update

MOUNTS.md

@@ -0,0 +1,62 @@
+# Remote mounts
+
+Remote storage under `/mnt` is managed with user-level systemd services. None
+of these mounts starts automatically at login.
+
+Do not run the legacy `mount-*.sh` scripts while the corresponding systemd
+service is active. Check current mounts with:
+
+```sh
+findmnt | grep /mnt
+```
+
+## Encrypted Wasabi data
+
+The password-backup timer mounts encrypted Wasabi data automatically, performs
+the backup, and unmounts it afterward.
+
+For interactive access, keep it mounted with the target:
+
+```sh
+systemctl --user start wasabi-data-crypt.target
+systemctl --user stop wasabi-data-crypt.target
+```
+
+Run or inspect the password backup with:
+
+```sh
+systemctl --user start backup-pass.service
+systemctl --user status backup-pass.service
+journalctl --user -u backup-pass.service
+```
+
+## Other remote mounts
+
+Start and stop these only when needed:
+
+| Location | Start command | Stop command |
+| --- | --- | --- |
+| `/mnt/ultracc` | `systemctl --user start ultracc-mount.service` | `systemctl --user stop ultracc-mount.service` |
+| `/mnt/wasabi-data` | `systemctl --user start wasabi-data-mount.service` | `systemctl --user stop wasabi-data-mount.service` |
+| `/mnt/wasabi-media` | `systemctl --user start wasabi-media-mount.service` | `systemctl --user stop wasabi-media-mount.service` |
+| `/mnt/wasabi-peertube.isnet` | `systemctl --user start wasabi-peertube-mount.service` | `systemctl --user stop wasabi-peertube-mount.service` |
+
+Inspect a service with:
+
+```sh
+systemctl --user status SERVICE_NAME
+journalctl --user -u SERVICE_NAME
+```
+
+## Borgmatic
+
+The Borgmatic repository mount remains a manual maintenance operation:
+
+```sh
+cd /mnt
+./mount-borgmatic.sh
+fusermount3 -u /mnt/borgmatic
+```
+
+The maintained unit files and this document live in
+`/home/ray/.config/systemd`.

user/backup-pass.service

@@ -1,10 +1,11 @@
 [Unit]
 Description=Backup kdbx password files
+Requires=wasabi-data-crypt.service
+After=wasabi-data-crypt.service
 
 [Service]
-WorkingDirectory=/home/ray/.Sync/Pass/
+Type=oneshot
-ExecStart=/home/ray/.Sync/Pass/backup.sh
+WorkingDirectory=/home/ray/.Syncthing/Pass/
-
+ExecCondition=/usr/bin/mountpoint -q /mnt/wasabi-data-crypt
-[Install]
+ExecStart=/bin/sh /home/ray/.config/systemd/user/backup-pass.sh
-WantedBy=default.target
 

user/backup-pass.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+
+set -eu
+umask 077
+
+mountpoint_dir='/mnt/wasabi-data-crypt'
+destination_dir="$mountpoint_dir/pass"
+timestamp=$(date +%s)
+copied=0
+
+if ! mountpoint -q "$mountpoint_dir"; then
+	echo "Password backup aborted: $mountpoint_dir is not mounted" >&2
+	exit 1
+fi
+
+if ! [ -d "$destination_dir" ]; then
+	echo "Password backup aborted: $destination_dir does not exist" >&2
+	exit 1
+fi
+
+for source_file in ./*.kdbx; do
+	[ -e "$source_file" ] || continue
+	filename=${source_file#./}
+	cp -- "$source_file" "$destination_dir/$timestamp-$filename"
+	printf 'Backed up %s\n' "$filename"
+	copied=$((copied + 1))
+done
+
+if [ "$copied" -eq 0 ]; then
+	echo 'Password backup aborted: no .kdbx files found' >&2
+	exit 1
+fi
+
+printf 'Password backup complete: %s file(s) copied to %s\n' "$copied" "$destination_dir"

user/backup-pass.timer

@@ -4,6 +4,7 @@ Description=Periodically run backup-pass
 [Timer]
 OnCalendar=*-*-* 22:00:00
 OnCalendar=*-*-* 10:00:00
+Persistent=true
 
 [Install]
 WantedBy=timers.target

user/dunst.service

@@ -1 +0,0 @@
-/dev/null

user/mango-session.target.wants/mango-tag-osd.service

@@ -0,0 +1 @@
+../mango-tag-osd.service

user/mango-session.target.wants/swayidle.service

@@ -0,0 +1 @@
+/home/ray/.config/systemd/user/swayidle.service

user/mango-tag-osd.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Mango tag and monitor focus indicator
+PartOf=mango-session.target
+After=mango-session.target
+
+[Service]
+Type=simple
+Environment=LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so
+Environment=GSK_RENDERER=gl
+ExecStartPre=/usr/bin/sh -c 'until [ -n "$WAYLAND_DISPLAY" ] && [ -S "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" ]; do sleep 0.2; done'
+ExecStart=/home/ray/.config/mango/tag-osd.py
+Restart=on-failure
+RestartSec=1
+
+[Install]
+WantedBy=mango-session.target

user/package-status-refresh.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Refresh cached package update and orphan counts
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/home/ray/.config/systemd/user/package-status-refresh.sh
+SuccessExitStatus=75
+Nice=10
+IOSchedulingClass=idle
+TimeoutStartSec=2min
+

user/package-status-refresh.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+set -uo pipefail
+
+readonly cache_dir="${XDG_CACHE_HOME:-${HOME}/.cache}/package-status"
+readonly cache_file="${cache_dir}/status"
+readonly attempt_file="${cache_dir}/last-attempt"
+readonly pacman_log="/var/log/pacman.log"
+readonly pacman_lock="/var/lib/pacman/db.lck"
+
+mkdir -p "${cache_dir}"
+chmod 700 "${cache_dir}"
+touch "${attempt_file}" || exit 1
+
+# Never inspect the package database while pacman is changing it. A later
+# timer run or terminal startup will request another refresh.
+if [[ -e "${pacman_lock}" ]]; then
+	exit 75
+fi
+
+pacman_log_signature_before=$(stat -c '%Y:%s:%i' "${pacman_log}" 2>/dev/null || printf '0:0:0')
+
+updates_output=''
+updates_output=$(CHECKUPDATES_DB="${cache_dir}/checkupdates-db" checkupdates --nocolor 2>/dev/null)
+checkupdates_status=$?
+
+case "${checkupdates_status}" in
+	0)
+		updates_count=$(printf '%s\n' "${updates_output}" | awk 'NF { count++ } END { print count + 0 }')
+		;;
+	2)
+		updates_count=0
+		;;
+	*)
+		# A network or mirror failure must not replace a known-good cache.
+		exit "${checkupdates_status}"
+		;;
+esac
+
+orphans_count=$(pacman -Qdtq 2>/dev/null | awk 'NF { count++ } END { print count + 0 }')
+pacman_log_signature_after=$(stat -c '%Y:%s:%i' "${pacman_log}" 2>/dev/null || printf '0:0:0')
+
+# Discard the result if a package operation overlapped this refresh.
+if [[ -e "${pacman_lock}" || "${pacman_log_signature_before}" != "${pacman_log_signature_after}" ]]; then
+	exit 75
+fi
+
+umask 077
+temporary_file=$(mktemp "${cache_dir}/status.XXXXXX")
+trap 'rm -f "${temporary_file}"' EXIT
+
+printf 'version=1\nupdates=%d\norphans=%d\nchecked_at=%d\npacman_log_signature=%s\n' \
+	"${updates_count}" \
+	"${orphans_count}" \
+	"$(date +%s)" \
+	"${pacman_log_signature_after}" > "${temporary_file}"
+
+mv -f "${temporary_file}" "${cache_file}"
+trap - EXIT

user/package-status-refresh.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodically refresh cached package status
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=30min
+AccuracySec=1min
+
+[Install]
+WantedBy=timers.target

user/swayidle.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Wayland idle and sleep lock manager
+Documentation=man:swayidle(1)
+PartOf=mango-session.target
+After=mango-session.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/swayidle -w
+Restart=on-failure
+RestartSec=2
+
+[Install]
+WantedBy=mango-session.target

user/ultracc-mount.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Ultra.cc remote mount
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/rclone mount ultra:/home/gabbaell /mnt/ultracc --config=/home/ray/.config/rclone/rclone.conf
+ExecStop=/usr/bin/fusermount3 -u /mnt/ultracc
+SuccessExitStatus=143
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30

user/update-notifier.service

@@ -1,9 +0,0 @@
-[Unit]
-Description=Notify when updates are available
-
-[Service]
-ExecStart=/usr/local/bin/notify-updates -n
-
-[Install]
-WantedBy=default.target
-

user/update-notifier.timer

@@ -1,8 +0,0 @@
-[Unit]
-Description=Periodically run update-notifier
-
-[Timer]
-OnCalendar=*-*-* 14:00:00
-
-[Install]
-WantedBy=timers.target

user/wait-for-mount.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -eu
+
+mountpoint_dir=$1
+attempt=0
+
+while ! mountpoint -q "$mountpoint_dir"; do
+	attempt=$((attempt + 1))
+	if [ "$attempt" -ge 100 ]; then
+		echo "Timed out waiting for mount: $mountpoint_dir" >&2
+		exit 1
+	fi
+	sleep 0.1
+done

user/wasabi-data-crypt.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Encrypted Wasabi data mount
+StopWhenUnneeded=yes
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/rclone mount crypt-data:/ /mnt/wasabi-data-crypt --config=/home/ray/.config/rclone/rclone.conf
+ExecStop=/usr/bin/fusermount3 -u /mnt/wasabi-data-crypt
+SuccessExitStatus=143
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30

user/wasabi-data-crypt.target

@@ -0,0 +1,4 @@
+[Unit]
+Description=Keep the encrypted Wasabi data mount available for interactive use
+Requires=wasabi-data-crypt.service
+After=wasabi-data-crypt.service

user/wasabi-data-mount.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Wasabi data bucket mount
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/s3fs data.isnet /mnt/wasabi-data -f -o passwd_file=/home/ray/.config/.s3fs-wasabi -o url=https://s3.eu-west-1.wasabisys.com -o use_path_request_style
+ExecStartPost=/bin/sh /home/ray/.config/systemd/user/wait-for-mount.sh /mnt/wasabi-data
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30

user/wasabi-media-mount.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Wasabi media bucket mount
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/s3fs media.isnet /mnt/wasabi-media -f -o passwd_file=/home/ray/.config/.s3fs-wasabi -o url=https://s3.eu-west-1.wasabisys.com -o use_path_request_style
+ExecStartPost=/bin/sh /home/ray/.config/systemd/user/wait-for-mount.sh /mnt/wasabi-media
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30

user/wasabi-peertube-mount.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Wasabi PeerTube bucket mount
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/s3fs peertube.isnet /mnt/wasabi-peertube.isnet -f -o passwd_file=/home/ray/.config/.s3fs-wasabi -o url=https://s3.eu-west-1.wasabisys.com -o use_path_request_style
+ExecStartPost=/bin/sh /home/ray/.config/systemd/user/wait-for-mount.sh /mnt/wasabi-peertube.isnet
+Restart=on-failure
+RestartSec=10
+TimeoutStopSec=30

user/ydotoold.service

@@ -1,13 +0,0 @@
-[Unit]
-Description=ydotool daemon
-After=default.target
-PartOf=default.target
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/ydotoold
-Restart=on-failure
-RestartSec=1
-
-[Install]
-WantedBy=default.target