | 6 | # Create post-boot directory | |
| 7 | 7 | mkdir -p /mnt/usr/local/share/archup/post-boot | |
| 8 | 8 | ||
| 9 | + | # Copy logo | |
| 10 | + | cp "$ARCHUP_PATH/logo.txt" /mnt/usr/local/share/archup/ | |
| 11 | + | ||
| 9 | 12 | # Copy all post-boot scripts | |
| 10 | 13 | cp "$ARCHUP_INSTALL/post-boot/all.sh" /mnt/usr/local/share/archup/post-boot/ | |
| 11 | 14 | cp "$ARCHUP_INSTALL/post-boot/snapper.sh" /mnt/usr/local/share/archup/post-boot/ | |
| @@ -6,6 +6,9 @@ gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Setting up first-boot | |||||
| 6 | # Create post-boot directory | 6 | # Create post-boot directory | ||
| 7 | mkdir -p /mnt/usr/local/share/archup/post-boot | 7 | mkdir -p /mnt/usr/local/share/archup/post-boot | ||
| 8 | 8 | ||||
| 9 | + | # Copy logo | |||
| 10 | + | cp "$ARCHUP_PATH/logo.txt" /mnt/usr/local/share/archup/ | |||
| 11 | + | ||||
| 9 | # Copy all post-boot scripts | 12 | # Copy all post-boot scripts | ||
| 10 | cp "$ARCHUP_INSTALL/post-boot/all.sh" /mnt/usr/local/share/archup/post-boot/ | 13 | cp "$ARCHUP_INSTALL/post-boot/all.sh" /mnt/usr/local/share/archup/post-boot/ | ||
| 11 | cp "$ARCHUP_INSTALL/post-boot/snapper.sh" /mnt/usr/local/share/archup/post-boot/ | 14 | cp "$ARCHUP_INSTALL/post-boot/snapper.sh" /mnt/usr/local/share/archup/post-boot/ | ||
A install/post-install/ufw.sh +24 -0
| @@ -0,0 +1,24 @@ | |||
| 1 | + | #!/bin/bash | |
| 2 | + | # Configure UFW (Uncomplicated Firewall) with basic protection | |
| 3 | + | ||
| 4 | + | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Configuring firewall..." | |
| 5 | + | ||
| 6 | + | # UFW is installed via extra.packages | |
| 7 | + | # Configure basic firewall rules | |
| 8 | + | ||
| 9 | + | # Set default policies | |
| 10 | + | arch-chroot /mnt ufw --force default deny incoming >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 11 | + | arch-chroot /mnt ufw --force default allow outgoing >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 12 | + | ||
| 13 | + | # Allow common local services (optional - can be removed for stricter security) | |
| 14 | + | # arch-chroot /mnt ufw allow ssh >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 15 | + | ||
| 16 | + | # Enable UFW | |
| 17 | + | arch-chroot /mnt ufw --force enable >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 18 | + | ||
| 19 | + | # Enable UFW service to start on boot | |
| 20 | + | arch-chroot /mnt systemctl enable ufw.service >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 21 | + | ||
| 22 | + | gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "[OK] Firewall configured (default deny incoming)" | |
| 23 | + | ||
| 24 | + | echo "UFW configured: default deny incoming, allow outgoing" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| @@ -0,0 +1,24 @@ | |||||
| 1 | + | #!/bin/bash | |||
| 2 | + | # Configure UFW (Uncomplicated Firewall) with basic protection | |||
| 3 | + | ||||
| 4 | + | gum style --foreground 6 --padding "1 0 0 $PADDING_LEFT" "Configuring firewall..." | |||
| 5 | + | ||||
| 6 | + | # UFW is installed via extra.packages | |||
| 7 | + | # Configure basic firewall rules | |||
| 8 | + | ||||
| 9 | + | # Set default policies | |||
| 10 | + | arch-chroot /mnt ufw --force default deny incoming >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |||
| 11 | + | arch-chroot /mnt ufw --force default allow outgoing >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |||
| 12 | + | ||||
| 13 | + | # Allow common local services (optional - can be removed for stricter security) | |||
| 14 | + | # arch-chroot /mnt ufw allow ssh >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |||
| 15 | + | ||||
| 16 | + | # Enable UFW | |||
| 17 | + | arch-chroot /mnt ufw --force enable >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |||
| 18 | + | ||||
| 19 | + | # Enable UFW service to start on boot | |||
| 20 | + | arch-chroot /mnt systemctl enable ufw.service >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |||
| 21 | + | ||||
| 22 | + | gum style --foreground 2 --padding "0 0 1 $PADDING_LEFT" "[OK] Firewall configured (default deny incoming)" | |||
| 23 | + | ||||
| 24 | + | echo "UFW configured: default deny incoming, allow outgoing" >> "$ARCHUP_INSTALL_LOG_FILE" | |||