work

.gitignore

@@ -13,6 +13,7 @@ node_modules
 tmp
 temp
 
+harden*
 
 /.idea
 venv

init-server.py

@@ -14,7 +14,7 @@ from ssh_lib.config import (
     SCRIPTS_DIR,
     TILE_GEN_BIN,
 )
-from ssh_lib.kernel import set_cpu_governor, setup_kernel_settings
+from ssh_lib.kernel import setup_kernel_settings
 from ssh_lib.nginx import certbot, nginx
 from ssh_lib.pkg_base import pkg_base, pkg_upgrade
 from ssh_lib.planetiler import install_planetiler
@@ -31,7 +31,6 @@ def prepare_shared(c):
     pkg_base(c)
 
     setup_kernel_settings(c)
-    set_cpu_governor(c)
 
     c.sudo(f'mkdir -p {REMOTE_CONFIG}')
     c.sudo('chown ofm:ofm /data/ofm/config')

ssh_lib/config.py

@@ -1,10 +1,8 @@
 from pathlib import Path
 
 
-base = Path(__file__).parent.parent
-
-CONFIG_DIR = base / 'config'
-SCRIPTS_DIR = base / 'scripts'
+CONFIG_DIR = Path(__file__).parent.parent / 'config'
+SCRIPTS_DIR = Path(__file__).parent.parent / 'scripts'
 ASSETS_DIR = Path(__file__).parent / 'assets'
 
 

ssh_lib/kernel.py

@@ -1,21 +1,7 @@
 from ssh_lib.config import ASSETS_DIR
-from ssh_lib.utils import apt_get_install, apt_get_purge, put, put_str
+from ssh_lib.utils import put
 
 
 def setup_kernel_settings(c):
     put(c, f'{ASSETS_DIR}/kernel/60-ofm.conf', '/etc/sysctl.d/')
     put(c, f'{ASSETS_DIR}/kernel/limits-ofm.conf', '/etc/security/limits.d/')
-
-
-def set_cpu_governor(c):
-    apt_get_install(c, 'cpufrequtils')
-    apt_get_purge(c, 'linux-tools-*')
-
-    put_str(
-        c,
-        '/etc/default/cpufrequtils',
-        'GOVERNOR="performance"',
-    )
-
-    # check after reboot
-    # cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor

ssh_lib/utils.py

@@ -113,7 +113,7 @@ def get_username(c):
 def add_user(c, username, passwd=None, uid=None):
     uid_str = f'--uid={uid}' if uid else ''
 
-    # --disabled-password - ssh-key login only
+    # --disabled-password -> ssh-key login only
     c.sudo(f'adduser --disabled-password --gecos "" {uid_str} {username}', warn=True)
     if passwd:
         sudo_cmd(c, f'echo "{username}:{passwd}" | chpasswd')