mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 18:07:06 +01:00
Krzysztof kuhy Rudnicki
4f2b0ccdf7
Two levels of pure taxonomy carrying no information, and a 2-directory
cap leaves no room for them. Categories now sit directly under
linux_configuration/: features, fixes, utils, misc, fresh-install,
installers, diagnostics, gaming, boot_recovery, periodic_background, lib,
meta, tests. A script's own lib/ and tests/ are exempt from the cap, so
those stay put.
Depth violations 248 -> 139; roughly 40 of the remainder are inside
digital_wellbeing and hosts, deferred until the guard-lib repoint.
The moves are the easy half. What breaks is every path that counted
levels, and three classes of it had to be found by resolving paths rather
than reading diffs:
- 52 relative `source` lines for lib/common.sh and lib/android.sh. The
correct prefix differs per file: 40 were ../../ and 12 were ../../../,
so a blanket replace would have fixed one set and broken the other.
- REPO_ROOT in 7 fixes/lib/tests harnesses and setup_syncyomi_guard.sh,
each walking up four levels from a directory now two levels shallower.
This caused a real regression -- the fixes suite went red with
"log_warn: command not found" -- caught by running it and comparing
against the pre-move baseline worktree.
- conftest.py's sys.path entries, which took the pytest gate down with
14 collection errors, and the `# shellcheck source=` directives, which
took shellcheck down with SC1091.
16 symlinks in $HOME broke, including the entire i3blocks bar. All
repointed, and cpu_monitor/memory/disk/time/volume were run to confirm
they emit real output rather than merely resolving.
Verified: 1798 tests pass at 100% coverage, 8 of 9 lib/tests suites pass
(the ninth needs the coverage jail, identically at baseline), pre-commit
is clean, and the two untracked secret configs are still ignored after
their gitignore paths changed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
110 lines
3.2 KiB
Bash
Executable File
110 lines
3.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# dnsmasq config, drop-in, refresh timer and watchdog units.
|
|
#
|
|
# Sourced by setup_dns_blocker.sh; split out to keep it under the 250-line cap.
|
|
# Sourced rather than run, so it inherits the caller's strict mode.
|
|
|
|
write_dnsmasq_conf() {
|
|
ensure_dir "$(dirname "$DNSMASQ_CONF")" # /etc/dnsmasq.d may not exist yet
|
|
log_info "Writing ${DNSMASQ_CONF} (listen on ${LAN_IFACE}/${LAN_IP}, upstream ${UPSTREAM})."
|
|
cat >"$DNSMASQ_CONF" <<EOF
|
|
# Managed by setup_dns_blocker.sh -- LAN DNS blocker.
|
|
# Serves the identical blocklist as /etc/hosts to LAN clients via addn-hosts.
|
|
# Do not edit by hand; re-run 'setup_dns_blocker.sh setup' instead.
|
|
|
|
# Listen only on the LAN interface (leaves 127.0.0.53 free for the
|
|
# systemd-resolved stub that the /etc/hosts installer enables).
|
|
interface=${LAN_IFACE}
|
|
bind-interfaces
|
|
|
|
# Do NOT read /etc/hosts (huge + immutable); the blocklist comes from the feed.
|
|
no-hosts
|
|
addn-hosts=${FEED}
|
|
|
|
# Forward everything not in the blocklist to the upstream resolver ONLY.
|
|
# no-resolv: ignore /etc/resolv.conf so we never chain through the
|
|
# systemd-resolved stub (127.0.0.53) that the /etc/hosts installer enables.
|
|
no-resolv
|
|
server=${UPSTREAM}
|
|
domain-needed
|
|
bogus-priv
|
|
|
|
cache-size=10000
|
|
|
|
# Log dnsmasq's own messages (startup, upstream failures) -- "log failures".
|
|
log-facility=${LOG_FILE}
|
|
# log-queries # opt-in: full per-query log (verbose + privacy). Off by default.
|
|
EOF
|
|
}
|
|
|
|
install_restart_dropin() {
|
|
ensure_dir "$DNSMASQ_DROPIN_DIR"
|
|
cat >"$DNSMASQ_DROPIN" <<'EOF'
|
|
# Managed by setup_dns_blocker.sh -- keep the resolver up and wait for the
|
|
# network so bind-interfaces can bind the LAN address at boot.
|
|
[Unit]
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
EOF
|
|
}
|
|
|
|
install_refresh_timer() {
|
|
cat >"$REFRESH_SERVICE" <<EOF
|
|
[Unit]
|
|
Description=Rebuild the LAN DNS blocklist and reload dnsmasq
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=${SELF} refresh
|
|
EOF
|
|
cat >"$REFRESH_TIMER" <<'EOF'
|
|
[Unit]
|
|
Description=Daily rebuild of the LAN DNS blocklist
|
|
|
|
[Timer]
|
|
OnCalendar=daily
|
|
Persistent=true
|
|
RandomizedDelaySec=15m
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
}
|
|
|
|
# The whole LAN's DHCP/DNS depends on this one process. Restart=always in the
|
|
# drop-in only catches an actual crash; an incident on 2026-07-23 found
|
|
# dnsmasq dead with ZERO error logged (no crash, no "Stopping"/"Stopped" line
|
|
# either -- consistent with something issuing a plain stop, not a failure) and
|
|
# it stayed down for hours, silently, until noticed by a phone unable to join
|
|
# WiFi. Mirrors the existing shutdown-timer-monitor-watchdog pattern used
|
|
# elsewhere in this repo: same 5-minute cadence, same is-active-or-start shape,
|
|
# plus a logger call so a future incident leaves a trace instead of none.
|
|
install_watchdog() {
|
|
cat >"$WATCHDOG_SERVICE" <<'EOF'
|
|
[Unit]
|
|
Description=Watchdog for dnsmasq (LAN DHCP/DNS)
|
|
After=multi-user.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/bin/bash -c 'systemctl is-active --quiet dnsmasq || { logger -t dnsmasq-watchdog "dnsmasq was down -- restarting"; systemctl restart dnsmasq; }'
|
|
EOF
|
|
cat >"$WATCHDOG_TIMER" <<'EOF'
|
|
[Unit]
|
|
Description=Watchdog Timer for dnsmasq
|
|
|
|
[Timer]
|
|
OnBootSec=60
|
|
OnUnitActiveSec=300
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
}
|