1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
#/bin/bash
# 脏标记：0=不需要重建 UKI，1=需要
MKINITCPIO=0
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ETC_DIR="$(cd $SCRIPT_DIR && cd ../etc && pwd)"
echo $ETC_DIR
setup_vconsole_font() {
sudo sed -i 's/^\(FONT=.*\)$/# \1\nFONT=ter-132n/' /etc/vconsole.conf
sudo cp /etc/kernel/cmdline /etc/kernel/cmdline.bak
sudo sed -i 's/$/ fbcon=font:TER16x32/' /etc/kernel/cmdline
sudo cp /boot/loader/loader.conf /boot/loader/loader.conf.bak
sudo sed -i -e '/^[[:space:]]*#\?[[:space:]]*console-mode/d' /boot/loader/loader.conf
echo 'console-mode 1' | sudo tee -a /boot/loader/loader.conf >/dev/null
# 标记需要重建
MKINITCPIO=1
}
setup_shadowsocks() {
sudo cat > /etc/shadowsocks-rust/s.json <<EOF
{
"server": "x.xxx",
"server_port": 1111,
"password": "xxxxxxxxxxxxxxxx",
"timeout": 300,
"method": "aes-256-gcm",
"locals": [
{
"local_address": "127.0.0.1",
"local_port": 1080
},
{
"local_address": "127.0.0.1",
"local_port": 3128,
"protocol": "http"
}
]
}
EOF
sudo systemctl enable --now shadowsocks-rust@s
}
setup_dae() {
sudo cat > /etc/dae/config.dae <<EOF
global {
wan_interface: auto
auto_config_kernel_parameter: true
log_level: info
# Keep the original domain when dialing through the proxy. This also makes
# domain-based routing independent from the IP returned by the local DNS.
dial_mode: domain
allow_insecure: false
}
# Reuse the local Shadowsocks SOCKS5 listener instead of duplicating the
# remote server address and password in this configuration.
node {
# local_ss: 'socks5://127.0.0.1:8888'
# Direct Shadowsocks node example using the SIP002 URI format. Replace the
# cipher, password, host, and port, then uncomment it. Base64 is encoding,
# not encryption, so keep the real link under secret/.
# example_ss: 'ss://YWVzLTEyOC1nY206dGVzdA@example.com:8388#example-ss'
ss: 'ss://aes-256-gcm:xxxxxxxxxx@xxxx:1234'
}
group {
proxy {
filter: name(ss)
policy: fixed(0)
}
}
# Let dae observe DNS queries so that routing rules can match domain names.
dns {
upstream {
router: 'udp://192.168.8.1:53'
direct_dns: 'tcp+udp://223.5.5.5:53'
}
routing {
request {
qname(suffix: l) -> router
qname(suffix: lan) -> router
fallback: direct_dns
}
response {
fallback: accept
}
}
}
routing {
# Shadowsocks must reach its remote server directly to avoid a proxy loop.
pname(sslocal) -> direct
# Keep local, multicast, and other private destinations direct.
dip(224.0.0.0/3, 'ff00::/8') -> direct
dip(geoip:private) -> direct
# Route mainland China IPs directly. Everything else uses the proxy, so
# overseas destinations do not need to be maintained in a domain list.
dip(geoip:cn) -> direct
fallback: proxy
}
EOF
}
setup_modem() {
sudo systemctl enable --now ModemManager.service
}
setup_fprint() {
# --- system-local-login（KDE 锁屏/系统登录）---
sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/system-local-login
sudo sed -i '/^auth[[:space:]]\+include[[:space:]]\+system-login/i auth sufficient pam_fprintd.so' /etc/pam.d/system-local-login
# --- polkit-1 ---
[ -f /etc/pam.d/polkit-1 ] || sudo cp /usr/lib/pam.d/polkit-1 /etc/pam.d/polkit-1
sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1
sudo sed -i '/^auth[[:space:]]\+include[[:space:]]\+system-auth/i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1
# --- kde-fingerprint ---
[ -f /etc/pam.d/kde-fingerprint ] || sudo cp /usr/lib/pam.d/kde-fingerprint /etc/pam.d/kde-fingerprint
}
setup_vconsole_font
setup_shadowsocks
setup_dae
setup_modem
setup_fprint
# 统一重建一次
if [ "$MKINITCPIO" -eq 1 ]; then
echo ">>> mkinitcpio -P"
sudo mkinitcpio -P
fi
|
